commit fef45134d555b68ffbbbd9bd39d612b85b11373f
Author: 432539 <432539@users.noreply.github.com>
Date:   Wed Aug 5 14:54:32 2026 +0800

    Initial commit: GPT 账号注册机 (open source)
    
    只开源「GPT 账号注册机 / 管理」(account-manager)：账号列表/导入导出、检测/批量检测、
    拿 RT、协议/浏览器注册等注册机能力。批量直开 / 协议支付 / 提取链接 / 直卡直开 等其它功能
    不含实现代码，仅通过 iframe 内嵌外链访问。真实机密均由 .gitignore 忽略，仅提供脱敏示例配置。

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..e683139
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,8 @@
+# 复制为 .env 后按需填写（.env 已被 .gitignore 忽略）
+# 监听地址与端口
+HOST=127.0.0.1
+PORT=5090
+# Node 可执行文件路径（默认走 PATH 上的 node）
+# ACCOUNT_MGR_NODE=C:\Program Files\nodejs\node.exe
+# 注册子进程回读验证码用的内部地址（默认指向本应用端口）
+# ACCOUNT_MGR_BASE=http://127.0.0.1:5090
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..a7b0a4f
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,32 @@
+# ===== 机密 / 真实数据（切勿提交）=====
+# account-manager 真实配置（代理 / 接码 / 邮箱 / license key 等）
+account-manager/config/settings.json
+account-manager/config/proxies.json
+account-manager/config/mailbox.json
+account-manager/config/*.local.json
+
+# 运行期数据（账号、收件箱、探测缓存等）
+data/
+*.jsonl
+*.db
+*.sqlite
+*.sqlite3
+
+# 环境变量
+.env
+.env.*
+!.env.example
+
+# Node 依赖与诊断产物
+node_modules/
+account-manager/node/_*.log
+account-manager/node/_*.png
+
+# Python
+__pycache__/
+*.pyc
+.venv/
+venv/
+
+# 日志
+*.log
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..88b2a5f
--- /dev/null
+++ b/README.md
@@ -0,0 +1,146 @@
+# GPT 账号注册机 / 管理（开源版）
+
+> 本仓库**只开源「GPT 账号注册机 / 管理」（GPT管理，account-manager）**这一个功能。
+> 批量直开、协议支付、提取链接、直卡直开等其它功能**不在本仓库内、不含任何实现代码**，
+> 仅通过右侧 iframe 内嵌外链的方式访问（它们是独立 / 闭源的线上服务）。
+
+An open-source **ChatGPT account registration & management tool**. Only the account
+manager (`account-manager`) is open-sourced here. Other capabilities (card-flow /
+protocol-pay / link-extract / direct-card) are **not** part of this repo and are only
+reachable as embedded external links.
+
+---
+
+## 一、开源范围
+
+### ✅ 本仓库包含（且仅包含）：GPT管理 / 注册机
+
+页面 `/account-manager/`，能力包括：
+
+- **账号列表 / 分页 / 搜索 / 筛选**（只看已开通、按状态筛选等）
+- **导入账号**：支持 `sub2api.json`、`email----password----clientId----refreshToken`、纯 access token 三种格式
+- **导出**：批量导出 AT / SUB 格式 / 账密
+- **检测 / 批量检测**：用 refresh_token 续期换 access_token，实时校验套餐（plan）与有效期
+- **自动刷新 TOKEN**：对未知 / 过期 / 临近过期账号自动续期
+- **拿 RT / 重拿 RT**：用 codex 客户端登录换取 refresh_token（触发手机验证时自动接码）
+- **账号注册（注册机核心）**：
+  - 协议注册（HTTP 直连）
+  - 浏览器注册（CloakBrowser 隐身 Chromium）
+  - 批量补绑手机并拿 RT
+- **设置**：代理池 / 接码（smscode·smsbower·herosms）/ 邮箱池 / 浏览器（CloakBrowser license、注册口令）
+
+### ❌ 本仓库不包含（仅 iframe 外链）
+
+| 菜单 | 形态 | 说明 |
+| --- | --- | --- |
+| 直卡直开 | iframe 外链 | 独立线上服务，无源码 |
+| 批量直开(试用3天) | iframe 外链 | 独立线上服务，无源码 |
+| 协议支付(试用3天) | iframe 外链 | 独立线上服务，无源码 |
+| 提取链接(试用3天) | iframe 外链 | 独立线上服务，无源码 |
+
+这些菜单点击后只在右侧内容区加载一个指向外部 URL 的 `<iframe>`（见 `templates/embed.html`），
+**本项目不含它们的任何业务实现**（没有 card-flow / protocol / pay / adobe 的后端、模板或静态资源）。
+
+---
+
+## 二、目录结构
+
+```
+opensource-gpt/
+├─ app.py                       # 精简入口：只注册 account_manager 蓝图 + /embed/<target> 外链壳
+├─ account_manager.py           # 注册机 / GPT管理 后端（唯一开源真实功能）
+├─ plan_check_session.py        # 实时套餐校验（curl_cffi 子进程，account_manager 依赖）
+├─ templates/
+│  ├─ _sidebar.html             # 共享侧边栏（一级平铺菜单）
+│  ├─ account-manager.html      # GPT管理页
+│  └─ embed.html                # 外链内嵌壳（shell + 一个铺满高度的 iframe，无业务代码）
+├─ static/
+│  ├─ app-shell.css             # 统一设计系统（企业蓝）
+│  ├─ account-manager.css       # GPT管理页样式
+│  └─ account-manager.js        # GPT管理页前端逻辑
+├─ account-manager/
+│  ├─ node/                     # 注册机所需 Node 脚本（见下）
+│  └─ config/
+│     ├─ settings.example.json  # 脱敏示例配置（git 跟踪）
+│     └─ proxies.example.json   # 脱敏示例代理（git 跟踪）
+├─ requirements.txt
+├─ .gitignore                   # 忽略真实机密与运行期数据
+├─ .env.example
+└─ README.md
+```
+
+`account-manager/node/`（全部为注册机运行时依赖）：
+
+| 文件 | 作用 |
+| --- | --- |
+| `reg_runner.mjs` | 协议注册（HTTP 直连）入口 |
+| `cloak_reg_runner.mjs` | 浏览器注册（CloakBrowser）入口 |
+| `rt_runner.mjs` / `refetch_runner.mjs` | 拿 RT / 重拿 RT |
+| `inbox_runner.mjs` | 查收邮箱验证码 |
+| `get-rt.js` | 核心：登录换 refresh_token / access_token |
+| `plus-mailbox.js` | 邮箱收件与验证码提取 |
+| `smscode.js` / `smsbower.js` / `hero-sms.js` | 接码平台适配 |
+| `fingerprint.js` | 指纹 / 随机资料生成 |
+| `reg_password.mjs` | 统一注册口令解析（默认仅占位，请自行配置） |
+| `package.json` / `package-lock.json` | Node 依赖清单 |
+
+---
+
+## 三、快速开始
+
+依赖：**Python 3.11+**；如需「拿 RT / 查收 / 注册」还需 **Node.js 18+**。
+
+```bash
+# 1) Python 依赖
+python -m venv .venv
+# Windows
+.venv\Scripts\activate
+# macOS / Linux
+# source .venv/bin/activate
+pip install -r requirements.txt
+
+# 2) Node 依赖（注册机相关功能需要）
+cd account-manager/node
+npm install
+cd ../..
+
+# 3) 配置（示例 -> 真实；真实配置已被 .gitignore 忽略）
+copy account-manager\config\settings.example.json account-manager\config\settings.json
+copy account-manager\config\proxies.example.json account-manager\config\proxies.json
+# 按需填入你自己的：代理池 / 接码 apiKey / 邮箱池 / CloakBrowser license / 注册口令 等
+# （邮箱池在页面「设置 → 邮箱池」里维护，会写入 config/mailbox.json，同样被忽略）
+
+# 4) 启动（默认端口 5090）
+python app.py
+```
+
+打开 http://127.0.0.1:5090/ （自动跳转到 `/account-manager/`）。
+
+可用环境变量（见 `.env.example`）：`HOST`、`PORT`、`ACCOUNT_MGR_NODE`（node 可执行路径）、`ACCOUNT_MGR_BASE`。
+
+---
+
+## 四、注意事项 / 安全
+
+- **切勿提交真实机密。** 以下均已在 `.gitignore` 中忽略，不会进入 git：
+  - `account-manager/config/settings.json`、`proxies.json`、`mailbox.json`
+  - `.env`、`data/`、`*.jsonl`、`*.db`、`node_modules/`、`__pycache__/`、`*.log`
+- 仓库仅提供 `*.example.json` **脱敏示例**（不含真实代理 / 接码 / 邮箱 / token / license / 注册口令）。
+  首次使用请复制示例为真实配置后再填写。
+- `reg_password.mjs` 内的默认口令仅为占位（`ChangeMe#2026Pw!`），请在「设置 → 浏览器 → 注册密码」
+  或真实 `settings.json` 的 `regPassword` 中配置你自己的强口令。
+
+---
+
+## 五、关于 iframe 内嵌
+
+内嵌能否成功取决于目标站点的证书是否可信，以及是否设置了 `X-Frame-Options` /
+`Content-Security-Policy: frame-ancestors`。若目标站禁止被内嵌，`embed.html` 会提供
+「在新标签页打开」的兜底入口。**本项目不修改这些外部服务，也不含其实现代码。**
+
+---
+
+## 六、开源地址 / 许可
+
+- 开源地址：https://github.com/432539/gpt
+- 许可（License）：暂未指定。建议后续按需补充（如 MIT / Apache-2.0）。
diff --git a/account-manager/config/proxies.example.json b/account-manager/config/proxies.example.json
new file mode 100644
index 0000000..863705b
--- /dev/null
+++ b/account-manager/config/proxies.example.json
@@ -0,0 +1,9 @@
+[
+  {
+    "raw": "host:port:username:password",
+    "host": "proxy.example.com",
+    "port": 3010,
+    "username": "your-user",
+    "password": "your-pass"
+  }
+]
diff --git a/account-manager/config/settings.example.json b/account-manager/config/settings.example.json
new file mode 100644
index 0000000..3a5f267
--- /dev/null
+++ b/account-manager/config/settings.example.json
@@ -0,0 +1,41 @@
+{
+  "concurrency": 20,
+  "headless": true,
+  "launchTimeout": 60000,
+  "cloakLicenseKey": "",
+  "regPassword": "",
+  "captcha": {
+    "provider": "yescaptcha",
+    "apiKey": "",
+    "endpoint": ""
+  },
+  "sms": {
+    "provider": "smsbower",
+    "pollTimeout": 180000,
+    "smscode": {
+      "apiKey": "",
+      "baseUrl": "https://api.smscode.gg/v1",
+      "countryId": 0,
+      "serviceId": 0,
+      "productId": 0,
+      "catalogProductId": 0,
+      "maxPrice": ""
+    },
+    "smsbower": {
+      "apiKey": "",
+      "baseUrl": "https://smsbower.page/stubs/handler_api.php",
+      "country": 10,
+      "service": "dr",
+      "maxPrice": "0.2"
+    },
+    "herosms": {
+      "apiKey": "",
+      "baseUrl": "https://hero-sms.com/stubs/handler_api.php",
+      "country": 22,
+      "service": "dr",
+      "maxPrice": ""
+    }
+  },
+  "probeTokenAutoRefresh": true,
+  "probeTokenAutoRefreshMin": 15
+}
diff --git a/account-manager/node/cloak_reg_runner.mjs b/account-manager/node/cloak_reg_runner.mjs
new file mode 100644
index 0000000..7550880
--- /dev/null
+++ b/account-manager/node/cloak_reg_runner.mjs
@@ -0,0 +1,1467 @@
+// 浏览器注册 wrapper —— 用 CloakBrowser（隐身 Chromium，指纹在 C++ 源码层随机，开箱即用）
+// 驱动真实 ChatGPT / OpenAI 注册 UI 完成注册，作为「账号注册」的第二种方式（第一种是
+// get-rt.js 的 HTTP 协议注册）。设计上与协议注册共用同一套外围资源：
+//   · 代理池：由 Python 侧随机选一个代理，注入 CloakBrowser 的 proxy（http://user:pass@host:port）；
+//   · 邮箱池 OTP：验证码依旧从 Flask /api/reg/inbox 读（IMAP / 取件API），与协议模式同一数据源；
+//   · 接码：需要手机验证时复用 smscode / smsbower / hero-sms 模块（按 settings.sms.provider）；
+//   · 日志：逐行 JSON 写 stderr（{level,msg,account}），沿用协议注册那套中文短语，前端浮层直接展示；
+//   · 结果：stdout 输出一段 JSON（形状对齐 reg_runner），由 Python 的 _save_registered_account 落库。
+//
+// 为什么这样拿 RT：浏览器完成注册后即持有 auth.openai.com 的登录会话（cookie）。我们让浏览器
+// 从 codex 客户端的 /oauth/authorize（PKCE）开始，注册收尾时服务端会 302 到
+// redirect_uri=http://localhost:1455/auth/callback?code=…。我们用 route 拦截这个跳转拿到
+// authorization code，再用同一 context（同 cookie/同代理）POST /oauth/token 换 refresh_token。
+// 这与协议模式换 RT 的原理一致，区别只是「授权页由真实浏览器走完」。
+//
+// 输入（stdin JSON）：{ email, settings, proxy, otpBase, headless, licenseKey, password? }
+// 输出（stdout JSON）：成功 { ok:true, refreshToken, accessToken, clientId, password, subOk:false }
+//                     失败 { ok:false, registered?, banned?, error }
+import crypto from 'node:crypto';
+import { appendFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { launchContext } from 'cloakbrowser';
+
+// 2FA 诊断落文件：Flask 侧 _pump_stderr 会过滤 [ 开头的诊断行，导致真实 E2E 注册流里的 2FA
+// 分支信息看不到。这里把 [2FA-DIAG] 同步追加到固定文件，事后可读，定位「新会话点开关后 enroll
+// 对话框到底出没出」。仅诊断用，稳定后可移除。
+const _2FA_DIAG_FILE = path.join(path.dirname(fileURLToPath(import.meta.url)), '_2fa_diag.log');
+function diag2fa(msg) {
+  const line = `[2FA-DIAG] ${new Date().toISOString()} ${msg}`;
+  try { process.stderr.write(line + '\n'); } catch { /* */ }
+  try { appendFileSync(_2FA_DIAG_FILE, line + '\n'); } catch { /* */ }
+}
+import { extractCode } from './plus-mailbox.js';
+import { resolveRegPassword } from './reg_password.mjs';
+import { generateFingerprint } from './fingerprint.js';
+import * as smscode from './smscode.js';
+import * as smsbower from './smsbower.js';
+import * as herosms from './hero-sms.js';
+
+// —— stdout 纪律：CloakBrowser / 底层库可能往 stdout 打印（下载进度、告警），会污染结果 JSON。
+// 把 console.* 与「非结果」的 stdout 全部改道 stderr，最终结果用保存的原始 writer 独占 stdout。
+const realStdoutWrite = process.stdout.write.bind(process.stdout);
+process.stdout.write = process.stderr.write.bind(process.stderr);
+const _errWrite = (...a) => { try { process.stderr.write(a.map(String).join(' ') + '\n'); } catch { /* ignore */ } };
+console.log = _errWrite;
+console.info = _errWrite;
+console.warn = _errWrite;
+console.debug = _errWrite;
+
+const OAUTH_ISSUER = 'https://auth.openai.com';
+// codex 客户端：/oauth/authorize?screen_hint=signup 直达注册，但 codex 授权流会强制手机验证
+//（这是我们一直卡手机、skip-phone 拿不到 AT 的根因）。仅保留给「后续绑手机拿 RT」用。
+const OAUTH_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+const OAUTH_REDIRECT_URI = 'http://localhost:1455/auth/callback';
+const OAUTH_SCOPE = 'openid profile email offline_access';
+// ChatGPT 网页客户端（来自真实抓包 8.3chatgpt.com.har）：走 chatgpt.com 普通 signup，
+// 一般不强制手机，注册完成即在 chatgpt.com 建立登录态 → 能直接拿「会话 cookie(CK)+网页 AT」。
+// 手机 + codex RT 留到后续「批量绑手机拿RT」再做。
+const WEB_CLIENT_ID = 'app_X8zY6vW2pQ9tR3dE7nK1jL5gH';
+const WEB_REDIRECT_URI = 'https://chatgpt.com/api/auth/callback/openai';
+const WEB_SCOPE = 'openid email profile offline_access model.request model.read organization.read organization.write';
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let buf = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (c) => { buf += c; });
+    process.stdin.on('end', () => resolve(buf));
+  });
+}
+function emitLog(level, msg, account) {
+  try { process.stderr.write(JSON.stringify({ level, msg: String(msg), account: account || '' }) + '\n'); } catch { /* ignore */ }
+}
+function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
+
+// 随机成年生日 YYYY-MM-DD（18~48 岁），与 fingerprint.randomAdultBirthdate 口径一致。
+function randomAdultBirthdate() {
+  const nowYear = new Date().getUTCFullYear();
+  const age = 18 + crypto.randomInt(0, 31);
+  const month = 1 + crypto.randomInt(0, 12);
+  const day = 1 + crypto.randomInt(0, 28);
+  return `${nowYear - age}-${String(month).padStart(2, '0')}-${String(day).padStart(2, '0')}`;
+}
+const FIRST = ['James', 'Michael', 'David', 'Emily', 'Emma', 'Olivia', 'Daniel', 'Sarah', 'Grace', 'Ryan', 'Laura', 'Nathan'];
+const LAST = ['Smith', 'Johnson', 'Brown', 'Miller', 'Davis', 'Wilson', 'Moore', 'Taylor', 'Anderson', 'Clark', 'Walker', 'Young'];
+function randomFullName() { return `${FIRST[crypto.randomInt(0, FIRST.length)]} ${LAST[crypto.randomInt(0, LAST.length)]}`; }
+
+// smsbower / sms-activate 的国家 id → { iso2, dial }。覆盖 settings 里配置的候选（越南/肯尼亚/
+// 印尼/美国/菲律宾/阿根廷）+ 常见国家。用途：接码平台返回的号码是「含国码的完整号」，而 OpenAI
+// 手机页默认停在美国 +1，必须按号码所属国家把页面上的国家选对，否则号码与国码对不上、永远收不到码。
+const SMS_COUNTRY = {
+  0: { iso2: 'ru', dial: '7' }, 4: { iso2: 'ph', dial: '63' }, 6: { iso2: 'id', dial: '62' },
+  8: { iso2: 'ke', dial: '254' }, 10: { iso2: 'vn', dial: '84' }, 16: { iso2: 'gb', dial: '44' },
+  22: { iso2: 'in', dial: '91' }, 36: { iso2: 'ca', dial: '1' }, 39: { iso2: 'ar', dial: '54' },
+  187: { iso2: 'us', dial: '1' },
+};
+// 常见国码（做「号码前缀最长匹配」剥离国码，得到本国号；hintDial 优先）。
+const DIAL_CODES = ['1', '7', '20', '27', '33', '34', '39', '44', '49', '52', '54', '55', '60', '61', '62', '63', '66', '81', '84', '90', '91', '234', '254', '351', '380', '852', '886'];
+function splitDial(digits, hintDial) {
+  const d = String(digits || '');
+  if (hintDial && d.startsWith(hintDial)) return { dial: hintDial, national: d.slice(hintDial.length) };
+  for (const c of [...DIAL_CODES].sort((a, b) => b.length - a.length)) {
+    if (d.startsWith(c)) return { dial: c, national: d.slice(c.length) };
+  }
+  return { dial: '', national: d };
+}
+
+// 把 Python 传来的 proxy 对象转成 CloakBrowser/Playwright 认的字符串（与 get-rt.js getProxyAgent 同构）。
+function proxyToString(proxy) {
+  if (!proxy || !proxy.host || !proxy.port) return undefined;
+  const auth = proxy.username
+    ? `${encodeURIComponent(proxy.username)}:${encodeURIComponent(proxy.password || '')}@`
+    : '';
+  return `http://${auth}${proxy.host}:${proxy.port}`;
+}
+
+// PKCE（与协议模式一致）。
+function generatePkce() {
+  const verifier = crypto.randomBytes(64).toString('base64url');
+  const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+  return { verifier, challenge };
+}
+
+// ==================== UI 小工具（尽量鲁棒，找不到就返回 null，不抛错） ====================
+// 返回第一个「可见」的定位器。提速：不再对每个候选各等满 timeout（N 个选择器最坏 N×timeout），
+// 改为在 timeout 内轮询所有候选、命中即返回，总耗时被 timeout 封顶；不存在时也快速返回。
+async function firstVisible(page, selectors, timeout = 1200) {
+  const deadline = Date.now() + timeout;
+  for (;;) {
+    for (const sel of selectors) {
+      try {
+        const loc = page.locator(sel).first();
+        if (await loc.isVisible()) return loc;
+      } catch { /* 试下一个 */ }
+    }
+    if (Date.now() >= deadline) return null;
+    await sleep(120);
+  }
+}
+
+// 建号后兜底定位「验证码输入框」：精确选择器失配时，取首个可见/可编辑/为空、且非
+// password/email/tel 的输入框（此阶段唯一要输入的就是邮箱验证码）。返回 locator 或 null。
+async function findGenericOtpBox(page) {
+  const cand = page.locator(
+    'input:not([type="hidden"]):not([type="checkbox"]):not([type="radio"]):not([type="submit"]):not([type="button"]):not([type="password"]):not([type="email"]):not([type="tel"])',
+  );
+  const n = await cand.count().catch(() => 0);
+  for (let i = 0; i < n; i++) {
+    const el = cand.nth(i);
+    try {
+      if (!(await el.isVisible())) continue;
+      if (!(await el.isEnabled())) continue;
+      if ((await el.getAttribute('readonly')) !== null) continue;
+      if (String(await el.inputValue().catch(() => '')).trim() !== '') continue;
+      return el;
+    } catch { /* 试下一个 */ }
+  }
+  return null;
+}
+
+// 提交当前步：优先点主提交按钮 / 精确文案 "Continue"（用 text-is 精确匹配，避免误点
+// "Continue with Google/Apple/Microsoft" 这些第三方登录按钮），否则回退按回车提交表单。
+async function submitStep(page) {
+  const btn = await firstVisible(page, [
+    'button[type="submit"]',
+    'button:text-is("Continue")',
+    'button:text-is("Next")',
+    'button:text-is("Sign up")',
+  ], 1500);
+  if (btn) { await btn.click().catch(() => {}); return; }
+  await page.keyboard.press('Enter').catch(() => {});
+}
+
+// 提交某步后让页面稳定再判定：等 DOM 就绪 + 极短延时。提速：真正的「离开该步」判定交给
+// waitLeaveType 用条件轮询处理，这里只做一次轻量稳定（1200ms→350ms），不再固定长等。
+async function settle(page) {
+  try { await page.waitForLoadState('domcontentloaded', { timeout: 6000 }); } catch { /* ignore */ }
+  await sleep(350);
+}
+
+// 提交某步后等页面「真正离开该步」再继续——OpenAI 是 SPA，提交后同一页会先进入「校验/跳转中」
+// 的过渡态（输入框被禁用/仍带旧值），若立即重新判定会把过渡页当成同一步二次处理（历史 bug：
+// 邮箱验证通过后又回到验证码分支、对已禁用的框重填而报「未能填入」）。轮询到类型变化即返回。
+async function waitLeaveType(page, type, ms = 20000) {
+  const start = Date.now();
+  // 提速：轮询间隔 1000ms→400ms，页面一离开该步立即返回；仍保留最大超时上限防卡死。
+  while (Date.now() - start < ms) {
+    await sleep(400);
+    const t = classifyPage(await detectPage(page));
+    if (t !== type) return t;
+  }
+  return type;
+}
+
+// 把当前页可见输入框/按钮/URL 转储到 stderr（原始行），便于按真实 DOM 校准选择器。
+async function dumpDiag(page) {
+  try {
+    const diag = await page.evaluate(() => {
+      const ins = [...document.querySelectorAll('input')]
+        .filter((i) => i.offsetParent !== null)
+        .map((i) => `${i.name || i.id || '?'}|${i.type}|im=${i.getAttribute('inputmode') || ''}|ac=${i.getAttribute('autocomplete') || ''}|ml=${i.getAttribute('maxlength') || ''}`);
+      const btns = [...document.querySelectorAll('button')].map((b) => (b.innerText || '').trim()).filter(Boolean);
+      return { url: location.href, title: document.title || '', text: (document.body && document.body.innerText || '').replace(/\s+/g, ' ').slice(0, 200), inputs: ins, buttons: btns };
+    });
+    process.stderr.write(`[CLOAK-DIAG] ${JSON.stringify(diag)}\n`);
+  } catch { /* ignore */ }
+}
+
+// ==================== 页面判定：严格按「当前页面真实特征」识别处于哪一步 ====================
+// 教训：不能靠「有没有 Continue 按钮 + 步骤标志位」顺着走——OTP/密码页也有 Continue 按钮，
+// 会被误当授权页空点，从而跳过邮箱验证码/手机验证，最终被带到登录页报「密码错误」。
+// detectPage 一次性在页面上下文里统计各类输入是否可见、是否还有「可填空输入」、授权按钮/语境、
+// 以及「密码错误 / 邮箱已注册」等硬信号；classifyPage 据此 + URL 判定当前步骤。
+async function detectPage(page) {
+  let url = '';
+  try { url = page.url(); } catch { /* ignore */ }
+  const dom = await page.evaluate(() => {
+    const vis = (el) => !!el && (el.offsetParent !== null || el.getClientRects().length > 0);
+    const qa = (s) => [...document.querySelectorAll(s)];
+    const cnt = (s) => qa(s).filter(vis).length;
+    const bad = new Set(['hidden', 'checkbox', 'radio', 'submit', 'button', 'image', 'reset', 'file']);
+    // 是否还有「可见 / 可编辑 / 非只读 / 值为空」的待填输入——授权分支必须为 false 才允许点。
+    const anyFillable = qa('input, textarea').some((i) => {
+      if (!vis(i)) return false;
+      if (i.disabled || i.readOnly) return false;
+      const t = (i.getAttribute('type') || 'text').toLowerCase();
+      if (bad.has(t)) return false;
+      return String(i.value || '').trim() === '';
+    });
+    const email = cnt('input[type="email"], input[name="email"], input#email-input, input[autocomplete="username"], input[placeholder*="email" i]');
+    const pw = cnt('input[type="password"], input[name="password"], input[name="new-password"]');
+    const tel = cnt('input[type="tel"], input[name="phone"], input[name="phone_number"], input[autocomplete="tel"]');
+    const otp = cnt('input[autocomplete="one-time-code"], input[name="code"], input[name="otp"], input[inputmode="numeric"], input[maxlength="1"], input[maxlength="6"], [role="textbox"][aria-label*="code" i]');
+    const name = cnt('input[name="name"], input#name, input[autocomplete="name"], input[placeholder*="name" i]');
+    const bday = cnt('input[type="date"], input[name="birthdate"], input[name="bday"], input[placeholder*="birth" i]');
+    const btnTexts = qa('button, [role="button"], input[type="submit"]').filter(vis)
+      .map((b) => (b.innerText || b.value || '').trim().toLowerCase()).filter(Boolean);
+    const authorizeBtn = btnTexts.some((t) => /^(authorize|allow|agree|yes,|continue to)/.test(t) || /\bauthorize\b/.test(t));
+    const continueBtn = btnTexts.some((t) => /^(continue|next)\b/.test(t)) || cnt('button[type="submit"]') > 0;
+    const text = (document.body && document.body.innerText || '').toLowerCase();
+    const wrongCred = /incorrect email address or password|that password is incorrect|wrong password/.test(text);
+    const emailTaken = /already (has|have) an account|already exists|use a different email/.test(text);
+    const mentionsPhone = /phone number|text message|\bsms\b|mobile number|verify your phone/.test(text);
+    const mentionsEmailCode = /check your (inbox|email)|sent .{0,20}to your email|verify your email|enter the code .{0,20}email/.test(text);
+    const consentText = /want[s]? to access|is requesting access|authorize .{0,20}(app|access)|by (continuing|authorizing)/.test(text);
+    // 账号选择页（bindPhone 恢复会话后发起 codex 授权时会出现）：「Choose an account to continue to …」，
+    // 页面无输入、只有账号磁贴/「Select account」，需点磁贴才继续到授权。用文本 + URL 双信号识别。
+    const chooseAccount = /choose an account to continue|select account/.test(text);
+    // about-you 强文本信号：「how old are you / full name / finish creating account / date of birth」等。
+    // 用途：变体A 的 Age(整数)输入会命中 inputmode=numeric 而被误判成验证码页，故用此强信号在
+    // classifyPage 里抢先判为 about_you，避免走到「等邮箱验证码」的错误分支。
+    const aboutYou = /how old are you|finish creating account|full name|tell us about you|what'?s your name|date of birth/.test(text);
+    return { email, pw, tel, otp, name, bday, anyFillable, authorizeBtn, continueBtn, wrongCred, emailTaken, mentionsPhone, mentionsEmailCode, consentText, aboutYou, chooseAccount };
+  }).catch(() => null);
+  return { url, dom };
+}
+
+// 按特征强弱判定当前步：手机 → 验证码 → 密码 → 邮箱 → 补资料 → 授权 → 过渡 → 未知。
+// 只有「无任何可填输入 + 授权按钮/授权语境」才判为 consent（真·授权页）；无输入但只有普通
+// Continue、又无授权语境的，判为 interstitial（过渡页，稳定后才点）——绝不在有输入的页上点授权。
+function classifyPage({ url, dom }) {
+  if (!dom) return 'loading';
+  const u = String(url || '').toLowerCase();
+  if (u.includes('localhost:1455')) return 'callback';
+  // 账号选择页：URL 或文本任一命中即判定（无输入、需点账号磁贴）。放在最前，避免落到 unknown。
+  if (u.includes('choose-an-account') || dom.chooseAccount) return 'choose_account';
+  // about-you 抢先判定（无密码/无电话时）：变体A 的 Age 数字框会误命中 OTP 选择器，用强文本信号先兜住。
+  if (dom.aboutYou && dom.pw === 0 && dom.tel === 0) return 'about_you';
+  if (dom.tel > 0) return 'phone';
+  if (dom.otp > 0 && dom.pw === 0) {
+    const phoneCtx = /add-phone|phone-verification|phone[-_/]?otp/.test(u) || (dom.mentionsPhone && !dom.mentionsEmailCode);
+    return phoneCtx ? 'phone_otp' : 'email_otp';
+  }
+  if (dom.pw > 0) return 'password';
+  if (dom.email > 0) return 'email_entry';
+  if (dom.name > 0 || dom.bday > 0) return 'about_you';
+  if (!dom.anyFillable && (dom.authorizeBtn || dom.consentText)) return 'consent';
+  if (!dom.anyFillable && dom.continueBtn) return 'interstitial';
+  return 'unknown';
+}
+
+// ==================== 跳过手机 + 采集会话（CK+AT）——新策略核心 ====================
+// 在 add_phone 页尝试找「以后再说/跳过」入口并点一次；同时把手机页可点元素转储到 stderr
+// （[CAP-DIAG] 原始行，便于确认到底有没有跳过入口）。找到并点了返回 true，否则 false。
+async function trySkipPhone(page, say) {
+  try {
+    const diag = await page.evaluate(() => {
+      const text = (document.body && document.body.innerText || '').replace(/\s+/g, ' ').slice(0, 300);
+      const controls = [...document.querySelectorAll('a, button, [role="button"]')]
+        .filter((e) => e.offsetParent !== null).map((e) => (e.innerText || '').trim()).filter(Boolean).slice(0, 30);
+      return { url: location.href, text, controls };
+    });
+    process.stderr.write(`[CAP-DIAG] phonepage ${JSON.stringify(diag)}\n`);
+  } catch { /* ignore */ }
+  // 文案启发式：not now / maybe later / do this later / skip / remind me later …
+  const re = /not now|maybe later|i.?ll do (this|it) later|do (this|it) later|remind me|^skip$|skip for now/i;
+  const cand = page.locator('a, button, [role="button"]');
+  const n = await cand.count().catch(() => 0);
+  for (let i = 0; i < n; i++) {
+    const el = cand.nth(i);
+    try {
+      if (!(await el.isVisible())) continue;
+      const txt = ((await el.innerText().catch(() => '')) || '').trim();
+      if (txt && re.test(txt)) { say('info', '尝试跳过手机'); await el.click().catch(() => {}); return true; }
+    } catch { /* 试下一个 */ }
+  }
+  return false;
+}
+
+// ==================== 登录后引导页 / 空白页兜底 ====================
+// 「You're all set」引导页：黑色对勾 + 大标题 "You're all set" + 正文 "ChatGPT can make mistakes.
+// Don't share sensitive info…" + 黑色 Continue 按钮。新号登录后常弹此页，不点 Continue 会一直被
+// 弹回首页（实测导致进设置开 2FA 时始终被踢回 chatgpt.com/ 空转）。这里按可见文本健壮识别并点 Continue。
+// 用「You're all set / Welcome」作引导页强信号（不能只用 "ChatGPT can make mistakes"——正常聊天页底部
+// 也有这句，会误伤）。返回是否点了。
+async function dismissOnboarding(page, say) {
+  const clicked = await page.evaluate(() => {
+    const txt = (document.body && document.body.innerText || '');
+    const isOnboard = /you'?re all set|welcome to chatgpt|准备就绪|全部设置完成|欢迎使用/i.test(txt);
+    if (!isOnboard) return '';
+    const re = /^(continue|okay,? let'?s go|get started|got it|done|next|继续|开始使用|知道了|完成)$/i;
+    const dlgs = [...document.querySelectorAll('[role="dialog"]')];
+    const scopes = dlgs.length ? dlgs : [document.body];
+    for (const sc of scopes) {
+      for (const b of sc.querySelectorAll('button, [role="button"], a')) {
+        const t = (b.innerText || b.getAttribute('aria-label') || '').trim();
+        if (t && re.test(t)) { b.click(); return t; }
+      }
+    }
+    return '';
+  }).catch(() => '');
+  if (clicked) { if (say) say('info', '关闭引导页'); await sleep(600); return true; }
+  return false;
+}
+// 空白/未加载兜底：页面几乎无正文且无任何可交互元素时，F5 刷新一次再继续检测（避免死等空白页）。
+async function refreshIfBlank(page) {
+  const blank = await page.evaluate(() => {
+    const t = (document.body && document.body.innerText || '').trim();
+    const hasCtl = document.querySelector('button, input, textarea, [role="button"], a[href]');
+    return t.length < 5 && !hasCtl;
+  }).catch(() => false);
+  if (blank) { await page.reload({ waitUntil: 'domcontentloaded' }).catch(() => {}); await sleep(800); return true; }
+  return false;
+}
+
+// ==================== TOTP（用于开启并确认 2FA 认证器）====================
+// base32 解码（RFC4648，忽略空格/分隔）。
+function base32Decode(s) {
+  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+  const clean = String(s || '').toUpperCase().replace(/[^A-Z2-7]/g, '');
+  let bits = 0, value = 0; const out = [];
+  for (const c of clean) {
+    const idx = alphabet.indexOf(c);
+    if (idx < 0) continue;
+    value = (value << 5) | idx; bits += 5;
+    if (bits >= 8) { out.push((value >>> (bits - 8)) & 0xff); bits -= 8; }
+  }
+  return Buffer.from(out);
+}
+// 由 base32 密钥算当前 6 位 TOTP（HMAC-SHA1，30s 步长）——用于向 OpenAI 确认认证器已绑定。
+function totpNow(secret, t = Date.now()) {
+  const key = base32Decode(secret);
+  let counter = Math.floor(t / 1000 / 30);
+  const buf = Buffer.alloc(8);
+  for (let i = 7; i >= 0; i--) { buf[i] = counter & 0xff; counter = Math.floor(counter / 256); }
+  const h = crypto.createHmac('sha1', key).update(buf).digest();
+  const off = h[h.length - 1] & 0x0f;
+  const bin = ((h[off] & 0x7f) << 24) | ((h[off + 1] & 0xff) << 16) | ((h[off + 2] & 0xff) << 8) | (h[off + 3] & 0xff);
+  return String(bin % 1000000).padStart(6, '0');
+}
+
+// 校验 2FA 是否真已开启：enroll 对话框（#enroll-totp-modal-title）应已关闭且无「验证码错误」提示；
+// 认证器开关若可读到 aria-checked=true / 内部 checkbox.checked 更是铁证。
+async function verify2faEnabled(page) {
+  await sleep(300); // 外层已按 1s 轮询，这里只需极短稳定
+  return await page.evaluate(() => {
+    const body = (document.body.innerText || '');
+    // enroll 对话框还在 + 有错误文案 → 明确失败（验证码不对）
+    if (document.querySelector('#enroll-totp-modal-title') && /incorrect|invalid|try again|wrong|didn'?t match/i.test(body)) return false;
+    const t = document.querySelector('[data-testid="mfa-authenticator-toggle"]');
+    if (t) {
+      if (t.getAttribute('aria-checked') === 'true') return true;
+      const inp = t.querySelector('input[type="checkbox"]');
+      if (inp && inp.checked) return true;
+    }
+    // 兜底：enroll 对话框已消失（点 Verify 成功后 OpenAI 会关闭它/进入备份码），且无错误文案。
+    return !document.querySelector('#enroll-totp-modal-title');
+  }).catch(() => false);
+}
+
+// 开启 TOTP 2FA 完整闭环并返回 base32 密钥（失败返回 ''，绝不影响主注册结果）。实测流程：
+//   chatgpt.com/#settings/Security → 点 mfa-authenticator-toggle → 跳 auth.openai.com/email-verification
+//   （邮箱验证码二次验证身份）→ 填码 Continue → 回设置弹窗 → 再点一次开关 → 弹出「Connect your
+//   authenticator app」对话框（QR 链接 otpauth://…?secret=<base32>，输入框 name=totp_otp，按钮 Verify）
+//   → 从 otpauth 链接解析 secret → 算当前 TOTP → 填入 → 点 Verify → 校验确已开启。
+// 关键：一定走到「填码→提交→确认」，绝不「拿到 secret 就关」。整段 try/catch：2FA 失败不拖垮已拿的 AT/密码。
+async function enableTotp2fa(context, page, email, otpBase, say) {
+  const TOGGLE = '[data-testid="mfa-authenticator-toggle"]';
+  try {
+    say('info', '开启2FA中');
+    // 关键：新号登录后停在「You're all set」引导页，不先关掉它，进 #settings 会被弹回首页 → 开关点了
+    // 也白点、页面空转到超时（实测就是这样）。先关引导页 + 空白页 F5 兜底，再进安全设置。
+    await dismissOnboarding(page, say);
+    await refreshIfBlank(page);
+    await page.goto('https://chatgpt.com/#settings/Security', { waitUntil: 'domcontentloaded' }).catch(() => {});
+    await settle(page);
+    await dismissOnboarding(page, say); // 进设置若又被引导页拦截，再关一次
+    // 提速：等开关出现从 20s 收到 12s；出现即继续（条件等待，不死等）。
+    try { await page.locator(TOGGLE).first().waitFor({ state: 'visible', timeout: 12000 }); } catch { /* 面板未出，下面循环兜底 */ }
+    // 基线设在点开关之前：只认此刻之后到达的「2FA 二次验证」邮件码，避开注册时的旧码。
+    const twoFaBaseline = Date.now();
+    // enroll 对话框检测：QR 可能是 otpauth 链接 / canvas / data:image，标题文案也可能变；用宽判据。
+    const detectEnroll = () => page.evaluate(() => {
+      if (document.querySelector('a[href^="otpauth://"]')) return true;
+      if (document.querySelector('#enroll-totp-modal-title, input[name="totp_otp"]')) return true;
+      const dlgs = [...document.querySelectorAll('[role="dialog"]')];
+      const top = dlgs[dlgs.length - 1];
+      if (top) {
+        const t = (top.innerText || '').toLowerCase();
+        if (/(authenticator app|scan (this |the )?qr|can'?t scan|trouble scanning|enter (this |the )?key|setup key|扫描|验证器|身份验证器)/.test(t)) return true;
+        if (top.querySelector('canvas, img[src^="data:image"], svg')) return true;
+      }
+      return false;
+    }).catch(() => false);
+    // 先点「Trouble scanning?」展开手动密钥（中英文健壮匹配；限最顶层对话框，避开设置面板里的 passkeys）。
+    const revealManualKey = () => page.evaluate(() => {
+      const r = /trouble scanning|can'?t scan|scan(ning)?\s*(issue|problem)|enter (this |the )?key manually|manual entry|扫描.*(问题|不了|失败)|无法扫描|遇到问题|手动(输入|录入|输入密钥)|输入密钥/i;
+      const dlgs = [...document.querySelectorAll('[role="dialog"]')];
+      const scope = dlgs[dlgs.length - 1] || document;
+      for (const n of scope.querySelectorAll('button, a, [role="button"], summary')) {
+        const t = (n.innerText || n.getAttribute('aria-label') || '');
+        if (t && r.test(t)) { n.click(); return; }
+      }
+    }).catch(() => {});
+    // 从 enroll 对话框抓 base32 secret。顺序很关键：
+    //   ① 二维码 otpauth://…?secret=<base32> —— 权威来源，一次给出完整精确 secret；
+    //   ② Trouble scanning 展开后的手动密钥文本 —— 必须按「4 位一组、空格/横线分隔」的形态严格捕获，
+    //      否则贪婪匹配会把 secret 和相邻大写文本连成一串（曾抓到 57 位废串导致 TOTP 算错、验证失败）；
+    //   ③ 只读框/等宽块里独立成段的严格 base32。全部经 ok() 严格校验（≥24 位且含数字），排除姓名/FREE 误抓。
+    const extractSecret = () => page.evaluate(() => {
+      const norm = (s) => (s || '').replace(/[\s-]+/g, '').toUpperCase();
+      const ok = (s) => /^[A-Z2-7]{16,64}$/.test(s) && /[2-7]/.test(s);
+      const dlgs = [...document.querySelectorAll('[role="dialog"]')];
+      const scope = dlgs[dlgs.length - 1] || document.body;
+      // ① otpauth 链接（权威）
+      const a = scope.querySelector('a[href^="otpauth://"]') || document.querySelector('a[href^="otpauth://"]');
+      if (a) { try { const u = new URL(a.getAttribute('href')); const s = norm(u.searchParams.get('secret') || ''); if (ok(s)) return s; } catch { /* */ } }
+      const stext = scope.innerText || '';
+      // ② 手动密钥：严格「4 位一组×4~13 组」，避免连带相邻文本
+      const grouped = stext.match(/\b([A-Z2-7]{4}(?:[ -][A-Z2-7]{4}){3,12})\b/);
+      if (grouped) { const n = norm(grouped[1]); if (ok(n)) return n; }
+      // ②b 手动密钥：label 后紧跟的一整段连续 base32（无分组时）
+      const near = stext.match(/(?:secret|key|密钥|代码|manual entry|setup key)[^A-Za-z0-9]{0,24}([A-Z2-7]{16,64})\b/i);
+      if (near) { const n = norm(near[1]); if (ok(n)) return n; }
+      // ③ 只读框/等宽块
+      for (const el of scope.querySelectorAll('code, pre, input[readonly], [class*="secret" i], [class*="key" i], [class*="mono" i]')) {
+        const v = norm(el.value || el.innerText || ''); if (ok(v)) return v;
+      }
+      return '';
+    }).catch(() => '');
+    // 处理一次邮箱二次验证（step-up）：取码→填→Continue→回设置。可能在点开关后、也可能在打开
+    // enroll 对话框「那一刻」才触发（实测：对话框先闪现，随即整页跳 auth.openai.com/email-verification）。
+    const handleEmailVerify = async () => {
+      say('info', '2FA邮箱验证');
+      const code = await waitEmailOtp(otpBase, email, { baselineTs: twoFaBaseline, say });
+      if (!code) throw new Error('2FA邮箱码超时');
+      const box = await firstVisible(page, ['input[name="code"]', 'input[autocomplete="one-time-code"]', 'input[inputmode="numeric"]'], 6000);
+      if (box) { await box.fill(''); await box.type(code, { delay: 40 }); }
+      const cont = await firstVisible(page, ['button:has-text("Continue")', 'button[type="submit"]'], 3000);
+      if (cont) await cont.click().catch(() => {});
+      // 提速：条件等待——等到「离开 email-verification 页」（跳回 action=enable/设置）即继续，最多 8s，不死等 3s。
+      await page.waitForURL((u) => !/email-verification/.test(String(u)), { timeout: 8000 }).catch(() => {});
+      await settle(page);
+    };
+
+    // 统一状态循环：email-verification 可能在任意时刻出现（点开关后 / 交互 enroll 对话框时）。
+    // 每轮按「当前页」判定：验证页→做邮箱二次验证并重开开关；enroll 对话框→展开抓密钥；
+    // 都没有→隔几秒补点一次开关。直到抓到 secret 或超总预算。避免旧两段式在「对话框→中途跳验证」时空跑。
+    await page.locator(TOGGLE).first().click().catch(() => {});
+    let secret = '';
+    let emailDone = false;
+    let lastToggle = Date.now();
+    let lastTrace = 0;
+    const deadline = Date.now() + 210000; // 总预算 3.5 分钟（含等邮箱码）
+    while (!secret && Date.now() < deadline) {
+      const url = page.url();
+      if (Date.now() - lastTrace > 5000) { lastTrace = Date.now(); const en = await detectEnroll(); diag2fa(`loop url=${url.slice(0, 55)} enroll=${en}`); }
+      if (/email-verification/.test(url)) {
+        await handleEmailVerify();
+        emailDone = true;
+        // 关键：邮箱二次验证后 OpenAI 会跳回 /?action=enable&factor=totp#settings/Security，SPA 据此
+        // 「自动打开」enroll 对话框——此时绝不能再点开关（再点等于取消这次开启、把刚弹的对话框关掉，
+        // 实测就是这样导致对话框始终 dlgs=0）。这里只给 SPA 一点时间，交给下面 detectEnroll 捕获。
+        lastToggle = Date.now(); // 抑制补点：给深链自动开对话框留出时间
+        await sleep(2500);
+        continue;
+      }
+      if (await detectEnroll()) {
+        await revealManualKey();
+        await sleep(1200);
+        secret = await extractSecret();
+        if (secret) break;
+        // 对话框在但没抓到：可能点开关那刻正要 step-up 跳验证页，下一轮由 url 分支处理。
+        await sleep(1200);
+        continue;
+      }
+      // 无对话框：分三种情形处理——
+      const onEnableLink = /action=enable/.test(url);
+      const onSettings = /#settings\/security/i.test(url) || /\/settings/i.test(url);
+      if (onEnableLink) {
+        // ① action=enable 深链：SPA 会自动开对话框，别乱点开关（再点=取消开启）；超 12s 没开才补点一次。
+        if (Date.now() - lastToggle > 12000) { await page.locator(TOGGLE).first().click().catch(() => {}); lastToggle = Date.now(); }
+      } else if (!onSettings) {
+        // ② 不在设置页（多为登录后被弹回 chatgpt.com/ 首页 / You're all set 引导页 / 空白页）：
+        //    别再点不存在的开关空转。先关引导页 → 空白页 F5 兜底 → 重新进设置页点开关。隔 3.5s 一次。
+        if (Date.now() - lastToggle > 3500) {
+          await dismissOnboarding(page, say);
+          await refreshIfBlank(page);
+          await page.goto('https://chatgpt.com/#settings/Security', { waitUntil: 'domcontentloaded' }).catch(() => {});
+          await settle(page);
+          await page.locator(TOGGLE).first().click().catch(() => {});
+          lastToggle = Date.now();
+        }
+      } else {
+        // ③ 在设置页但没弹对话框：隔 5s 补点一次开关触发开启。
+        if (Date.now() - lastToggle > 5000) { await page.locator(TOGGLE).first().click().catch(() => {}); lastToggle = Date.now(); }
+      }
+      await sleep(700);
+    }
+    diag2fa(`loopEnd url=${page.url().slice(0, 60)} emailDone=${emailDone} secret=${secret ? secret.slice(0, 4) + '…len' + secret.length : 'none'}`);
+    if (!secret || !/^[A-Z2-7]{24,64}$/.test(secret)) {
+      const diag = await page.evaluate(() => {
+        const dlgs = [...document.querySelectorAll('[role="dialog"]')];
+        const top = dlgs[dlgs.length - 1];
+        return { url: location.href, dlgs: dlgs.length, hasOtpauth: !!document.querySelector('a[href^="otpauth://"]'), topText: top ? (top.innerText || '').replace(/\s+/g, ' ').slice(0, 200) : '' };
+      }).catch(() => ({}));
+      diag2fa(`noSecret ${JSON.stringify(diag)}`);
+      throw new Error('未取到2FA密钥（enroll 对话框未稳定出现）');
+    }
+    diag2fa(`secret=${secret.slice(0, 4)}… len=${secret.length}`);
+    // 填 6 位 TOTP → Verify。刚好跨 30s 边界会失效，这里紧接着算+填+提交，窗口足够。
+    const inp = await firstVisible(page, ['input[name="totp_otp"]', 'input[placeholder*="6-digit" i]', 'input[inputmode="numeric"]', 'input[maxlength="6"]'], 6000);
+    if (!inp) throw new Error('未找到验证码输入框');
+    await inp.fill(''); await inp.type(totpNow(secret), { delay: 60 });
+    const verify = await firstVisible(page, ['button:has-text("Verify")', 'button:has-text("Enable")', 'button[type="submit"]'], 3000);
+    if (!verify) throw new Error('未找到 Verify 按钮');
+    await verify.click().catch(() => {});
+    // 提速：把固定 4s 等待改成条件轮询——最多 8s，一旦确认已开启立即继续，不死等。
+    let enabled = false;
+    for (let i = 0; i < 8 && !enabled; i++) { await sleep(1000); enabled = await verify2faEnabled(page); }
+    if (!enabled) throw new Error('提交验证码后未确认已开启');
+    // 关掉可能出现的备份码/成功后续弹窗，避免影响后续采集。
+    await page.evaluate(() => {
+      for (const b of document.querySelectorAll('button')) { if (/^(done|close|got it|continue)$/i.test((b.innerText || '').trim())) { b.click(); return; } }
+    }).catch(() => {});
+    say('ok', '2FA已开启');
+    return secret;
+  } catch (e) {
+    diag2fa(`fail ${String(e).slice(0, 160)}`);
+    say('warn', '2FA开启失败');
+    return '';
+  }
+}
+
+// 采集「会话 cookie(CK) + 网页 AT」：
+//   CK：导出 context 全量 cookie（含 auth.openai.com / chatgpt.com 的 session）；
+//   AT：访问 chatgpt.com 建立会话后，fetch /api/auth/session 取 accessToken（若被 onboarding 拦回则拿不到）。
+// 全程把关键信号写 [CAP-DIAG] 原始行，便于研判「手机前能否拿到可用会话/AT」。
+async function captureWebSession(context, page, say) {
+  const out = { cookies: [], webAccessToken: '', chatgptUrl: '', sessionStatus: 0, sessionHead: '' };
+  try { out.cookies = await context.cookies(); } catch { /* ignore */ }
+  try {
+    const names = out.cookies.map((c) => `${c.domain}:${c.name}`);
+    process.stderr.write(`[CAP-DIAG] cookies n=${out.cookies.length} names=${JSON.stringify(names.slice(0, 40))}\n`);
+  } catch { /* ignore */ }
+  say('info', '采集会话中');
+  // 访问 chatgpt.com：看是否放行（拿到会话）还是被重定向回 onboarding/手机页
+  try {
+    await page.goto('https://chatgpt.com/', { waitUntil: 'domcontentloaded', timeout: 45000 });
+    await sleep(1000); // 提速：会话 cookie 已就绪，只需短暂稳定即可 fetch /api/auth/session（3500→1000）
+  } catch (e) { process.stderr.write(`[CAP-DIAG] goto chatgpt err ${String(e).slice(0, 140)}\n`); }
+  try { out.chatgptUrl = page.url(); } catch { /* ignore */ }
+  process.stderr.write(`[CAP-DIAG] chatgpt landing=${out.chatgptUrl}\n`);
+  // 取网页 AT：/api/auth/session（登录态则返回 {accessToken,...}）。
+  // 关键：在浏览器内解析「完整 body」再取 accessToken——之前把 body 截断到 2000 字符后再 JSON.parse，
+  // 因 session 响应很大（WARNING_BANNER/user 在前、accessToken 在后）被截断成非法 JSON，导致 AT 一直取空。
+  try {
+    const r = await page.evaluate(async () => {
+      try {
+        const res = await fetch('/api/auth/session', { credentials: 'include', headers: { accept: 'application/json' } });
+        const t = await res.text();
+        let accessToken = '';
+        let accountId = '';
+        try {
+          const j = JSON.parse(t);
+          if (j && j.accessToken) accessToken = j.accessToken;
+          accountId = (j && j.user && (j.user.id || j.user.chatgpt_account_id)) || '';
+        } catch { /* 非 JSON */ }
+        return { status: res.status, url: res.url, head: t.slice(0, 160), accessToken, accountId };
+      } catch (e) { return { status: -1, url: '', head: 'ERR ' + String(e), accessToken: '', accountId: '' }; }
+    });
+    out.sessionStatus = r.status; out.sessionHead = r.head || '';
+    if (r.accessToken) out.webAccessToken = r.accessToken;
+    if (r.accountId) out.accountId = r.accountId;
+    process.stderr.write(`[CAP-DIAG] session status=${r.status} url=${r.url} at=${r.accessToken ? r.accessToken.slice(0, 12) + '…len' + r.accessToken.length : 'NONE'}\n`);
+  } catch (e) { process.stderr.write(`[CAP-DIAG] session err ${String(e).slice(0, 140)}\n`); }
+  // 导航后重新导出 cookie（可能新增 chatgpt.com 域的 session cookie）
+  try { out.cookies = await context.cookies(); } catch { /* ignore */ }
+  return out;
+}
+
+// 归一化保存的 cookie 以喂给 context.addCookies：只保留必要字段，sameSite 归一到合法枚举，
+// 过滤掉缺 domain/name 的脏数据（否则 addCookies 会整批抛错）。
+function sanitizeCookies(list) {
+  const okSame = new Set(['Strict', 'Lax', 'None']);
+  const out = [];
+  for (const c of list || []) {
+    if (!c || !c.name || !c.domain) continue;
+    const ck = {
+      name: String(c.name),
+      value: String(c.value == null ? '' : c.value),
+      domain: String(c.domain),
+      path: c.path || '/',
+      httpOnly: !!c.httpOnly,
+      secure: !!c.secure,
+    };
+    if (typeof c.expires === 'number' && c.expires > 0) ck.expires = c.expires;
+    let ss = c.sameSite;
+    if (ss === 'no_restriction' || ss === 'None') ss = 'None';
+    else if (ss === 'lax' || ss === 'Lax') ss = 'Lax';
+    else if (ss === 'strict' || ss === 'Strict') ss = 'Strict';
+    ck.sameSite = okSame.has(ss) ? ss : 'Lax';
+    out.push(ck);
+  }
+  return out;
+}
+
+// 是否已存在 chatgpt.com 的 next-auth 会话 cookie（登录成功标志；匿名态没有）。
+// 兼容分块 cookie（__Secure-next-auth.session-token / .0 / .1），且要求 value 非空。
+async function hasNextAuthSession(context) {
+  try {
+    const cs = await context.cookies();
+    return cs.some((c) => /(^|\.)?next-auth\.session-token(\.\d+)?$/i.test(c.name || '')
+      && String(c.value || '').length > 10);
+  } catch { return false; }
+}
+
+// 打开 chatgpt.com 的登录/注册面板并露出邮箱输入框。
+// chatgpt.com 落地页有两种变体：①右侧直接是「Email address + Continue」；②聊天页只有
+// 「Log in / Sign up for free」按钮，需先点一下才弹出邮箱输入。让 chatgpt.com 自己发起
+// next-auth signin（state/CSRF 由它维护，比手拼 authorize URL 稳）。返回是否已露出邮箱框。
+async function openAuthPanel(page) {
+  const hasEmail = async () => {
+    try {
+      const el = await firstVisible(page, [
+        'input[type="email"]', 'input[name="email"]', 'input#email-input',
+        'input[autocomplete="username"]', 'input[placeholder*="email" i]',
+      ], 600);
+      return !!el;
+    } catch { return false; }
+  };
+  const re = /sign ?up|log ?in|create.*account|get started|注册|登录/i;
+  for (let attempt = 0; attempt < 4; attempt++) {
+    if (await hasEmail()) return true;
+    // 找可点的「注册/登录」入口（优先注册），点开面板。
+    const cand = page.locator('a, button, [role="button"]');
+    const n = await cand.count().catch(() => 0);
+    let clicked = false;
+    for (const preferSignup of [true, false]) {
+      for (let i = 0; i < n; i++) {
+        const el = cand.nth(i);
+        try {
+          if (!(await el.isVisible())) continue;
+          const txt = ((await el.innerText().catch(() => '')) || '').trim();
+          if (!txt || txt.length > 30 || !re.test(txt)) continue;
+          if (preferSignup && !/sign ?up|get started|注册/i.test(txt)) continue;
+          await el.click().catch(() => {});
+          clicked = true;
+          break;
+        } catch { /* 试下一个 */ }
+      }
+      if (clicked) break;
+    }
+    // 提速：点开后用「条件等待」替代固定 2.5s——邮箱框出现 / 跳到 auth.openai.com 任一满足即返回。
+    const deadline = Date.now() + 3500;
+    while (Date.now() < deadline) {
+      if (await hasEmail()) return true;
+      try { if (/auth\.openai\.com/.test(page.url())) return true; } catch { /* ignore */ }
+      await sleep(250);
+    }
+  }
+  return await hasEmail();
+}
+
+// 按「可见 label 文本」健壮定位并填写字段（about-you 变体多、裸 input 无 name/placeholder 常见）。
+// 依次尝试：1) getByLabel(正则)；2) placeholder/aria-label 选择器；3) 传入的兜底选择器；
+// 4) 就近法（找含 label 文案的元素 → for 关联或容器内最近 input）。填完读回 value 非空才算成功。
+async function fillByLabel(page, labelTexts, value, extraSelectors = []) {
+  const tryLoc = async (loc) => {
+    try {
+      if (!(await loc.count())) return false;
+      if (!(await loc.isVisible().catch(() => false))) return false;
+      await loc.fill('').catch(() => {});
+      await loc.type(String(value), { delay: 30 });
+      const v = (await loc.inputValue().catch(() => '')) || '';
+      return v.trim() !== '';
+    } catch { return false; }
+  };
+  // 1) getByLabel
+  for (const lt of labelTexts) {
+    try {
+      if (await tryLoc(page.getByLabel(new RegExp(lt, 'i')).first())) return true;
+    } catch { /* ignore */ }
+  }
+  // 2) placeholder / aria-label
+  const sels = [];
+  for (const lt of labelTexts) sels.push(`input[placeholder*="${lt}" i]`, `input[aria-label*="${lt}" i]`);
+  sels.push(...extraSelectors);
+  for (const s of sels) {
+    if (await tryLoc(page.locator(s).first())) return true;
+  }
+  // 3) 就近法：在页面内按 label 文案找到关联 input，用 elementHandle 填
+  try {
+    const el = await page.evaluateHandle((texts) => {
+      const lc = texts.map((t) => t.toLowerCase());
+      const match = (t) => { t = (t || '').trim().toLowerCase(); return t && lc.some((k) => t === k || t.startsWith(k)); };
+      for (const lab of document.querySelectorAll('label, span, div, p')) {
+        if (!match(lab.textContent)) continue;
+        const forId = lab.getAttribute && lab.getAttribute('for');
+        if (forId) { const e = document.getElementById(forId); if (e && e.tagName === 'INPUT') return e; }
+        let p = lab;
+        for (let d = 0; d < 3 && p; d++, p = p.parentElement) {
+          const inp = p.querySelector && p.querySelector('input');
+          if (inp && inp.offsetParent !== null) return inp;
+        }
+      }
+      return null;
+    }, labelTexts);
+    const handle = el && el.asElement && el.asElement();
+    if (handle && await handle.isVisible().catch(() => false)) {
+      await handle.fill('').catch(() => {});
+      await handle.type(String(value), { delay: 30 }).catch(() => {});
+      const v = (await handle.inputValue().catch(() => '')) || '';
+      if (v.trim() !== '') return true;
+    }
+  } catch { /* ignore */ }
+  return false;
+}
+
+// ==================== 邮箱验证码：从 Flask /api/reg/inbox 轮询「新鲜」验证码 ====================
+// 复刻协议模式 waitEmailOtp 的核心：只接受 baseline 之后到达、且像 OpenAI verification 的码，
+// 优先 subject 含 "verification"（score 高）的那封，避免误用 login code。
+function scoreOtp(m) {
+  const from = ((m && m.from_addr) || '').toLowerCase();
+  const subj = ((m && m.subject) || '').toLowerCase();
+  const isOpenAi = /openai|chatgpt/.test(from) || /openai|chatgpt/.test(subj);
+  if (!isOpenAi) return 0;
+  if (/verification code/.test(subj)) return 4;
+  if (/verification/.test(subj)) return 3;
+  // 2FA 二次验证/登录场景，OpenAI 邮件主题可能是 "login code"/"security code"/"your code"，
+  // 之前给 2 分被 verif(>=3) 与 generic(===1) 两个筛子都漏掉 → 永远取不到码。提到 3 分纳入正选。
+  if (/login code|security code|your .*code|one-?time|passcode/.test(subj)) return 3;
+  if (/\bcode\b/.test(subj)) return 1;
+  return 1;
+}
+async function waitEmailOtp(otpBase, email, { timeoutMs = 180000, intervalMs = 2500, baselineTs = 0, sinceSkewMs = 90000, say } = {}) {
+  const start = Date.now();
+  const threshold = baselineTs ? baselineTs - sinceSkewMs : 0;
+  let attempt = 0;
+  let fallback = null;
+  while (Date.now() - start < timeoutMs) {
+    attempt++;
+    try {
+      const res = await fetch(`${otpBase}/api/reg/inbox?email=${encodeURIComponent(email)}`);
+      const data = await res.json().catch(() => ({}));
+      const cands = [];
+      for (const m of (data.messages || [])) {
+        const ts = Date.parse(m.received_at || '') || 0;
+        const fresh = !threshold || ts >= threshold;
+        const code = m.extracted_code || extractCode(`${m.subject || ''} ${m.body || ''}`);
+        if (!code || !fresh) continue;
+        cands.push({ code, ts, score: scoreOtp(m) });
+      }
+      const verif = cands.filter((c) => c.score >= 3).sort((a, b) => (b.score - a.score) || (b.ts - a.ts))[0];
+      if (verif) { say && say('ok', '已收到验证码'); return verif.code; }
+      const generic = cands.filter((c) => c.score === 1).sort((a, b) => b.ts - a.ts)[0];
+      if (generic && !fallback) fallback = generic;
+      say && say('info', '等待验证码');
+    } catch { /* 单次失败继续轮询 */ }
+    await sleep(intervalMs);
+  }
+  if (fallback) { say && say('warn', '使用兜底验证码'); return fallback.code; }
+  return null;
+}
+
+// 在 OTP 输入区填入验证码：兼容单框（input[name=code]）与分段 6 框（逐位输入）。
+// known：上游若已通过启发式定位到验证码输入框，传进来做最后兜底，避免 OpenAI 改版后
+// 特定选择器失配导致「明明在验证码页却填不进去」。
+async function fillOtp(page, code, known = null) {
+  const single = await firstVisible(page, [
+    'input[name="code"]',
+    'input[autocomplete="one-time-code"]',
+    'input[inputmode="numeric"]',
+    'input[name="otp"]',
+  ], 2000);
+  if (single) {
+    await single.fill('');
+    await single.type(code, { delay: 60 });
+    return true;
+  }
+  // 分段输入框：找一组 input，逐位敲
+  const segs = page.locator('input[maxlength="1"]');
+  const n = await segs.count().catch(() => 0);
+  if (n >= code.length) {
+    for (let i = 0; i < code.length; i++) {
+      await segs.nth(i).type(code[i], { delay: 60 }).catch(() => {});
+    }
+    return true;
+  }
+  // 兜底：用上游传入的已定位框（启发式命中的那个可见输入）。
+  if (known) {
+    try {
+      await known.fill('');
+      await known.type(code, { delay: 60 });
+      return true;
+    } catch { /* ignore */ }
+  }
+  return false;
+}
+
+// 在手机页把「国家选择器」切到号码所属国家（iso2）。兼容三类控件：
+//   1) 原生 <select>（option 值可能是 iso2 / 国码 / 含国家名）；
+//   2) intl-tel-input（点旗标按钮展开列表，选 data-country-code=iso2 的项）；
+//   3) 通用 combobox（aria-haspopup 按钮 + 列表项）。
+// 成功返回 true（此后只需填「本国号」）；失败返回 false（回退：直接填「+完整E.164」让控件自识别）。
+async function selectPhoneCountry(page, iso2) {
+  if (!iso2) return false;
+  // 1) 原生 select：尝试按 value/label 选中
+  try {
+    const sel = page.locator('select').first();
+    if (await sel.count() && await sel.isVisible().catch(() => false)) {
+      for (const v of [iso2, iso2.toUpperCase()]) {
+        try { await sel.selectOption(v, { timeout: 800 }); return true; } catch { /* 试下一个 */ }
+      }
+    }
+  } catch { /* ignore */ }
+  // 2/3) 旗标 / combobox 按钮 → 展开 → 选对应国家项
+  const flag = await firstVisible(page, [
+    '.iti__selected-flag', '.iti__selected-country', 'button.iti__selected-country',
+    '[class*="selected-flag"]', '[class*="country-selector"]', 'button[aria-haspopup="listbox"]',
+  ], 1200);
+  if (flag) {
+    await flag.click().catch(() => {});
+    await sleep(400);
+    const item = await firstVisible(page, [
+      `.iti__country[data-country-code="${iso2}"]`, `li[data-country-code="${iso2}"]`,
+      `[data-country-code="${iso2}"]`, `li[data-country="${iso2}"]`, `[role="option"][data-country-code="${iso2}"]`,
+    ], 1200);
+    if (item) { await item.click().catch(() => {}); await sleep(300); return true; }
+    await page.keyboard.press('Escape').catch(() => {});
+  }
+  return false;
+}
+
+// ==================== 手机验证（浏览器 UI + 接码平台，best-effort） ====================
+async function verifyPhoneInBrowser(page, sms, say) {
+  const MODS = { smscode, smsbower, herosms };
+  const LABELS = { smscode: 'smscode.gg', smsbower: 'smsbower.app', herosms: 'hero-sms.com' };
+  const provider = (sms && MODS[sms.provider]) ? sms.provider : 'smscode';
+  const mod = MODS[provider];
+  const cfg = (sms && sms[provider]) || {};
+  if (!cfg.apiKey) throw new Error('需要手机验证但未配置接码 API Key');
+  say('info', '需要手机验证');
+  // 多国候选：与协议模式一致，逐个国家换号重试
+  const cand = Array.isArray(cfg.countryCandidates) && cfg.countryCandidates.length
+    ? cfg.countryCandidates.map((c) => (c && typeof c === 'object' ? c : { id: c })) : null;
+  const MAX = cand ? cand.length : Math.max(1, Number(sms.maxAttempts) || 3);
+  const perTimeout = Math.max(Number(sms.pollTimeout) || 0, 120000);
+  let lastErr = null;
+  for (let attempt = 1; attempt <= MAX; attempt++) {
+    let orderId = null;
+    const acfg = cand ? { ...cfg, country: cand[attempt - 1].id, countryId: cand[attempt - 1].id } : cfg;
+    try {
+      say('info', '获取手机号中');
+      const acq = await mod.acquireNumber(acfg, { log: () => {} });
+      orderId = acq.orderId;
+      const digits = String(acq.phone || '').replace(/[^\d]/g, '');
+      // 号码所属国家：优先用本次请求的 smsbower 国家 id 映射，其次按号码前缀反推国码。
+      const info = SMS_COUNTRY[acfg.country] || SMS_COUNTRY[String(acfg.country)] || null;
+      const { national } = splitDial(digits, info ? info.dial : '');
+      const iso2 = info ? info.iso2 : '';
+      const e164 = `+${digits}`;
+
+      const tel = await firstVisible(page, [
+        'input[type="tel"]', 'input[name="phone"]', 'input[name="phone_number"]', 'input[autocomplete="tel"]',
+      ], 3000);
+      if (!tel) throw new Error('未找到手机号输入框');
+
+      // 关键：把页面上的国家选到号码所属国家（否则默认停在美国 +1，号码与国码对不上）。
+      const picked = await selectPhoneCountry(page, iso2);
+      if (picked) say('info', `已选国家 ${(iso2 || '').toUpperCase()}`);
+      // 控件是否单独展示国码（separate dial code）——是则只填本国号。
+      const separateDial = await page.evaluate(
+        () => !!document.querySelector('.iti__selected-dial-code, [class*="selected-dial-code"]'),
+      ).catch(() => false);
+
+      await tel.click().catch(() => {});
+      await tel.fill('');
+      if (picked || separateDial) {
+        // 已选对国家 / 控件自带国码：只填本国号（无国码），与所选国家拼成正确号码。
+        await tel.type(national || digits, { delay: 40 });
+      } else {
+        // 没选到国家：填「+完整E.164」，靠控件对「+」前缀自动识别国家（与 HTTP 模式 formatE164 一致）。
+        await tel.type(e164, { delay: 40 });
+      }
+      await tel.press('Enter').catch(() => {});
+      await sleep(1500);
+      say('info', '等待验证码');
+      const otp = await mod.pollOtp(acfg, orderId, { timeoutMs: perTimeout, log: () => {} });
+      const ok = await fillOtp(page, otp.code);
+      if (!ok) throw new Error('未找到短信验证码输入框');
+      await page.keyboard.press('Enter').catch(() => {});
+      await mod.finishOrder(acfg, orderId).catch(() => {});
+      say('ok', '手机验证通过');
+      return true;
+    } catch (e) {
+      lastErr = e;
+      const msg = String((e && e.message) || e);
+      if (/NO_BALANCE|余额/.test(msg)) { say('warn', '接码余额不足'); throw e; }
+      say('warn', '手机验证失败');
+      try { await mod.cancelOrder(acfg, orderId, { log: () => {} }); } catch { /* ignore */ }
+    }
+  }
+  throw new Error(`手机验证失败：${lastErr ? lastErr.message : '未知'}`);
+}
+
+// ==================== 主流程 ====================
+(async () => {
+  let email = '';
+  let browser = null;
+  let context = null;
+  let registered = false; // 是否已越过「建号」步（用于让上游把邮箱标 burned）
+  try {
+    const input = JSON.parse((await readStdin()) || '{}');
+    email = input.email || '';
+    const settings = input.settings || {};
+    const proxy = input.proxy || null;
+    const otpBase = String(input.otpBase || 'http://127.0.0.1:5088').replace(/\/$/, '');
+    const headless = input.headless !== false; // 默认无头
+    const licenseKey = String(input.licenseKey || settings.cloakLicenseKey || '').trim();
+    // 固定/确定性密码（settings.regPassword，缺省用内置强口令）：见 reg_password.mjs 说明。
+    const password = resolveRegPassword(input, settings);
+    const sms = settings.sms || {};
+    // 新策略：注册阶段不做手机验证——走到 add_phone 时不接码，改为采集「会话 cookie(CK)+网页 AT」入库，
+    // 手机/RT 由后续「批量绑手机拿RT」单独做。opt-in（默认 false，保持老行为不变）。
+    // 用 let：bindPhone 模式在「拿到会话→转 codex 授权」时会把它切回 false（此步必须真接码）。
+    let skipPhone = input.skipPhone === true;
+    // 网页客户端注册（走 chatgpt.com 普通 signup，一般不强制手机）：opt-in，默认沿用 codex 入口。
+    // 用 let：bindPhone 模式先用网页登录建立会话（webClient=true），拿到会话后切 false 转 codex 授权拿 RT。
+    let webClient = input.webClient === true;
+    // 批量绑手机拿RT（针对无密码网页号）：先用「保存的 CK 恢复会话」，失效则「邮箱验证码重登」，
+    // 建立 chatgpt.com 登录态后，再走 codex 授权（app_EMoam…）触发手机验证 → 拿独立 codex RT。
+    const bindPhone = input.bindPhone === true;
+    const restoreCookies = Array.isArray(input.cookies) ? input.cookies : [];
+    if (bindPhone) { webClient = true; skipPhone = false; } // 绑机：先网页登录，后 codex 必须接码
+    // 网页注册拿到登录态后是否开启 TOTP 2FA（默认开；绑机模式不开）。
+    const enable2fa = input.enable2fa !== false && !bindPhone;
+    if (!email) throw new Error('缺少邮箱');
+
+    emitLog('info', bindPhone ? '开始绑机' : '开始注册', email);
+    const proxyStr = proxyToString(proxy);
+    emitLog('info', `浏览器启动（${headless ? '无头' : '有头'}${proxyStr ? ' · 代理' : ''}）`, email);
+
+    // 每号一套独立指纹：CloakBrowser 用 --fingerprint=<每次随机seed> 已在二进制层随机 canvas/webgl/
+    // 音频/字体等；这里再用 fingerprint.js 让「语言/时区」也逐号变化（经二进制 flag 设置、彼此自洽、
+    // 不走可检测的 CDP 模拟）。不覆盖 UA/sec-ch-ua——那会与二进制真实 146 头不一致反成强特征。
+    const fp = generateFingerprint();
+    process.stderr.write(`[FP-DIAG] locale=${fp.language} tz=${fp.timezone} screen=${fp.screenStr} ua=${fp.userAgent.slice(0, 40)}\n`);
+
+    // 启动 CloakBrowser：launchContext 每次都是「全新隐身上下文 + 独立临时 profile」（chromium.launch()
+    // 分配一次性 user-data-dir，close 即弃），因此逐号天然隔离、无 cookie/localStorage 残留。
+    // --disable-quic：经 HTTP 代理时 QUIC/HTTP3(UDP) 无法隧道，实测不加此 flag 连 auth.openai.com 会
+    // ERR_CONNECTION_REFUSED；关掉 QUIC 强制走 TCP 后各 OpenAI 域名均可正常访问。
+    context = await launchContext({
+      headless,
+      proxy: proxyStr,
+      licenseKey: licenseKey || undefined,
+      locale: fp.language,   // 逐号变化的英文区语言（en-US/en-GB/en-CA）
+      timezone: fp.timezone, // 与语言自洽的时区
+      humanize: true,
+      args: ['--disable-quic'],
+    });
+    browser = context.browser();
+    // 兜底再清一遍会话态：新上下文本为空，但异常复用/残留时这一步保证「干净新注册」——用户实测
+    // 报「直接弹已登录账号」，显式清 cookie 后即便底层被复用也不会带上一号登录态。
+    try { await context.clearCookies(); } catch { /* ignore */ }
+    const page = await context.newPage();
+    page.setDefaultTimeout(45000);
+    // 有头模式：把窗口顶到前台，避免开在其它窗口后面让用户以为「没开浏览器」。
+    if (!headless) { try { await page.bringToFront(); } catch { /* ignore */ } }
+
+    // 拦截 redirect_uri：注册收尾会 302 到 localhost:1455/auth/callback?code=…，
+    // 这里 fulfill 一个空 200 并把 code 记下来（浏览器无需真的连到本地 1455）。
+    let authCode = null;
+    await context.route('http://localhost:1455/**', async (route) => {
+      try {
+        const u = new URL(route.request().url());
+        if (u.searchParams.get('code')) authCode = u.searchParams.get('code');
+      } catch { /* ignore */ }
+      try { await route.fulfill({ status: 200, contentType: 'text/html', body: 'ok' }); } catch { /* ignore */ }
+    });
+
+    // say 提前定义：网页入口块（openAuthPanel/日志）会用到，避免 TDZ「Cannot access 'say' before init」。
+    const say = (level, msg) => emitLog(level, msg, email);
+
+    // 测试/复用入口：mode2fa —— 用已存 CK 恢复登录态后，仅跑「开启 TOTP 2FA」完整闭环并回吐密钥。
+    // 供验证 2FA 闭环（填码→提交→确认）用，也可日后给「已登录账号补开 2FA」复用。
+    if (input.mode2fa === true) {
+      if (restoreCookies.length) { try { await context.addCookies(sanitizeCookies(restoreCookies)); } catch { /* */ } }
+      await page.goto('https://chatgpt.com/', { waitUntil: 'domcontentloaded' }).catch(() => {});
+      await sleep(3000);
+      const sec = await enableTotp2fa(context, page, email, otpBase, say);
+      try { await browser.close(); } catch { /* ignore */ }
+      realStdoutWrite(JSON.stringify({ ok: !!sec, twoFactorSecret: sec || '' }));
+      return;
+    }
+
+    // 从 codex 客户端的 /oauth/authorize 起步，并 screen_hint=signup 直达注册 UI。
+    const { verifier, challenge } = generatePkce();
+    const state = crypto.randomBytes(32).toString('base64url');
+    const authorizeUrl = `${OAUTH_ISSUER}/oauth/authorize?` + new URLSearchParams({
+      response_type: 'code', client_id: OAUTH_CLIENT_ID, redirect_uri: OAUTH_REDIRECT_URI,
+      scope: OAUTH_SCOPE, code_challenge: challenge, code_challenge_method: 'S256', state,
+      screen_hint: 'signup', prompt: 'login',
+    }).toString();
+    // codex 授权（用于 bindPhone：已在浏览器里建立 chatgpt.com 登录态后，对已存在账号发起 codex 授权，
+    // 触发手机验证并换取独立 codex RT）。不带 screen_hint=signup——是对既有账号授权而非建号；
+    // 关键：不带 prompt=login——否则会强制邮箱重新验证(步进验证)，而我们要复用已恢复的会话直达授权/手机。
+    const codexAuthorizeUrl = `${OAUTH_ISSUER}/oauth/authorize?` + new URLSearchParams({
+      response_type: 'code', client_id: OAUTH_CLIENT_ID, redirect_uri: OAUTH_REDIRECT_URI,
+      scope: OAUTH_SCOPE, code_challenge: challenge, code_challenge_method: 'S256', state,
+    }).toString();
+
+    if (bindPhone) {
+      // 绑机阶段一：恢复 chatgpt.com 登录态。优先用保存的 CK；失效则走网页邮箱验证码重登。
+      if (restoreCookies.length) {
+        try { await context.addCookies(sanitizeCookies(restoreCookies)); say('info', '恢复会话中'); }
+        catch (e) { process.stderr.write(`[BIND-DIAG] addCookies err ${String(e).slice(0, 120)}\n`); }
+      }
+      await page.goto('https://chatgpt.com/', { waitUntil: 'domcontentloaded' }).catch(() => {});
+      await sleep(1200);
+      if (await hasNextAuthSession(context)) {
+        say('ok', '会话已恢复');
+      } else {
+        // CK 失效/为空：露出邮箱面板，交给状态机走「邮箱→验证码(→密码)」登录，拿到会话后再转 codex。
+        say('info', 'CK失效改邮箱登录');
+        await firstVisible(page, [
+          'input[type="email"]', 'input[placeholder*="email" i]',
+          'button:has-text("Sign up")', 'button:has-text("Log in")', 'button:text-is("Continue")',
+        ], 6000).catch(() => null);
+        await openAuthPanel(page).catch(() => {});
+      }
+    } else if (webClient) {
+      // 网页注册入口：直接开 chatgpt.com 落地页。现代 chatgpt.com 右侧就是「Sign up or log in」面板
+      //（Email address 输入 + Continue，属 login_or_signup 统一入口）——新邮箱填进去点 Continue 即进注册。
+      // 由 chatgpt.com 自己发起 next-auth signin（POST 带 CSRF），state/CSRF 全程它维护，最稳；
+      // 手拼 authorize URL / 直连 signin GET 都会得到「会话已结束 / auth/error」。
+      // 后续交给状态机：email_entry(填邮箱→Continue) → 密码 → 邮箱验证码 → about-you → 回落 chatgpt.com 登录态。
+      say('info', '进入网页注册');
+      await page.goto('https://chatgpt.com/', { waitUntil: 'domcontentloaded' }).catch(() => {});
+      // 提速：不再固定等 4s——等落地页出现可交互入口（邮箱框 / 登录·注册按钮）后再开面板，最多 ~6s。
+      await firstVisible(page, [
+        'input[type="email"]', 'input[placeholder*="email" i]',
+        'button:has-text("Sign up")', 'button:has-text("Log in")', 'button:text-is("Continue")',
+      ], 6000).catch(() => null);
+      // 露出邮箱输入框（两种落地变体都兼容）；露不出来也继续，交给状态机兜底判定。
+      await openAuthPanel(page).catch(() => {});
+    } else {
+      await page.goto(authorizeUrl, { waitUntil: 'domcontentloaded' }).catch(() => {});
+    }
+
+    const otpBaselineTs = Date.now();
+
+    // 按「当前页面真实特征」判定的状态机：每轮 detectPage 读 URL+DOM，classifyPage 判定当前步，
+    // 再精确处理对应步骤。授权只在「无任何可填输入 + 授权语境」时点，非授权页绝不点 Continue，
+    // 从根本上杜绝「在验证码/密码页上空点 Continue 跳过验证」的历史 bug。
+    let phoneDone = false;      // 手机验证是否已在本次流程里处理过
+    let pwSubmitted = false;    // 是否已提交过密码（建号或登录）——用于日志用词
+    let otpFilled = false;      // 邮箱验证码是否已成功填过一次（用于识别「提交后过渡页」）
+    let skipTried = false;      // skipPhone 模式下「找跳过入口」是否已尝试过（只试一次）
+    let phonePending = false;   // skipPhone 模式：已到手机页但按策略不验、改为采集 CK+AT 入库
+    let capturedCookies = null; // 采集到的会话 cookie（CK）
+    let webAccessToken = '';    // 采集到的网页 access token（AT）
+    let capturedAccountId = ''; // 采集到的 chatgpt account id（可选）
+    let twoFactorSecret = '';   // 开启 TOTP 2FA 后拿到的 base32 密钥（失败留空）
+    let dumped = false;         // 未知页面只转储一次 DOM 诊断，避免刷屏
+    let lastSig = '';           // 上一轮「类型|URL」签名，判断是否卡在同一页
+    let sameCount = 0;
+    // 提速：轮询间隔 350ms→250ms 更跟手；步数上限相应提到 180 以保住整体墙钟预算（邮箱验证码的长等
+    // 在 email_otp 分支内阻塞、不占这里的步数）。卡住判定的 sameCount 阈值保持不变，仍靠墙钟容忍。
+    for (let step = 0; step < 180 && !authCode; step++) {
+      await sleep(250);
+      if (authCode) break;
+
+      const snap = await detectPage(page);
+      if (authCode) break;
+      const type = classifyPage(snap);
+      const sig = `${type}|${snap.url}`;
+      if (sig === lastSig) sameCount++; else { sameCount = 0; lastSig = sig; }
+
+      // 硬信号：密码错误（多为「此邮箱曾用别的密码注册」）→ 直接失败，别再空转。
+      if (snap.dom && snap.dom.wrongCred) {
+        throw new Error('邮箱或密码不正确（此邮箱可能曾用别的密码注册）');
+      }
+
+      // 网页客户端终止条件：出现 chatgpt.com 的 next-auth 会话 cookie 即代表「已登录」。
+      // 关键：网页 signup 是「邮箱验证码即登录」的无密码流（实测无密码步、也不强制手机），
+      // 所以不能用 pwSubmitted 当门槛；只认 __Secure-next-auth.session-token（登录后才有、匿名态没有），
+      // 每轮都查（不导航），一出现就采集 CK+AT 并结束。
+      if (webClient && (await hasNextAuthSession(context))) {
+        if (bindPhone) {
+          // 绑机：已建立 chatgpt.com 登录态 → 转 codex 授权（同一浏览器会话，auth.openai.com 已有 SSO），
+          // 触发手机验证 → 拿独立 codex RT。切 webClient=false 让终止逻辑改用 codex 的 authCode。
+          say('ok', '会话就绪转授权');
+          webClient = false;
+          skipPhone = false; // 此步必须真接码
+          phoneDone = false;
+          await page.goto(codexAuthorizeUrl, { waitUntil: 'domcontentloaded' }).catch(() => {});
+          await settle(page);
+          continue;
+        }
+        const cap = await captureWebSession(context, page, say);
+        capturedCookies = cap.cookies;
+        webAccessToken = cap.webAccessToken;
+        capturedAccountId = cap.accountId || '';
+        // 拿到登录态后开启 TOTP 2FA 并保存密钥（默认开启，可传 enable2fa=false 关闭）。失败不影响入库。
+        if (enable2fa) {
+          twoFactorSecret = await enableTotp2fa(context, page, email, otpBase, say);
+          // 开 2FA 后会话 cookie 可能刷新，重采一次 CK，保证落库的是最新会话。
+          try { capturedCookies = await context.cookies(); } catch { /* ignore */ }
+        }
+        phonePending = true; // 网页号暂无 codex RT：CK+AT(+2FA) 入库，SUB 列显示否
+        break;
+      }
+
+      if (type === 'email_entry') {
+        const el = await firstVisible(page, [
+          'input[name="email"]', 'input#email-input', 'input[type="email"]', 'input[autocomplete="username"]',
+          'input[placeholder*="email" i]',
+        ], 1500);
+        if (el) {
+          say('info', '提交邮箱');
+          await el.fill('');
+          await el.type(email, { delay: 40 });
+          await submitStep(page);
+          await settle(page);
+          await waitLeaveType(page, 'email_entry');
+        }
+        continue;
+      }
+
+      if (type === 'password') {
+        const pw = await firstVisible(page, [
+          'input[type="password"]', 'input[name="password"]', 'input[name="new-password"]',
+        ], 1500);
+        if (pw) {
+          // 建号与「已注册邮箱重进」的登录都用同一固定密码；已注册邮箱也能凭此登录拿状态。
+          say('info', pwSubmitted ? '重新登录中' : '创建账号中');
+          // 单页表单可能同时要邮箱：为空则补填，避免只填密码提交失败。
+          const em = await firstVisible(page, ['input[type="email"]', 'input[name="email"]'], 400);
+          if (em) {
+            const v = await em.inputValue().catch(() => '');
+            if (!v) { await em.fill(''); await em.type(email, { delay: 30 }); }
+          }
+          await pw.fill('');
+          await pw.type(password, { delay: 40 });
+          await submitStep(page);
+          registered = true;
+          pwSubmitted = true;
+          say('info', '发送验证码');
+          await settle(page);
+          await waitLeaveType(page, 'password');
+        }
+        continue;
+      }
+
+      if (type === 'email_otp') {
+        const otpBox = (await firstVisible(page, [
+          'input[name="code"]', 'input[autocomplete="one-time-code"]', 'input[inputmode="numeric"]',
+          'input[name="otp"]', 'input[maxlength="1"]', 'input[maxlength="6"]',
+        ], 1200)) || await findGenericOtpBox(page);
+        // 已填过码后又回到验证码页：多为「刚回车、正在校验/跳转」的同一过渡页（框被禁用/仍带旧值）。
+        // 此时别重复填（会因框只读而报「未能填入」），等它跳走即可；长时间不走才判校验失败。
+        if (otpFilled) {
+          if (!otpBox) { await settle(page); continue; }
+          const busy = await page.evaluate(() => {
+            const skip = ['password', 'email', 'tel', 'hidden', 'checkbox', 'radio', 'submit', 'button'];
+            return [...document.querySelectorAll('input')].filter((i) => i.offsetParent !== null).some(
+              (i) => (i.readOnly || i.disabled || String(i.value || '').trim() !== '')
+                && !skip.includes((i.getAttribute('type') || 'text').toLowerCase()),
+            );
+          }).catch(() => false);
+          if (busy) { await settle(page); continue; }
+          if (sameCount >= 8) throw new Error('邮箱验证码校验未通过');
+        }
+        say('info', '等待验证码');
+        const code = await waitEmailOtp(otpBase, email, { baselineTs: otpBaselineTs, say });
+        if (!code) throw new Error('邮箱验证码等待超时');
+        const ok = await fillOtp(page, code, otpBox);
+        if (!ok) throw new Error('未能填入邮箱验证码');
+        await page.keyboard.press('Enter').catch(() => {});
+        otpFilled = true;
+        say('ok', '邮箱验证通过');
+        // 关键：提交后主动等「离开验证码页」再继续，避免在过渡页二次误入验证码分支。
+        await waitLeaveType(page, 'email_otp');
+        continue;
+      }
+
+      if (type === 'phone') {
+        if (skipPhone) {
+          // 新策略：不接码。先试「以后再说/跳过」入口；能跳过就让状态机继续（可能直达 about-you/授权）。
+          if (!skipTried) {
+            skipTried = true;
+            const skipped = await trySkipPhone(page, say);
+            if (skipped) { await settle(page); continue; }
+          }
+          // 无跳过入口 / 跳过后仍回手机页：采集 CK+AT，结束状态机去入库（手机待绑）。
+          say('info', '跳过手机验证');
+          const cap = await captureWebSession(context, page, say);
+          capturedCookies = cap.cookies;
+          webAccessToken = cap.webAccessToken;
+          capturedAccountId = cap.accountId || '';
+          phonePending = true;
+          break;
+        }
+        if (!phoneDone) {
+          await verifyPhoneInBrowser(page, sms, say);
+          phoneDone = true;
+          await settle(page);
+        }
+        continue;
+      }
+
+      if (type === 'about_you') {
+        say('info', '完善资料中');
+        // 判定变体：优先看是否有「生日框」→ 变体B（名/姓+生日）；否则若有「Age(整数)」→ 变体A（Full name+Age）。
+        // 提速：两个探测合并为单次 page.evaluate，减少一次往返。
+        const { hasBday, hasAge } = await page.evaluate(() => {
+          const vis = (e) => e && e.offsetParent !== null;
+          const hasBday = [...document.querySelectorAll(
+            'input[type="date"], input[name="birthdate"], input[name="bday"], input[placeholder*="birth" i]',
+          )].some(vis);
+          let hasAge = [...document.querySelectorAll(
+            'input[name="age" i], input[placeholder*="age" i], input[aria-label*="age" i]',
+          )].some(vis);
+          if (!hasAge) {
+            for (const l of document.querySelectorAll('label, span, div, p')) {
+              const t = (l.textContent || '').trim().toLowerCase();
+              if (t === 'age' || t.startsWith('age')) {
+                let p = l;
+                for (let d = 0; d < 3 && p; d++, p = p.parentElement) { if (p.querySelector && p.querySelector('input')) { hasAge = true; break; } }
+              }
+              if (hasAge) break;
+            }
+          }
+          return { hasBday, hasAge };
+        }).catch(() => ({ hasBday: false, hasAge: false }));
+
+        let okFilled = false;
+        if (hasBday) {
+          // 变体B：名/姓（拿不到则退回单个 Full name）+ 生日(YYYY-MM-DD)
+          const first = FIRST[crypto.randomInt(0, FIRST.length)];
+          const last = LAST[crypto.randomInt(0, LAST.length)];
+          const fOk = await fillByLabel(page, ['first name', 'first', 'given'], first,
+            ['input[name="firstName" i]', 'input[autocomplete="given-name"]']);
+          const lOk = await fillByLabel(page, ['last name', 'last', 'family', 'surname'], last,
+            ['input[name="lastName" i]', 'input[autocomplete="family-name"]']);
+          let nameOk = fOk && lOk;
+          if (!nameOk) {
+            nameOk = await fillByLabel(page, ['full name', 'name'], `${first} ${last}`,
+              ['input[name="name"]', 'input#name', 'input[autocomplete="name"]']);
+          }
+          const bOk = await fillByLabel(page, ['date of birth', 'birthdate', 'birth', 'dob'], randomAdultBirthdate(),
+            ['input[type="date"]', 'input[name="birthdate"]', 'input[name="bday"]']);
+          okFilled = nameOk && bOk;
+        } else {
+          // 变体A（截图这种）：Full name + Age(整数 18~48)
+          const fullName = randomFullName();
+          const age = String(18 + crypto.randomInt(0, 31));
+          const nOk = await fillByLabel(page, ['full name', 'name'], fullName,
+            ['input[name="name"]', 'input#name', 'input[autocomplete="name"]']);
+          const aOk = await fillByLabel(page, ['age'], age,
+            ['input[name="age"]', 'input[type="number"]', 'input[inputmode="numeric"]']);
+          okFilled = nOk && aOk;
+        }
+
+        if (!okFilled) {
+          // 没填成功绝不点「Finish creating account」：转储诊断，稍等重试；久卡才判失败。
+          await dumpDiag(page);
+          if (sameCount >= 7) throw new Error('补资料填写失败（字段未识别）');
+          await settle(page);
+          continue;
+        }
+        say('ok', '资料已填写');
+        // 点「Finish creating account」/ Continue 提交
+        const fin = await firstVisible(page, [
+          'button:has-text("Finish creating account")', 'button:text-is("Continue")',
+          'button:text-is("Next")', 'button[type="submit"]',
+        ], 1500);
+        if (fin) { await fin.click().catch(() => {}); } else { await submitStep(page); }
+        await settle(page);
+        await waitLeaveType(page, 'about_you');
+        continue;
+      }
+
+      if (type === 'choose_account') {
+        // 账号选择页：点「含本邮箱的账号磁贴」，避开「Log in to another account / Create account」。
+        // 用 Playwright 真实点击（React SPA 需真实指针事件；page.evaluate 里的 DOM .click() 常不触发导航）。
+        say('info', '选择账号中');
+        let clicked = false;
+        try {
+          const tile = page.locator('button, [role="button"], a').filter({ hasText: email }).first();
+          if (await tile.isVisible()) { await tile.click(); clicked = true; }
+        } catch { /* ignore */ }
+        if (!clicked) {
+          const b = await firstVisible(page, ['button:has-text("Select account")', `button:has-text("${email}")`], 1500);
+          if (b) { await b.click().catch(() => {}); clicked = true; }
+        }
+        await settle(page);
+        await waitLeaveType(page, 'choose_account', 12000);
+        continue;
+      }
+
+      if (type === 'consent' || type === 'callback') {
+        // 真·授权页（无可填输入 + 授权按钮/授权语境）才点授权。
+        say('info', '获取授权中');
+        const btn = await firstVisible(page, [
+          'button:text-is("Authorize")', 'button:text-is("Allow")', 'button:text-is("Agree")',
+          'button:text-is("Continue")', 'button[type="submit"]',
+        ], 1200);
+        if (btn) { await btn.click().catch(() => {}); await settle(page); }
+        continue;
+      }
+
+      if (type === 'interstitial') {
+        // 「You're all set」引导页也常被归到过渡页：优先按引导页处理（点其 Continue）。命中即继续。
+        if (await dismissOnboarding(page, say)) { await settle(page); continue; }
+        // 无可填输入、只有普通 Continue、又无授权语境：多为过渡/加载页。稳定几轮后点一次
+        // （此时确无输入可填，点它安全、不会跳过输入步）；限制点击轮次，避免对死按钮狂点。
+        if (sameCount >= 3 && sameCount <= 8) {
+          const btn = await firstVisible(page, ['button:text-is("Continue")', 'button[type="submit"]'], 1000);
+          if (btn) { await btn.click().catch(() => {}); await settle(page); }
+        } else {
+          await sleep(300);
+        }
+        continue;
+      }
+
+      // loading / unknown / phone_otp：等待页面稳定；未知页卡住先做「引导页 + 空白页 F5」兜底
+      // （新号登录后被弹回首页/空白页会长期归为 unknown），再转储诊断；久卡才中止（绝不盲进授权）。
+      if (type === 'unknown' && sameCount >= 2) {
+        if (await dismissOnboarding(page, say)) { await settle(page); continue; }
+        if (await refreshIfBlank(page)) { await settle(page); continue; }
+      }
+      if (!dumped && type === 'unknown' && sameCount >= 3) { dumped = true; await dumpDiag(page); }
+      if (type === 'unknown' && sameCount >= 14) {
+        await dumpDiag(page).catch(() => {});
+        throw new Error('停留在未知页面，已中止（未进入授权）');
+      }
+      await sleep(300);
+    }
+
+    // 网页模式兜底：循环结束但可能已在 chatgpt.com 建立登录态（session cookie 已就绪），
+    // 补采一次 CK+AT 并置 phonePending，走下面统一出口入库，避免误落到 codex 的 authCode 分支。
+    if (webClient && !phonePending && (await hasNextAuthSession(context))) {
+      const cap = await captureWebSession(context, page, say);
+      capturedCookies = cap.cookies;
+      webAccessToken = cap.webAccessToken;
+      capturedAccountId = cap.accountId || '';
+      phonePending = true;
+    }
+    if (webClient && !phonePending) {
+      throw new Error('网页注册未建立登录态（未拿到 chatgpt.com 会话）');
+    }
+
+    // 新策略：跳过手机 → 不换 RT，直接带「CK(cookies)+AT」入库（手机待绑，SUB=否）。
+    if (phonePending) {
+      // 仅在「连 cookie 都没采到」时补采一次。注意：网页 AT 在「未绑手机」状态被 OpenAI 挡住
+      //（/api/auth/session 返回 200 但为匿名、无 accessToken），所以不能因 AT 为空就重复采集，
+      // 否则每次都白跑一次 chatgpt.com 导航。AT 留待后续「批量绑手机拿RT」用 CK 恢复会话后再取。
+      if (!capturedCookies || !capturedCookies.length) {
+        const cap = await captureWebSession(context, page, say);
+        capturedCookies = (capturedCookies && capturedCookies.length) ? capturedCookies : cap.cookies;
+        webAccessToken = webAccessToken || cap.webAccessToken;
+        capturedAccountId = capturedAccountId || cap.accountId || '';
+      }
+      const gotAt = !!(webAccessToken && webAccessToken.length > 20);
+      const gotCk = Array.isArray(capturedCookies) && capturedCookies.length > 0;
+      say(gotAt || gotCk ? 'ok' : 'warn', gotAt ? '已拿会话与AT' : (gotCk ? '已拿会话' : '会话采集不全'));
+      const result = {
+        ok: true,
+        phonePending: true,        // 标记：网页号暂无 codex RT（供后端标 SUB=否）
+        refreshToken: '',          // 无 codex RT
+        accessToken: webAccessToken || '',
+        webAccessToken: webAccessToken || '',
+        webRefreshToken: '',       // 网页 RT：next-auth 不向客户端暴露 refresh_token，无法自助获取（见汇报）
+        twoFactorSecret: twoFactorSecret || '',  // 2FA base32 密钥（开启成功才有）
+        cookies: capturedCookies || [],   // CK：序列化会话 cookie
+        chatgptAccountId: capturedAccountId || '',
+        clientId: OAUTH_CLIENT_ID,
+        password,
+        subOk: false,
+      };
+      try { await browser.close(); } catch { /* ignore */ }
+      realStdoutWrite(JSON.stringify(result));
+      return;
+    }
+
+    if (!authCode) {
+      // 兜底：若已完成登录态但未触发跳转，主动再访问一次 authorize，让服务端直接给 code。
+      // bindPhone 用 codex 授权地址（对既有账号），其它用注册 authorize。
+      await page.goto(bindPhone ? codexAuthorizeUrl : authorizeUrl, { waitUntil: 'domcontentloaded' }).catch(() => {});
+      for (let i = 0; i < 8 && !authCode; i++) await sleep(700);
+    }
+    if (!authCode) throw new Error('未能取得 authorization code（注册 UI 未走到授权跳转）');
+    say('ok', '获取授权成功');
+
+    // 用同一 context（同 cookie、同代理）POST /oauth/token 换 refresh_token。
+    say('info', '获取令牌中');
+    const tokResp = await context.request.post(`${OAUTH_ISSUER}/oauth/token`, {
+      form: {
+        grant_type: 'authorization_code',
+        code: authCode,
+        redirect_uri: OAUTH_REDIRECT_URI,
+        client_id: OAUTH_CLIENT_ID,
+        code_verifier: verifier,
+      },
+    });
+    if (!tokResp.ok()) {
+      const body = await tokResp.text().catch(() => '');
+      throw new Error(`换取 token 失败：HTTP ${tokResp.status()} ${body.slice(0, 160)}`);
+    }
+    const tok = await tokResp.json().catch(() => ({}));
+    if (!tok.refresh_token) throw new Error('token 响应缺少 refresh_token');
+
+    say('ok', '账号登录成功');
+    // 浏览器模式不再单独跑第二阶段 SUB（拿不到就 SUB=否，与需求一致）。
+    const result = {
+      ok: true,
+      refreshToken: tok.refresh_token,
+      accessToken: tok.access_token || '',
+      idToken: tok.id_token || '',
+      clientId: OAUTH_CLIENT_ID,
+      password,
+      subOk: false,
+    };
+    try { await browser.close(); } catch { /* ignore */ }
+    realStdoutWrite(JSON.stringify(result));
+  } catch (e) {
+    const msg = (e && e.message) || String(e);
+    emitLog('error', msg, email);
+    try { if (browser) await browser.close(); } catch { /* ignore */ }
+    const banned = /deleted or deactivated|deactivat|账号已停用/i.test(msg);
+    realStdoutWrite(JSON.stringify({ ok: false, banned, registered, error: msg }));
+  }
+})();
diff --git a/account-manager/node/fingerprint.js b/account-manager/node/fingerprint.js
new file mode 100644
index 0000000..0ed5cdc
--- /dev/null
+++ b/account-manager/node/fingerprint.js
@@ -0,0 +1,118 @@
+// 反检测：为每个注册账号合成一套「内部自洽」的浏览器/设备指纹 + 随机姓名 + 成年生日。
+// 目的：以前所有账号都写死同一 UA（Chrome/145 Windows）、同一屏幕/语言、姓名只在 6×6 里选、
+// 年龄挤在 1995~2002，风控极易把这些注册归成同一批机器人。这里让「每账号一套、全程一致、
+// 账号间不同」——UA / sec-ch-ua / platform / screen / navigator 全部彼此对齐（否则 sec-ch-ua
+// 与 UA 不符本身就是强特征）。
+import crypto from 'node:crypto';
+
+function pick(arr) { return arr[crypto.randomInt(0, arr.length)]; }
+
+// 每个 profile 固定「Chrome 大版本 ↔ 真实的 sec-ch-ua 品牌串」配对：sec-ch-ua 的 GREASE 品牌
+// （"Not?A_Brand" 之类）与版本号是浏览器构建时生成的，随便拼会露馅，所以直接采样真实组合。
+const CHROME_PROFILES = [
+  { major: 140, secChUa: '"Chromium";v="140", "Not=A?Brand";v="24", "Google Chrome";v="140"' },
+  { major: 141, secChUa: '"Google Chrome";v="141", "Not?A_Brand";v="8", "Chromium";v="141"' },
+  { major: 142, secChUa: '"Chromium";v="142", "Google Chrome";v="142", "Not_A Brand";v="99"' },
+  { major: 143, secChUa: '"Not;A=Brand";v="99", "Google Chrome";v="143", "Chromium";v="143"' },
+  { major: 144, secChUa: '"Google Chrome";v="144", "Chromium";v="144", "Not.A/Brand";v="24"' },
+  { major: 145, secChUa: '"Chromium";v="145", "Not)A;Brand";v="8", "Google Chrome";v="145"' },
+  { major: 138, secChUa: '"Not)A;Brand";v="8", "Chromium";v="138", "Google Chrome";v="138"' },
+  { major: 139, secChUa: '"Chromium";v="139", "Not_A Brand";v="24", "Google Chrome";v="139"' },
+];
+
+// OS 决定 UA 平台段、navigator.platform、sec-ch-ua-platform 三者必须一致。
+const OS_PROFILES = [
+  { uaToken: 'Windows NT 10.0; Win64; x64', platform: 'Win32', chPlatform: '"Windows"' },
+  { uaToken: 'Macintosh; Intel Mac OS X 10_15_7', platform: 'MacIntel', chPlatform: '"macOS"' },
+];
+
+// 常见桌面分辨率（宽x高）；taskbar/书签栏占用后 availHeight 略小于 height，贴近真机。
+const SCREENS = [
+  { width: 1920, height: 1080 },
+  { width: 2560, height: 1440 },
+  { width: 1536, height: 864 },
+  { width: 1440, height: 900 },
+  { width: 1366, height: 768 },
+  { width: 1680, height: 1050 },
+];
+
+// 英文母语区：语言/locale 保持在英语圈内，避免 UA 是美式 Chrome 却报 zh-CN 这种矛盾。
+const LOCALES = [
+  { language: 'en-US', accept: 'en-US,en;q=0.9', tz: 'America/New_York' },
+  { language: 'en-US', accept: 'en-US,en;q=0.9', tz: 'America/Chicago' },
+  { language: 'en-US', accept: 'en-US,en;q=0.9', tz: 'America/Los_Angeles' },
+  { language: 'en-GB', accept: 'en-GB,en;q=0.9', tz: 'Europe/London' },
+  { language: 'en-CA', accept: 'en-CA,en;q=0.9', tz: 'America/Toronto' },
+];
+
+// 生成一套彼此自洽的指纹。同一账号整条注册流程复用同一个对象；不同账号各自独立随机。
+export function generateFingerprint() {
+  const chrome = pick(CHROME_PROFILES);
+  const osp = pick(OS_PROFILES);
+  const screen = pick(SCREENS);
+  const loc = pick(LOCALES);
+  const hardwareConcurrency = pick([4, 8, 12, 16]);
+  const deviceMemory = pick([8, 16]); // Chrome 只暴露 8/16 这类粗粒度值
+
+  const userAgent =
+    `Mozilla/5.0 (${osp.uaToken}) AppleWebKit/537.36 (KHTML, like Gecko) ` +
+    `Chrome/${chrome.major}.0.0.0 Safari/537.36`;
+
+  return {
+    userAgent,
+    secChUa: chrome.secChUa,
+    secChUaMobile: '?0', // 桌面固定 ?0，与 UA 无移动标记一致
+    secChUaPlatform: osp.chPlatform,
+    platform: osp.platform,
+    language: loc.language,
+    acceptLanguage: loc.accept,
+    languages: `${loc.language},${loc.language.split('-')[0]}`,
+    timezone: loc.tz,
+    screen: {
+      width: screen.width,
+      height: screen.height,
+      // availHeight 减去任务栏/系统栏的典型高度，availWidth 通常等于 width。
+      availWidth: screen.width,
+      availHeight: screen.height - 40,
+      colorDepth: 24,
+      pixelDepth: 24,
+    },
+    screenStr: `${screen.width}x${screen.height}`,
+    hardwareConcurrency,
+    deviceMemory,
+  };
+}
+
+// 扩充姓名池：各数十个真实常见英文名，随机组合，避免总是那几对被风控聚类。
+const FIRST_NAMES = [
+  'James', 'Michael', 'Robert', 'John', 'David', 'William', 'Richard', 'Joseph',
+  'Thomas', 'Christopher', 'Daniel', 'Matthew', 'Anthony', 'Andrew', 'Joshua',
+  'Ryan', 'Brandon', 'Justin', 'Benjamin', 'Samuel', 'Nathan', 'Aaron', 'Adam',
+  'Mary', 'Patricia', 'Jennifer', 'Linda', 'Elizabeth', 'Barbara', 'Susan',
+  'Jessica', 'Sarah', 'Karen', 'Emily', 'Emma', 'Olivia', 'Sophia', 'Ava',
+  'Isabella', 'Mia', 'Charlotte', 'Amelia', 'Hannah', 'Grace', 'Rachel',
+  'Laura', 'Megan', 'Lauren', 'Victoria',
+];
+const LAST_NAMES = [
+  'Smith', 'Johnson', 'Williams', 'Brown', 'Jones', 'Garcia', 'Miller', 'Davis',
+  'Rodriguez', 'Martinez', 'Hernandez', 'Lopez', 'Gonzalez', 'Wilson', 'Anderson',
+  'Thomas', 'Taylor', 'Moore', 'Jackson', 'Martin', 'Lee', 'Perez', 'Thompson',
+  'White', 'Harris', 'Sanchez', 'Clark', 'Ramirez', 'Lewis', 'Robinson', 'Walker',
+  'Young', 'Allen', 'King', 'Wright', 'Scott', 'Torres', 'Hill', 'Green',
+  'Adams', 'Baker', 'Nelson', 'Carter', 'Mitchell', 'Roberts', 'Turner',
+  'Phillips', 'Campbell', 'Parker', 'Evans',
+];
+
+export function randomFullName() {
+  return `${pick(FIRST_NAMES)} ${pick(LAST_NAMES)}`;
+}
+
+// 成年生日：约 18~48 岁均匀取样，月/日在安全范围（1~28）避免非法日期，格式 YYYY-MM-DD 与旧逻辑一致。
+export function randomAdultBirthdate() {
+  const nowYear = new Date().getUTCFullYear();
+  const age = 18 + crypto.randomInt(0, 31); // 18..48
+  const year = nowYear - age;
+  const month = 1 + crypto.randomInt(0, 12);
+  const day = 1 + crypto.randomInt(0, 28);
+  return `${year}-${String(month).padStart(2, '0')}-${String(day).padStart(2, '0')}`;
+}
diff --git a/account-manager/node/get-rt.js b/account-manager/node/get-rt.js
new file mode 100644
index 0000000..acd9f10
--- /dev/null
+++ b/account-manager/node/get-rt.js
@@ -0,0 +1,1230 @@
+// 拿 RT —— 纯 HTTP 复刻 OpenAI Codex OAuth 授权流程以换取 refresh_token
+// 参考实现：https://github.com/Ttungx/codex_auto_register （codex/protocol_keygen.py）
+//
+// 这些账号没有 OpenAI 密码 → 使用「无密码 / 邮箱验证码」登录（passwordless），不提交任何密码。
+// 复刻的关键步骤（零浏览器，全部走 fetch）：
+//   步骤1  GET  /oauth/authorize                     → 拿 login_session cookie（PKCE + state）
+//   步骤2  POST /api/accounts/authorize/continue      → 提交邮箱（需 openai-sentinel-token）
+//   步骤3  GET  /api/accounts/email-otp/send          → 触发发送邮箱登录验证码（无需 sentinel）
+//   步骤4  从账号自己的 Outlook 邮箱收取验证码 → POST /api/accounts/email-otp/validate 提交
+//   步骤4.5 （可选）手机验证：使用 smscode.gg 拿号 + 收码（当前 OpenAI 流程通常不触发，见文末说明）
+//   步骤5  consent：GET 授权页 → POST /api/accounts/workspace/select
+//          → GET /api/oauth/oauth2/auth(+login_verifier) → /api/accounts/consent?consent_challenge=
+//          → oauth2/auth(+consent_verifier) → ?code=（必要时中间再 organization/select）
+//   步骤6  POST /oauth/token                          → 换取 access_token / refresh_token
+//
+// 反爬 Sentinel PoW：sentinel.openai.com 的 openai-sentinel-token 由逆向的 FNV-1a PoW 生成。
+// 注意：官方仓库 V1 已标注“因 API 变更弃用”，Sentinel 算法/端点会被 OpenAI 轮换，
+// 因此对线上端点该 token 可能被拒；每一步 HTTP 状态都会记录，便于观察失败点。
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+// 【回归修复 2026-07-28】本文件必须使用与 Node 内置全局 fetch 版本一致的 undici：
+// - 项目为配合 probe.js 的 TLS 改造，把顶层依赖 `undici` 升到了 ^8.9.0（远新于当前
+//   Node 运行时内置的 7.21.0）。用这个新版 undici 自带的 fetch/ProxyAgent 直接请求
+//   auth.openai.com 会被 Cloudflare 判定为非常规客户端指纹，稳定返回 403（已用
+//   tls.peet.ws 同类手法实测复现：undici@8.9.0 直连/走代理均 403，Node 内置全局
+//   fetch 与 undici@7.21.0 均为 302 正常）——这正是本轮"拿 RT 出现 403"回归的根因。
+// - 同时不能直接把 Node 全局 fetch 和顶层 undici@8.9.0 的 ProxyAgent 混用，两者内部
+//   undici 版本不一致会抛 "invalid onRequestStart method"（历史"代理路径报错"正是
+//   这个）。
+// 解法：单独钉死一份与 Node 内置版本完全一致的 undici（别名 undici-legacy，
+// package.json 里 `"undici-legacy": "npm:undici@=7.21.0"`），只在本文件（拿 RT /
+// 接码链路）使用，与 probe.js 的 undici@8.9.0（提链/TLS 改造）互不影响，也不使用
+// setGlobalDispatcher，无任何全局副作用。
+import { fetch as undiciFetch, ProxyAgent as UndiciProxyAgent } from 'undici-legacy';
+import { generateFingerprint, randomFullName, randomAdultBirthdate } from './fingerprint.js';
+import { fetchPlusInbox, extractCode } from './plus-mailbox.js';
+import * as smscode from './smscode.js';
+import * as smsbower from './smsbower.js';
+import * as herosms from './hero-sms.js';
+
+const OAUTH_ISSUER = 'https://auth.openai.com';
+const OAUTH_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+const OAUTH_REDIRECT_URI = 'http://localhost:1455/auth/callback';
+const OAUTH_SCOPE = 'openid profile email offline_access';
+const SENTINEL_REQ_URL = 'https://sentinel.openai.com/backend-api/sentinel/req';
+
+// 仅作兜底默认值：正常路径下每个账号会用 generateFingerprint() 产生独立自洽的 UA，
+// 全程透传（见 runGetRefreshToken）。此常量只在极少数未持有 fp 的独立调用里用到。
+const USER_AGENT =
+  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36';
+
+// ==================== Sentinel PoW（逆向自 sentinel SDK） ====================
+function fnv1a32(text) {
+  let h = 2166136261 >>> 0;
+  for (let i = 0; i < text.length; i++) {
+    h ^= text.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  h ^= h >>> 16;
+  h = Math.imul(h, 2246822507) >>> 0;
+  h ^= h >>> 13;
+  h = Math.imul(h, 3266489909) >>> 0;
+  h ^= h >>> 16;
+  return (h >>> 0).toString(16).padStart(8, '0');
+}
+
+class SentinelTokenGenerator {
+  // fp：本账号的指纹对象（generateFingerprint()）；缺省时退回写死默认值，保证向后兼容。
+  constructor(deviceId, fp) {
+    this.deviceId = deviceId || crypto.randomUUID();
+    this.sid = crypto.randomUUID();
+    this.fp = fp || null;
+    this.MAX_ATTEMPTS = 500000;
+  }
+  _getConfig() {
+    const now = new Date();
+    const dateStr = now.toUTCString().replace('GMT', 'GMT+0000 (Coordinated Universal Time)');
+    const navProps = ['vendorSub', 'productSub', 'vendor', 'maxTouchPoints', 'scheduling', 'userActivation', 'doNotTrack', 'plugins', 'mimeTypes', 'hardwareConcurrency', 'cookieEnabled', 'mediaDevices', 'permissions', 'locks'];
+    const navProp = navProps[Math.floor(Math.random() * navProps.length)];
+    const perfNow = 1000 + Math.random() * 49000;
+    // 指纹关键字段（屏幕/UA/语言/并发数）改由 fp 提供，使 sentinel PoW 里携带的浏览器画像
+    // 与 HTTP 头、jsdom turnstile 解算保持同一套，跨账号各不相同。
+    const fp = this.fp;
+    return [
+      fp ? fp.screenStr : '1920x1080',
+      dateStr,
+      4294705152,
+      Math.random(),
+      fp ? fp.userAgent : USER_AGENT,
+      'https://sentinel.openai.com/sentinel/20260124ceb8/sdk.js',
+      null,
+      null,
+      fp ? fp.language : 'en-US',
+      fp ? fp.languages : 'en-US,en',
+      Math.random(),
+      `${navProp}\u2212undefined`,
+      ['location', 'implementation', 'URL', 'documentURI', 'compatMode'][Math.floor(Math.random() * 5)],
+      ['Object', 'Function', 'Array', 'Number', 'parseFloat', 'undefined'][Math.floor(Math.random() * 6)],
+      perfNow,
+      this.sid,
+      '',
+      fp ? fp.hardwareConcurrency : [4, 8, 12, 16][Math.floor(Math.random() * 4)],
+      Date.now() - perfNow,
+    ];
+  }
+  _b64(cfg) {
+    return Buffer.from(JSON.stringify(cfg), 'utf8').toString('base64');
+  }
+  generateToken(seed, difficulty) {
+    seed = seed == null ? String(Math.random()) : seed;
+    difficulty = difficulty || '0';
+    const start = Date.now();
+    const cfg = this._getConfig();
+    for (let i = 0; i < this.MAX_ATTEMPTS; i++) {
+      cfg[3] = i;
+      cfg[9] = Math.round(Date.now() - start);
+      const data = this._b64(cfg);
+      const hex = fnv1a32(seed + data);
+      if (hex.slice(0, difficulty.length) <= difficulty) return 'gAAAAAB' + data + '~S';
+    }
+    return 'gAAAAAB' + this._b64(cfg) + '~S';
+  }
+  generateRequirementsToken() {
+    const cfg = this._getConfig();
+    cfg[3] = 1;
+    cfg[9] = Math.round(5 + Math.random() * 45);
+    return 'gAAAAAC' + this._b64(cfg);
+  }
+}
+
+async function buildSentinelToken(jar, deviceId, flow, proxy, fp) {
+  const gen = new SentinelTokenGenerator(deviceId, fp);
+  const pToken = gen.generateRequirementsToken();
+  let challenge;
+  try {
+    const res = await req('POST', SENTINEL_REQ_URL, {
+      jar,
+      proxy,
+      raw: JSON.stringify({ p: pToken, id: deviceId, flow }),
+      headers: sentinelReqHeaders(fp),
+    });
+    challenge = res.json();
+  } catch {
+    return null;
+  }
+  if (!challenge) return null;
+  const cValue = challenge.token || '';
+  const pow = challenge.proofofwork || {};
+  const pValue = pow.required && pow.seed ? gen.generateToken(pow.seed, pow.difficulty || '0') : gen.generateRequirementsToken();
+  return JSON.stringify({ p: pValue, t: '', c: cValue, id: deviceId, flow });
+}
+
+// ==================== Sentinel Turnstile VM（jsdom 求解 t / so） ====================
+// 登录/拿 RT 流程对空 t 宽容；但注册（user/register / create_account）严格校验 turnstile。
+// 复用 pay/ 下已部署的 sentinel_sdk_full.js + gen_token_jsdom.js（jsdom 跑真 SDK 的 VM），
+// 由 requirements token 作为 XOR key 解 dx，产出 t（turnstile）与 so（session-observer）。
+const _GET_RT_DIR = path.dirname(fileURLToPath(import.meta.url));
+const PAY_DIR = path.resolve(_GET_RT_DIR, '..', '..', 'pay');
+const GEN_TOKEN_JSDOM = path.join(PAY_DIR, 'gen_token_jsdom.js');
+
+function solveSentinelVm(chatReq, cachedProof, flow, deviceId, fp) {
+  return new Promise((resolve) => {
+    let tmp;
+    try {
+      tmp = path.join(os.tmpdir(), `sentinel_${crypto.randomUUID()}.json`);
+      // 把本账号指纹一并写入：gen_token_jsdom.js 会据此设置 jsdom 的 navigator/screen，
+      // 让 turnstile(t)/so 的求解环境与 p-token、HTTP 头用的是同一套画像。
+      fs.writeFileSync(tmp, JSON.stringify({ chatReq, flow, deviceId, cachedProof, fingerprint: fp || null }));
+    } catch {
+      resolve({ t: null, so: null });
+      return;
+    }
+    execFile(process.execPath, [GEN_TOKEN_JSDOM, tmp], { cwd: PAY_DIR, timeout: 30000, maxBuffer: 8 * 1024 * 1024 }, (err, stdout) => {
+      try { fs.unlinkSync(tmp); } catch { /* ignore */ }
+      if (err && !stdout) { resolve({ t: null, so: null }); return; }
+      const marker = '=== JSON_OUTPUT ===';
+      const idx = (stdout || '').indexOf(marker);
+      if (idx < 0) { resolve({ t: null, so: null }); return; }
+      try {
+        const data = JSON.parse(stdout.slice(idx + marker.length).trim());
+        resolve({ t: data && data.t ? data.t : null, so: data && data.so ? data.so : null });
+      } catch {
+        resolve({ t: null, so: null });
+      }
+    });
+  });
+}
+
+// 生成「完整」sentinel token（含 turnstile t）以及配套 so-token（会话观测），一次 /sentinel/req
+// 派生（challenge 单次有效，p/t/so 必须同源）。返回 { token: <json串>, so: <json串|null> }。
+async function buildSentinelBundle(jar, deviceId, flow, proxy, fp) {
+  const gen = new SentinelTokenGenerator(deviceId, fp);
+  const pToken = gen.generateRequirementsToken();
+  let challenge;
+  // /sentinel/req 走代理时偶发 fetch failed（代理 session 抖动）：重试 3 次再放弃。
+  for (let attempt = 1; attempt <= 3 && !challenge; attempt++) {
+    try {
+      const res = await req('POST', SENTINEL_REQ_URL, {
+        jar,
+        proxy,
+        raw: JSON.stringify({ p: pToken, id: deviceId, flow }),
+        headers: sentinelReqHeaders(fp),
+      });
+      challenge = res.json();
+    } catch (e) {
+      if (attempt >= 3) return { token: null, so: null, error: String((e && e.message) || e) };
+      await new Promise((r) => setTimeout(r, 800 * attempt));
+    }
+  }
+  if (!challenge) return { token: null, so: null };
+  const cValue = challenge.token || '';
+  const pow = challenge.proofofwork || {};
+  const pValue = pow.required && pow.seed ? gen.generateToken(pow.seed, pow.difficulty || '0') : gen.generateRequirementsToken();
+  const tokenObj = { p: pValue, c: cValue, id: deviceId, flow };
+  let soStr = null;
+  const turnstile = challenge.turnstile || {};
+  const soInfo = challenge.so || {};
+  if (turnstile.dx || soInfo.required) {
+    const vm = await solveSentinelVm(challenge, pToken, flow, deviceId, fp);
+    if (vm.t) tokenObj.t = vm.t;
+    if (vm.so && soInfo.required) soStr = JSON.stringify({ so: vm.so, c: cValue, id: deviceId, flow });
+  }
+  return { token: JSON.stringify(tokenObj), so: soStr };
+}
+
+// ==================== PKCE ====================
+function generatePkce() {
+  const verifier = crypto.randomBytes(64).toString('base64url');
+  const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+  return { verifier, challenge };
+}
+function datadogTrace() {
+  const traceId = String(BigInt('0x' + crypto.randomBytes(8).toString('hex')));
+  const parentId = String(BigInt('0x' + crypto.randomBytes(8).toString('hex')));
+  const traceHex = BigInt(traceId).toString(16).padStart(16, '0');
+  const parentHex = BigInt(parentId).toString(16).padStart(16, '0');
+  return {
+    traceparent: `00-0000000000000000${traceHex}-${parentHex}-01`,
+    tracestate: 'dd=s:1;o:rum',
+    'x-datadog-origin': 'rum',
+    'x-datadog-parent-id': parentId,
+    'x-datadog-sampling-priority': '1',
+    'x-datadog-trace-id': traceId,
+  };
+}
+
+// ==================== Cookie Jar + 手动重定向 fetch ====================
+class Jar {
+  constructor() { this.map = new Map(); }
+  ingest(res) {
+    let set = [];
+    if (typeof res.headers.getSetCookie === 'function') set = res.headers.getSetCookie();
+    else { const s = res.headers.get('set-cookie'); if (s) set = [s]; }
+    for (const line of set) {
+      const first = line.split(';')[0];
+      const eq = first.indexOf('=');
+      if (eq < 0) continue;
+      const name = first.slice(0, eq).trim();
+      const value = first.slice(eq + 1).trim();
+      if (name) this.map.set(name, value);
+    }
+  }
+  set(name, value) { this.map.set(name, value); }
+  header() { return Array.from(this.map.entries()).map(([k, v]) => `${k}=${v}`).join('; '); }
+}
+
+async function getProxyAgent(proxy) {
+  if (!proxy || !proxy.host || !proxy.port) return null;
+  const auth = proxy.username ? `${encodeURIComponent(proxy.username)}:${encodeURIComponent(proxy.password || '')}@` : '';
+  return new UndiciProxyAgent(`http://${auth}${proxy.host}:${proxy.port}`);
+}
+
+// 单次请求（不自动跟随重定向），带 cookie 注入/回收
+async function req(method, url, { jar, headers = {}, body, raw, proxy, timeoutMs = 30000 } = {}) {
+  const h = { ...headers };
+  if (jar) { const c = jar.header(); if (c) h.cookie = c; }
+  let payload;
+  if (raw !== undefined) payload = raw;
+  else if (body !== undefined) { payload = JSON.stringify(body); if (!h['content-type']) h['content-type'] = 'application/json'; }
+  const opts = { method, headers: h, body: payload, redirect: 'manual' };
+  const agent = await getProxyAgent(proxy);
+  if (agent) opts.dispatcher = agent;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  opts.signal = ctrl.signal;
+  let res;
+  try { res = await undiciFetch(url, opts); } finally { clearTimeout(timer); }
+  if (jar) jar.ingest(res);
+  const text = await res.text();
+  return {
+    status: res.status,
+    location: res.headers.get('location') || '',
+    headers: res.headers,
+    text,
+    json() { try { return JSON.parse(text); } catch { return {}; } },
+  };
+}
+
+// 跟随重定向链，直到拿到 redirect_uri?code= 或无法再跳。
+// 覆盖 Codex consent 实测链：
+//   oauth2/auth(+login_verifier) → /api/accounts/consent?consent_challenge=
+//   → oauth2/auth(+consent_verifier) → localhost:1455/auth/callback?code=
+// 也接受 JSON 体里的 continue_url / redirect_url（部分中间 API 会这样返回）。
+async function follow(url, { jar, headers, proxy, max = 15, log } = {}) {
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+  let current = url;
+  let last = null;
+  for (let i = 0; i < max; i++) {
+    if (current.startsWith(OAUTH_REDIRECT_URI) || (current.includes('code=') && /localhost:1455/i.test(current))) {
+      return { last, code: extractCodeFromUrl(current), location: current };
+    }
+    last = await req('GET', current, { jar, headers, proxy });
+    const loc = last.location ? absAuthUrl(last.location) : '';
+    say('info', `    follow[${i}] ${last.status} ${(current.length > 120 ? current.slice(0, 120) + '…' : current)}`);
+    if (loc && (loc.includes('code=') || loc.startsWith(OAUTH_REDIRECT_URI))) {
+      return { last, code: extractCodeFromUrl(loc), location: loc };
+    }
+    if (last.status >= 300 && last.status < 400 && loc) {
+      current = loc;
+      continue;
+    }
+    // 200 JSON 里也可能带下一跳（consent / oauth 中间态）
+    if (last.status === 200) {
+      const next = pickContinueUrl(last.json());
+      if (next) {
+        const abs = absAuthUrl(next);
+        if (abs.includes('code=') || abs.startsWith(OAUTH_REDIRECT_URI)) {
+          return { last, code: extractCodeFromUrl(abs), location: abs };
+        }
+        if (abs !== current) {
+          current = abs;
+          continue;
+        }
+      }
+    }
+    break;
+  }
+  return { last, code: extractCodeFromUrl(current), location: current };
+}
+
+function extractCodeFromUrl(url) {
+  if (!url || !url.includes('code=')) return null;
+  try { return new URL(url, OAUTH_ISSUER).searchParams.get('code'); } catch { return null; }
+}
+
+function absAuthUrl(url) {
+  if (!url) return '';
+  if (url.startsWith('http://') || url.startsWith('https://')) return url;
+  return `${OAUTH_ISSUER}${url.startsWith('/') ? url : `/${url}`}`;
+}
+
+function pickContinueUrl(obj) {
+  if (!obj || typeof obj !== 'object') return '';
+  for (const key of ['continue_url', 'redirect_url', 'url', 'continueUrl', 'redirectUrl']) {
+    const v = obj[key];
+    if (typeof v === 'string' && v) return v;
+  }
+  const data = obj.data;
+  if (data && typeof data === 'object') {
+    for (const key of ['continue_url', 'redirect_url', 'url', 'continueUrl', 'redirectUrl']) {
+      const v = data[key];
+      if (typeof v === 'string' && v) return v;
+    }
+  }
+  return '';
+}
+
+// Flask 签名 cookie：<b64url_payload>.<ts>.<sig> —— 只解 payload
+function decodeSignedCookiePayload(raw) {
+  if (!raw) return null;
+  let val = String(raw).trim();
+  try { val = decodeURIComponent(val); } catch { /* keep raw */ }
+  if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+    val = val.slice(1, -1);
+  }
+  const part = val.includes('.') ? val.split('.')[0] : val;
+  const pad = '='.repeat((4 - (part.length % 4)) % 4);
+  try {
+    const json = Buffer.from(part + pad, 'base64url').toString('utf8');
+    const data = JSON.parse(json);
+    return data && typeof data === 'object' ? data : null;
+  } catch {
+    try {
+      const json = Buffer.from(part + pad, 'base64').toString('utf8');
+      const data = JSON.parse(json);
+      return data && typeof data === 'object' ? data : null;
+    } catch {
+      return null;
+    }
+  }
+}
+
+function extractWorkspaceIdFromJar(jar) {
+  for (const [name, value] of jar.map.entries()) {
+    if (!String(name).includes('oai-client-auth-session')) continue;
+    const data = decodeSignedCookiePayload(value);
+    if (!data) continue;
+    const workspaces = data.workspaces || (data.client_auth_session && data.client_auth_session.workspaces) || [];
+    if (Array.isArray(workspaces) && workspaces[0] && workspaces[0].id) {
+      return String(workspaces[0].id);
+    }
+  }
+  return '';
+}
+
+function extractLoginVerifierFromJar(jar) {
+  const ls = jar.map.get('login_session');
+  if (!ls) return '';
+  const data = decodeSignedCookiePayload(ls);
+  if (!data) return '';
+  return String(data.login_challenge || data.login_verifier || '');
+}
+
+function pickOrgsFromWorkspaceBody(body) {
+  if (!body || typeof body !== 'object') return [];
+  const fromData = body.data && Array.isArray(body.data.orgs) ? body.data.orgs : null;
+  const fromTop = Array.isArray(body.orgs) ? body.orgs : null;
+  const list = fromData || fromTop || [];
+  return list.filter((o) => o && typeof o === 'object');
+}
+
+function pickPersonalOrFirstOrg(orgs) {
+  if (!orgs || !orgs.length) return null;
+  const personal = orgs.find((o) => String(o.kind || '').toLowerCase() === 'personal');
+  return personal || orgs[0];
+}
+
+// Codex consent 真正的“Authorize”动作（对照 chromewebdata.har / auth.openai.com.har）：
+//   1) GET consent 页（刷新 oai-client-auth-session）
+//   2) POST /api/accounts/workspace/select { workspace_id }
+//   3) （若需）POST /api/accounts/organization/select { org_id, project_id? }
+//   4) GET /api/oauth/oauth2/auth?...&login_verifier=…
+//        → 302 /api/accounts/consent?consent_challenge=…
+//        → 302 oauth2/auth?...&consent_verifier=…
+//        → 303 localhost:1455/auth/callback?code=
+// 注意：步骤 4 是浏览器前端在 workspace/select 之后必走的；不能只靠 GET consent HTML。
+async function submitConsentAndExtractCode({ jar, deviceId, proxy, consentUrl, challenge, state, fp }, { log } = {}) {
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+  const consentReferer = consentUrl.includes('/consent')
+    ? consentUrl
+    : `${OAUTH_ISSUER}/sign-in-with-chatgpt/codex/consent`;
+
+  const cookieNames = [...jar.map.keys()];
+  say('info', `  cookies：has_session=${cookieNames.includes('oai-client-auth-session') ? 'Y' : 'N'} login_session=${cookieNames.includes('login_session') ? 'Y' : 'N'} total=${cookieNames.length}`);
+
+  // 1) GET consent HTML —— 可能已带 code（少见），并刷新 session cookie
+  say('info', `  GET consent 页：${consentUrl.slice(0, 100)}`);
+  const stepGet = await follow(consentUrl, {
+    jar,
+    headers: { ...navHeaders(fp), referer: `${OAUTH_ISSUER}/` },
+    proxy,
+    log: say,
+  });
+  if (stepGet.code) {
+    say('ok', '  consent GET 重定向链已直接给出 authorization code');
+    return stepGet.code;
+  }
+  say('info', `  consent GET 未直接给 code（停在 ${String(stepGet.location || '').slice(0, 120)}）`);
+
+  // 2) 取 workspace_id：cookie 优先，否则 session_dump
+  let workspaceId = extractWorkspaceIdFromJar(jar);
+  let workspaceSrc = workspaceId ? 'cookie' : '';
+  if (!workspaceId) {
+    say('info', '  cookie 无 workspace_id，尝试 GET /api/accounts/client_auth_session_dump');
+    const dump = await req('GET', `${OAUTH_ISSUER}/api/accounts/client_auth_session_dump`, {
+      jar, proxy,
+      headers: {
+        accept: 'application/json',
+        'user-agent': fp ? fp.userAgent : USER_AGENT,
+        ...(fp ? { 'sec-ch-ua': fp.secChUa, 'sec-ch-ua-mobile': fp.secChUaMobile, 'sec-ch-ua-platform': fp.secChUaPlatform } : {}),
+        referer: `${OAUTH_ISSUER}/email-verification`,
+        'oai-device-id': deviceId,
+      },
+    });
+    say('info', `  session_dump 状态：${dump.status} body=${dump.text.slice(0, 160)}`);
+    const dj = dump.json();
+    const workspaces = dj.workspaces
+      || (dj.client_auth_session && dj.client_auth_session.workspaces)
+      || [];
+    if (Array.isArray(workspaces) && workspaces[0] && workspaces[0].id) {
+      workspaceId = String(workspaces[0].id);
+      workspaceSrc = 'session_dump';
+    }
+    if (!workspaceId) {
+      workspaceId = extractWorkspaceIdFromJar(jar);
+      if (workspaceId) workspaceSrc = 'cookie-after-dump';
+    }
+  }
+  say('info', `  workspace_id=${workspaceId ? workspaceId.slice(0, 8) + '…' : '(无)'} source=${workspaceSrc || '(none)'}`);
+
+  let authCode = null;
+  let lastHint = stepGet.location || consentUrl;
+
+  if (workspaceId) {
+    say('info', `  POST /api/accounts/workspace/select（workspace_id=${workspaceId.slice(0, 8)}…）`);
+    const rws = await req('POST', `${OAUTH_ISSUER}/api/accounts/workspace/select`, {
+      jar, proxy,
+      headers: apiHeaders(fp, deviceId, consentReferer),
+      body: { workspace_id: workspaceId },
+    });
+    say('info', `  workspace/select 状态：${rws.status} loc=${(rws.location || '(无)').slice(0, 120)} body=${rws.text.slice(0, 200)}`);
+
+    if (rws.status >= 300 && rws.status < 400 && rws.location) {
+      const loc = absAuthUrl(rws.location);
+      lastHint = loc;
+      authCode = extractCodeFromUrl(loc);
+      if (!authCode) {
+        const followed = await follow(loc, {
+          jar, headers: { ...navHeaders(fp), referer: consentReferer }, proxy, log: say,
+        });
+        authCode = followed.code;
+        lastHint = followed.location || lastHint;
+      }
+    } else if (rws.status === 200 || rws.status === 201 || rws.status === 204) {
+      const wsBody = rws.json();
+      const wsNext = pickContinueUrl(wsBody);
+      const orgs = pickOrgsFromWorkspaceBody(wsBody);
+      const pageType = (wsBody.page && wsBody.page.type) || '';
+      say('info', `  workspace/select page.type=${pageType || '(空)'} continue_url=${(wsNext || '(空)').slice(0, 120)} orgs=${orgs.length}`);
+
+      authCode = extractCodeFromUrl(wsNext);
+      if (!authCode && wsNext && (wsNext.startsWith(OAUTH_REDIRECT_URI) || wsNext.includes('code='))) {
+        authCode = extractCodeFromUrl(absAuthUrl(wsNext));
+      }
+
+      // 需要选 organization（Codex 多 org / personal）
+      const needOrg = !authCode && (
+        orgs.length > 0
+        || /\/codex\/organization/i.test(wsNext)
+        || pageType === 'organization_select'
+        || pageType === 'organization'
+      );
+      if (needOrg) {
+        const org = pickPersonalOrFirstOrg(orgs);
+        if (!org || !org.id) {
+          say('warn', '  需要 organization/select 但未拿到 org_id');
+        } else {
+          const orgBody = { org_id: String(org.id) };
+          const projects = Array.isArray(org.projects) ? org.projects : [];
+          if (projects[0] && projects[0].id) orgBody.project_id = String(projects[0].id);
+          else if (org.default_project_id) orgBody.project_id = String(org.default_project_id);
+          else if (org.project_id) orgBody.project_id = String(org.project_id);
+          const orgReferer = wsNext ? absAuthUrl(wsNext) : consentReferer;
+          if (wsNext && /\/codex\/organization/i.test(wsNext)) {
+            await req('GET', absAuthUrl(wsNext), {
+              jar, proxy, headers: { ...navHeaders(fp), referer: consentReferer },
+            }).catch(() => {});
+          }
+          say('info', `  POST /api/accounts/organization/select body=${JSON.stringify(orgBody)}`);
+          const rorg = await req('POST', `${OAUTH_ISSUER}/api/accounts/organization/select`, {
+            jar, proxy,
+            headers: apiHeaders(fp, deviceId, orgReferer),
+            body: orgBody,
+          });
+          say('info', `  organization/select 状态：${rorg.status} loc=${(rorg.location || '(无)').slice(0, 120)} body=${rorg.text.slice(0, 200)}`);
+          if (rorg.status >= 300 && rorg.status < 400 && rorg.location) {
+            const loc = absAuthUrl(rorg.location);
+            lastHint = loc;
+            authCode = extractCodeFromUrl(loc);
+            if (!authCode) {
+              const followed = await follow(loc, {
+                jar, headers: { ...navHeaders(fp), referer: orgReferer }, proxy, log: say,
+              });
+              authCode = followed.code;
+              lastHint = followed.location || lastHint;
+            }
+          } else if (rorg.status === 200 || rorg.status === 201) {
+            const orgNext = pickContinueUrl(rorg.json());
+            authCode = extractCodeFromUrl(orgNext);
+            if (!authCode && orgNext) {
+              const followed = await follow(absAuthUrl(orgNext), {
+                jar, headers: { ...navHeaders(fp), referer: orgReferer }, proxy, log: say,
+              });
+              authCode = followed.code;
+              lastHint = followed.location || lastHint;
+            }
+          } else {
+            say('warn', `  organization/select 失败：${rorg.text.slice(0, 160)}`);
+          }
+        }
+      }
+
+      if (!authCode && wsNext) {
+        const followed = await follow(absAuthUrl(wsNext), {
+          jar, headers: { ...navHeaders(fp), referer: consentReferer }, proxy, log: say,
+        });
+        authCode = followed.code;
+        lastHint = followed.location || lastHint;
+      }
+    } else {
+      say('warn', `  workspace/select 失败：${rws.text.slice(0, 160)}`);
+    }
+  } else {
+    say('warn', '  未找到 workspace_id，将直接尝试 oauth2/auth（login_verifier）');
+  }
+
+  // 3) HAR 主路径：workspace/select 之后必须 chase oauth2/auth(+login_verifier)
+  //    → /api/accounts/consent?consent_challenge= → consent_verifier → ?code=
+  if (!authCode && challenge && state) {
+    const loginVerifier = extractLoginVerifierFromJar(jar);
+    const params = {
+      client_id: OAUTH_CLIENT_ID,
+      code_challenge: challenge,
+      code_challenge_method: 'S256',
+      codex_cli_simplified_flow: 'true',
+      id_token_add_organizations: 'true',
+      redirect_uri: OAUTH_REDIRECT_URI,
+      response_type: 'code',
+      scope: OAUTH_SCOPE,
+      state,
+    };
+    if (loginVerifier) {
+      params.login_verifier = loginVerifier;
+      say('info', `  GET /api/oauth/oauth2/auth（login_verifier=${loginVerifier.slice(0, 12)}…）`);
+    } else {
+      params.prompt = 'login';
+      say('info', '  GET /api/oauth/oauth2/auth（无 login_verifier，带 prompt=login）');
+    }
+    const oauth2Url = `${OAUTH_ISSUER}/api/oauth/oauth2/auth?${new URLSearchParams(params)}`;
+    const followed = await follow(oauth2Url, {
+      jar, headers: { ...navHeaders(fp), referer: consentReferer }, proxy, max: 15, log: say,
+    });
+    authCode = followed.code;
+    lastHint = followed.location || lastHint;
+    if (authCode) {
+      say('ok', `  oauth2/auth 链提取到 code（经 consent_challenge 完成授权）`);
+    } else {
+      say('warn', `  oauth2/auth 链未拿到 code（停在 ${String(lastHint).slice(0, 140)}）`);
+    }
+  }
+
+  if (!authCode) {
+    say('error', `  consent 最终失败，最后 URL：${String(lastHint).slice(0, 200)}`);
+  }
+  return authCode;
+}
+
+// 导航（HTML）请求头：UA / accept-language / sec-ch-ua 全部取自本账号指纹并保持一致，
+// 真实 Chrome 在导航请求也会带这几个 client-hint，缺失或与 UA 矛盾本身就是特征。
+function navHeaders(fp) {
+  return {
+    accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
+    'accept-language': fp ? fp.acceptLanguage : 'en-US,en;q=0.9',
+    'user-agent': fp ? fp.userAgent : USER_AGENT,
+    ...(fp ? { 'sec-ch-ua': fp.secChUa, 'sec-ch-ua-mobile': fp.secChUaMobile, 'sec-ch-ua-platform': fp.secChUaPlatform } : {}),
+    'upgrade-insecure-requests': '1',
+  };
+}
+// XHR/JSON 请求头：同理，sec-ch-ua 三件套必须与 UA/平台自洽。
+function apiHeaders(fp, deviceId, referer) {
+  return {
+    accept: 'application/json',
+    'accept-language': fp ? fp.acceptLanguage : 'en-US,en;q=0.9',
+    'content-type': 'application/json',
+    origin: OAUTH_ISSUER,
+    referer,
+    'user-agent': fp ? fp.userAgent : USER_AGENT,
+    ...(fp ? { 'sec-ch-ua': fp.secChUa, 'sec-ch-ua-mobile': fp.secChUaMobile, 'sec-ch-ua-platform': fp.secChUaPlatform } : {}),
+    'oai-device-id': deviceId,
+    ...datadogTrace(),
+  };
+}
+// sentinel/req 的头：UA 也跟随账号指纹，保持与 p-token 内 UA 一致。
+function sentinelReqHeaders(fp) {
+  return {
+    'content-type': 'text/plain;charset=UTF-8',
+    referer: 'https://sentinel.openai.com/backend-api/sentinel/frame.html',
+    origin: 'https://sentinel.openai.com',
+    'user-agent': fp ? fp.userAgent : USER_AGENT,
+    ...(fp ? { 'sec-ch-ua': fp.secChUa, 'sec-ch-ua-mobile': fp.secChUaMobile, 'sec-ch-ua-platform': fp.secChUaPlatform } : {}),
+  };
+}
+
+// ==================== 从微软邮箱轮询读取 OTP ====================
+// 稳健解析邮件收件时间：Graph=ISO8601，IMAP=RFC2822 Date 头，均可被 Date.parse 处理。
+function parseReceivedTs(m) {
+  const raw = m && m.received_at;
+  if (!raw) return 0;
+  const t = Date.parse(raw);
+  return Number.isNaN(t) ? 0 : t;
+}
+// OTP 邮件打分：OpenAI 每次会同时发「login code」和「verification code」两封，
+// 而 OAuth 的 email_otp_verification 步骤要的是「verification code」那封；
+// 分数越高越优先。0 表示不像 OpenAI 验证码邮件。
+function scoreOtpEmail(m) {
+  const from = ((m && m.from_addr) || '').toLowerCase();
+  const subj = ((m && m.subject) || '').toLowerCase();
+  const isOpenAi = /openai\.com|openai|chatgpt/.test(from) || /openai|chatgpt/.test(subj);
+  if (!isOpenAi) return 0;
+  if (/verification code/.test(subj)) return 4; // 最匹配 email-otp/validate
+  if (/verification/.test(subj)) return 3;
+  if (/login code/.test(subj)) return 2;         // 无密码登录码，非本步骤
+  if (/\bcode\b/.test(subj)) return 1;
+  return 1;
+}
+// 轮询账号自己的 Outlook 收件箱，只接受“新鲜”（在触发发送之后到达）的验证码，
+// 优先 OpenAI/ChatGPT 登录邮件；找不到新鲜码则超时报错，绝不提交旧码。
+// baselineTs：调用 email-otp/send 之前记录的时间戳(ms)；sinceSkewMs：允许的时钟偏差。
+async function waitEmailOtp(account, { timeoutMs = 180000, intervalMs = 4000, baselineTs = 0, sinceSkewMs = 90000, log, fetchInbox } = {}) {
+  const readInbox = fetchInbox || ((acc, limit) => fetchPlusInbox(acc, limit));
+  const start = Date.now();
+  const threshold = baselineTs ? baselineTs - sinceSkewMs : 0;
+  if (threshold) log && log('info', `仅接受收件时间 ≥ ${new Date(threshold).toISOString()} 的验证码`);
+  let attempt = 0;
+  let lateFallback = null; // 泛化 "code" 邮件（score=1，非 login/verification），仅超时前兜底
+  while (Date.now() - start < timeoutMs) {
+    attempt++;
+    try {
+      const { messages } = await readInbox(account, 15);
+      // 收集所有“新鲜且含验证码”的候选，按 (打分, 收件时间) 取最优
+      const candidates = [];
+      for (const m of messages || []) {
+        const ts = parseReceivedTs(m);
+        const fresh = !threshold || ts >= threshold;
+        const code = m.extracted_code || extractCode(`${m.subject || ''} ${m.body || m.snippet || ''}`);
+        if (!code || !fresh) continue;
+        candidates.push({ code, m, ts, score: scoreOtpEmail(m) });
+      }
+      // OpenAI 每次会同时发 login code(score=2) 和 verification code(score>=3)，
+      // 而 email-otp/validate 只认 verification code（login code 提交必 401）。
+      // 因此只在拿到 verification（score>=3）时立即返回；否则继续等待它到达。
+      const verif = candidates
+        .filter((c) => c.score >= 3)
+        .sort((a, b) => (b.score - a.score) || (b.ts - a.ts))[0];
+      if (verif) {
+        log && log('ok', `第 ${attempt} 次查收：命中新鲜 verification 验证码 ${verif.code}（${verif.m.from_addr || '?'} / “${verif.m.subject || ''}” / ${verif.m.received_at || '?'}）`);
+        return verif.code;
+      }
+      // 记录泛化兜底（既非 login 也非 verification 的 code 邮件）
+      const generic = candidates.filter((c) => c.score === 1).sort((a, b) => b.ts - a.ts)[0];
+      if (generic && !lateFallback) lateFallback = generic;
+      const sawLogin = candidates.some((c) => c.score === 2);
+      log && log('info', `第 ${attempt} 次查收：${sawLogin ? '仅见到 login code，' : ''}等待 verification 验证码，${Math.round(intervalMs / 1000)}s 后重试…`);
+    } catch (e) {
+      log && log('warn', `第 ${attempt} 次查收失败（将重试）：${e.message}`);
+    }
+    await sleep(intervalMs);
+  }
+  if (lateFallback) {
+    log && log('warn', `超时前使用兜底验证码 ${lateFallback.code}（${lateFallback.m.subject || ''}）`);
+    return lateFallback.code;
+  }
+  return null;
+}
+function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
+
+// ==================== 手机验证（add-phone：由我们提供号码，OpenAI 下发短信） ====================
+// 把 smscode 返回的号码规整为 E.164（如 919330904913 → +919330904913）。
+function formatE164(phone) {
+  const digits = String(phone || '').replace(/[^\d]/g, '');
+  return digits ? `+${digits}` : '';
+}
+
+// 取消订单以退款；未满 2 分钟(CANCEL_TOO_EARLY)则交由到期自动退款，不阻塞。mod 为选中的接码模块。
+async function safeCancel(mod, cfg, orderId, say) {
+  if (orderId == null) return;
+  try {
+    const r = await mod.cancelOrder(cfg, orderId, { log: (l, m) => say(l, m) });
+    if (r && r.earlyCancelDenied) {
+      say('info', `订单 ${orderId} 未满 2 分钟暂不能取消（EARLY_CANCEL_DENIED），将到期自动退款`);
+    } else {
+      say('info', `已取消订单 ${orderId}（退款）`);
+    }
+  } catch (e) {
+    const msg = String(e && e.message || e);
+    if (String(e.code) === 'CANCEL_TOO_EARLY' || /EARLY_CANCEL_DENIED|CANCEL_TOO_EARLY/i.test(msg)) {
+      say('info', `订单 ${orderId} 未满 2 分钟暂不能取消，将到期自动退款`);
+    } else {
+      say('warn', `取消订单 ${orderId} 失败：${msg}`);
+    }
+  }
+}
+
+// 手机验证主逻辑（带换号重试）：按 settings.sms.provider 选 smscode/smsbower/herosms 模块，
+// 拿号 → 提交号码让 OpenAI 发短信 → 轮询接码平台收码 → 提交校验。
+// 失败/超时则取消当前号并换新号重试，最多 MAX 次。成功返回新的 continue_url。
+// 端点（已据真实浏览器 HAR 校正并实测）：
+//   发送：POST /api/accounts/add-phone/send      body { phone_number, channel }  referer /add-phone
+//       —— 真实浏览器必带 channel（"sms"|"whatsapp"）；缺 channel 时 OpenAI 可能默认走 WhatsApp，
+//          导致接码平台的手机号永远收不到短信（历史 200 却无码的根因）。此处强制 channel="sms"。
+//   校验：POST /api/accounts/phone-otp/validate  body { code }           referer /phone-verification
+// 无需 sentinel（与 email-otp 一致，HAR 确认 add-phone/validate 均不带 sentinel-token）。
+// 多国择优（测试用）：cfg.countryCandidates = [{id,name,price}] 或 [id,...]，每次换一个国家拿号。
+async function verifyPhoneWithSms({ jar, deviceId, proxy, sms, startPageUrl, fp }, { log } = {}) {
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+  // 按 provider 选择接码模块与其专属配置；pollTimeout 为各平台共享
+  const MODS = { smscode, smsbower, herosms };
+  const LABELS = { smscode: 'smscode.gg', smsbower: 'smsbower.app', herosms: 'hero-sms.com' };
+  const provider = (sms && MODS[sms.provider]) ? sms.provider : 'smscode';
+  const mod = MODS[provider];
+  const cfg = (sms && sms[provider]) || {};
+  const label = LABELS[provider];
+  if (!cfg.apiKey) throw new Error(`流程要求手机验证，但未配置接码 API Key（${label}）`);
+  say('info', `手机验证：使用接码平台 ${label}`);
+  const channel = cfg.channel || 'sms'; // add-phone/send 的投递渠道；接码收短信必须 sms
+  // 多国候选：有则按候选逐个换国家拿号，否则用单一 cfg.country/countryId
+  const candRaw = Array.isArray(cfg.countryCandidates) ? cfg.countryCandidates : null;
+  const candidates = (candRaw && candRaw.length)
+    ? candRaw.map((c) => (c && typeof c === 'object' ? c : { id: c }))
+    : null;
+  const MAX = candidates ? candidates.length : Math.max(1, Number(sms.maxAttempts) || 3);
+  const perAttemptTimeout = Math.max(Number(sms.pollTimeout) || 0, 120000); // 短信可能 30~90s，单次至少等 120s
+  let lastErr = null;
+
+  // 先访问 add-phone / select-channel 页以对齐后续 cookie（失败可忽略）
+  await req('GET', startPageUrl, {
+    jar, proxy, headers: { ...navHeaders(fp), referer: `${OAUTH_ISSUER}/email-verification` },
+  }).catch(() => {});
+
+  for (let attempt = 1; attempt <= MAX; attempt++) {
+    let orderId = null;
+    // 本次尝试所用配置：多国候选时覆盖 country/countryId
+    let attemptCfg = cfg;
+    if (candidates) {
+      const c = candidates[attempt - 1];
+      attemptCfg = { ...cfg, country: c.id, countryId: c.id };
+      say('info', `第 ${attempt}/${MAX} 次：国家 ${c.name || c.id}（id=${c.id}${c.price != null ? `, 价${c.price}` : ''}${c.stock != null ? `, 库存${c.stock}` : ''}）`);
+    }
+    try {
+      say('info', `第 ${attempt}/${MAX} 次：通过 ${label} 拿号…`);
+      const acq = await mod.acquireNumber(attemptCfg, { log: (l, m) => say(l, '  ' + m) });
+      orderId = acq.orderId;
+      const e164 = formatE164(acq.phone);
+
+      say('info', `提交手机号 ${e164}（channel=${channel}）→ POST /api/accounts/add-phone/send`);
+      const rsend = await req('POST', `${OAUTH_ISSUER}/api/accounts/add-phone/send`, {
+        jar, proxy, headers: apiHeaders(fp, deviceId, `${OAUTH_ISSUER}/add-phone`), body: { phone_number: e164, channel },
+      });
+      say('info', `add-phone/send 状态：${rsend.status}`);
+      if (rsend.status >= 400) throw new Error(`OpenAI 拒绝手机号：HTTP ${rsend.status} ${rsend.text.slice(0, 160)}`);
+
+      say('info', `等待短信验证码（最长 ${Math.round(perAttemptTimeout / 1000)}s）…`);
+      const otp = await mod.pollOtp(attemptCfg, orderId, { timeoutMs: perAttemptTimeout, log: (l, m) => say(l, '  ' + m) });
+
+      say('info', `提交短信验证码 → POST /api/accounts/phone-otp/validate`);
+      const rval = await req('POST', `${OAUTH_ISSUER}/api/accounts/phone-otp/validate`, {
+        jar, proxy, headers: apiHeaders(fp, deviceId, `${OAUTH_ISSUER}/phone-verification`), body: { code: otp.code },
+      });
+      say('info', `phone-otp/validate 状态：${rval.status}`);
+      if (rval.status !== 200) throw new Error(`短信验证码校验失败：HTTP ${rval.status} ${rval.text.slice(0, 120)}`);
+
+      await mod.finishOrder(attemptCfg, orderId).catch(() => {});
+      say('ok', '手机验证完成');
+      const dv = rval.json();
+      return dv.continue_url || '';
+    } catch (e) {
+      lastErr = e;
+      const msg = String(e && e.message || e);
+      say('warn', `第 ${attempt}/${MAX} 次手机验证失败：${msg}`);
+      await safeCancel(mod, attemptCfg, orderId, say);
+      // 账号已停用：再换号也无意义，立刻停，避免白烧号码
+      if (/deleted or deactivated/i.test(msg) || (/\b403\b/.test(msg) && /deactivated/i.test(msg))) {
+        throw new Error(`账号已停用，停止手机重试：${msg.slice(0, 160)}`);
+      }
+      if (attempt < MAX) say('info', `第 ${attempt + 1}/${MAX} 次换号重试…`);
+    }
+  }
+  throw new Error(`手机验证在 ${MAX} 次换号后仍失败：${lastErr ? lastErr.message : '未知错误'}`);
+}
+
+// ==================== 主流程 ====================
+// account: { email, password, clientId, refreshToken }
+// opts: { settings, proxy, log }
+// 返回结构化结果，区分三种情况：
+//   成功  { ok: true, refreshToken, clientId, accessToken, idToken }
+//   封号  { ok: false, banned: true, reason: 'account_deactivated', error }   —— 403「deleted or deactivated」
+//   其它失败（可重试，如手机 400 suspicious/in-use、consent 失败等）
+//         { ok: false, banned: false, error }
+export async function getRefreshToken(account, opts = {}) {
+  const say = (level, msg) => { if (typeof opts.log === 'function') opts.log(level, msg, account.email); };
+  try {
+    const result = await runGetRefreshToken(account, opts);
+    return { ok: true, ...result };
+  } catch (e) {
+    const msg = String((e && e.message) || e);
+    // 封号信号：403「account deleted or deactivated」（可能出现在邮箱 OTP 校验、手机验证或 authorize 环节）
+    const banned = /deleted or deactivated/i.test(msg)
+      || /账号已停用/.test(msg)
+      || (/\b403\b/.test(msg) && /deactivat/i.test(msg));
+    if (banned) {
+      say('error', '检测到 403 账号已停用/删除，标注为封号（不可用）');
+      return { ok: false, banned: true, reason: 'account_deactivated', registered: !!opts.__registered, error: msg };
+    }
+    // registered:true 表示 OpenAI 账号已建（user/register 成功）但后续失败 → 上游据此把邮箱标 burned
+    return { ok: false, banned: false, registered: !!opts.__registered, error: msg };
+  }
+}
+
+// 实际执行 OAuth 授权换 RT 的内部实现（失败以 throw 抛出，由 getRefreshToken 归类）。
+async function runGetRefreshToken(account, opts = {}) {
+  const { settings = {}, proxy = null, log } = opts;
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg, account.email); };
+  const sms = settings.sms || {};
+  const jar = new Jar();
+  const deviceId = crypto.randomUUID();
+  // 每个账号（每次 flow）生成一套独立且自洽的指纹，全程复用：UA / sec-ch-ua / 屏幕 / 语言 /
+  // navigator 在 HTTP 头、sentinel p-token、jsdom turnstile 解算里保持同一套，账号间彼此不同。
+  const fp = generateFingerprint();
+  jar.set('oai-did', deviceId);
+  say('info', `  本次指纹：UA=${fp.userAgent.slice(0, 58)}… platform=${fp.secChUaPlatform} screen=${fp.screenStr} lang=${fp.language}`);
+  const { verifier, challenge } = generatePkce();
+  const state = crypto.randomBytes(32).toString('base64url');
+
+  const authorizeUrl =
+    `${OAUTH_ISSUER}/oauth/authorize?` +
+    new URLSearchParams({
+      response_type: 'code',
+      client_id: OAUTH_CLIENT_ID,
+      redirect_uri: OAUTH_REDIRECT_URI,
+      scope: OAUTH_SCOPE,
+      code_challenge: challenge,
+      code_challenge_method: 'S256',
+      state,
+    }).toString();
+
+  // 步骤1：GET /oauth/authorize
+  say('info', '[步骤1] GET /oauth/authorize（初始化 OAuth 会话）');
+  const step1 = await follow(authorizeUrl, { jar, headers: navHeaders(fp), proxy });
+  say('info', `  authorize 结果状态：${step1.last ? step1.last.status : '?'}`);
+  if (!jar.map.has('login_session')) say('warn', '  未获得 login_session cookie（可能被反爬拦截）');
+
+  // 注册模式（协议注册）：对齐真实浏览器 signup 抓包——authorize/continue 带 screen_hint=signup，
+  // 之后先 POST user/register 建号（设密码），再走 email-otp/send+validate、create_account。
+  const isReg = !!opts.register;
+
+  // 步骤2：POST authorize/continue（提交邮箱）
+  say('info', `[步骤2] POST /api/accounts/authorize/continue（提交邮箱${isReg ? ' · signup' : ''}）`);
+  let sentinel2;
+  if (isReg) {
+    const b2 = await buildSentinelBundle(jar, deviceId, 'authorize_continue', proxy, fp);
+    sentinel2 = b2.token;
+    if (!sentinel2 && b2.error) say('warn', `  sentinel/req 失败原因：${String(b2.error).slice(0, 160)}`);
+  } else {
+    sentinel2 = await buildSentinelToken(jar, deviceId, 'authorize_continue', proxy, fp);
+  }
+  if (!sentinel2) { say('error', '  获取 sentinel token 失败（authorize_continue）'); throw new Error('sentinel token 获取失败'); }
+  const h2 = { ...apiHeaders(fp, deviceId, `${OAUTH_ISSUER}/${isReg ? 'create-account' : 'log-in'}`), 'openai-sentinel-token': sentinel2 };
+  const continueBody = { username: { kind: 'email', value: account.email } };
+  if (isReg) continueBody.screen_hint = 'signup';
+  const r2 = await req('POST', `${OAUTH_ISSUER}/api/accounts/authorize/continue`, {
+    jar, proxy, headers: h2, body: continueBody,
+  });
+  say('info', `  authorize/continue 状态：${r2.status}`);
+  if (r2.status !== 200) throw new Error(`提交邮箱失败：HTTP ${r2.status} ${r2.text.slice(0, 160)}`);
+
+  // 这些账号没有 OpenAI 密码，走无密码（邮箱验证码）登录：
+  // authorize/continue 之后不提交密码，直接触发并校验邮箱登录验证码。
+  let cont = r2.json();
+  let continueUrl = cont.continue_url || '';
+  let pageType = (cont.page && cont.page.type) || '';
+  say('info', `  authorize/continue 返回 page.type=${pageType || '(空)'}`);
+
+  if (!isReg && !opts.fetchInbox && (!account.clientId || !account.refreshToken)) {
+    throw new Error('无密码登录需读取 Outlook 邮箱验证码，但该账号缺少 clientId/refreshToken');
+  }
+
+  // 步骤2.5（仅注册）：POST /api/accounts/user/register 建号并设置密码
+  if (isReg) {
+    if (!opts.password) throw new Error('注册需要提供密码（opts.password）');
+    say('info', '[步骤2.5] POST /api/accounts/user/register（建号 + 设置密码）');
+    const regBundle = await buildSentinelBundle(jar, deviceId, 'username_password_create', proxy, fp);
+    const sReg = regBundle.token;
+    if (!sReg) { say('error', '  获取 sentinel token 失败（username_password_create）'); throw new Error('sentinel token 获取失败'); }
+    const hReg = { ...apiHeaders(fp, deviceId, `${OAUTH_ISSUER}/create-account/password`), 'openai-sentinel-token': sReg };
+    if (regBundle.so) hReg['openai-sentinel-so-token'] = regBundle.so;
+    const rReg = await req('POST', `${OAUTH_ISSUER}/api/accounts/user/register`, {
+      jar, proxy, headers: hReg, body: { username: account.email, password: opts.password },
+    });
+    say('info', `  user/register 状态：${rReg.status}`);
+    if (rReg.status !== 200) throw new Error(`建号失败：HTTP ${rReg.status} ${rReg.text.slice(0, 200)}`);
+    // 标记：OpenAI 账号此刻已被创建。后续任一步骤失败都要把邮箱标记 burned，
+    // 避免下次再用同一邮箱注册命中"账号已存在"。opts 按引用传入，getRefreshToken 的
+    // catch 分支据此回传 registered 标志。
+    opts.__registered = true;
+    try {
+      const dReg = rReg.json();
+      if (dReg && dReg.continue_url) continueUrl = dReg.continue_url;
+      if (dReg && dReg.page && dReg.page.type) pageType = dReg.page.type;
+    } catch { /* 无 JSON 体也可继续 */ }
+  }
+
+  // 步骤3：请求邮箱登录验证码（无密码 / passwordless）
+  // 发送前记录基线时间，用于只接受此后到达的“新鲜”验证码
+  const otpBaselineTs = Date.now();
+  say('info', '[步骤3] GET /api/accounts/email-otp/send（请求邮箱验证码）');
+  const otpReferer = `${OAUTH_ISSUER}/${isReg ? 'create-account' : 'log-in'}`;
+  const rsend = await req('GET', `${OAUTH_ISSUER}/api/accounts/email-otp/send`, {
+    jar, proxy, headers: { ...navHeaders(fp), referer: otpReferer },
+  });
+  say('info', `  email-otp/send 状态：${rsend.status}`);
+  if (rsend.status >= 400) throw new Error(`请求邮箱验证码失败：HTTP ${rsend.status} ${rsend.text.slice(0, 160)}`);
+  // 触达 email-verification 页以对齐后续 cookie（失败可忽略）
+  await req('GET', `${OAUTH_ISSUER}/email-verification`, {
+    jar, proxy, headers: { ...navHeaders(fp), referer: `${OAUTH_ISSUER}/log-in` },
+  }).catch(() => {});
+
+  // 步骤4：从 Outlook 收取验证码并提交
+  say('info', '[步骤4] 从 Outlook 收取邮箱验证码…');
+  const code = await waitEmailOtp(account, {
+    timeoutMs: 180000, baselineTs: otpBaselineTs, log: (l, m) => say(l, '  ' + m),
+    fetchInbox: opts.fetchInbox,
+  });
+  if (!code) throw new Error('邮箱验证码等待超时（未收到新鲜验证码）');
+  say('info', '  提交验证码 POST /api/accounts/email-otp/validate');
+  const hVal = apiHeaders(fp, deviceId, `${OAUTH_ISSUER}/email-verification`);
+  if (isReg) {
+    const valBundle = await buildSentinelBundle(jar, deviceId, 'email_otp_validate', proxy, fp);
+    if (valBundle.token) hVal['openai-sentinel-token'] = valBundle.token;
+    if (valBundle.so) hVal['openai-sentinel-so-token'] = valBundle.so;
+  }
+  const rv = await req('POST', `${OAUTH_ISSUER}/api/accounts/email-otp/validate`, {
+    jar, proxy, headers: hVal, body: { code },
+  });
+  say('info', `  email-otp/validate 状态：${rv.status}`);
+  if (rv.status !== 200) throw new Error(`邮箱验证码校验失败：HTTP ${rv.status} ${rv.text.slice(0, 160)}`);
+  const dv = rv.json();
+  continueUrl = dv.continue_url || continueUrl;
+  pageType = (dv.page && dv.page.type) || pageType;
+
+  // 步骤4.x：注册收尾状态机 —— 严格按服务端返回的 page.type / continue_url 决定下一步，
+  // 而不是写死顺序。真实抓包(8.3chatgpt.com.har)存在两条分支：
+  //   A) validate → about-you(create_account) → consent
+  //   B) validate → add_phone(手机验证) → (可能再 about-you) → consent
+  // 之前写死「isReg 必做 create_account」会在服务端要求 add_phone 时得到 400，并污染后续 consent。
+  say('info', `[步骤4] 收尾状态机开始：page.type=${pageType || '(空)'}, continue_url=${String(continueUrl).slice(0, 90) || '(空)'}`);
+  let didAboutYou = false;
+  for (let step = 0; step < 6; step++) {
+    const ct = String(continueUrl || '');
+    const pt = String(pageType || '').toLowerCase();
+    const isPhone = /add[_-]?phone|phone[_-]?verification|phone-otp/i.test(pt)
+      || /add-phone|phone-otp|phone-verification/i.test(ct);
+    const isAboutYou = /about[_-]?you/i.test(pt) || pt === 'create_account' || /about-you/i.test(ct);
+    const isConsent = /consent|oauth2\/auth|sign-in-with-chatgpt|workspace|organization|login_verifier|consent_challenge/i.test(ct);
+
+    if (isPhone) {
+      say('info', `[步骤4.a] 服务端要求手机验证（page.type=${pageType || '(空)'}）`);
+      const startPageUrl = ct.startsWith('http') ? ct : (ct ? `${OAUTH_ISSUER}${ct}` : `${OAUTH_ISSUER}/add-phone`);
+      const nextUrl = await verifyPhoneWithSms(
+        { jar, deviceId, proxy, sms, startPageUrl, fp },
+        { log: (l, m) => say(l, '  ' + m) },
+      );
+      continueUrl = nextUrl || '';
+      pageType = '';
+      say('info', `  手机验证后 continue_url=${String(continueUrl).slice(0, 90) || '(空)'}`);
+      continue;
+    }
+
+    if (isAboutYou && !didAboutYou) {
+      say('info', '[步骤4.b] 服务端要求 about-you（补充资料）→ create_account');
+      continueUrl = await doCreateAccount();
+      didAboutYou = true;
+      continue;
+    }
+
+    if (isConsent || ct) break;
+
+    // 未知 / 空状态：注册模式且尚未补资料时兜底补一次 about-you，否则进入 consent
+    if (isReg && !didAboutYou) {
+      say('info', '[步骤4.b] 状态未知，注册模式兜底执行 create_account（about-you）');
+      continueUrl = await doCreateAccount();
+      didAboutYou = true;
+      continue;
+    }
+    break;
+  }
+
+  // create_account：提交 name/birthdate（带 oauth_create_account 的 sentinel token+so），返回新的 continue_url
+  async function doCreateAccount() {
+    // 姓名从扩充后的数十×数十池随机组合、生日按 18~48 岁随机，避免旧逻辑（6×6 名 + 1995~2002）
+    // 造成的高度雷同被风控聚类。
+    const fullName = randomFullName();
+    const bd = randomAdultBirthdate();
+    const hAcc = apiHeaders(fp, deviceId, `${OAUTH_ISSUER}/about-you`);
+    const accBundle = await buildSentinelBundle(jar, deviceId, 'oauth_create_account', proxy, fp);
+    if (accBundle.token) hAcc['openai-sentinel-token'] = accBundle.token;
+    if (accBundle.so) hAcc['openai-sentinel-so-token'] = accBundle.so;
+    say('info', `  create_account 身份：name=${fullName} birthdate=${bd}`);
+    const rc = await req('POST', `${OAUTH_ISSUER}/api/accounts/create_account`, {
+      jar, proxy, headers: hAcc, body: { name: fullName, birthdate: bd },
+    });
+    say('info', `  create_account 状态：${rc.status}`);
+    if (rc.status !== 200) say('warn', `  create_account 响应：${rc.text.slice(0, 200)}`);
+    let dc = {};
+    try { dc = rc.json() || {}; } catch { /* 空体 */ }
+    if (dc.page && dc.page.type) pageType = dc.page.type;
+    return dc.continue_url || `${OAUTH_ISSUER}/sign-in-with-chatgpt/codex/consent`;
+  }
+
+  // 步骤5：consent → 提取 authorization code
+  // HAR 主路径：create_account 直接返回 oauth2/auth?login_verifier=… 的 continue_url，
+  // 顺着它 follow 一路 302/303：consent_challenge → consent_verifier → redirect_uri?code=。
+  if (!continueUrl) continueUrl = `${OAUTH_ISSUER}/sign-in-with-chatgpt/codex/consent`;
+  const finalUrl = String(continueUrl).startsWith('http')
+    ? String(continueUrl)
+    : `${OAUTH_ISSUER}${String(continueUrl).startsWith('/') ? continueUrl : `/${continueUrl}`}`;
+  let authCode = null;
+  if (/oauth2\/auth|consent_challenge|login_verifier/i.test(finalUrl)) {
+    say('info', `[步骤5] 跟随服务端 continue_url 直取 code：${finalUrl.slice(0, 110)}…`);
+    const r = await follow(finalUrl, {
+      jar, headers: { ...navHeaders(fp), referer: `${OAUTH_ISSUER}/about-you` }, proxy, max: 15,
+      log: (l, m) => say(l, '  ' + m),
+    });
+    if (r && r.code) { authCode = r.code; say('ok', '  已从 continue_url 链路提取 code'); }
+    else say('warn', `  直取失败，落点=${String(r && r.location || '').slice(0, 120)}`);
+  }
+  if (!authCode) {
+    say('info', '[步骤5b] 回退 workspace/select + oauth2/auth(consent_challenge) 提取 code');
+    let consentUrl = finalUrl;
+    if (!/consent|sign-in-with-chatgpt|workspace|organization/i.test(consentUrl)) {
+      consentUrl = `${OAUTH_ISSUER}/sign-in-with-chatgpt/codex/consent`;
+    }
+    authCode = await submitConsentAndExtractCode(
+      { jar, deviceId, proxy, consentUrl, challenge, state, fp },
+      { log: (l, m) => say(l, m) },
+    );
+  }
+  if (!authCode) {
+    throw new Error(`未能提取 authorization code（continue_url=${finalUrl.slice(0, 120)}）`);
+  }
+  say('ok', `  已提取 authorization code（${authCode.slice(0, 8)}…）`);
+
+  // 步骤6：POST /oauth/token 换取 tokens
+  say('info', '[步骤6] POST /oauth/token（换取 refresh_token）');
+  const rt = await req('POST', `${OAUTH_ISSUER}/oauth/token`, {
+    jar, proxy,
+    headers: { 'content-type': 'application/x-www-form-urlencoded', 'user-agent': fp.userAgent },
+    raw: new URLSearchParams({
+      grant_type: 'authorization_code',
+      code: authCode,
+      redirect_uri: OAUTH_REDIRECT_URI,
+      client_id: OAUTH_CLIENT_ID,
+      code_verifier: verifier,
+    }).toString(),
+  });
+  say('info', `  /oauth/token 状态：${rt.status}`);
+  if (rt.status !== 200) throw new Error(`换取 token 失败：HTTP ${rt.status} ${rt.text.slice(0, 160)}`);
+  const tok = rt.json();
+  if (!tok.refresh_token) throw new Error('token 响应缺少 refresh_token');
+  say('ok', '  已获取 refresh_token（第一阶段）');
+  const phase1 = {
+    refreshToken: tok.refresh_token,
+    clientId: OAUTH_CLIENT_ID,
+    accessToken: tok.access_token || '',
+    idToken: tok.id_token || '',
+    deviceId,
+    // 回传本次会话的指纹，供二阶段/自检里的 refresh_token 换取沿用同一套 UA（与本会话 device_id 自洽）。
+    fp,
+  };
+
+  // 第二阶段（SUB / sub2api）：注册完成后，用【全新 device_id + 全新会话】对该账号再跑一次
+  // 独立的 codex 登录（邮箱验证码），换取与第一阶段【不同】的 codex refreshToken 作为 SUB。
+  // 硬性约束（用户明确要求）：
+  //   · 全新 device_id：runGetRefreshToken 每次都新建 jar + deviceId，天然满足独立会话/设备；
+  //   · 绝不假标：只有真正拿到「独立且能换 AT」的 codex RT 才 subOk=true；
+  //   · 删除「回退复用第一阶段 RT 当 SUB」的假标兜底，拿不到就 subOk=false。
+  let sub = { subOk: false };
+  if (isReg) {
+    say('info', '获取SUB中');
+    try {
+      sub = await doSubViaFreshLogin(account, opts, phase1);
+    } catch (e) {
+      sub = { subOk: false, subError: String((e && e.message) || e) };
+    }
+    if (sub.subOk) say('ok', 'SUB获取成功');
+    else say('warn', 'SUB获取失败');
+  }
+
+  return { ...phase1, ...sub };
+}
+
+// 对外证明：用一个【全新 device_id】把某个 codex refreshToken 换成 access_token，
+// 换到即证明「该 RT 是可登录 CODEX 的独立 codex 凭据」。用于硬证据/自检。
+export async function proveCodexRt(refreshToken, proxy = null) {
+  const deviceId = crypto.randomUUID();
+  const r = await refreshGrant(refreshToken, deviceId, proxy);
+  return { ok: !!r.ok, deviceId, accessToken: r.accessToken || '', newRefreshToken: r.refreshToken || '', status: r.status };
+}
+
+// 用 refresh_token 换一次 access_token，证明该 codex RT 确实可登录 CODEX（全程用同一 device_id）。
+// fp 缺省时临时生成一套，使这次刷新的 UA 也是自洽随机值，而非写死同一 UA。
+async function refreshGrant(refreshToken, deviceId, proxy, fp) {
+  const ua = (fp && fp.userAgent) || generateFingerprint().userAgent;
+  try {
+    const r = await req('POST', `${OAUTH_ISSUER}/oauth/token`, {
+      proxy,
+      headers: { 'content-type': 'application/x-www-form-urlencoded', 'user-agent': ua, 'oai-device-id': deviceId },
+      raw: new URLSearchParams({
+        grant_type: 'refresh_token', client_id: OAUTH_CLIENT_ID,
+        refresh_token: refreshToken, scope: OAUTH_SCOPE,
+      }).toString(),
+    });
+    if (r.status === 200) {
+      const t = r.json();
+      if (t.access_token) return { ok: true, accessToken: t.access_token, refreshToken: t.refresh_token || refreshToken };
+    }
+    return { ok: false, status: r.status };
+  } catch (e) {
+    return { ok: false, error: String((e && e.message) || e) };
+  }
+}
+
+// 第二阶段：以【独立 device_id + 独立会话】对已建账号做一次全新的 codex 登录（邮箱验证码），
+// 得到与第一阶段【不同】的 codex refreshToken；再用它换一次 AT 证明确实可登录 CODEX。
+// 不同会话/设备 + 真登录 → 不再撞 login_verifier already used。拿不到 → subOk=false（绝不假标）。
+async function doSubViaFreshLogin(account, opts, phase1 = {}) {
+  // 内部登录细节静默（log 传空），二阶段只对外输出高层中文进度，保持日志清爽。
+  const r = await runGetRefreshToken(
+    { email: account.email, password: opts.password },
+    { settings: opts.settings, proxy: opts.proxy, fetchInbox: opts.fetchInbox, register: false, log: () => {} },
+  );
+  const subRt = r && r.refreshToken;
+  const subDeviceId = r && r.deviceId;
+  if (!subRt) return { subOk: false, subError: '未取得独立 codex RT' };
+  if (phase1 && subRt === phase1.refreshToken) return { subOk: false, subError: 'SUB RT 与一阶段相同' };
+  // 硬校验：用二阶段【自己那套 device_id + 指纹】把 SUB RT 换成 AT，换到才算真 SUB（绝不假标）。
+  const proof = await refreshGrant(subRt, subDeviceId, opts.proxy, r && r.fp);
+  if (!proof.ok) return { subOk: false, subError: 'SUB RT 无法换 AT' };
+  return {
+    subOk: true,
+    subClientId: OAUTH_CLIENT_ID,
+    subRefreshToken: subRt,
+    subAccessToken: proof.accessToken || (r && r.accessToken) || '',
+    subDeviceId,
+  };
+}
diff --git a/account-manager/node/hero-sms.js b/account-manager/node/hero-sms.js
new file mode 100644
index 0000000..dbfe0c3
--- /dev/null
+++ b/account-manager/node/hero-sms.js
@@ -0,0 +1,205 @@
+// 接码 / SMS 验证码服务 —— hero-sms.com API 客户端（零依赖，使用全局 fetch）
+// 协议：经典 sms-activate 风格，所有请求为 GET https://hero-sms.com/stubs/handler_api.php?api_key=..&action=..
+// 响应为纯文本（冒号分隔），如 ACCESS_NUMBER:<activationId>:<phone>、STATUS_OK:<code>、ACCESS_BALANCE:<n>
+//
+// 与 smsbower.js / smscode.js 接口对齐（可作为调度器的替换供应商）：
+//   acquireNumber(cfg, { log })            → { orderId, phone, order }
+//   pollOtp(cfg, id, { timeoutMs, intervalMs, log }) → { code, message, order }
+//   finishOrder(cfg, id)                   → setStatus status=6（完成）
+//   cancelOrder(cfg, id, { log })          → setStatus status=8（取消，2 分钟内不可取消时静默处理）
+//   getBalance(cfg)                        → 余额数字
+//
+// 已实测（2026-07）：base=https://hero-sms.com/stubs/handler_api.php，
+//   India country=22，OpenAI service="dr"（getServicesList 返回 {code:"dr",name:"OpenAI"}）。
+// 配置字段：apiKey、baseUrl（默认 hero-sms 地址）、country（默认 22=印度）、
+//          service（默认 "dr"=OpenAI）、maxPrice、minPrice
+
+const DEFAULT_BASE = 'https://hero-sms.com/stubs/handler_api.php';
+const DEFAULT_COUNTRY = 22; // 印度
+const DEFAULT_SERVICE = 'dr'; // OpenAI
+
+function normBase(baseUrl) {
+  return String(baseUrl || DEFAULT_BASE).trim().replace(/\/+$/, '') || DEFAULT_BASE;
+}
+
+// 统一请求：拼接 api_key + action + 参数，返回纯文本响应（已 trim）
+async function request(cfg, action, params = {}, { timeoutMs = 30000 } = {}) {
+  const apiKey = String((cfg && cfg.apiKey) || '').trim();
+  if (!apiKey) {
+    const e = new Error('未配置 hero-sms API Key（系统设置 → 接码配置）');
+    e.code = 'NO_API_KEY';
+    throw e;
+  }
+  const q = new URLSearchParams({ api_key: apiKey, action });
+  for (const [k, v] of Object.entries(params)) {
+    if (v !== undefined && v !== null && v !== '') q.set(k, String(v));
+  }
+  const url = `${normBase(cfg && cfg.baseUrl)}?${q.toString()}`;
+
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  let res;
+  try {
+    res = await fetch(url, { method: 'GET', signal: ctrl.signal });
+  } catch (err) {
+    clearTimeout(timer);
+    const e = new Error(err.name === 'AbortError' ? `接码请求超时（action=${action}）` : `接码请求失败：${err.message}`);
+    e.code = 'NETWORK';
+    throw e;
+  }
+  clearTimeout(timer);
+
+  const text = String(await res.text().catch(() => '')).trim();
+  if (!res.ok) {
+    const e = new Error(`接码接口错误：HTTP_${res.status}${text ? ' · ' + text.slice(0, 200) : ''}`);
+    e.code = `HTTP_${res.status}`;
+    e.status = res.status;
+    throw e;
+  }
+  return text;
+}
+
+// 通用错误码 → 带 code 的 Error（BAD_KEY / BAD_ACTION / BAD_SERVICE / NO_ACTIVATION 等）
+function apiError(token, action) {
+  const map = {
+    BAD_KEY: 'API Key 无效',
+    BAD_ACTION: '接口 action 无效',
+    BAD_SERVICE: '服务代码无效',
+    NO_ACTIVATION: '激活订单不存在',
+    NO_BALANCE: '余额不足',
+    NO_NUMBERS: '当前无可用号码',
+  };
+  const e = new Error(`接码接口错误：${token}${map[token] ? ' · ' + map[token] : ''}（action=${action}）`);
+  e.code = token;
+  return e;
+}
+
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// ---------- 余额 ----------
+// 返回余额数字。响应：ACCESS_BALANCE:<balance>
+export async function getBalance(cfg) {
+  const text = await request(cfg, 'getBalance');
+  const m = /^ACCESS_BALANCE:(.+)$/.exec(text);
+  if (m) {
+    const n = Number(m[1]);
+    if (Number.isFinite(n)) return n;
+  }
+  throw apiError(text || 'EMPTY_RESPONSE', 'getBalance');
+}
+
+// ---------- 拿号 ----------
+// 返回 { orderId, phone, order }，与 smsbower.acquireNumber 一致（orderId = activationId）。
+// NO_NUMBERS（无库存，可回退重试）→ e.code='NO_OFFER_AVAILABLE'（与其它平台的库存错误标记一致），
+// 并附 e.providerCode='NO_NUMBERS'；NO_BALANCE / BAD_KEY / BAD_SERVICE 为硬错误，直接抛出。
+export async function acquireNumber(cfg, { log } = {}) {
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+  const country = cfg.country !== undefined && cfg.country !== null && cfg.country !== '' ? cfg.country : DEFAULT_COUNTRY;
+  const service = String(cfg.service || DEFAULT_SERVICE);
+
+  const params = { service, country };
+  if (cfg.maxPrice) params.maxPrice = cfg.maxPrice;
+  if (cfg.minPrice) params.minPrice = cfg.minPrice;
+  if (cfg.operator) params.operator = cfg.operator; // 指定运营商（如 tim/claro/vivo），换号段规避风控
+
+  say('info', `向 hero-sms 请求号码（service=${service} country=${country}${cfg.operator ? ' operator=' + cfg.operator : ''}${cfg.maxPrice ? ' maxPrice=' + cfg.maxPrice : ''}）…`);
+  const text = await request(cfg, 'getNumber', params);
+
+  const m = /^ACCESS_NUMBER:([^:]+):(.+)$/.exec(text);
+  if (m) {
+    const orderId = m[1];
+    const phone = m[2];
+    const order = { id: orderId, phone_number: phone, status: 'PENDING', raw: text };
+    say('ok', `已获取号码：${phone}（订单 ${orderId}）`);
+    return { orderId, phone, order };
+  }
+
+  if (text === 'NO_NUMBERS' || text.startsWith('NO_NUMBERS')) {
+    const e = new Error(`当前无可用号码（service=${service} country=${country}）`);
+    e.code = 'NO_OFFER_AVAILABLE';
+    e.providerCode = 'NO_NUMBERS';
+    throw e;
+  }
+  throw apiError(text || 'EMPTY_RESPONSE', 'getNumber');
+}
+
+// ---------- 查询状态 ----------
+// 返回 { status, code }。status ∈ WAIT_CODE / WAIT_RETRY / CANCEL / OK
+export async function getStatus(cfg, id) {
+  const text = await request(cfg, 'getStatus', { id });
+  if (text === 'STATUS_WAIT_CODE') return { status: 'WAIT_CODE', code: '' };
+  let m = /^STATUS_WAIT_RETRY:(.*)$/.exec(text);
+  if (m) return { status: 'WAIT_RETRY', code: m[1] };
+  if (text === 'STATUS_CANCEL') return { status: 'CANCEL', code: '' };
+  m = /^STATUS_OK:(.+)$/.exec(text);
+  if (m) return { status: 'OK', code: m[1] };
+  throw apiError(text || 'EMPTY_RESPONSE', 'getStatus');
+}
+
+// ---------- 轮询等待验证码 ----------
+// 直到 STATUS_OK 拿到 code，或订单取消/超时抛错。返回 { code, message, order }，与其它平台一致。
+export async function pollOtp(cfg, id, { timeoutMs = 180000, intervalMs = 4000, log } = {}) {
+  const start = Date.now();
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+  while (Date.now() - start < timeoutMs) {
+    let st;
+    try {
+      st = await getStatus(cfg, id);
+    } catch (e) {
+      if (e.code === 'NO_ACTIVATION' || e.code === 'BAD_KEY') throw e; // 不可恢复
+      say('warn', `查询订单失败（将重试）：${e.message}`);
+      await sleep(intervalMs);
+      continue;
+    }
+    if (st.status === 'OK' && st.code) {
+      say('ok', `已收到验证码：${st.code}`);
+      const order = { id, status: 'OTP_RECEIVED', otp_code: st.code };
+      return { code: st.code, message: '', order };
+    }
+    if (st.status === 'CANCEL') {
+      const e = new Error('订单已取消，未收到验证码');
+      e.code = 'CANCELED';
+      throw e;
+    }
+    say('info', `等待验证码…（订单 ${id} 状态 ${st.status}${st.status === 'WAIT_RETRY' && st.code ? '，上一条验证码 ' + st.code : ''}）`);
+    await sleep(intervalMs);
+  }
+  const e = new Error(`等待验证码超时（${Math.round(timeoutMs / 1000)}s）`);
+  e.code = 'OTP_TIMEOUT';
+  throw e;
+}
+
+// ---------- 状态变更 ----------
+// setStatus：1=已就绪 3=请求下一条验证码 6=完成 8=取消
+async function setStatus(cfg, id, status) {
+  return request(cfg, 'setStatus', { id, status });
+}
+
+// 完成订单（收到验证码后调用，setStatus=6）。响应：ACCESS_ACTIVATION
+export async function finishOrder(cfg, id) {
+  const text = await setStatus(cfg, id, 6);
+  if (text === 'ACCESS_ACTIVATION') return { id, status: 'FINISHED' };
+  throw apiError(text || 'EMPTY_RESPONSE', 'setStatus(6)');
+}
+
+// 取消订单（setStatus=8）。响应：ACCESS_CANCEL。
+// EARLY_CANCEL_DENIED（购买 2 分钟内不可取消）按非致命处理：记 warn 后正常返回，号码到期自动退款。
+export async function cancelOrder(cfg, id, { log } = {}) {
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+  const text = await setStatus(cfg, id, 8);
+  if (text === 'ACCESS_CANCEL') return { id, status: 'CANCELED' };
+  if (text === 'EARLY_CANCEL_DENIED') {
+    say('warn', `订单 ${id} 购买未满 2 分钟，暂不可取消（到期后将自动退款）`);
+    return { id, status: 'CANCEL_PENDING', earlyCancelDenied: true };
+  }
+  throw apiError(text || 'EMPTY_RESPONSE', 'setStatus(8)');
+}
+
+// 请求下一条验证码（setStatus=3）。响应：ACCESS_RETRY_GET
+export async function resendOrder(cfg, id) {
+  const text = await setStatus(cfg, id, 3);
+  if (text === 'ACCESS_RETRY_GET') return { id, status: 'WAIT_RETRY' };
+  throw apiError(text || 'EMPTY_RESPONSE', 'setStatus(3)');
+}
diff --git a/account-manager/node/inbox_runner.mjs b/account-manager/node/inbox_runner.mjs
new file mode 100644
index 0000000..95f87fa
--- /dev/null
+++ b/account-manager/node/inbox_runner.mjs
@@ -0,0 +1,36 @@
+// 查收 wrapper —— 由 Flask /api/plus/inbox 通过 `node inbox_runner.mjs` 调用。
+// 输入：stdin 一段 JSON { email, clientId, refreshToken, limit? }
+// 输出：stdout 一段 JSON
+//   成功 { ok:true, address, via, messages:[...] }
+//   失败 { ok:false, status, error }
+// 复用 auto 项目原封不动的 plus-mailbox.js（fetchPlusInbox）。
+import { fetchPlusInbox } from './plus-mailbox.js';
+
+// 复用的脚本会用 console.log 打印诊断信息（如 plus-mailbox 的“令牌换取成功”），
+// 这些默认写 stdout 会污染我们的 JSON 结果。统一改写到 stderr，保证 stdout 只有结果 JSON。
+const _errWrite = (...a) => { try { process.stderr.write(a.map(String).join(' ') + '\n'); } catch { /* ignore */ } };
+console.log = _errWrite;
+console.info = _errWrite;
+console.warn = _errWrite;
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let buf = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (c) => { buf += c; });
+    process.stdin.on('end', () => resolve(buf));
+  });
+}
+
+(async () => {
+  try {
+    const raw = await readStdin();
+    const input = JSON.parse(raw || '{}');
+    const { email, clientId, refreshToken } = input;
+    const limit = Number(input.limit) || 15;
+    const r = await fetchPlusInbox({ email, clientId, refreshToken }, limit);
+    process.stdout.write(JSON.stringify({ ok: true, address: r.address, via: r.via, messages: r.messages || [] }));
+  } catch (e) {
+    process.stdout.write(JSON.stringify({ ok: false, status: e && e.status ? e.status : 502, error: (e && e.message) || String(e) }));
+  }
+})();
diff --git a/account-manager/node/package-lock.json b/account-manager/node/package-lock.json
new file mode 100644
index 0000000..3e3159e
--- /dev/null
+++ b/account-manager/node/package-lock.json
@@ -0,0 +1,137 @@
+{
+  "name": "account-manager-node",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "account-manager-node",
+      "dependencies": {
+        "cloakbrowser": "^0.5.3",
+        "playwright-core": "^1.62.1",
+        "undici-legacy": "npm:undici@=7.21.0"
+      }
+    },
+    "node_modules/@isaacs/fs-minipass": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmmirror.com/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
+      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
+      "license": "ISC",
+      "dependencies": {
+        "minipass": "^7.0.4"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/chownr": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmmirror.com/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/cloakbrowser": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmmirror.com/cloakbrowser/-/cloakbrowser-0.5.3.tgz",
+      "integrity": "sha512-awxjoA3y+id0H9m9278GXftCkgcRcJSWu9D1Oc5E76L063GyMkNbTii8ZCrEQ4zA7b3H3zjRWF+HCtwpHwrsrw==",
+      "license": "MIT",
+      "dependencies": {
+        "tar": "^7.0.0"
+      },
+      "bin": {
+        "cloakbrowser": "dist/cli.js"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      },
+      "peerDependencies": {
+        "mmdb-lib": ">=2.0.0",
+        "playwright-core": ">=1.53.0",
+        "puppeteer-core": ">=21.0.0",
+        "socks-proxy-agent": ">=10.0.0"
+      },
+      "peerDependenciesMeta": {
+        "mmdb-lib": {
+          "optional": true
+        },
+        "playwright-core": {
+          "optional": true
+        },
+        "puppeteer-core": {
+          "optional": true
+        },
+        "socks-proxy-agent": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmmirror.com/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/minizlib": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmmirror.com/minizlib/-/minizlib-3.1.0.tgz",
+      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
+      "license": "MIT",
+      "dependencies": {
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.62.1",
+      "resolved": "https://registry.npmmirror.com/playwright-core/-/playwright-core-1.62.1.tgz",
+      "integrity": "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==",
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/tar": {
+      "version": "7.5.22",
+      "resolved": "https://registry.npmmirror.com/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/undici-legacy": {
+      "name": "undici",
+      "version": "7.21.0",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
+    "node_modules/yallist": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmmirror.com/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
+    }
+  }
+}
diff --git a/account-manager/node/package.json b/account-manager/node/package.json
new file mode 100644
index 0000000..d365dea
--- /dev/null
+++ b/account-manager/node/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "account-manager-node",
+  "private": true,
+  "type": "module",
+  "description": "账号管理 Node 引擎：协议注册(get-rt.js) + 浏览器注册(cloakbrowser)。",
+  "dependencies": {
+    "cloakbrowser": "^0.5.3",
+    "playwright-core": "^1.62.1",
+    "undici-legacy": "npm:undici@=7.21.0"
+  }
+}
diff --git a/account-manager/node/plus-mailbox.js b/account-manager/node/plus-mailbox.js
new file mode 100644
index 0000000..74ceab0
--- /dev/null
+++ b/account-manager/node/plus-mailbox.js
@@ -0,0 +1,319 @@
+// PLUS 邮箱收信 —— 微软 Outlook/Hotmail OAuth（refresh_token + client_id）
+// 导入格式：email----password----clientId----refreshToken
+// 收信流程：refresh_token 换 access_token → 优先 Microsoft Graph 读收件箱，失败回退 IMAP(XOAUTH2)
+import tls from 'node:tls';
+
+const TOKEN_URL = 'https://login.microsoftonline.com/consumers/oauth2/v2.0/token';
+// 这些批量 Outlook 账号的 refresh_token 是按「资源级同意」(.default) 颁发的，
+// 直接请求细粒度 scope（如 https://graph.microsoft.com/Mail.Read）会被拒：
+//   AADSTS70000 invalid_grant: one or more scopes requested are unauthorized or expired
+// 因此每种传输都按候选 scope 依次尝试，取第一个成功者（.default 优先，细粒度兜底）。
+const GRAPH_SCOPES = [
+  'https://graph.microsoft.com/.default',
+  'https://graph.microsoft.com/Mail.Read offline_access',
+];
+const IMAP_SCOPES = [
+  'https://outlook.office.com/IMAP.AccessAsUser.All offline_access',
+  'https://outlook.office.com/.default',
+];
+const IMAP_HOST = 'outlook.office365.com';
+const IMAP_PORT = 993;
+
+const tokenCache = new Map(); // key: clientId|refreshToken|scope -> { token, ts }
+const TOKEN_TTL = 45 * 60 * 1000;
+
+// ---------- 解析导入格式 ----------
+// 每行：email----password----clientId----refreshToken（也兼容用 | 或制表符分隔的多字段）
+export function parsePlus(text) {
+  const out = [];
+  const seen = new Set();
+  for (const raw of String(text || '').split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line) continue;
+    let parts;
+    if (line.includes('----')) parts = line.split('----');
+    else if (line.includes('\t')) parts = line.split('\t');
+    else if (line.includes('|')) parts = line.split('|');
+    else parts = line.split(/\s+/);
+    parts = parts.map((s) => s.trim()).filter(Boolean);
+    if (parts.length < 4) continue;
+    const [email, password, clientId, refreshToken] = parts;
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) continue;
+    const key = email.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ email, password, clientId, refreshToken });
+  }
+  return out;
+}
+
+// ---------- 验证码提取（与 buyer 收信口径一致：4-8 位数字优先）----------
+export function extractCode(text) {
+  if (!text) return '';
+  const s = String(text);
+  const labeled = s.match(/(?:code|验证码|verification|otp|passcode)[^\d]{0,12}(\d{4,8})/i);
+  if (labeled) return labeled[1];
+  const m = s.match(/\b(\d{4,8})\b/);
+  return m ? m[1] : '';
+}
+
+// ---------- 换取 access_token（单个 scope）----------
+async function exchangeToken(clientId, refreshToken, scope) {
+  const ck = `${clientId}|${refreshToken}|${scope}`;
+  const cached = tokenCache.get(ck);
+  if (cached && Date.now() - cached.ts < TOKEN_TTL) return cached.token;
+  const params = new URLSearchParams();
+  params.set('client_id', clientId);
+  params.set('grant_type', 'refresh_token');
+  params.set('refresh_token', refreshToken);
+  params.set('scope', scope);
+  const res = await fetch(TOKEN_URL, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: params.toString(),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.access_token) {
+    const e = new Error(`换取令牌失败：${data.error || res.status} ${data.error_description ? '· ' + String(data.error_description).slice(0, 120) : ''}`);
+    e.status = res.status;
+    e.oauthError = data.error || '';
+    throw e;
+  }
+  tokenCache.set(ck, { token: data.access_token, ts: Date.now() });
+  return data.access_token;
+}
+
+// ---------- 换取 access_token（按候选 scope 回退）----------
+// scopes 为候选 scope 数组，依次尝试，返回第一个成功者的 token。
+// 遇到 invalid_grant/scope 类错误继续尝试下一个 scope；全部失败则抛出最后错误。
+// 成功时打印命中的 scope，便于观察是哪种同意口径生效。
+async function getAccessToken(clientId, refreshToken, scopes) {
+  const candidates = Array.isArray(scopes) ? scopes : [scopes];
+  let lastErr = null;
+  for (const scope of candidates) {
+    try {
+      const token = await exchangeToken(clientId, refreshToken, scope);
+      if (candidates.length > 1) {
+        console.log(`[plus-mailbox] 令牌换取成功 scope=${scope}`);
+      }
+      return token;
+    } catch (e) {
+      lastErr = e;
+      // scope 未授权/过期 → 尝试下一个候选；其它错误（RT 失效等）同样继续，
+      // 但若全部候选都失败则把最后的错误抛出（通常即真正原因）。
+      continue;
+    }
+  }
+  throw lastErr || new Error('换取令牌失败：无可用 scope');
+}
+
+// ---------- MIME 解码：编码字（RFC2047）/ quoted-printable / base64 ----------
+function decodeQP(str, isWord = false) {
+  let s = String(str || '');
+  if (isWord) s = s.replace(/_/g, ' ');
+  return s
+    .replace(/=\r?\n/g, '')
+    .replace(/=([0-9A-Fa-f]{2})/g, (_, h) => String.fromCharCode(parseInt(h, 16)));
+}
+function utf8(bytesStr) {
+  // bytesStr 为 latin1 字节串，按 UTF-8 还原
+  try { return Buffer.from(bytesStr, 'latin1').toString('utf8'); } catch { return bytesStr; }
+}
+function decodeEncodedWords(str) {
+  return String(str || '').replace(/=\?([^?]+)\?([BbQq])\?([^?]*)\?=/g, (_, charset, enc, data) => {
+    try {
+      let bytes;
+      if (enc.toUpperCase() === 'B') bytes = Buffer.from(data, 'base64').toString('latin1');
+      else bytes = decodeQP(data, true);
+      return /utf-?8/i.test(charset) ? utf8(bytes) : bytes;
+    } catch { return data; }
+  }).replace(/\?=\s*=\?/g, ''); // 相邻编码字之间的折行分隔
+}
+
+// ---------- HTML → 纯文本 ----------
+function htmlToText(html) {
+  return String(html || '')
+    .replace(/<style[\s\S]*?<\/style>/gi, ' ')
+    .replace(/<script[\s\S]*?<\/script>/gi, ' ')
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/&nbsp;/g, ' ')
+    .replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>')
+    .replace(/&#(\d+);/g, (_, d) => String.fromCharCode(Number(d)))
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+// ---------- Graph 读收件箱 ----------
+async function fetchViaGraph(clientId, refreshToken, limit) {
+  const token = await getAccessToken(clientId, refreshToken, GRAPH_SCOPES);
+  const url = `https://graph.microsoft.com/v1.0/me/mailFolders/inbox/messages?$top=${limit}` +
+    `&$select=subject,from,receivedDateTime,bodyPreview,body&$orderby=receivedDateTime desc`;
+  const res = await fetch(url, { headers: { authorization: `Bearer ${token}` } });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const e = new Error(`Graph 读信失败：${(data.error && data.error.message) || res.status}`);
+    e.status = res.status;
+    throw e;
+  }
+  return (data.value || []).map((m) => {
+    const bodyText = m.body && m.body.contentType === 'html' ? htmlToText(m.body.content) : (m.body && m.body.content) || m.bodyPreview || '';
+    return {
+      from_addr: (m.from && m.from.emailAddress && m.from.emailAddress.address) || '',
+      subject: m.subject || '',
+      received_at: m.receivedDateTime || '',
+      body: bodyText.slice(0, 4000),
+      snippet: m.bodyPreview || '',
+      extracted_code: extractCode(`${m.subject || ''} ${m.bodyPreview || ''} ${bodyText}`),
+    };
+  });
+}
+
+// ---------- IMAP(XOAUTH2) 读收件箱（Graph 失败时回退）----------
+function imapRead(email, token, limit) {
+  return new Promise((resolve, reject) => {
+    const sock = tls.connect(IMAP_PORT, IMAP_HOST, { servername: IMAP_HOST }, () => {});
+    let buf = '';
+    let stage = 'greeting';
+    let tag = 0;
+    let exists = 0;
+    let raw = '';
+    let settled = false;
+    const timer = setTimeout(() => finish(new Error('IMAP 超时')), 20000);
+    function finish(err, val) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try { sock.end(); sock.destroy(); } catch {}
+      err ? reject(err) : resolve(val);
+    }
+    const send = (cmd) => { tag++; sock.write(`a${tag} ${cmd}\r\n`); return `a${tag}`; };
+    sock.setEncoding('utf8');
+    sock.on('error', (e) => finish(new Error('IMAP ' + (e.code || e.message))));
+    sock.on('data', (chunk) => {
+      buf += chunk;
+      if (stage === 'greeting') {
+        if (!/\r\n/.test(buf)) return;
+        buf = '';
+        stage = 'auth';
+        const b64 = Buffer.from(`user=${email}\x01auth=Bearer ${token}\x01\x01`).toString('base64');
+        sock.write(`a1 AUTHENTICATE XOAUTH2 ${b64}\r\n`);
+        tag = 1;
+        return;
+      }
+      if (stage === 'auth') {
+        if (/^\+/m.test(buf)) { sock.write('\r\n'); } // 服务器要求继续 → 发空行以取回错误
+        if (/^a1 OK/mi.test(buf)) { buf = ''; stage = 'select'; send('SELECT INBOX'); return; }
+        if (/^a1 (NO|BAD)/mi.test(buf)) return finish(new Error('IMAP 认证失败（XOAUTH2）'));
+        return;
+      }
+      if (stage === 'select') {
+        const m = buf.match(/\*\s+(\d+)\s+EXISTS/i);
+        if (m) exists = Number(m[1]);
+        if (/^a2 OK/mi.test(buf)) {
+          buf = '';
+          if (!exists) return finish(null, []);
+          const from = Math.max(1, exists - limit + 1);
+          stage = 'fetch';
+          send(`FETCH ${from}:${exists} (BODY.PEEK[HEADER.FIELDS (FROM SUBJECT DATE)] BODY.PEEK[TEXT])`);
+          return;
+        }
+        if (/^a2 (NO|BAD)/mi.test(buf)) return finish(new Error('IMAP SELECT 失败'));
+        return;
+      }
+      if (stage === 'fetch') {
+        raw += chunk;
+        if (/^a3 OK/mi.test(raw)) return finish(null, parseImapFetch(raw));
+        if (/^a3 (NO|BAD)/mi.test(raw)) return finish(new Error('IMAP FETCH 失败'));
+      }
+    });
+    // buf 只在非 fetch 阶段用；fetch 阶段用 raw
+  });
+}
+
+// 从 BODY[TEXT] 原文中挑出可读正文段：multipart 优先 text/plain，其次 text/html
+function pickBodyPart(rawBody) {
+  let segment = rawBody;
+  const boundaryM = rawBody.match(/boundary="?([^"\r\n;]+)"?/i);
+  if (boundaryM) {
+    const bnd = boundaryM[1].replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const parts = rawBody.split(new RegExp('--' + bnd));
+    let plain = null, html = null;
+    for (const p of parts) {
+      if (!plain && /Content-Type:\s*text\/plain/i.test(p)) plain = p;
+      else if (!html && /Content-Type:\s*text\/html/i.test(p)) html = p;
+    }
+    segment = plain || html || rawBody;
+  }
+  const cte = (segment.match(/Content-Transfer-Encoding:\s*([\w-]+)/i) || [])[1] || '';
+  const charset = (segment.match(/charset=?["']?\s*([\w-]+)/i) || [])[1] || '';
+  const headEnd = segment.search(/\r?\n\r?\n/);
+  const content = headEnd >= 0 ? segment.slice(headEnd).replace(/^\s+/, '') : segment;
+  return { content, cte, isUtf8: /utf-?8/i.test(charset) };
+}
+
+// 极简解析：按邮件块切分，抓取 From/Subject/Date 和正文文本，并做 MIME 解码
+function parseImapFetch(raw) {
+  const out = [];
+  const blocks = raw.split(/\*\s+\d+\s+FETCH/i).slice(1);
+  for (const b of blocks) {
+    const from = decodeEncodedWords((b.match(/From:\s*(.*)/i) || [])[1] || '');
+    const subject = decodeEncodedWords((b.match(/Subject:\s*(.*)/i) || [])[1] || '').trim();
+    const date = ((b.match(/Date:\s*(.*)/i) || [])[1] || '').trim();
+    const textIdx = b.search(/BODY\[TEXT\]/i);
+    let body = '';
+    if (textIdx >= 0) {
+      const after = b.slice(textIdx);
+      const lit = after.match(/\{(\d+)\}\r?\n/);
+      if (lit) {
+        const start = after.indexOf(lit[0]) + lit[0].length;
+        body = after.slice(start, start + Number(lit[1]));
+      }
+    }
+    // 挑选正文段（multipart 优先 text/plain），按其自身编码解码
+    const part = pickBodyPart(body);
+    let content = part.content;
+    if (/base64/i.test(part.cte)) {
+      try { content = Buffer.from(content.replace(/\s+/g, ''), 'base64').toString(part.isUtf8 ? 'utf8' : 'latin1'); } catch {}
+    } else if (/quoted-printable/i.test(part.cte)) {
+      content = decodeQP(content);
+      if (part.isUtf8) content = utf8(content);
+    } else {
+      content = decodeQP(content); // 兜底：常见 =XX 也一并还原
+      if (part.isUtf8) content = utf8(content);
+    }
+    body = htmlToText(content).slice(0, 4000);
+    out.push({
+      from_addr: from.trim().replace(/^.*<|>.*$/g, '').trim() || from.trim(),
+      subject,
+      received_at: date,
+      body,
+      snippet: body.slice(0, 160),
+      extracted_code: extractCode(`${subject} ${body}`),
+    });
+  }
+  return out.reverse();
+}
+
+// ---------- 对外统一入口 ----------
+export async function fetchPlusInbox({ email, clientId, refreshToken }, limit = 15) {
+  if (!clientId || !refreshToken) {
+    const e = new Error('缺少 clientId / refreshToken');
+    e.status = 400;
+    throw e;
+  }
+  try {
+    const messages = await fetchViaGraph(clientId, refreshToken, limit);
+    return { address: email, via: 'graph', messages };
+  } catch (graphErr) {
+    // Graph 不通（scope 未授权等）→ 回退 IMAP
+    try {
+      const token = await getAccessToken(clientId, refreshToken, IMAP_SCOPES);
+      const messages = await imapRead(email, token, limit);
+      return { address: email, via: 'imap', messages };
+    } catch (imapErr) {
+      const e = new Error(`收信失败（Graph: ${graphErr.message}；IMAP: ${imapErr.message}）`);
+      e.status = graphErr.status || 502;
+      throw e;
+    }
+  }
+}
diff --git a/account-manager/node/refetch_runner.mjs b/account-manager/node/refetch_runner.mjs
new file mode 100644
index 0000000..f3ded46
--- /dev/null
+++ b/account-manager/node/refetch_runner.mjs
@@ -0,0 +1,63 @@
+// 「重拿RT」wrapper —— 对【已存在账号】用 codex 客户端跑一次全新登录（register:false），
+// 换取新的 codex refreshToken / accessToken（全程用全新 device_id）。
+// 输入（stdin JSON）：{ email, password, settings, proxy, otpBase }
+// 输出：
+//   - 过程日志：逐行写 stderr，每行 JSON { level, msg, account }
+//   - 最终结果：stdout 一段 JSON（getRefreshToken 返回结构：{ ok, refreshToken, accessToken, clientId, deviceId, ... }）
+import { getRefreshToken } from './get-rt.js';
+
+const _errWrite = (...a) => { try { process.stderr.write(a.map(String).join(' ') + '\n'); } catch { /* ignore */ } };
+console.log = _errWrite;
+console.info = _errWrite;
+console.warn = _errWrite;
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let buf = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (c) => { buf += c; });
+    process.stdin.on('end', () => resolve(buf));
+  });
+}
+
+function emitLog(level, msg, account) {
+  try { process.stderr.write(JSON.stringify({ level, msg: String(msg), account: account || '' }) + '\n'); } catch { /* ignore */ }
+}
+
+(async () => {
+  let email = '';
+  try {
+    const input = JSON.parse((await readStdin()) || '{}');
+    email = input.email || '';
+    const settings = input.settings || {};
+    const proxy = input.proxy || null;
+    const password = input.password || '';
+    const otpBase = String(input.otpBase || 'http://127.0.0.1:5088').replace(/\/$/, '');
+    if (!email) throw new Error('缺少邮箱');
+
+    // 邮箱验证码来源：邮箱池（经 Flask /api/reg/inbox）。已注册账号的邮箱在池中，可读到新码。
+    const fetchInbox = async (account /* , limit */) => {
+      const addr = (account && account.email) || email;
+      const url = `${otpBase}/api/reg/inbox?email=${encodeURIComponent(addr)}`;
+      const res = await fetch(url, { method: 'GET' });
+      if (!res.ok) throw new Error('读取邮箱失败 HTTP ' + res.status);
+      const data = await res.json().catch(() => ({}));
+      return { messages: (data && data.messages) || [] };
+    };
+
+    emitLog('info', '重拿RT中', email);
+    const result = await getRefreshToken({ email, password }, {
+      settings,
+      proxy,
+      register: false,
+      password,
+      log: (level, msg, acc) => emitLog(level, msg, acc || email),
+      fetchInbox,
+    });
+    if (result && result.refreshToken) result.ok = true;
+    process.stdout.write(JSON.stringify(result || { ok: false, error: '无结果' }));
+  } catch (e) {
+    emitLog('error', (e && e.message) || String(e), email);
+    process.stdout.write(JSON.stringify({ ok: false, error: (e && e.message) || String(e) }));
+  }
+})();
diff --git a/account-manager/node/reg_password.mjs b/account-manager/node/reg_password.mjs
new file mode 100644
index 0000000..5f11cb3
--- /dev/null
+++ b/account-manager/node/reg_password.mjs
@@ -0,0 +1,17 @@
+// 注册密码统一来源 —— 协议模式(reg_runner.mjs) 与 浏览器模式(cloak_reg_runner.mjs) 共用。
+//
+// 为什么改成「固定/确定性密码」而不是每次随机：
+//   随机密码会导致「同一邮箱之前已建号、这次又进来」时用新的随机密码去登录 → OpenAI 报
+//   "Incorrect email address or password"，账号再也拿不到登录态。固定密码让「建号」和
+//   「已注册邮箱重进时的登录」始终用同一个口令，也方便导出账密后人工登录。
+//
+// 优先级：显式传入 input.password > settings.regPassword（用户可在设置里改）> 内置默认强密码。
+// 开源版这里仅放一个占位默认口令；请在「设置 → 浏览器 → 注册密码」中填写你自己的强口令，
+// 或在真实（被 .gitignore 忽略的）settings.json 里配置 regPassword。
+export const DEFAULT_REG_PASSWORD = 'ChangeMe#2026Pw!';
+
+export function resolveRegPassword(input = {}, settings = {}) {
+  const fromInput = input && typeof input.password === 'string' ? input.password.trim() : '';
+  const fromSettings = settings && typeof settings.regPassword === 'string' ? settings.regPassword.trim() : '';
+  return fromInput || fromSettings || DEFAULT_REG_PASSWORD;
+}
diff --git a/account-manager/node/reg_runner.mjs b/account-manager/node/reg_runner.mjs
new file mode 100644
index 0000000..f950102
--- /dev/null
+++ b/account-manager/node/reg_runner.mjs
@@ -0,0 +1,68 @@
+// 协议注册 wrapper —— 复用 get-rt.js 的无密码 OAuth 协议流程（步骤1~6），
+// 但 OTP 不再从 Outlook 读，而是经 Flask /api/reg/inbox 从「邮箱池」读取（IMAP / 取件API）。
+// 输入（stdin JSON）：{ email, settings, proxy, otpBase }
+// 输出：
+//   - 过程日志：逐行写 stderr，每行 JSON { level, msg, account }
+//   - 最终结果：stdout 一段 JSON（getRefreshToken 返回结构）
+//       成功 { ok:true, refreshToken, clientId, accessToken, idToken }
+//       失败 { ok:false, banned?, reason?, error }
+import { getRefreshToken } from './get-rt.js';
+import { resolveRegPassword } from './reg_password.mjs';
+
+// get-rt.js / plus-mailbox.js 里的 console.* 默认写 stdout，会污染结果 JSON，统一改到 stderr。
+const _errWrite = (...a) => { try { process.stderr.write(a.map(String).join(' ') + '\n'); } catch { /* ignore */ } };
+console.log = _errWrite;
+console.info = _errWrite;
+console.warn = _errWrite;
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let buf = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (c) => { buf += c; });
+    process.stdin.on('end', () => resolve(buf));
+  });
+}
+
+function emitLog(level, msg, account) {
+  try { process.stderr.write(JSON.stringify({ level, msg: String(msg), account: account || '' }) + '\n'); } catch { /* ignore */ }
+}
+
+(async () => {
+  let email = '';
+  try {
+    const input = JSON.parse((await readStdin()) || '{}');
+    email = input.email || '';
+    const settings = input.settings || {};
+    const proxy = input.proxy || null;
+    const otpBase = String(input.otpBase || 'http://127.0.0.1:5088').replace(/\/$/, '');
+    if (!email) throw new Error('缺少邮箱');
+
+    // 从邮箱池（经 Flask）读取收件箱，形状与 plus-mailbox 一致：
+    //   { messages: [{ from_addr, subject, body, received_at, extracted_code }] }
+    const fetchInbox = async (account /* , limit */) => {
+      const addr = (account && account.email) || email;
+      const url = `${otpBase}/api/reg/inbox?email=${encodeURIComponent(addr)}`;
+      const res = await fetch(url, { method: 'GET' });
+      if (!res.ok) throw new Error('读取邮箱失败 HTTP ' + res.status);
+      const data = await res.json().catch(() => ({}));
+      return { messages: (data && data.messages) || [] };
+    };
+
+    const password = resolveRegPassword(input, settings);
+    const result = await getRefreshToken({ email }, {
+      settings,
+      proxy,
+      register: true,
+      password,
+      log: (level, msg, acc) => emitLog(level, msg, acc || email),
+      fetchInbox,
+    });
+    // getRefreshToken 成功仅返回 {refreshToken,...}，补 ok:true 供上游判断，并回传密码用于落库/导出账密
+    if (result && result.refreshToken) { result.ok = true; result.password = password; }
+    process.stdout.write(JSON.stringify(result));
+  } catch (e) {
+    emitLog('error', (e && e.message) || String(e), email);
+    process.stdout.write(JSON.stringify({ ok: false, banned: false, error: (e && e.message) || String(e) }));
+  }
+})();
diff --git a/account-manager/node/rt_runner.mjs b/account-manager/node/rt_runner.mjs
new file mode 100644
index 0000000..72c7177
--- /dev/null
+++ b/account-manager/node/rt_runner.mjs
@@ -0,0 +1,50 @@
+// 拿 RT wrapper —— 由 Flask /api/plus/get-rt 编排逐个账号通过 `node rt_runner.mjs` 调用。
+// 输入：stdin 一段 JSON { account:{email,password,clientId,refreshToken}, settings, proxy }
+// 输出：
+//   - 过程日志：逐行写 stderr，每行是 JSON { level, msg, account }（供 Flask 汇集/落日志）
+//   - 最终结果：stdout 一段 JSON（getRefreshToken 的返回结构）
+//       成功  { ok:true, refreshToken, clientId, accessToken, idToken }
+//       封号  { ok:false, banned:true, reason, error }
+//       失败  { ok:false, banned:false, error }
+// 复用 auto 项目原封不动的 get-rt.js（getRefreshToken）。
+import { getRefreshToken } from './get-rt.js';
+
+// 复用脚本内部的 console.log/info/warn（如 plus-mailbox 的诊断行）默认写 stdout，
+// 会污染我们最终的结果 JSON。统一改写到 stderr，保证 stdout 只有结果 JSON。
+const _errWrite = (...a) => { try { process.stderr.write(a.map(String).join(' ') + '\n'); } catch { /* ignore */ } };
+console.log = _errWrite;
+console.info = _errWrite;
+console.warn = _errWrite;
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let buf = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (c) => { buf += c; });
+    process.stdin.on('end', () => resolve(buf));
+  });
+}
+
+function emitLog(level, msg, account) {
+  try { process.stderr.write(JSON.stringify({ level, msg: String(msg), account: account || '' }) + '\n'); } catch { /* ignore */ }
+}
+
+(async () => {
+  let account = {};
+  try {
+    const raw = await readStdin();
+    const input = JSON.parse(raw || '{}');
+    account = input.account || {};
+    const settings = input.settings || {};
+    const proxy = input.proxy || null;
+    const result = await getRefreshToken(account, {
+      settings,
+      proxy,
+      log: (level, msg, acc) => emitLog(level, msg, acc || account.email),
+    });
+    process.stdout.write(JSON.stringify(result));
+  } catch (e) {
+    emitLog('error', (e && e.message) || String(e), account.email);
+    process.stdout.write(JSON.stringify({ ok: false, banned: false, error: (e && e.message) || String(e) }));
+  }
+})();
diff --git a/account-manager/node/smsbower.js b/account-manager/node/smsbower.js
new file mode 100644
index 0000000..8c82ecc
--- /dev/null
+++ b/account-manager/node/smsbower.js
@@ -0,0 +1,204 @@
+// 接码 / SMS 验证码服务 —— smsbower.app API 客户端（零依赖，使用全局 fetch）
+// 协议：经典 sms-activate 风格，所有请求为 GET https://smsbower.page/stubs/handler_api.php?api_key=..&action=..
+// 响应为纯文本（冒号分隔），如 ACCESS_NUMBER:<activationId>:<phone>、STATUS_OK:<code>
+//
+// 与 smscode.js 接口对齐（可作为调度器的替换供应商）：
+//   acquireNumber(cfg, { log })            → { orderId, phone, order }
+//   pollOtp(cfg, id, { timeoutMs, intervalMs, log }) → { code, message, order }
+//   finishOrder(cfg, id)                   → setStatus status=6（完成）
+//   cancelOrder(cfg, id)                   → setStatus status=8（取消，2 分钟内不可取消时静默处理）
+//   getBalance(cfg)                        → 余额数字
+//
+// 配置字段：apiKey、baseUrl（默认 .page 地址）、country（默认 22=印度）、
+//          service（默认 "dr"=OpenAI/ChatGPT）、maxPrice、pollTimeout
+
+const DEFAULT_BASE = 'https://smsbower.page/stubs/handler_api.php';
+const DEFAULT_COUNTRY = 22; // 印度
+const DEFAULT_SERVICE = 'dr'; // OpenAI / ChatGPT
+
+function normBase(baseUrl) {
+  return String(baseUrl || DEFAULT_BASE).trim().replace(/\/+$/, '') || DEFAULT_BASE;
+}
+
+// 统一请求：拼接 api_key + action + 参数，返回纯文本响应（已 trim）
+async function request(cfg, action, params = {}, { timeoutMs = 30000 } = {}) {
+  const apiKey = String((cfg && cfg.apiKey) || '').trim();
+  if (!apiKey) {
+    const e = new Error('未配置 smsbower API Key（系统设置 → 接码配置）');
+    e.code = 'NO_API_KEY';
+    throw e;
+  }
+  const q = new URLSearchParams({ api_key: apiKey, action });
+  for (const [k, v] of Object.entries(params)) {
+    if (v !== undefined && v !== null && v !== '') q.set(k, String(v));
+  }
+  const url = `${normBase(cfg && cfg.baseUrl)}?${q.toString()}`;
+
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  let res;
+  try {
+    res = await fetch(url, { method: 'GET', signal: ctrl.signal });
+  } catch (err) {
+    clearTimeout(timer);
+    const e = new Error(err.name === 'AbortError' ? `接码请求超时（action=${action}）` : `接码请求失败：${err.message}`);
+    e.code = 'NETWORK';
+    throw e;
+  }
+  clearTimeout(timer);
+
+  const text = String(await res.text().catch(() => '')).trim();
+  if (!res.ok) {
+    const e = new Error(`接码接口错误：HTTP_${res.status}${text ? ' · ' + text.slice(0, 200) : ''}`);
+    e.code = `HTTP_${res.status}`;
+    e.status = res.status;
+    throw e;
+  }
+  return text;
+}
+
+// 通用错误码 → 带 code 的 Error（BAD_KEY / BAD_ACTION / BAD_SERVICE / NO_ACTIVATION 等）
+function apiError(token, action) {
+  const map = {
+    BAD_KEY: 'API Key 无效',
+    BAD_ACTION: '接口 action 无效',
+    BAD_SERVICE: '服务代码无效',
+    NO_ACTIVATION: '激活订单不存在',
+    NO_BALANCE: '余额不足',
+    NO_NUMBERS: '当前无可用号码',
+  };
+  const e = new Error(`接码接口错误：${token}${map[token] ? ' · ' + map[token] : ''}（action=${action}）`);
+  e.code = token;
+  return e;
+}
+
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// ---------- 余额 ----------
+// 返回余额数字。响应：ACCESS_BALANCE:<balance>
+export async function getBalance(cfg) {
+  const text = await request(cfg, 'getBalance');
+  const m = /^ACCESS_BALANCE:(.+)$/.exec(text);
+  if (m) {
+    const n = Number(m[1]);
+    if (Number.isFinite(n)) return n;
+  }
+  throw apiError(text || 'EMPTY_RESPONSE', 'getBalance');
+}
+
+// ---------- 拿号 ----------
+// 返回 { orderId, phone, order }，与 smscode.acquireNumber 一致（orderId = activationId）。
+// NO_NUMBERS（无库存，可回退重试）→ e.code='NO_OFFER_AVAILABLE'（与 smscode 的库存错误标记一致），
+// 并附 e.providerCode='NO_NUMBERS'；NO_BALANCE / BAD_KEY / BAD_SERVICE 为硬错误，直接抛出。
+export async function acquireNumber(cfg, { log } = {}) {
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+  const country = cfg.country !== undefined && cfg.country !== null && cfg.country !== '' ? cfg.country : DEFAULT_COUNTRY;
+  const service = String(cfg.service || DEFAULT_SERVICE);
+
+  const params = { service, country };
+  if (cfg.maxPrice) params.maxPrice = cfg.maxPrice;
+  if (cfg.minPrice) params.minPrice = cfg.minPrice;
+
+  say('info', `向 smsbower 请求号码（service=${service} country=${country}${cfg.maxPrice ? ' maxPrice=' + cfg.maxPrice : ''}）…`);
+  const text = await request(cfg, 'getNumber', params);
+
+  const m = /^ACCESS_NUMBER:([^:]+):(.+)$/.exec(text);
+  if (m) {
+    const orderId = m[1];
+    const phone = m[2];
+    const order = { id: orderId, phone_number: phone, status: 'PENDING', raw: text };
+    say('ok', `已获取号码：${phone}（订单 ${orderId}）`);
+    return { orderId, phone, order };
+  }
+
+  if (text === 'NO_NUMBERS' || text.startsWith('NO_NUMBERS')) {
+    // 无库存：标记为可回退的库存错误（与 smscode 的 isStockError 判定一致）
+    const e = new Error(`当前无可用号码（service=${service} country=${country}）`);
+    e.code = 'NO_OFFER_AVAILABLE';
+    e.providerCode = 'NO_NUMBERS';
+    throw e;
+  }
+  throw apiError(text || 'EMPTY_RESPONSE', 'getNumber');
+}
+
+// ---------- 查询状态 ----------
+// 返回 { status, code }。status ∈ WAIT_CODE / WAIT_RETRY / CANCEL / OK
+export async function getStatus(cfg, id) {
+  const text = await request(cfg, 'getStatus', { id });
+  if (text === 'STATUS_WAIT_CODE') return { status: 'WAIT_CODE', code: '' };
+  let m = /^STATUS_WAIT_RETRY:(.*)$/.exec(text);
+  if (m) return { status: 'WAIT_RETRY', code: m[1] };
+  if (text === 'STATUS_CANCEL') return { status: 'CANCEL', code: '' };
+  m = /^STATUS_OK:(.+)$/.exec(text);
+  if (m) return { status: 'OK', code: m[1] };
+  throw apiError(text || 'EMPTY_RESPONSE', 'getStatus');
+}
+
+// ---------- 轮询等待验证码 ----------
+// 直到 STATUS_OK 拿到 code，或订单取消/超时抛错。返回 { code, message, order }，与 smscode.pollOtp 一致。
+export async function pollOtp(cfg, id, { timeoutMs = 180000, intervalMs = 4000, log } = {}) {
+  const start = Date.now();
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+  while (Date.now() - start < timeoutMs) {
+    let st;
+    try {
+      st = await getStatus(cfg, id);
+    } catch (e) {
+      if (e.code === 'NO_ACTIVATION' || e.code === 'BAD_KEY') throw e; // 不可恢复
+      say('warn', `查询订单失败（将重试）：${e.message}`);
+      await sleep(intervalMs);
+      continue;
+    }
+    if (st.status === 'OK' && st.code) {
+      say('ok', `已收到验证码：${st.code}`);
+      const order = { id, status: 'OTP_RECEIVED', otp_code: st.code };
+      return { code: st.code, message: '', order };
+    }
+    if (st.status === 'CANCEL') {
+      const e = new Error('订单已取消，未收到验证码');
+      e.code = 'CANCELED';
+      throw e;
+    }
+    // WAIT_CODE / WAIT_RETRY：继续等待
+    say('info', `等待验证码…（订单 ${id} 状态 ${st.status}${st.status === 'WAIT_RETRY' && st.code ? '，上一条验证码 ' + st.code : ''}）`);
+    await sleep(intervalMs);
+  }
+  const e = new Error(`等待验证码超时（${Math.round(timeoutMs / 1000)}s）`);
+  e.code = 'OTP_TIMEOUT';
+  throw e;
+}
+
+// ---------- 状态变更 ----------
+// setStatus：1=已就绪 3=请求下一条验证码 6=完成 8=取消
+async function setStatus(cfg, id, status) {
+  return request(cfg, 'setStatus', { id, status });
+}
+
+// 完成订单（收到验证码后调用，setStatus=6）。响应：ACCESS_ACTIVATION
+export async function finishOrder(cfg, id) {
+  const text = await setStatus(cfg, id, 6);
+  if (text === 'ACCESS_ACTIVATION') return { id, status: 'FINISHED' };
+  throw apiError(text || 'EMPTY_RESPONSE', 'setStatus(6)');
+}
+
+// 取消订单（setStatus=8）。响应：ACCESS_CANCEL。
+// EARLY_CANCEL_DENIED（购买 2 分钟内不可取消）按非致命处理：记 warn 后正常返回，号码到期自动退款。
+export async function cancelOrder(cfg, id, { log } = {}) {
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+  const text = await setStatus(cfg, id, 8);
+  if (text === 'ACCESS_CANCEL') return { id, status: 'CANCELED' };
+  if (text === 'EARLY_CANCEL_DENIED') {
+    say('warn', `订单 ${id} 购买未满 2 分钟，暂不可取消（到期后将自动退款）`);
+    return { id, status: 'CANCEL_PENDING', earlyCancelDenied: true };
+  }
+  throw apiError(text || 'EMPTY_RESPONSE', 'setStatus(8)');
+}
+
+// 请求下一条验证码（setStatus=3），对应 smscode.resendOrder。响应：ACCESS_RETRY_GET
+export async function resendOrder(cfg, id) {
+  const text = await setStatus(cfg, id, 3);
+  if (text === 'ACCESS_RETRY_GET') return { id, status: 'WAIT_RETRY' };
+  throw apiError(text || 'EMPTY_RESPONSE', 'setStatus(3)');
+}
diff --git a/account-manager/node/smscode.js b/account-manager/node/smscode.js
new file mode 100644
index 0000000..f218cfe
--- /dev/null
+++ b/account-manager/node/smscode.js
@@ -0,0 +1,241 @@
+// 接码 / SMS 验证码服务 —— smscode.gg API 客户端（零依赖，使用全局 fetch）
+// 文档：https://smscode.gg/docs   Base URL: https://api.smscode.gg/v1
+// 鉴权：Authorization: Bearer <apiKey>
+// 统一响应包络：{ success:true, data:{...} } / { success:false, error:{ code, message } }
+//
+// 订单生命周期：
+//   1. createOrder  → 下单拿号（product_id 精确档位 或 catalog_product_id 路由）
+//   2. pollOtp      → 轮询 GET /orders/{id} 直到 status=OTP_RECEIVED 拿到 otp_code
+//   3. finishOrder  → 收到验证码后标记完成（立即释放号码）
+//   或 cancelOrder  → 未收到验证码时取消（退款）
+
+const DEFAULT_BASE = 'https://api.smscode.gg/v1';
+
+function normBase(baseUrl) {
+  return String(baseUrl || DEFAULT_BASE).trim().replace(/\/+$/, '') || DEFAULT_BASE;
+}
+
+// 统一请求：注入 Bearer、解析包络、处理 429/超时/HTTP 错误
+async function request(cfg, method, pathAndQuery, { body, idempotencyKey, timeoutMs = 30000 } = {}) {
+  const base = normBase(cfg && cfg.baseUrl);
+  const apiKey = String((cfg && cfg.apiKey) || '').trim();
+  if (!apiKey) {
+    const e = new Error('未配置接码 API Key（系统设置 → 接码配置）');
+    e.code = 'NO_API_KEY';
+    throw e;
+  }
+  const url = `${base}${pathAndQuery}`;
+  const headers = {
+    authorization: `Bearer ${apiKey}`,
+    accept: 'application/json',
+  };
+  if (body !== undefined) headers['content-type'] = 'application/json';
+  if (idempotencyKey) headers['idempotency-key'] = idempotencyKey;
+
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body: body === undefined ? undefined : JSON.stringify(body),
+      signal: ctrl.signal,
+    });
+  } catch (err) {
+    clearTimeout(timer);
+    const e = new Error(err.name === 'AbortError' ? `接码请求超时（${method} ${pathAndQuery}）` : `接码请求失败：${err.message}`);
+    e.code = 'NETWORK';
+    throw e;
+  }
+  clearTimeout(timer);
+
+  if (res.status === 429) {
+    const retry = Number(res.headers.get('retry-after')) || 5;
+    const e = new Error(`接码接口限流（429），请 ${retry}s 后重试`);
+    e.code = 'RATE_LIMIT_EXCEEDED';
+    e.retryAfter = retry;
+    throw e;
+  }
+
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || data.success === false) {
+    const err = (data && data.error) || {};
+    const e = new Error(`接码接口错误：${err.code || res.status}${err.message ? ' · ' + err.message : ''}`);
+    e.code = err.code || `HTTP_${res.status}`;
+    e.status = res.status;
+    throw e;
+  }
+  return data.data;
+}
+
+// ---------- 目录（catalog） ----------
+export async function listCountries(cfg) {
+  return request(cfg, 'GET', '/catalog/countries');
+}
+export async function listServices(cfg, countryId) {
+  const q = countryId ? `?country_id=${encodeURIComponent(countryId)}` : '';
+  return request(cfg, 'GET', `/catalog/services${q}`);
+}
+export async function listProducts(cfg, { countryId, platformId, operatorId, limit = 50, page = 1 } = {}) {
+  const p = new URLSearchParams();
+  if (countryId) p.set('country_id', countryId);
+  if (platformId) p.set('platform_id', platformId);
+  if (operatorId) p.set('operator_id', operatorId);
+  p.set('limit', limit);
+  p.set('page', page);
+  return request(cfg, 'GET', `/catalog/products?${p.toString()}`);
+}
+export async function getBalance(cfg) {
+  return request(cfg, 'GET', '/balance');
+}
+
+// ---------- 订单 ----------
+// 下单拿号。优先使用 productId（精确档位），否则用 catalogProductId（路由下单）。
+export async function createOrder(cfg, { productId, catalogProductId, operatorId, maxPrice, quantity = 1 } = {}) {
+  const body = { quantity };
+  if (productId) body.product_id = Number(productId);
+  else if (catalogProductId) {
+    body.catalog_product_id = Number(catalogProductId);
+    if (operatorId) body.operator_id = Number(operatorId);
+    if (maxPrice) body.max_price = /^\d+$/.test(String(maxPrice)) ? Number(maxPrice) : String(maxPrice);
+  } else {
+    const e = new Error('下单需提供 productId 或 catalogProductId');
+    e.code = 'VALIDATION_ERROR';
+    throw e;
+  }
+  const idempotencyKey = `getrt-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+  const data = await request(cfg, 'POST', '/orders/create', { body, idempotencyKey });
+  const order = (data.orders && data.orders[0]) || data;
+  if (!order || !order.id) {
+    const e = new Error('下单未返回有效订单');
+    e.code = 'NO_ORDER';
+    throw e;
+  }
+  return order; // { id, status, phone_number, ... }
+}
+
+export async function getOrder(cfg, id) {
+  return request(cfg, 'GET', `/orders/${encodeURIComponent(id)}`);
+}
+export async function finishOrder(cfg, id) {
+  return request(cfg, 'POST', '/orders/finish', { body: { id: Number(id) } });
+}
+export async function cancelOrder(cfg, id) {
+  return request(cfg, 'POST', '/orders/cancel', { body: { id: Number(id) } });
+}
+export async function resendOrder(cfg, id) {
+  return request(cfg, 'POST', '/orders/resend', { body: { id: Number(id) } });
+}
+
+// 轮询等待验证码：直到 status=OTP_RECEIVED 且拿到 otp_code，或超时。
+// log(level,msg) 可选，用于向上层推送进度。
+export async function pollOtp(cfg, id, { timeoutMs = 180000, intervalMs = 4000, log } = {}) {
+  const start = Date.now();
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+  while (Date.now() - start < timeoutMs) {
+    let order;
+    try {
+      order = await getOrder(cfg, id);
+    } catch (e) {
+      say('warn', `查询订单失败（将重试）：${e.message}`);
+      await sleep(intervalMs);
+      continue;
+    }
+    const status = String(order.status || '').toUpperCase();
+    if (order.otp_code) {
+      say('ok', `已收到验证码：${order.otp_code}`);
+      return { code: order.otp_code, message: order.otp_message || '', order };
+    }
+    if (status === 'CANCELED' || status === 'EXPIRED') {
+      const e = new Error(`订单已${status === 'CANCELED' ? '取消' : '过期'}，未收到验证码`);
+      e.code = status;
+      throw e;
+    }
+    say('info', `等待验证码…（订单 ${id} 状态 ${status || '未知'}）`);
+    await sleep(intervalMs);
+  }
+  const e = new Error(`等待验证码超时（${Math.round(timeoutMs / 1000)}s）`);
+  e.code = 'OTP_TIMEOUT';
+  throw e;
+}
+
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// 一站式：拿号 → 轮询验证码。返回 { orderId, phone, code }。
+// 判断下单失败是否属于“无库存/无号码”类（可回退下一档位），而非鉴权/余额类（应立即抛出）。
+function isStockError(e) {
+  const code = String((e && e.code) || '').toUpperCase();
+  if (['NO_OFFER_AVAILABLE', 'PROVIDER_ERROR', 'NO_ORDER'].includes(code)) return true;
+  const msg = String((e && e.message) || '').toLowerCase();
+  if ((e && e.status === 422) && /(no[_\s-]?number|no[_\s-]?offer|out.?of.?stock|no.?stock|stock|available|sold.?out)/.test(msg)) return true;
+  return false;
+}
+
+// 拉取 country+service 的产品档位，构造“有货 + 按价格升序”的候选下单顺序。
+// 若配置了 productId 且该档位有货，则置于队首。返回 [{ productId, price, available }]。
+export async function buildCandidates(cfg, { log } = {}) {
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+  const products = await listProducts(cfg, { countryId: cfg.countryId, platformId: cfg.serviceId, limit: 10000, page: 1 });
+  const list = Array.isArray(products) ? products : [];
+  const inStock = list
+    .filter((p) => p && p.active !== false && (Number(p.available) || 0) > 0)
+    .map((p) => ({ productId: p.id, price: Number(p.price) || 0, available: Number(p.available) || 0 }))
+    .sort((a, b) => a.price - b.price);
+  const configured = Number(cfg.productId) || 0;
+  let ordered = inStock;
+  if (configured) {
+    const hit = inStock.find((c) => Number(c.productId) === configured);
+    if (hit) ordered = [hit, ...inStock.filter((c) => Number(c.productId) !== configured)];
+    else say('warn', `配置的 productId=${configured} 当前无货，改用有货档位（按价格升序）`);
+  }
+  say('info', `候选档位（有货，共 ${ordered.length}）：${ordered.slice(0, 8).map((c) => `#${c.productId}@${c.price}(${c.available})`).join(' → ')}${ordered.length > 8 ? ' …' : ''}`);
+  return ordered;
+}
+
+// 拿号（带无货自动回退）。返回 { orderId, phone, order }，与旧签名一致。
+// 调用方应在使用完验证码后调用 finishOrder；失败时调用 cancelOrder（若 can_cancel）。
+export async function acquireNumber(cfg, { log } = {}) {
+  const say = (level, msg) => { if (typeof log === 'function') log(level, msg); };
+
+  // 未配置 country+service：维持旧行为（单一 productId / catalogProductId）。
+  if (!cfg.countryId || !cfg.serviceId) {
+    const order = await createOrder(cfg, {
+      productId: cfg.productId,
+      catalogProductId: cfg.catalogProductId,
+      operatorId: cfg.operatorId,
+      maxPrice: cfg.maxPrice,
+    });
+    say('ok', `已获取号码：${order.phone_number}（订单 ${order.id}）`);
+    return { orderId: order.id, phone: order.phone_number, order };
+  }
+
+  const candidates = await buildCandidates(cfg, { log });
+  if (!candidates.length) {
+    const e = new Error(`所有档位均无库存/下单失败（country=${cfg.countryId} service=${cfg.serviceId}）`);
+    e.code = 'NO_OFFER_AVAILABLE';
+    throw e;
+  }
+
+  for (let i = 0; i < candidates.length; i++) {
+    const c = candidates[i];
+    try {
+      say('info', `尝试下单档位 #${c.productId}（价格 ${c.price} IDR，库存 ${c.available}）`);
+      const order = await createOrder(cfg, { productId: c.productId });
+      say('ok', `已获取号码：${order.phone_number}（订单 ${order.id}，档位 #${c.productId} 价格 ${c.price} IDR）`);
+      return { orderId: order.id, phone: order.phone_number, order };
+    } catch (e) {
+      if (isStockError(e)) {
+        say('warn', `档位 #${c.productId} 无库存/下单失败（${e.code || e.message}），尝试下一档位…`);
+        continue;
+      }
+      throw e; // 鉴权/余额等非库存错误：立即抛出
+    }
+  }
+
+  const e = new Error(`所有档位均无库存/下单失败（country=${cfg.countryId} service=${cfg.serviceId}）`);
+  e.code = 'NO_OFFER_AVAILABLE';
+  throw e;
+}
diff --git a/account_manager.py b/account_manager.py
new file mode 100644
index 0000000..9298096
--- /dev/null
+++ b/account_manager.py
@@ -0,0 +1,2683 @@
+"""账号管理（Account Management）—— 从 auto(Node) 项目移植的 `plus`(GPT 管理) 功能。
+
+本模块是「加法式」的：仅新增一个 Flask Blueprint，挂到主 app（app.register_blueprint）。
+不改动任何既有功能。页面地址 /account-manager/，API 前缀 /api/plus。
+
+数据存储：card-binding/data/plus.json（记录形状与 auto/data/plus.json 一致：
+  email, password, clientId, refreshToken, note, createdAt，拿 RT 后追加
+  codexRt, codexClientId, codexAccessToken, codexIdToken, codexStatus, banned, banReason）。
+
+两类操作的实现：
+  纯 Python（列表/导入/删除/删封号/导出）—— 忠实复刻 Node 的纯数据逻辑；
+  Node 子进程（查收 inbox / 批量拿 RT）—— 直接复用 auto 的 get-rt.js / plus-mailbox.js，
+  经 account-manager/node/*.mjs 包装，用 `node <script>` + stdin(JSON) 调用，mirror
+  项目里既有的“Python 调子进程”做法。
+"""
+from __future__ import annotations
+
+import base64
+import json
+import os
+import random
+import re
+import subprocess
+import sys
+import threading
+import time
+import uuid
+from pathlib import Path
+
+try:
+    import httpx
+except Exception:  # pragma: no cover - httpx ships with the server interpreter
+    httpx = None
+
+from flask import Blueprint, Response, jsonify, render_template, request
+
+ROOT = Path(__file__).resolve().parent
+DATA_DIR = ROOT / "data"
+PLUS_FILE = DATA_DIR / "plus.json"
+NODE_DIR = ROOT / "account-manager" / "node"
+CONFIG_DIR = ROOT / "account-manager" / "config"
+SETTINGS_FILE = CONFIG_DIR / "settings.json"
+PROXY_FILE = CONFIG_DIR / "proxies.json"
+MAILBOX_FILE = CONFIG_DIR / "mailbox.json"
+
+# Node 可执行文件：默认走 PATH 上的 node，可用环境变量覆盖。
+NODE_BIN = os.getenv("ACCOUNT_MGR_NODE", "").strip() or os.getenv("NODE_BIN", "").strip() or "node"
+INBOX_RUNNER = str(NODE_DIR / "inbox_runner.mjs")
+RT_RUNNER = str(NODE_DIR / "rt_runner.mjs")
+REG_RUNNER = str(NODE_DIR / "reg_runner.mjs")
+# 浏览器注册（CloakBrowser 隐身 Chromium）runner —— 与 REG_RUNNER（HTTP 协议注册）并列，
+# 由「注册方式」决定调用哪一个；两者输入/输出协议一致，故批量编排逻辑可共用。
+CLOAK_REG_RUNNER = str(NODE_DIR / "cloak_reg_runner.mjs")
+REFETCH_RUNNER = str(NODE_DIR / "refetch_runner.mjs")
+# 注册子进程回读邮箱验证码用的内部地址（主 app 端口）
+OTP_INTERNAL_BASE = os.getenv("ACCOUNT_MGR_BASE", "").strip() or "http://127.0.0.1:5088"
+
+# 实时套餐校验(accounts/check)需 curl_cffi(firefox144) 绕过 Cloudflare；主程序解释器 curl_cffi 版本可能过旧，
+# 故用 .venv 的 python 以子进程执行 plan_check_session.py（与 card_bind_session.py 同源）。
+def _default_venv_python() -> str:
+    venv_dir = ROOT.parent / ".venv"
+    candidates = (
+        venv_dir / "Scripts" / "python.exe",  # Windows
+        venv_dir / "bin" / "python",          # Linux/macOS
+    )
+    return next((str(candidate) for candidate in candidates if candidate.exists()), sys.executable)
+PY_BIN = os.getenv("PAY153_PYTHON", "").strip() or _default_venv_python()
+PLAN_CHECK_SCRIPT = str(ROOT / "plan_check_session.py")
+
+SUB2API_DEFAULT_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
+
+bp = Blueprint("account_manager", __name__)
+
+_plus_lock = threading.RLock()
+
+# 批量拿 RT 运行态（mirror server.js 的 rtRunning + pushLog 日志环）
+_rt_state = {
+    "running": False,
+    "total": 0,
+    "done": 0,
+    "ok": 0,
+    "banned": 0,
+    "fail": 0,
+    "logs": [],  # [{ ts, level, msg, account }]
+    "started_at": 0,
+    "finished_at": 0,
+}
+_rt_lock = threading.RLock()
+_MAX_LOGS = 500
+
+# 协议注册运行态
+_reg_state = {
+    "running": False,
+    "stop": False,
+    "total": 0,
+    "done": 0,
+    "ok": 0,
+    "fail": 0,
+    "logs": [],
+    "started_at": 0,
+    "finished_at": 0,
+}
+_reg_lock = threading.RLock()
+
+
+# ---------- JSON 存储 ----------
+def load_plus() -> list:
+    with _plus_lock:
+        DATA_DIR.mkdir(parents=True, exist_ok=True)
+        if not PLUS_FILE.exists():
+            return []
+        try:
+            data = json.loads(PLUS_FILE.read_text(encoding="utf-8"))
+            return data if isinstance(data, list) else []
+        except Exception:
+            return []
+
+
+def save_plus(items: list) -> None:
+    with _plus_lock:
+        DATA_DIR.mkdir(parents=True, exist_ok=True)
+        PLUS_FILE.write_text(json.dumps(items, ensure_ascii=False, indent=2), encoding="utf-8")
+
+
+def load_settings() -> dict:
+    try:
+        return json.loads(SETTINGS_FILE.read_text(encoding="utf-8")) or {}
+    except Exception:
+        return {}
+
+
+def load_proxies() -> list:
+    try:
+        data = json.loads(PROXY_FILE.read_text(encoding="utf-8"))
+        return data if isinstance(data, list) else []
+    except Exception:
+        return []
+
+
+# ---------- 解析导入格式（忠实复刻 plus-mailbox.js parsePlus）----------
+# 每行：email----password----clientId----refreshToken（兼容制表符 / | / 空白分隔）
+_EMAIL_RE = re.compile(r"^[^\s@]+@[^\s@]+\.[^\s@]+$")
+
+
+def parse_plus(text: str) -> list:
+    out: list = []
+    seen: set = set()
+    for raw in str(text or "").split("\n"):
+        line = raw.replace("\r", "").strip()
+        if not line:
+            continue
+        if "----" in line:
+            parts = line.split("----")
+        elif "\t" in line:
+            parts = line.split("\t")
+        elif "|" in line:
+            parts = line.split("|")
+        else:
+            parts = re.split(r"\s+", line)
+        parts = [s.strip() for s in parts if s.strip()]
+        if len(parts) < 4:
+            continue
+        email, password, client_id, refresh_token = parts[0], parts[1], parts[2], parts[3]
+        if not _EMAIL_RE.match(email):
+            continue
+        key = email.lower()
+        if key in seen:
+            continue
+        seen.add(key)
+        out.append({"email": email, "password": password, "clientId": client_id, "refreshToken": refresh_token})
+    return out
+
+
+# ---------- 页面 ----------
+@bp.get("/account-manager/")
+def account_manager_page():
+    return render_template("account-manager.html")
+
+
+# ---------- GET /api/plus ----------
+@bp.get("/api/plus")
+def api_plus_list():
+    return jsonify({"accounts": load_plus()})
+
+
+# ---------- POST /api/plus/import ----------
+@bp.post("/api/plus/import")
+def api_plus_import():
+    body = request.get_json(silent=True) or {}
+    parsed = parse_plus(body.get("text") or "")
+    with _plus_lock:
+        items = load_plus()
+        by_email = {a.get("email", "").lower(): a for a in items}
+        added = 0
+        updated = 0
+        for item in parsed:
+            key = item["email"].lower()
+            existing = by_email.get(key)
+            if existing:
+                changed = False
+                for f in ("password", "clientId", "refreshToken"):
+                    if existing.get(f) != item.get(f):
+                        existing[f] = item[f]
+                        changed = True
+                if changed:
+                    updated += 1
+            else:
+                rec = {
+                    "email": item["email"],
+                    "password": item["password"],
+                    "clientId": item["clientId"],
+                    "refreshToken": item["refreshToken"],
+                    "note": "",
+                    "createdAt": int(time.time() * 1000),
+                }
+                items.append(rec)
+                by_email[key] = rec
+                added += 1
+        save_plus(items)
+        total = len(items)
+    return jsonify({"added": added, "updated": updated, "parsed": len(parsed), "total": total})
+
+
+# ---------- DELETE /api/plus ----------
+# 按 emails 删除；「批量删除封号」由前端收集封号邮箱后走同一入口（与 Node 一致）。
+@bp.delete("/api/plus")
+def api_plus_delete():
+    body = request.get_json(silent=True) or {}
+    emails = body.get("emails") or []
+    target = {str(e).lower() for e in emails}
+    with _plus_lock:
+        items = load_plus()
+        before = len(items)
+        items = [a for a in items if a.get("email", "").lower() not in target]
+        save_plus(items)
+        total = len(items)
+    return jsonify({"removed": before - total, "total": total})
+
+
+# ---------- POST /api/plus/inbox（查收，Node 子进程）----------
+@bp.post("/api/plus/inbox")
+def api_plus_inbox():
+    body = request.get_json(silent=True) or {}
+    email = str(body.get("email") or "")
+    items = load_plus()
+    acc = next((a for a in items if a.get("email", "").lower() == email.lower()), None)
+    if not acc:
+        return jsonify({"error": "账号不存在"}), 404
+    payload = {
+        "email": acc.get("email"),
+        "clientId": acc.get("clientId"),
+        "refreshToken": acc.get("refreshToken"),
+    }
+    try:
+        proc = subprocess.run(
+            [NODE_BIN, INBOX_RUNNER],
+            input=json.dumps(payload),
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            cwd=str(NODE_DIR),
+            timeout=90,
+        )
+    except FileNotFoundError:
+        return jsonify({"error": f"未找到 Node 可执行文件：{NODE_BIN}"}), 500
+    except subprocess.TimeoutExpired:
+        return jsonify({"error": "查收超时"}), 504
+    out = (proc.stdout or "").strip()
+    if not out:
+        return jsonify({"error": f"查收进程无输出（stderr: {(proc.stderr or '').strip()[:300]}）"}), 502
+    try:
+        result = json.loads(out)
+    except Exception:
+        return jsonify({"error": f"查收结果解析失败：{out[:300]}"}), 502
+    if not result.get("ok"):
+        status = int(result.get("status") or 502)
+        return jsonify({"error": result.get("error") or "查收失败"}), (401 if status == 401 else 502)
+    return jsonify({"address": result.get("address"), "via": result.get("via"), "messages": result.get("messages") or []})
+
+
+# ---------- 拿 RT 编排（mirror server.js runGetRtBatch）----------
+def _rt_log(level: str, msg: str, account: str = "") -> None:
+    entry = {"ts": int(time.time() * 1000), "level": level, "msg": str(msg), "account": account or ""}
+    with _rt_lock:
+        _rt_state["logs"].append(entry)
+        if len(_rt_state["logs"]) > _MAX_LOGS:
+            del _rt_state["logs"][: len(_rt_state["logs"]) - _MAX_LOGS]
+
+
+def _run_get_rt_batch(targets: list) -> None:
+    settings = load_settings()
+    sms = settings.get("sms") or {}
+    provider = sms.get("provider") or "smscode"
+    sms_configured = bool((sms.get(provider) or {}).get("apiKey"))
+    proxies = load_proxies()
+    ok_proxies = [p for p in proxies if p.get("status") == "ok"]
+    pool = ok_proxies if ok_proxies else proxies
+    try:
+        concurrency = int(settings.get("concurrency") or 1)
+    except (TypeError, ValueError):
+        concurrency = 1
+    concurrency = max(1, min(concurrency, len(targets) or 1))
+
+    with _rt_lock:
+        _rt_state.update({"running": True, "total": len(targets), "done": 0, "ok": 0,
+                          "banned": 0, "fail": 0, "started_at": int(time.time() * 1000), "finished_at": 0})
+    _rt_log("info", f"====== 批量拿 RT 开始：{len(targets)} 个账号 ｜ 并发 {concurrency} ｜ "
+                     f"可用代理 {len(ok_proxies)}/{len(proxies)} ｜ 接码 {'已配置' if sms_configured else '未配置'} ======")
+
+    queue = list(enumerate(targets))
+    q_lock = threading.Lock()
+
+    def worker(wid: int) -> None:
+        while True:
+            with q_lock:
+                if not queue:
+                    return
+                idx, target = queue.pop(0)
+            proxy = pool[idx % len(pool)] if pool else None
+            with _rt_lock:
+                _rt_state["done"] += 1
+                done = _rt_state["done"]
+            _rt_log("info", f"—— [{done}/{len(targets)}] 线程#{wid} 拿 RT ——", target.get("email"))
+            payload = {
+                "account": {
+                    "email": target.get("email"),
+                    "password": target.get("password"),
+                    "clientId": target.get("clientId"),
+                    "refreshToken": target.get("refreshToken"),
+                },
+                "settings": settings,
+                "proxy": proxy,
+            }
+            result = None
+            try:
+                proc = subprocess.run(
+                    [NODE_BIN, RT_RUNNER],
+                    input=json.dumps(payload),
+                    capture_output=True,
+                    text=True,
+                    encoding="utf-8",
+                    errors="replace",
+                    cwd=str(NODE_DIR),
+                    timeout=600,
+                )
+                for line in (proc.stderr or "").splitlines():
+                    line = line.strip()
+                    if not line:
+                        continue
+                    try:
+                        rec = json.loads(line)
+                        _rt_log(rec.get("level") or "info", rec.get("msg") or "", rec.get("account") or target.get("email"))
+                    except Exception:
+                        _rt_log("info", line, target.get("email"))
+                out = (proc.stdout or "").strip()
+                result = json.loads(out) if out else {"ok": False, "banned": False, "error": "拿 RT 进程无输出"}
+            except FileNotFoundError:
+                result = {"ok": False, "banned": False, "error": f"未找到 Node 可执行文件：{NODE_BIN}"}
+            except subprocess.TimeoutExpired:
+                result = {"ok": False, "banned": False, "error": "拿 RT 超时（600s）"}
+            except Exception as exc:  # noqa: BLE001
+                result = {"ok": False, "banned": False, "error": str(exc)}
+
+            # 写回 plus.json
+            with _plus_lock:
+                items = load_plus()
+                rec = next((x for x in items if x.get("email", "").lower() == target.get("email", "").lower()), None)
+                if result.get("ok"):
+                    if rec is not None:
+                        rec["codexRt"] = result.get("refreshToken")
+                        if result.get("clientId"):
+                            rec["codexClientId"] = result.get("clientId")
+                        if result.get("accessToken"):
+                            rec["codexAccessToken"] = result.get("accessToken")
+                        if result.get("idToken"):
+                            rec["codexIdToken"] = result.get("idToken")
+                        rec["codexStatus"] = "ok"
+                        rec["banned"] = False
+                    with _rt_lock:
+                        _rt_state["ok"] += 1
+                    _rt_log("ok", "已获取 refresh_token 并写回", target.get("email"))
+                elif result.get("banned"):
+                    if rec is not None:
+                        rec["banned"] = True
+                        rec["banReason"] = result.get("reason") or ""
+                        rec["codexStatus"] = "banned"
+                    with _rt_lock:
+                        _rt_state["banned"] += 1
+                    _rt_log("warn", "账号已封禁（403 停用/删除），标注为不可用", target.get("email"))
+                else:
+                    if rec is not None:
+                        rec["codexStatus"] = "failed"
+                    with _rt_lock:
+                        _rt_state["fail"] += 1
+                    _rt_log("error", "拿 RT 失败：" + (result.get("error") or "未知原因"), target.get("email"))
+                save_plus(items)
+
+    threads = [threading.Thread(target=worker, args=(k + 1,), name=f"rt-{k+1}", daemon=True) for k in range(concurrency)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+
+    with _rt_lock:
+        _rt_state["running"] = False
+        _rt_state["finished_at"] = int(time.time() * 1000)
+        ok, banned, fail = _rt_state["ok"], _rt_state["banned"], _rt_state["fail"]
+    _rt_log("ok", f"====== 批量拿 RT 结束：成功 {ok} ｜ 封号 {banned} ｜ 失败 {fail} ======")
+
+
+# ---------- POST /api/plus/get-rt ----------
+@bp.post("/api/plus/get-rt")
+def api_plus_get_rt():
+    body = request.get_json(silent=True) or {}
+    emails = [str(e).lower() for e in (body.get("emails") or [])]
+    items = load_plus()
+    targets = [a for a in items if a.get("email", "").lower() in emails]
+    if not targets:
+        return jsonify({"error": "没有匹配的账号"}), 400
+    with _rt_lock:
+        if _rt_state["running"]:
+            return jsonify({"error": "已有拿 RT 任务正在进行"}), 409
+    _rt_log("info", f"收到批量拿 RT 请求：{len(targets)} 个账号")
+    threading.Thread(target=_run_get_rt_batch, args=(targets,), name="rt-batch", daemon=True).start()
+    return jsonify({"started": len(targets)})
+
+
+# ---------- GET /api/plus/rt-status（拿 RT 进度/日志，供前端轮询）----------
+@bp.get("/api/plus/rt-status")
+def api_plus_rt_status():
+    with _rt_lock:
+        return jsonify({
+            "running": _rt_state["running"],
+            "total": _rt_state["total"],
+            "done": _rt_state["done"],
+            "ok": _rt_state["ok"],
+            "banned": _rt_state["banned"],
+            "fail": _rt_state["fail"],
+            "logs": list(_rt_state["logs"][-200:]),
+        })
+
+
+# ==========================================================================
+# 协议注册（复用 get-rt.js 的无密码 OAuth 协议流程，跑在邮箱池的未使用邮箱上）
+# ==========================================================================
+# ---------- 日志美化：把注册/重拿RT 的技术日志压成「纯中文 ≤15 字 脱敏」短语 ----------
+# 设计：集中一个「关键词→中文短语」有序映射；命中即替换；未命中且含技术噪声则丢弃，
+# 未命中但本身已是短中文则原样保留。时间戳/邮箱由前端浮层展示，文本不再重复技术串。
+_BEAUTIFY_RULES = [
+    (r"开始注册|协议注册开始|====== 协议注册开始|浏览器注册开始|====== 浏览器注册开始", "开始注册"),
+    (r"本次完成|协议注册结束|====== 协议注册结束|浏览器注册结束|====== 浏览器注册结束", "本次完成"),
+    (r"浏览器启动|启动浏览器", "启动浏览器"),
+    (r"获取授权成功|获取授权中|授权成功", "获取授权中"),
+    (r"账号登录成功|登录成功", "账号登录成功"),
+    (r"开始重拿|重拿RT中|重新登录中", "重拿RT中"),
+    (r"重拿成功", "重拿成功"),
+    (r"重拿失败", "重拿失败"),
+    # 批量绑手机拿RT：与重拿RT同一套 codex 登录+手机+换RT 流程，仅日志用词区分。
+    (r"开始绑机|绑手机拿RT|绑机拿RT", "绑机拿RT中"),
+    (r"绑机成功|绑手机成功", "绑机成功"),
+    (r"绑机失败|绑手机失败", "绑机失败"),
+    (r"步骤1|初始化 ?OAuth|初始化会话", "正在初始化"),
+    (r"已建号但后续失败|burned", "建号后失败"),
+    (r"user/?register|创建账号|create-account/password|POST .*register", "创建账号中"),
+    (r"authorize/?continue|提交邮箱", "提交邮箱"),
+    (r"email-?otp/?send|请求邮箱验证码|发送验证码", "发送验证码"),
+    (r"命中新鲜.*验证码|已收到验证码|已收到.*码：", "已收到验证码"),
+    (r"从 ?Outlook 收取|收取邮箱验证码|等待 ?verification|查收.*等待|等待短信验证码|等待验证码", "等待验证码"),
+    (r"email-?otp/?validate.*(200|通过)|邮箱验证通过", "邮箱验证通过"),
+    (r"suspicious|号码被拒|拒绝手机号", "号码被拒重试"),
+    (r"NO_BALANCE|余额不足|接码余额", "接码余额不足"),
+    (r"手机验证失败|拿号失败|短信验证码校验失败|拿号超时|短信.*超时", "手机验证失败"),
+    (r"add[_-]?phone|需要手机验证|要求手机验证|phone[_-]?verification", "需要手机验证"),
+    (r"请求号码|拿号|获取手机号|已获取号码|提交手机号", "获取手机号中"),
+    (r"phone-?otp/?validate.*(200|通过)|手机验证完成|手机验证通过", "手机验证通过"),
+    (r"about[_-]?you|补充资料|完善资料", "完善资料中"),
+    (r"consent|workspace/?select|oauth2/?auth|authorization code|获取授权|提取.*code", "获取授权中"),
+    (r"/oauth/?token|换取.*token|换取令牌|获取令牌", "获取令牌中"),
+    (r"refresh_token（第一阶段）|拿到令牌|第一阶段.*成功", "账号登录成功"),
+    (r"获取SUB|开始 ?SUB|第二阶段.*开始", "获取SUB中"),
+    (r"SUB获取成功|SUB 成功|独立 ?SUB", "SUB获取成功"),
+    (r"SUB获取失败|SUB 未取得|SUB.*失败", "SUB获取失败"),
+    (r"注册成功|已保存为 ?GPT|落库", "注册成功"),
+    (r"账号已保存|容错保存", "账号已保存"),
+    (r"已建号但后续失败|burned", "建号后失败"),
+    (r"账号已停用|deactivat|deleted", "账号已停用"),
+    (r"账号已存在|already (registered|exists)|Failed to create account", "账号已存在"),
+    (r"fetch failed|网络|timeout|超时|ECONN|ETIMEDOUT", "网络异常，重试中"),
+    (r"sentinel|安全校验", "安全校验失败"),
+    (r"region|territory|unsupported_country|无资格|不支持|该号不可用", "该号不可用"),
+]
+_BEAUTIFY_COMPILED = [(re.compile(p, re.I), t) for p, t in _BEAUTIFY_RULES]
+# 含以下技术噪声、且未命中任何映射的日志 → 丢弃不展示
+_NOISE_RE = re.compile(
+    r"https?://|HTTP\b|状态：|status|code=|page\.type|continue_url|follow\[|cookie|/api/|"
+    r"login_verifier|consent_challenge|workspace_id|session_dump|localhost|%[0-9A-Fa-f]{2}|"
+    r"\bGET\b|\bPOST\b|refresh_token|access_token|oai-|device|订单|referer|json|body=|"
+    r"仅接受收件时间|返回 page|结果状态|线程#|收到协议注册请求|收尾状态机|"
+    r"使用接码平台|换号重试|次：国家|第 ?\d+/\d+|channel=|订单|WAIT_CODE",
+    re.I,
+)
+_HAN_RE = re.compile(r"[\u4e00-\u9fff]")
+
+
+def _beautify_log(msg: str) -> str | None:
+    """把一条原始日志压成 ≤15 字纯中文短语；返回 None 表示丢弃（纯技术噪声）。"""
+    s = (msg or "").strip()
+    if not s:
+        return None
+    for rx, text in _BEAUTIFY_COMPILED:
+        if rx.search(s):
+            return text
+    # 未命中映射：含技术噪声 → 丢弃；否则若是短中文原样保留（截断 15 字）
+    if _NOISE_RE.search(s):
+        return None
+    if _HAN_RE.search(s) and len(s) <= 30:
+        return s[:15]
+    return None
+
+
+def _reg_log(level: str, msg: str, email: str = "") -> None:
+    clean = _beautify_log(str(msg))
+    if clean is None:
+        return
+    entry = {"ts": int(time.time() * 1000), "level": level, "msg": clean, "account": email or ""}
+    with _reg_lock:
+        _reg_state["logs"].append(entry)
+        if len(_reg_state["logs"]) > _MAX_LOGS:
+            del _reg_state["logs"][: len(_reg_state["logs"]) - _MAX_LOGS]
+
+
+def _save_registered_account(email: str, result: dict) -> None:
+    with _plus_lock:
+        items = load_probe()
+        key = email.lower()
+        rec = next((x for x in items if x.get("email", "").lower() == key), None)
+        if rec is None:
+            rec = {
+                "id": str(uuid.uuid4()),
+                "email": email,
+                "password": "",
+                "clientId": result.get("clientId") or SUB2API_DEFAULT_CLIENT_ID,
+                "refreshToken": "",
+                "accessToken": "",
+                "chatgptAccountId": "",
+                "planType": "",
+                "createdAt": int(time.time() * 1000),
+            }
+            items.append(rec)
+        # 兜底：历史注册记录可能缺 id，补上以免前端编辑/复制按 id 查不到（find 返回 undefined）
+        if not rec.get("id"):
+            rec["id"] = str(uuid.uuid4())
+        rec["refreshToken"] = result.get("refreshToken") or rec.get("refreshToken", "")
+        rec["accessToken"] = result.get("accessToken") or rec.get("accessToken", "")
+        if result.get("password"):
+            rec["password"] = result.get("password")
+        if result.get("clientId"):
+            rec["clientId"] = result.get("clientId")
+        # 第二阶段 SUB / sub2api 授权结果（best-effort）：拿到则记 subOk=True 并保存 SUB 令牌，
+        # 没拿到则 subOk=False（账号第一阶段信息仍然落库，SUB 列显示"否"）。
+        rec["subOk"] = bool(result.get("subOk"))
+        if result.get("subOk"):
+            rec["subClientId"] = result.get("subClientId") or ""
+            rec["subRefreshToken"] = result.get("subRefreshToken") or ""
+            if result.get("subAccessToken"):
+                rec["subAccessToken"] = result.get("subAccessToken")
+        # 网页注册产物（无手机验证策略）：持久化 网页AT / 网页RT / 会话cookie(CK) / 2FA密钥 到账号记录。
+        # 这些字段只要 runner 返回就存，不再局限于 phonePending 分支（用户要求核实密码/AT/RT/2FA 均落库）。
+        if result.get("webAccessToken"):
+            rec["webAccessToken"] = result.get("webAccessToken")
+        if result.get("webRefreshToken"):
+            rec["webRefreshToken"] = result.get("webRefreshToken")
+        if result.get("twoFactorSecret"):
+            rec["twoFactorSecret"] = result.get("twoFactorSecret")
+        if result.get("chatgptAccountId"):
+            rec["chatgptAccountId"] = result.get("chatgptAccountId")
+        cookies = result.get("cookies")
+        if isinstance(cookies, list) and cookies:
+            rec["cookies"] = cookies
+        # phonePending：网页号尚无 codex RT，标记「手机/RT 待补」，SUB 列显示否（现策略不再自动绑手机）。
+        if result.get("phonePending"):
+            rec["phonePending"] = True
+        rec["registeredAt"] = int(time.time() * 1000)
+        save_probe(items)
+
+
+def _run_reg_batch(targets: list, threads: int, mode: str = "protocol", headless: bool = True,
+                   skip_phone: bool = True, web_client: bool = True) -> None:
+    settings = load_settings()
+    proxies = load_proxies()
+    pool = [p for p in proxies if p.get("status") == "ok"] or proxies
+    threads = max(1, min(int(threads or 1), len(targets) or 1, 20))
+    # 注册方式：protocol=HTTP 直连（reg_runner.mjs）；browser=CloakBrowser 浏览器（cloak_reg_runner.mjs）。
+    is_browser = str(mode or "protocol").lower() == "browser"
+    runner = CLOAK_REG_RUNNER if is_browser else REG_RUNNER
+    license_key = str(settings.get("cloakLicenseKey") or "").strip()
+    with _reg_lock:
+        _reg_state.update({"running": True, "stop": False, "total": len(targets), "done": 0,
+                           "ok": 0, "fail": 0, "started_at": int(time.time() * 1000), "finished_at": 0})
+    if is_browser:
+        _reg_log("info", f"====== 浏览器注册开始：{len(targets)} 个邮箱 ｜ 并发 {threads} ｜ "
+                          f"{'无头' if headless else '有头'} ｜ 可用代理 {len(pool)} ｜ "
+                          f"KEY {'已配置' if license_key else '未配置'} ======")
+        if not license_key:
+            _reg_log("warn", "未配置 CloakBrowser KEY，将以免费额度启动（可能受限）")
+    else:
+        _reg_log("info", f"====== 协议注册开始：{len(targets)} 个邮箱 ｜ 并发 {threads} ｜ 可用代理 {len(pool)} ======")
+
+    queue = list(enumerate(targets))
+    q_lock = threading.Lock()
+
+    def worker(wid: int) -> None:
+        while True:
+            with _reg_lock:
+                if _reg_state["stop"]:
+                    return
+            with q_lock:
+                if not queue:
+                    return
+                idx, target = queue.pop(0)
+            # 随机取代理：这些代理是同一网关的不同 session（sid），随机可换出口 IP，
+            # 避免单号测试时永远命中同一个坏 session 导致 fetch failed。
+            proxy = random.choice(pool) if pool else None
+            email = target.get("email")
+            with _reg_lock:
+                _reg_state["done"] += 1
+                done = _reg_state["done"]
+            _reg_log("info", f"—— [{done}/{len(targets)}] 线程#{wid} 开始{'浏览器' if is_browser else '协议'}注册 ——", email)
+            payload = {"email": email, "settings": settings, "proxy": proxy, "otpBase": OTP_INTERNAL_BASE}
+            # 浏览器模式额外透传：无头开关 + CloakBrowser license key（协议模式忽略这些字段）。
+            if is_browser:
+                payload["headless"] = bool(headless)
+                payload["licenseKey"] = license_key
+                # 新策略：注册阶段不做手机验证——走到手机页就采集 CK+AT 入库（手机/RT 由后续批量绑手机再补）。
+                payload["skipPhone"] = bool(skip_phone)
+                # 走 chatgpt.com 网页客户端注册（app_X8zY6…）：实测无密码(邮箱验证码即登录)、不强制手机，
+                # 注册完成即拿「会话 cookie(CK)+网页 AT」。codex 授权流(app_EMoam…)会强制手机，只留给
+                # 后续「批量绑手机拿RT」。默认开启；如需回退 codex 注册流，前端传 webClient=false。
+                payload["webClient"] = bool(web_client)
+            result = None
+            try:
+                # 用 Popen 实时把 Node 的 stderr 日志逐行喂给 reg 日志（原来 subprocess.run 只能在子进程
+                # 结束后一次性读取，导致跑手机验证等长耗时步骤时前端完全看不到进度）。
+                proc = subprocess.Popen(
+                    [NODE_BIN, runner],
+                    stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                    text=True, encoding="utf-8", errors="replace", cwd=str(NODE_DIR),
+                )
+                try:
+                    proc.stdin.write(json.dumps(payload))
+                    proc.stdin.close()
+                except Exception:
+                    pass
+
+                def _pump_stderr() -> None:
+                    try:
+                        for line in proc.stderr:
+                            line = (line or "").strip()
+                            if not line:
+                                continue
+                            try:
+                                rec = json.loads(line)
+                                _reg_log(rec.get("level") or "info", rec.get("msg") or "", rec.get("account") or email)
+                            except Exception:
+                                _reg_log("info", line, email)
+                    except Exception:
+                        pass
+
+                et = threading.Thread(target=_pump_stderr, name=f"reg-err-{wid}", daemon=True)
+                et.start()
+
+                timed_out = {"v": False}
+
+                def _kill_on_timeout() -> None:
+                    timed_out["v"] = True
+                    try:
+                        proc.kill()
+                    except Exception:
+                        pass
+
+                # 浏览器模式首启会下载隐身 Chromium(~200MB) 且有真实渲染/手机验证，耗时更长，
+                # 放宽到 900s；协议模式维持 600s。
+                reg_timeout = 900 if is_browser else 600
+                timer = threading.Timer(reg_timeout, _kill_on_timeout)
+                timer.start()
+                try:
+                    out = (proc.stdout.read() or "").strip()
+                    proc.wait()
+                finally:
+                    timer.cancel()
+                    et.join(timeout=5)
+
+                if timed_out["v"]:
+                    result = {"ok": False, "error": f"注册超时（{reg_timeout}s）"}
+                else:
+                    result = json.loads(out) if out else {"ok": False, "error": "注册进程无输出"}
+            except FileNotFoundError:
+                result = {"ok": False, "error": f"未找到 Node 可执行文件：{NODE_BIN}"}
+            except Exception as exc:  # noqa: BLE001
+                result = {"ok": False, "error": str(exc)}
+
+            if result.get("ok"):
+                _save_registered_account(email, result)
+                with _plus_lock:
+                    mb = load_mailbox()
+                    me = next((x for x in mb.get("entries", []) if x.get("email", "").lower() == email.lower()), None)
+                    if me:
+                        me["used"] = True
+                        me["usedAt"] = int(time.time() * 1000)
+                        save_mailbox(mb)
+                with _reg_lock:
+                    _reg_state["ok"] += 1
+                _reg_log("ok", "注册成功，已保存为 GPT 账号并标记邮箱已使用", email)
+            else:
+                # user/register 已成功但后续失败：账号已在 OpenAI 侧创建，把邮箱标记 burned，
+                # 避免下次再用同一邮箱注册命中"账号已存在"（burned 也计入 used，不再进未使用池）。
+                if result.get("registered"):
+                    with _plus_lock:
+                        mb = load_mailbox()
+                        me = next((x for x in mb.get("entries", []) if x.get("email", "").lower() == email.lower()), None)
+                        if me:
+                            me["used"] = True
+                            me["burned"] = True
+                            me["usedAt"] = int(time.time() * 1000)
+                            me["burnReason"] = (result.get("error") or "注册中途失败")[:200]
+                            save_mailbox(mb)
+                    _reg_log("warn", "该邮箱已建号但后续失败，已标记 burned（不再复用）", email)
+                with _reg_lock:
+                    _reg_state["fail"] += 1
+                _reg_log("error", "注册失败：" + (result.get("error") or "未知原因"), email)
+
+    ts = [threading.Thread(target=worker, args=(k + 1,), name=f"reg-{k+1}", daemon=True) for k in range(threads)]
+    for t in ts:
+        t.start()
+    for t in ts:
+        t.join()
+
+    with _reg_lock:
+        _reg_state["running"] = False
+        _reg_state["finished_at"] = int(time.time() * 1000)
+        ok, fail = _reg_state["ok"], _reg_state["fail"]
+    _reg_log("ok", f"====== {'浏览器' if is_browser else '协议'}注册结束：成功 {ok} ｜ 失败 {fail} ======")
+
+
+@bp.post("/api/reg/start")
+def api_reg_start():
+    body = request.get_json(silent=True) or {}
+    try:
+        count = max(1, int(body.get("count") or 1))
+    except (TypeError, ValueError):
+        count = 1
+    try:
+        threads = max(1, int(body.get("threads") or 1))
+    except (TypeError, ValueError):
+        threads = 1
+    # 注册方式：protocol（默认，HTTP 直连）/ browser（CloakBrowser）；headless 仅浏览器模式有意义。
+    mode = str(body.get("mode") or "protocol").lower()
+    if mode not in ("protocol", "browser"):
+        mode = "protocol"
+    headless = body.get("headless")
+    headless = True if headless is None else bool(headless)
+    # 新策略默认注册阶段跳过手机（浏览器模式）；前端可显式传 skipPhone=false 恢复「注册即绑手机」旧行为。
+    skip_phone = body.get("skipPhone")
+    skip_phone = True if skip_phone is None else bool(skip_phone)
+    # 浏览器注册默认走 chatgpt.com 网页客户端（不强制手机、拿 CK+AT）；传 webClient=false 回退 codex 注册流。
+    web_client = body.get("webClient")
+    web_client = True if web_client is None else bool(web_client)
+    with _reg_lock:
+        if _reg_state["running"]:
+            return jsonify({"error": "已有注册任务正在进行"}), 409
+    mb = load_mailbox()
+    unused = [e for e in mb.get("entries", []) if not e.get("used") and e.get("credential")]
+    if not unused:
+        return jsonify({"error": "邮箱池没有可用的未使用邮箱"}), 400
+    targets = unused[:count]
+    label = "浏览器" if mode == "browser" else "协议"
+    _reg_log("info", f"收到{label}注册请求：计划 {len(targets)} 个（未使用剩余 {len(unused)}），并发 {threads}"
+                     + (f"，{'无头' if headless else '有头'}" if mode == "browser" else ""))
+    threading.Thread(target=_run_reg_batch, args=(targets, threads, mode, headless, skip_phone, web_client),
+                     name="reg-batch", daemon=True).start()
+    return jsonify({"started": len(targets), "mode": mode})
+
+
+# ---------- 重拿RT：对已存在账号跑一次全新 codex 登录（register:false, 全新 device_id） ----------
+# 复用协议注册的日志浮层（_reg_state / _reg_log）显示进度；成功则用新拿到的 codex RT 更新
+# 账号 refreshToken / accessToken / clientId，并标记 SUB=是（这份 RT 本身就是 codex/sub2api 凭据）。
+def _run_refetch_batch(accounts: list, threads: int, label: str = "重拿RT") -> None:
+    # label 用于区分「重拿RT」与「批量绑手机拿RT」——两者底层完全一致（codex 客户端全新登录→
+    # 需要手机则接码→换独立 RT），只是入口/日志用词不同。bind 时成功后额外清 phonePending。
+    is_bind = label.startswith("绑机")
+    prog_msg = f"{label}中"
+    ok_msg = "绑机成功" if is_bind else "重拿成功"
+    fail_prefix = "绑机失败：" if is_bind else "重拿失败："
+    settings = load_settings()
+    proxies = load_proxies()
+    pool = [p for p in proxies if p.get("status") == "ok"] or proxies
+    threads = max(1, min(int(threads or 1), len(accounts) or 1, 20))
+    with _reg_lock:
+        _reg_state.update({"running": True, "stop": False, "total": len(accounts), "done": 0,
+                           "ok": 0, "fail": 0, "started_at": int(time.time() * 1000), "finished_at": 0})
+    _reg_log("info", f"====== 开始{label}：{len(accounts)} 个账号 ｜ 并发 {threads} ======")
+
+    queue = list(accounts)
+    q_lock = threading.Lock()
+
+    def worker(wid: int) -> None:
+        while True:
+            with _reg_lock:
+                if _reg_state["stop"]:
+                    return
+            with q_lock:
+                if not queue:
+                    return
+                acc = queue.pop(0)
+            proxy = random.choice(pool) if pool else None
+            email = acc.get("email") or ""
+            with _reg_lock:
+                _reg_state["done"] += 1
+            _reg_log("info", prog_msg, email)
+            # 运行方式按账号数据分流：
+            #   有 CK(cookies) 的「网页无密码号」→ 浏览器 bindPhone（CK 恢复/邮箱码重登 → codex 授权 → 手机 → RT）；
+            #   无 CK 的「有密码号」（协议模式产出）→ 原 HTTP 密码重登（get-rt.js）。
+            ck = acc.get("cookies") if isinstance(acc.get("cookies"), list) else []
+            use_browser = bool(ck)
+            if use_browser:
+                runner_path = CLOAK_REG_RUNNER
+                payload = {
+                    "email": email,
+                    "password": acc.get("password") or "",
+                    "cookies": ck,
+                    "bindPhone": True,
+                    "settings": settings,
+                    "proxy": proxy,
+                    "otpBase": OTP_INTERNAL_BASE,
+                    # 浏览器 bindPhone 默认有头（与已验证的注册路径一致、便于观测、抗检测更稳）。
+                    "headless": False,
+                    "licenseKey": str(settings.get("cloakLicenseKey") or "").strip(),
+                }
+            else:
+                runner_path = REFETCH_RUNNER
+                payload = {
+                    "email": email,
+                    "password": acc.get("password") or "",
+                    "settings": settings,
+                    "proxy": proxy,
+                    "otpBase": OTP_INTERNAL_BASE,
+                }
+            result = None
+            try:
+                proc = subprocess.Popen(
+                    [NODE_BIN, runner_path],
+                    stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                    text=True, encoding="utf-8", errors="replace", cwd=str(NODE_DIR),
+                )
+                try:
+                    proc.stdin.write(json.dumps(payload))
+                    proc.stdin.close()
+                except Exception:
+                    pass
+
+                def _pump_stderr() -> None:
+                    try:
+                        for line in proc.stderr:
+                            line = (line or "").strip()
+                            if not line:
+                                continue
+                            # 诊断行（[CAP-DIAG]/[BIND-DIAG]/[CLOAK-DIAG]）不进用户日志，保持纯中文≤15字。
+                            if line.startswith("["):
+                                continue
+                            try:
+                                rec = json.loads(line)
+                                _reg_log(rec.get("level") or "info", rec.get("msg") or "", rec.get("account") or email)
+                            except Exception:
+                                pass
+                    except Exception:
+                        pass
+
+                et = threading.Thread(target=_pump_stderr, name=f"refetch-err-{wid}", daemon=True)
+                et.start()
+                timed_out = {"v": False}
+
+                def _kill_on_timeout() -> None:
+                    timed_out["v"] = True
+                    try:
+                        proc.kill()
+                    except Exception:
+                        pass
+
+                # 浏览器 bindPhone（CK 恢复/邮箱码重登 + 手机多国轮试）更耗时，放宽到 1200s；HTTP 重登 600s。
+                to_sec = 1200 if use_browser else 600
+                timer = threading.Timer(to_sec, _kill_on_timeout)
+                timer.start()
+                try:
+                    out = (proc.stdout.read() or "").strip()
+                    proc.wait()
+                finally:
+                    timer.cancel()
+                    et.join(timeout=5)
+                if timed_out["v"]:
+                    result = {"ok": False, "error": f"绑机/重拿RT超时（{to_sec}s）"}
+                else:
+                    result = json.loads(out) if out else {"ok": False, "error": "重拿RT进程无输出"}
+            except FileNotFoundError:
+                result = {"ok": False, "error": f"未找到 Node 可执行文件：{NODE_BIN}"}
+            except Exception as exc:  # noqa: BLE001
+                result = {"ok": False, "error": str(exc)}
+
+            if result.get("ok") and result.get("refreshToken"):
+                with _plus_lock:
+                    items = load_probe()
+                    rec = next((x for x in items if str(x.get("id")) == str(acc.get("id"))), None)
+                    if rec is None:
+                        rec = next((x for x in items if x.get("email", "").lower() == email.lower()), None)
+                    if rec is not None:
+                        rec["refreshToken"] = result.get("refreshToken") or rec.get("refreshToken")
+                        if result.get("accessToken"):
+                            rec["accessToken"] = result.get("accessToken")
+                        rec["clientId"] = result.get("clientId") or rec.get("clientId") or SUB2API_DEFAULT_CLIENT_ID
+                        # 新拿到的 codex RT 本身即 sub2api(SUB) 凭据
+                        rec["subOk"] = True
+                        rec["subClientId"] = result.get("clientId") or rec.get("clientId")
+                        rec["subRefreshToken"] = result.get("refreshToken")
+                        if result.get("accessToken"):
+                            rec["subAccessToken"] = result.get("accessToken")
+                        rec["status"] = "valid"
+                        # 绑手机拿到 RT 后，该账号不再是「待绑手机」态：清 phonePending。
+                        rec["phonePending"] = False
+                        rec["lastCheckedAt"] = int(time.time() * 1000)
+                        save_probe(items)
+                with _reg_lock:
+                    _reg_state["ok"] += 1
+                _reg_log("ok", ok_msg, email)
+            else:
+                with _reg_lock:
+                    _reg_state["fail"] += 1
+                _reg_log("error", fail_prefix + (result.get("error") or "未知原因"), email)
+
+    ts = [threading.Thread(target=worker, args=(k + 1,), name=f"refetch-{k+1}", daemon=True) for k in range(threads)]
+    for t in ts:
+        t.start()
+    for t in ts:
+        t.join()
+
+    with _reg_lock:
+        _reg_state["running"] = False
+        _reg_state["finished_at"] = int(time.time() * 1000)
+        ok, fail = _reg_state["ok"], _reg_state["fail"]
+    _reg_log("ok", f"====== {label}结束：成功 {ok} ｜ 失败 {fail} ======")
+
+
+@bp.post("/api/probe/refetch-rt")
+def api_probe_refetch_rt():
+    body = request.get_json(silent=True) or {}
+    ids = body.get("ids") or []
+    emails = body.get("emails") or []
+    try:
+        threads = max(1, min(int(body.get("threads") or 3), 5))
+    except (TypeError, ValueError):
+        threads = 3
+    with _reg_lock:
+        if _reg_state["running"]:
+            return jsonify({"error": "已有注册/重拿任务正在进行，请稍后"}), 409
+    items = load_probe()
+    idset = {str(x) for x in ids}
+    emset = {str(x).lower() for x in emails}
+    picked = [a for a in items
+              if (idset and str(a.get("id")) in idset) or (emset and str(a.get("email", "")).lower() in emset)]
+    if not picked:
+        return jsonify({"error": "未选择有效账号"}), 400
+    threading.Thread(target=_run_refetch_batch, args=(picked, threads), name="refetch-batch", daemon=True).start()
+    return jsonify({"started": len(picked)})
+
+
+@bp.post("/api/probe/bind-phone-rt")
+def api_probe_bind_phone_rt():
+    """批量绑手机拿RT：对「跳过手机注册」产出的 phonePending（有CK、无RT）账号，
+    用邮箱+固定密码重新登录（路径A）→ 需要手机则走现有 smsbower 多国轮试 → codex 授权换独立 RT。
+    与 /api/probe/refetch-rt 共用 _run_refetch_batch，仅目标筛选与日志用词不同：
+      - 传了 ids/emails：绑手机指定账号（尊重人工选择）；
+      - 未传：自动挑库里所有「phonePending 且无 RT」的账号。
+    成功后 _run_refetch_batch 会写 RT/clientId、SUB=是、并清 phonePending。"""
+    body = request.get_json(silent=True) or {}
+    ids = body.get("ids") or []
+    emails = body.get("emails") or []
+    try:
+        threads = max(1, min(int(body.get("threads") or 3), 5))
+    except (TypeError, ValueError):
+        threads = 3
+    with _reg_lock:
+        if _reg_state["running"]:
+            return jsonify({"error": "已有注册/重拿/绑机任务正在进行，请稍后"}), 409
+    items = load_probe()
+    idset = {str(x) for x in ids}
+    emset = {str(x).lower() for x in emails}
+    if idset or emset:
+        picked = [a for a in items
+                  if str(a.get("id")) in idset or str(a.get("email", "")).lower() in emset]
+    else:
+        picked = [a for a in items
+                  if a.get("phonePending") and not str(a.get("refreshToken") or "").strip()]
+    # 绑手机拿RT 必须有邮箱+密码才能重登；过滤掉缺密码的（避免白跑）。
+    picked = [a for a in picked if a.get("email") and str(a.get("password") or "").strip()]
+    if not picked:
+        return jsonify({"error": "没有可绑手机的账号（需 待绑手机/无RT 且有邮箱密码）"}), 400
+    threading.Thread(target=_run_refetch_batch, args=(picked, threads, "绑机拿RT"),
+                     name="bindphone-batch", daemon=True).start()
+    return jsonify({"started": len(picked)})
+
+
+@bp.get("/api/reg/status")
+def api_reg_status():
+    mb = load_mailbox()
+    unused = sum(1 for e in mb.get("entries", []) if not e.get("used") and e.get("credential"))
+    with _reg_lock:
+        return jsonify({
+            "running": _reg_state["running"],
+            "total": _reg_state["total"],
+            "done": _reg_state["done"],
+            "ok": _reg_state["ok"],
+            "fail": _reg_state["fail"],
+            "logs": list(_reg_state["logs"][-200:]),
+            "unused": unused,
+            "finishedAt": _reg_state["finished_at"],
+        })
+
+
+@bp.post("/api/reg/stop")
+def api_reg_stop():
+    with _reg_lock:
+        if not _reg_state["running"]:
+            return jsonify({"ok": True})
+        _reg_state["stop"] = True
+    _reg_log("warn", "收到停止请求，将在当前进行中的账号完成后结束（不再领取新邮箱）")
+    return jsonify({"ok": True})
+
+
+@bp.post("/api/reg/logs/clear")
+def api_reg_logs_clear():
+    """清空注册日志缓冲（前端点“清空”时调用，后端也一并清掉，避免下次恢复浮层又灌回旧日志）。"""
+    with _reg_lock:
+        _reg_state["logs"].clear()
+    return jsonify({"ok": True})
+
+
+@bp.get("/api/reg/inbox")
+def api_reg_inbox():
+    """供 reg_runner 回读邮箱验证码：按 email 在邮箱池查凭证并读信。"""
+    email = (request.args.get("email") or "").strip()
+    if not email:
+        return jsonify({"messages": []})
+    mb = load_mailbox()
+    e = next((x for x in mb.get("entries", []) if x.get("email", "").lower() == email.lower()), None)
+    if not e or not e.get("credential"):
+        return jsonify({"messages": [], "error": "邮箱不在池中或缺少凭证"})
+    try:
+        msgs = _mailbox_messages(email, e.get("credential", ""), 15)
+        return jsonify({"messages": msgs})
+    except Exception as exc:  # noqa: BLE001
+        return jsonify({"messages": [], "error": f"{type(exc).__name__}: {exc}"})
+
+
+# ---------- POST /api/plus/export（批量导出 SUB2API 格式）----------
+# Export = 返回与 Node 批量导出一致的 SUB2API JSON。默认导出选中且已有 codexRt 的账号。
+@bp.post("/api/plus/export")
+def api_plus_export():
+    body = request.get_json(silent=True) or {}
+    emails = body.get("emails")
+    items = load_plus()
+    if emails:
+        target_set = {str(e).lower() for e in emails}
+        base = [a for a in items if a.get("email", "").lower() in target_set]
+    else:
+        base = items
+    with_rt = [a for a in base if isinstance(a.get("codexRt"), str) and a.get("codexRt")]
+
+    accounts = []
+    for a in with_rt:
+        credentials = {
+            "refresh_token": a.get("codexRt"),
+            "client_id": a.get("codexClientId") or SUB2API_DEFAULT_CLIENT_ID,
+            "email": a.get("email"),
+        }
+        if a.get("codexAccessToken"):
+            credentials["access_token"] = a.get("codexAccessToken")
+        if a.get("codexIdToken"):
+            credentials["id_token"] = a.get("codexIdToken")
+        accounts.append({
+            "name": a.get("email"),
+            "platform": "openai",
+            "type": "oauth",
+            "credentials": credentials,
+            "extra": {"email": a.get("email")},
+            "concurrency": 1,
+            "priority": 1,
+            "rate_multiplier": 1,
+            "auto_pause_on_expired": True,
+        })
+
+    payload = {
+        "type": "sub2api-data",
+        "version": 1,
+        "exported_at": time.strftime("%Y-%m-%dT%H:%M:%S.000Z", time.gmtime()),
+        "proxies": [],
+        "accounts": accounts,
+    }
+    ts = time.strftime("%Y-%m-%dT%H-%M-%S", time.gmtime())
+    filename = f"sub2api_export_{ts}.json"
+    return Response(
+        json.dumps(payload, ensure_ascii=False, indent=2),
+        mimetype="application/json",
+        headers={"Content-Disposition": f'attachment; filename="{filename}"',
+                 "X-Export-Count": str(len(accounts))},
+    )
+
+
+# ==========================================================================
+# GPT 账号管理（probe / sub2api）—— 从 auto probe.js + server.js 的 /api/probe/accounts
+# 组忠实移植。数据存储：card-binding/data/probe_accounts.json。
+# TOKEN 刷新是对 https://auth.openai.com/oauth/token 的普通表单 POST（无 sentinel/PoW），
+# 因此用 httpx 在 Python 里原样复刻，并可经代理池转发（应对区域限制）。
+# ==========================================================================
+PROBE_FILE = DATA_DIR / "probe_accounts.json"
+OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token"
+OPENAI_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
+OPENAI_SCOPE = "openid profile email offline_access"
+CHROME_UA = ("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 "
+             "(KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36")
+PROBE_TOKEN_NEAR_EXP_SEC = 24 * 3600  # 临近过期阈值：1 天
+
+_probe_lock = threading.RLock()
+_probe_rr = {"i": 0}  # 代理池 round-robin 游标
+
+# 自动刷新运行态（mirror server.js 的 probeTokenAuto）
+_probe_auto = {"running": False, "lastRunAt": 0, "lastResult": None}
+_probe_auto_lock = threading.RLock()
+_probe_auto_wake = threading.Event()
+
+# 批量检测运行态（≤5 线程并发跑实时套餐校验）
+_probe_detect = {"running": False, "total": 0, "done": 0, "ok": 0, "fail": 0, "startedAt": 0, "finishedAt": 0}
+_probe_detect_lock = threading.RLock()
+
+
+def load_probe() -> list:
+    with _probe_lock:
+        DATA_DIR.mkdir(parents=True, exist_ok=True)
+        if not PROBE_FILE.exists():
+            return []
+        try:
+            data = json.loads(PROBE_FILE.read_text(encoding="utf-8"))
+            if not isinstance(data, list):
+                return []
+        except Exception:
+            return []
+    # 兜底补 id：历史/注册落库的记录可能缺 id，导致前端按 id 查不到而无法编辑/复制。
+    changed = False
+    for a in data:
+        if isinstance(a, dict) and not a.get("id"):
+            a["id"] = str(uuid.uuid4())
+            changed = True
+    if changed:
+        save_probe(data)
+    return data
+
+
+def save_probe(items: list) -> None:
+    with _probe_lock:
+        DATA_DIR.mkdir(parents=True, exist_ok=True)
+        PROBE_FILE.write_text(json.dumps(items, ensure_ascii=False, indent=2), encoding="utf-8")
+
+
+def save_settings(data: dict) -> None:
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    SETTINGS_FILE.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
+
+
+# ---------- 邮箱池（email----专用密码 / email----取件API链接）----------
+def load_mailbox() -> dict:
+    try:
+        data = json.loads(MAILBOX_FILE.read_text(encoding="utf-8"))
+    except Exception:
+        data = {}
+    if not isinstance(data, dict):
+        return {"split": False, "entries": []}
+    entries = data.get("entries")
+    return {
+        "split": bool(data.get("split")),
+        "entries": entries if isinstance(entries, list) else [],
+    }
+
+
+def save_mailbox(data: dict) -> None:
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    MAILBOX_FILE.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
+
+
+def parse_mailbox_lines(text: str) -> list:
+    """每行 email----credential；credential 为 http(s) 链接则视为取件 API，否则为 IMAP 专用密码。"""
+    out: list = []
+    seen: set = set()
+    for raw in str(text or "").split("\n"):
+        line = raw.replace("\r", "").strip()
+        if not line:
+            continue
+        if "----" in line:
+            parts = line.split("----", 1)
+        elif "\t" in line:
+            parts = line.split("\t", 1)
+        elif "|" in line:
+            parts = line.split("|", 1)
+        else:
+            parts = re.split(r"\s+", line, maxsplit=1)
+        if len(parts) < 2:
+            continue
+        email = parts[0].strip()
+        cred = parts[1].strip()
+        if not _EMAIL_RE.match(email) or not cred:
+            continue
+        key = email.lower()
+        if key in seen:
+            continue
+        seen.add(key)
+        typ = "api" if re.match(r"^https?://", cred, re.I) else "imap"
+        out.append({"email": email, "credential": cred, "type": typ, "used": False})
+    return out
+
+
+def merge_mailbox_entries(existing: list, parsed: list) -> tuple:
+    """把 parsed 合并进 existing：已存在的邮箱更新凭证但保留 used 状态；新邮箱追加(used=False)。"""
+    by_email = {e.get("email", "").lower(): e for e in existing}
+    added = 0
+    for item in parsed:
+        key = item["email"].lower()
+        cur = by_email.get(key)
+        if cur:
+            cur["credential"] = item["credential"]
+            cur["type"] = item["type"]
+        else:
+            existing.append(item)
+            by_email[key] = item
+            added += 1
+    return existing, added
+
+
+def _mailbox_public(e: dict) -> dict:
+    return {
+        "email": e.get("email", ""),
+        "type": e.get("type", "imap"),
+        "used": bool(e.get("used")),
+        "credential": e.get("credential", ""),
+    }
+
+
+def _mailbox_to_line(e: dict) -> str:
+    return f"{e.get('email', '')}----{e.get('credential', '')}"
+
+
+_IMAP_HOSTS = {
+    "icloud.com": "imap.mail.me.com",
+    "me.com": "imap.mail.me.com",
+    "mac.com": "imap.mail.me.com",
+    "gmail.com": "imap.gmail.com",
+    "googlemail.com": "imap.gmail.com",
+    "outlook.com": "outlook.office365.com",
+    "hotmail.com": "outlook.office365.com",
+    "live.com": "outlook.office365.com",
+}
+
+
+def _imap_host_for(email: str) -> str:
+    dom = email.rsplit("@", 1)[-1].lower()
+    return _IMAP_HOSTS.get(dom, "imap." + dom)
+
+
+def _extract_code(text: str) -> str:
+    s = str(text or "")
+    # OpenAI 验证码固定 6 位，优先匹配独立的 6 位数字（避免误取年份/金额等）
+    m = re.search(r"(?<!\d)(\d{6})(?!\d)", s)
+    if m:
+        return m.group(1)
+    # 退回 4-8 位，但跳过明显的 4 位年份
+    for mm in re.finditer(r"(?<!\d)(\d{4,8})(?!\d)", s):
+        val = mm.group(1)
+        if len(val) == 4 and 1990 <= int(val) <= 2100:
+            continue
+        return val
+    return ""
+
+
+def _strip_html_text(html: str) -> str:
+    """去掉 style/script/标签，得到可见正文，用于提取验证码。"""
+    s = re.sub(r"<style[^>]*>.*?</style>", " ", str(html or ""), flags=re.S | re.I)
+    s = re.sub(r"<script[^>]*>.*?</script>", " ", s, flags=re.S | re.I)
+    s = re.sub(r"<[^>]+>", " ", s)
+    s = re.sub(r"&nbsp;|&amp;|&zwnj;|&#\d+;", " ", s)
+    return re.sub(r"\s+", " ", s).strip()
+
+
+def _clean_header_text(s: str) -> str:
+    """清理发件人/主题/日期等短字段：解码常见实体并折叠空白，
+    但保留形如 <addr@domain> 的邮箱地址（不当作 HTML 标签删除）。"""
+    t = str(s or "")
+    t = t.replace("&lt;", "<").replace("&gt;", ">").replace("&amp;", "&")
+    t = re.sub(r"&nbsp;|&zwnj;|&#\d+;", " ", t)
+    return re.sub(r"\s+", " ", t).strip()
+
+
+def _parse_api_mailbox_html(html: str, limit: int = 15) -> list:
+    """解析第三方取件 API 返回的 HTML（icloud-api.top 等）为逐封邮件记录。
+    页面结构：每封邮件为一个 <div class="card">，内含 .fr(发件人)/.su(主题)/.dt(日期)/.bd(正文)。
+    返回 get-rt.js 期望的形状：[{from_addr, subject, body, received_at(ISO), extracted_code}]。"""
+    from email.utils import parsedate_to_datetime
+
+    text = str(html or "")
+    chunks = text.split('<div class="card">')[1:]
+    out: list = []
+    for ch in chunks[:limit]:
+        frm_m = re.search(r'<div class="fr">(.*?)</div>', ch, re.S)
+        su_m = re.search(r'<div class="su">(.*?)</div>', ch, re.S)
+        dt_m = re.search(r'<div class="dt">(.*?)</div>', ch, re.S)
+        bd_m = re.search(r'<div class="bd">(.*)$', ch, re.S)
+        frm = _clean_header_text(frm_m.group(1)) if frm_m else ""
+        subject = _clean_header_text(su_m.group(1)) if su_m else ""
+        raw_date = _clean_header_text(dt_m.group(1)) if dt_m else ""
+        body = _strip_html_text(bd_m.group(1)) if bd_m else ""
+        try:
+            dt = parsedate_to_datetime(raw_date)
+            recv_iso = dt.isoformat() if dt else raw_date
+        except Exception:
+            recv_iso = raw_date
+        code = _extract_code(subject) or _extract_code(body)
+        out.append({
+            "from_addr": frm,
+            "subject": subject,
+            "body": body,
+            "received_at": recv_iso,
+            "extracted_code": code,
+        })
+    # 无 card 结构时退回整页扫描（尽量仍可取到码）
+    if not out:
+        clean = _strip_html_text(text)
+        code = _extract_code(clean)
+        if clean:
+            out.append({
+                "from_addr": "",
+                "subject": clean[:120],
+                "body": clean,
+                "received_at": "",
+                "extracted_code": code,
+            })
+    return out
+
+
+def _msg_text(msg) -> str:
+    parts: list = []
+    try:
+        walk = msg.walk() if msg.is_multipart() else [msg]
+        for p in walk:
+            if p.get_content_type() not in ("text/plain", "text/html"):
+                continue
+            try:
+                payload = p.get_payload(decode=True)
+                if payload:
+                    parts.append(payload.decode(p.get_content_charset() or "utf-8", "replace"))
+            except Exception:
+                continue
+    except Exception:
+        pass
+    return "\n".join(parts)
+
+
+def _mailbox_test_imap(email: str, credential: str, limit: int = 5) -> dict:
+    import imaplib
+    import email as emaillib
+    from email.header import decode_header, make_header
+
+    host = _imap_host_for(email)
+    M = imaplib.IMAP4_SSL(host, 993, timeout=20)
+    try:
+        M.login(email, credential.replace(" ", ""))
+        M.select("INBOX", readonly=True)
+        typ, data = M.search(None, "ALL")
+        ids = data[0].split() if data and data[0] else []
+        ids = ids[-limit:][::-1]
+        messages: list = []
+        for i in ids:
+            # iCloud 对 (RFC822) 返回空，需用 BODY.PEEK[]（且不置 \Seen 标记）
+            typ, md = M.fetch(i, "(BODY.PEEK[])")
+            if typ != "OK" or not md:
+                continue
+            raw = next((p[1] for p in md if isinstance(p, tuple) and len(p) >= 2 and p[1]), None)
+            if not raw:
+                continue
+            msg = emaillib.message_from_bytes(raw)
+            try:
+                subject = str(make_header(decode_header(msg.get("Subject", ""))))
+            except Exception:
+                subject = msg.get("Subject", "")
+            try:
+                frm = str(make_header(decode_header(msg.get("From", ""))))
+            except Exception:
+                frm = msg.get("From", "")
+            body = _msg_text(msg)
+            code = _extract_code(subject) or _extract_code(re.sub(r"<[^>]+>", " ", body))
+            messages.append({
+                "from": frm,
+                "subject": subject,
+                "date": msg.get("Date", ""),
+                "code": code,
+            })
+        return {"ok": True, "type": "imap", "host": host, "count": len(messages), "messages": messages}
+    finally:
+        try:
+            M.logout()
+        except Exception:
+            pass
+
+
+def _mailbox_test_api(email: str, url: str) -> dict:
+    if httpx is None:
+        raise RuntimeError("httpx 不可用，无法请求取件 API")
+    r = httpx.get(url, timeout=25, follow_redirects=True)
+    parsed = _parse_api_mailbox_html(r.text or "", 15)
+    # 展示层：优先展示 OpenAI/ChatGPT 验证码那封
+    def _score(m):
+        blob = f"{m.get('from_addr','')} {m.get('subject','')}".lower()
+        s = 0
+        if "openai" in blob or "chatgpt" in blob:
+            s += 2
+        if "verification" in blob or "验证" in blob:
+            s += 1
+        return s
+    best = sorted(parsed, key=_score, reverse=True)[0] if parsed else None
+    return {
+        "ok": r.status_code == 200,
+        "type": "api",
+        "status": r.status_code,
+        "code": (best or {}).get("extracted_code", ""),
+        "count": len(parsed),
+        "messages": [{
+            "from": m.get("from_addr", ""),
+            "subject": m.get("subject", "")[:200],
+            "date": m.get("received_at", ""),
+            "code": m.get("extracted_code", ""),
+        } for m in parsed],
+    }
+
+
+def _decode_header(v: str) -> str:
+    from email.header import decode_header, make_header
+    try:
+        return str(make_header(decode_header(v or "")))
+    except Exception:
+        return str(v or "")
+
+
+def _mailbox_messages(email: str, credential: str, limit: int = 15) -> list:
+    """读取邮箱最新邮件，返回 get-rt.js 期望的形状：
+    [{from_addr, subject, body, received_at(ISO), extracted_code}]。"""
+    if re.match(r"^https?://", credential, re.I):
+        if httpx is None:
+            return []
+        try:
+            r = httpx.get(credential, timeout=25, follow_redirects=True)
+        except Exception:
+            return []
+        return _parse_api_mailbox_html(r.text or "", limit)
+
+    import imaplib
+    import email as emaillib
+    from email.utils import parsedate_to_datetime
+
+    host = _imap_host_for(email)
+    M = imaplib.IMAP4_SSL(host, 993, timeout=20)
+    try:
+        M.login(email, credential.replace(" ", ""))
+        M.select("INBOX", readonly=True)
+        typ, data = M.search(None, "ALL")
+        ids = (data[0].split() if data and data[0] else [])[-limit:][::-1]
+        msgs: list = []
+        for i in ids:
+            typ, md = M.fetch(i, "(BODY.PEEK[])")
+            raw = None
+            if typ == "OK" and md:
+                raw = next((p[1] for p in md if isinstance(p, tuple) and len(p) >= 2 and p[1]), None)
+            if not raw:
+                continue
+            m = emaillib.message_from_bytes(raw)
+            subject = _decode_header(m.get("Subject", ""))
+            frm = _decode_header(m.get("From", ""))
+            body = _msg_text(m)
+            recv = m.get("Date", "")
+            try:
+                dt = parsedate_to_datetime(recv)
+                recv_iso = dt.isoformat() if dt else recv
+            except Exception:
+                recv_iso = recv
+            code = _extract_code(subject) or _extract_code(re.sub(r"<[^>]+>", " ", body))
+            msgs.append({
+                "from_addr": frm,
+                "subject": subject,
+                "body": body,
+                "received_at": recv_iso,
+                "extracted_code": code,
+            })
+        return msgs
+    finally:
+        try:
+            M.logout()
+        except Exception:
+            pass
+
+
+def _clamp_int(v, lo, hi, default):
+    try:
+        n = int(round(float(v)))
+    except (TypeError, ValueError):
+        return default
+    return max(lo, min(hi, n))
+
+
+# ---------- sub2api 解析：兼容 JSON 与 email----password----clientId----refreshToken 行格式 ----------
+def parse_sub2api(raw) -> list:
+    text = raw if isinstance(raw, str) else json.dumps(raw)
+    text = str(text or "").strip()
+    if not text:
+        return []
+    # 1) 优先尝试 sub2api JSON（导出文件 / 账号数组）
+    obj = None
+    try:
+        obj = json.loads(text)
+    except Exception:
+        obj = None
+    if obj is not None:
+        if isinstance(obj, list):
+            arr = obj
+        elif isinstance(obj, dict) and isinstance(obj.get("accounts"), list):
+            arr = obj["accounts"]
+        else:
+            arr = []
+        out = []
+        for a in arr:
+            if not isinstance(a, dict):
+                continue
+            cred = a.get("credentials") or a.get("creds") or {}
+            extra = a.get("extra") or {}
+            email = a.get("name") or a.get("email") or extra.get("email") or ""
+            access_token = cred.get("access_token") or a.get("access_token") or ""
+            refresh_token = cred.get("refresh_token") or a.get("refresh_token") or ""
+            if not email and not access_token and not refresh_token:
+                continue
+            out.append({
+                "email": str(email or "").strip(),
+                "password": str(cred.get("password") or a.get("password") or ""),
+                "accessToken": str(access_token or ""),
+                "refreshToken": str(refresh_token or ""),
+                "clientId": str(cred.get("client_id") or a.get("client_id") or ""),
+                "chatgptAccountId": str(cred.get("chatgpt_account_id") or a.get("chatgpt_account_id") or ""),
+                "planType": str(a.get("plan_type") or cred.get("plan_type") or ""),
+            })
+        return out
+    # 2) 行格式（非 JSON）——逐行自动识别：
+    #    含分隔符(---- / tab / |)且 >=4 段 → email----password----clientId----refreshToken；
+    #    否则整行视为一个裸 access token（仅 accessToken，其余留空）。
+    out = []
+    seen = set()
+
+    def _dedupe_key(email, at, rt):
+        if email:
+            return "email:" + email.lower()
+        if at:
+            return "at:" + at
+        if rt:
+            return "rt:" + rt
+        return ""
+
+    def _add(email, password, client_id, refresh_token, access_token):
+        key = _dedupe_key(email, access_token, refresh_token)
+        if not key or key in seen:
+            return
+        seen.add(key)
+        out.append({
+            "email": email,
+            "password": password,
+            "clientId": client_id,
+            "refreshToken": refresh_token,
+            "accessToken": access_token,
+            "chatgptAccountId": "",
+            "planType": "",
+        })
+
+    for raw_line in text.split("\n"):
+        line = raw_line.replace("\r", "").strip()
+        if not line:
+            continue
+        delim = "----" if "----" in line else ("\t" if "\t" in line else ("|" if "|" in line else None))
+        if delim is not None:
+            parts = [s.strip() for s in line.split(delim) if s.strip()]
+            if len(parts) >= 4 and _EMAIL_RE.match(parts[0]):
+                _add(parts[0], parts[1], parts[2], parts[3], "")
+            # 分隔符行但字段不足/首列非邮箱 → 视为非法，跳过
+            continue
+        # 无分隔符：可能是空白分隔的 4 字段，或裸 access token
+        ws = [s for s in re.split(r"\s+", line) if s]
+        if len(ws) >= 4 and _EMAIL_RE.match(ws[0]):
+            _add(ws[0], ws[1], ws[2], ws[3], "")
+        else:
+            # 裸 AT：JWT 不含空白，取整行作为 accessToken
+            _add("", "", "", "", ws[0] if len(ws) == 1 else line)
+    return out
+
+
+# ---------- JWT / 账号派生 ----------
+def decode_jwt_payload(token: str):
+    try:
+        parts = str(token or "").split(".")
+        if len(parts) < 2:
+            return None
+        seg = parts[1].replace("-", "+").replace("_", "/")
+        seg += "=" * ((4 - len(seg) % 4) % 4)
+        data = json.loads(base64.b64decode(seg).decode("utf-8", "replace"))
+        return data if isinstance(data, dict) else None
+    except Exception:
+        return None
+
+
+def enrich_probe_account(acc: dict) -> dict:
+    a = acc or {}
+    payload = decode_jwt_payload(a.get("accessToken")) or {}
+    auth = payload.get("https://api.openai.com/auth") or {}
+    plan_raw = str(auth.get("chatgpt_plan_type") or "").strip()
+    # 实时 accounts/check 检测得到的套餐(livePlanType / 存储的 planType)权威;
+    # JWT 里的 chatgpt_plan_type 常年过期(PLUS 账号也可能显示 free),仅作兜底。
+    effective_plan = str(a.get("livePlanType") or a.get("planType") or "").strip() or plan_raw
+    exp = int(payload.get("exp") or 0) if payload else 0
+    now = int(time.time())
+    stored = a.get("status") if a.get("status") in ("valid", "invalid", "unknown") else "unknown"
+    token_expired = (exp <= now) if exp else None
+    remaining = (exp - now) if exp else None
+    # 展示状态：ok / expiring / invalid / unknown（源于 JWT exp，尊重刷新失败标记的 invalid）
+    if stored == "invalid":
+        display = "invalid"
+    elif exp:
+        display = "ok" if remaining > PROBE_TOKEN_NEAR_EXP_SEC else "expiring"
+    elif stored == "valid":
+        display = "ok"
+    else:
+        display = "unknown"
+    return {
+        "id": a.get("id"),
+        "email": a.get("email") or "",
+        "password": a.get("password") or "",
+        "twoFactorSecret": a.get("twoFactorSecret") or "",
+        "accessToken": a.get("accessToken") or "",
+        "refreshToken": a.get("refreshToken") or "",
+        "clientId": a.get("clientId") or "",
+        "chatgptAccountId": a.get("chatgptAccountId") or auth.get("chatgpt_account_id") or "",
+        "planType": effective_plan or "unknown",
+        "planLabel": effective_plan.upper() if effective_plan else "未知",
+        "tokenExp": exp,
+        "tokenExpired": token_expired,
+        "tokenExpiresInSec": remaining,
+        "status": display,
+        "rawStatus": stored,
+        "hasAccess": bool(a.get("accessToken")),
+        "hasRefresh": bool(a.get("refreshToken")),
+        # SUB / sub2api 第二阶段授权是否成功（用于账号列表的"SUB"列）
+        "subOk": bool(a.get("subOk")),
+        # 批量直开(card-flow)开通成功的标记（pool-mark-opened 写入）
+        "opened": bool(a.get("opened")),
+        "activatedAt": a.get("activatedAt"),
+        "note": a.get("note") or "",
+        "lastCheckedAt": a.get("lastCheckedAt") or 0,
+        "createdAt": a.get("createdAt") or 0,
+    }
+
+
+# ---------- 代理：从池里取一个（round-robin），转成 httpx 代理 URL ----------
+def _proxy_url_from(proxy: dict):
+    if not proxy or not proxy.get("host") or not proxy.get("port"):
+        return None
+    user = proxy.get("username")
+    if user:
+        from urllib.parse import quote as _q
+        auth = f"{_q(str(user))}:{_q(str(proxy.get('password') or ''))}@"
+    else:
+        auth = ""
+    return f"http://{auth}{proxy['host']}:{proxy['port']}"
+
+
+def _pick_proxy_url():
+    proxies = load_proxies()
+    ok = [p for p in proxies if p.get("status") == "ok"]
+    pool = ok if ok else proxies
+    if not pool:
+        return None
+    with _probe_lock:
+        idx = _probe_rr["i"] % len(pool)
+        _probe_rr["i"] += 1
+    return _proxy_url_from(pool[idx])
+
+
+# ---------- 核心：refresh_token 换 access_token（普通 HTTPS，忠实复刻 probe.js refreshOpenAiTokens）----------
+def refresh_openai_tokens(refresh_token: str, proxy_url: str | None = None) -> dict:
+    if not refresh_token:
+        return {"ok": False, "accessToken": "", "refreshToken": "", "error": "missing_refresh_token", "httpStatus": 0}
+    if httpx is None:
+        return {"ok": False, "accessToken": "", "refreshToken": "", "error": "httpx_unavailable", "httpStatus": 0}
+    data = {
+        "grant_type": "refresh_token",
+        "client_id": OPENAI_CLIENT_ID,
+        "refresh_token": refresh_token,
+        "scope": OPENAI_SCOPE,
+    }
+    headers = {"content-type": "application/x-www-form-urlencoded", "user-agent": CHROME_UA}
+    try:
+        client_kwargs = {"timeout": 30.0, "headers": headers}
+        if proxy_url:
+            client_kwargs["proxy"] = proxy_url
+        with httpx.Client(**client_kwargs) as client:
+            r = client.post(OPENAI_TOKEN_URL, data=data)
+        try:
+            body = r.json()
+        except Exception:
+            body = {}
+        if r.status_code == 200 and body.get("access_token"):
+            return {
+                "ok": True,
+                "accessToken": str(body.get("access_token") or ""),
+                "refreshToken": str(body.get("refresh_token") or refresh_token or ""),
+                "error": "",
+                "httpStatus": r.status_code,
+            }
+        err = str(body.get("error") or body.get("error_description") or f"HTTP {r.status_code}")
+        return {"ok": False, "accessToken": "", "refreshToken": "", "error": err, "httpStatus": r.status_code}
+    except Exception as exc:  # noqa: BLE001
+        return {"ok": False, "accessToken": "", "refreshToken": "", "error": str(exc), "httpStatus": 0}
+
+
+def _refresh_with_fallback(refresh_token: str) -> dict:
+    """先经代理池刷新；若因区域被 403(unsupported_country...) 拦截，则直连再试一次。
+    auto 原实现是直连（无代理），这里保留“代理池优先 + 直连兜底”以兼顾区域限制。"""
+    proxy_url = _pick_proxy_url()
+    r = refresh_openai_tokens(refresh_token, proxy_url)
+    if (not r.get("ok")) and proxy_url and r.get("httpStatus") == 403 \
+            and re.search(r"unsupported_country|region|territory", r.get("error") or "", re.I):
+        r2 = refresh_openai_tokens(refresh_token, None)  # 直连兜底
+        if r2.get("ok") or r2.get("httpStatus") not in (0, 403):
+            return r2
+    return r
+
+
+# ---------- 实时套餐校验：用 access_token 调 accounts/check（curl_cffi 子进程）----------
+def _plan_check_once(access_token: str, account_id: str, proxy_url: str | None) -> dict:
+    payload = {"access_token": access_token, "account_id": account_id or "", "proxy": proxy_url or "DIRECT"}
+    try:
+        proc = subprocess.run(
+            [PY_BIN, PLAN_CHECK_SCRIPT],
+            input=json.dumps(payload),
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            cwd=str(ROOT),
+            timeout=90,
+        )
+    except FileNotFoundError:
+        return {"ok": False, "httpStatus": 0, "error": f"未找到 Python 解释器：{PY_BIN}"}
+    except subprocess.TimeoutExpired:
+        return {"ok": False, "httpStatus": 0, "error": "套餐校验超时"}
+    out = (proc.stdout or "").strip()
+    if not out:
+        return {"ok": False, "httpStatus": 0, "error": (proc.stderr or "no output")[:300]}
+    try:
+        return json.loads(out.splitlines()[-1])
+    except Exception:
+        return {"ok": False, "httpStatus": 0, "error": out[:300]}
+
+
+def _live_plan_check(access_token: str, account_id: str) -> dict:
+    """先经代理池校验；若区域 403 被拦，直连兜底再试一次。"""
+    proxy_url = _pick_proxy_url()
+    r = _plan_check_once(access_token, account_id, proxy_url)
+    if (not r.get("ok")) and proxy_url and (
+        r.get("httpStatus") in (403, 0)
+        or re.search(r"unsupported_country|region|territory", str(r.get("error") or ""), re.I)
+    ):
+        r2 = _plan_check_once(access_token, account_id, None)  # 直连兜底
+        if r2.get("ok"):
+            return r2
+    return r
+
+
+def _refresh_probe_by_id(acc_id: str) -> dict:
+    with _probe_lock:
+        items = load_probe()
+        acc = next((a for a in items if str(a.get("id")) == str(acc_id)), None)
+        if not acc:
+            return {"ok": False, "notFound": True, "error": "账号不存在"}
+        if not acc.get("refreshToken"):
+            acc["status"] = "invalid"
+            acc["lastCheckedAt"] = int(time.time() * 1000)
+            save_probe(items)
+            return {"ok": False, "error": "缺少 refreshToken", "account": enrich_probe_account(acc)}
+        rt = acc["refreshToken"]
+    r = _refresh_with_fallback(rt)
+    with _probe_lock:
+        items = load_probe()
+        acc = next((a for a in items if str(a.get("id")) == str(acc_id)), None)
+        if not acc:
+            return {"ok": False, "notFound": True, "error": "账号不存在"}
+        acc["lastCheckedAt"] = int(time.time() * 1000)
+        if r.get("ok") and r.get("accessToken"):
+            acc["accessToken"] = r["accessToken"]
+            if r.get("refreshToken"):
+                acc["refreshToken"] = r["refreshToken"]
+            acc["status"] = "valid"
+            save_probe(items)
+            return {"ok": True, "account": enrich_probe_account(acc)}
+        invalid = r.get("httpStatus") == 401 or re.search(r"invalid_grant|invalid_token|unauthorized", r.get("error") or "", re.I)
+        acc["status"] = "invalid" if invalid else (acc.get("status") or "unknown")
+        save_probe(items)
+        return {"ok": False, "error": r.get("error") or "refresh_failed",
+                "httpStatus": r.get("httpStatus"), "account": enrich_probe_account(acc)}
+
+
+def _run_probe_auto_refresh() -> dict:
+    with _probe_auto_lock:
+        if _probe_auto["running"]:
+            return _probe_auto["lastResult"]
+        _probe_auto["running"] = True
+    summary = {"scanned": 0, "refreshed": 0, "skipped": 0, "failed": 0, "invalid": 0}
+    try:
+        snapshot = load_probe()
+        now = int(time.time())
+        summary["scanned"] = len(snapshot)
+        updates: dict = {}  # id -> 待写回字段（仅按 id 合并，避免覆盖并发删除/编辑）
+        for acc in snapshot:
+            try:
+                if not acc.get("refreshToken"):
+                    summary["skipped"] += 1
+                    continue
+                payload = decode_jwt_payload(acc.get("accessToken"))
+                exp = int(payload.get("exp") or 0) if payload else 0
+                status = str(acc.get("status") or "unknown")
+                need = status == "unknown" or not exp or exp <= now + PROBE_TOKEN_NEAR_EXP_SEC
+                if not need:
+                    summary["skipped"] += 1
+                    continue
+                r = _refresh_with_fallback(acc["refreshToken"])
+                upd = {"lastCheckedAt": int(time.time() * 1000)}
+                if r.get("ok") and r.get("accessToken"):
+                    upd["accessToken"] = r["accessToken"]
+                    if r.get("refreshToken"):
+                        upd["refreshToken"] = r["refreshToken"]
+                    upd["status"] = "valid"
+                    summary["refreshed"] += 1
+                else:
+                    invalid = r.get("httpStatus") == 401 or re.search(r"invalid_grant|invalid_token|unauthorized", r.get("error") or "", re.I)
+                    if invalid:
+                        upd["status"] = "invalid"
+                        summary["invalid"] += 1
+                    else:
+                        summary["failed"] += 1
+                updates[str(acc.get("id"))] = upd
+            except Exception:
+                summary["failed"] += 1
+        # 按 id 合并写回当前存储（重新加载，跳过期间已被删除的账号）
+        with _probe_lock:
+            items = load_probe()
+            by_id = {str(a.get("id")): a for a in items}
+            for acc_id, upd in updates.items():
+                target = by_id.get(acc_id)
+                if target is not None:
+                    target.update(upd)
+            save_probe(items)
+        with _probe_auto_lock:
+            _probe_auto["lastRunAt"] = int(time.time() * 1000)
+            _probe_auto["lastResult"] = summary
+        return summary
+    finally:
+        with _probe_auto_lock:
+            _probe_auto["running"] = False
+
+
+def _auto_refresh_state() -> dict:
+    s = load_settings()
+    with _probe_auto_lock:
+        return {
+            "enabled": s.get("probeTokenAutoRefresh", True) is not False,
+            "intervalMin": _clamp_int(s.get("probeTokenAutoRefreshMin"), 5, 1440, 15),
+            "lastRunAt": _probe_auto["lastRunAt"],
+            "lastResult": _probe_auto["lastResult"],
+            "running": _probe_auto["running"],
+        }
+
+
+def _auto_refresh_loop():
+    time.sleep(8)  # 启动后稍晚跑一轮，避免拖慢 listen（对齐 auto）
+    while True:
+        try:
+            state = _auto_refresh_state()
+            if state["enabled"]:
+                _run_probe_auto_refresh()
+            interval = _auto_refresh_state()["intervalMin"]
+        except Exception:
+            interval = 15
+        _probe_auto_wake.wait(timeout=interval * 60)
+        _probe_auto_wake.clear()
+
+
+# ---------- GET /api/probe/accounts ----------
+@bp.get("/api/probe/accounts")
+def api_probe_list():
+    items = load_probe()
+    return jsonify({
+        "accounts": [enrich_probe_account(a) for a in items],
+        "autoRefresh": _auto_refresh_state(),
+    })
+
+
+# ---------- POST /api/probe/accounts/import ----------
+@bp.post("/api/probe/accounts/import")
+def api_probe_import():
+    body = request.get_json(silent=True) or {}
+    parsed = parse_sub2api(body.get("text") or "")
+    with _probe_lock:
+        items = load_probe()
+        by_email = {str(a.get("email") or "").lower(): a for a in items if a.get("email")}
+        by_at = {str(a.get("accessToken")): a for a in items if a.get("accessToken")}
+        by_rt = {str(a.get("refreshToken")): a for a in items if a.get("refreshToken")}
+        added = 0
+        updated = 0
+        for item in parsed:
+            key = str(item.get("email") or "").lower()
+            # 有邮箱按邮箱去重；无邮箱(裸AT/仅RT)按 accessToken / refreshToken 去重
+            existing = by_email.get(key) if key else None
+            if existing is None and not key:
+                if item.get("accessToken"):
+                    existing = by_at.get(str(item.get("accessToken")))
+                if existing is None and item.get("refreshToken"):
+                    existing = by_rt.get(str(item.get("refreshToken")))
+            if existing:
+                existing["accessToken"] = item.get("accessToken") or existing.get("accessToken") or ""
+                existing["refreshToken"] = item.get("refreshToken") or existing.get("refreshToken") or ""
+                if item.get("password"):
+                    existing["password"] = item["password"]
+                if item.get("clientId"):
+                    existing["clientId"] = item["clientId"]
+                existing["chatgptAccountId"] = item.get("chatgptAccountId") or existing.get("chatgptAccountId") or ""
+                existing["planType"] = item.get("planType") or existing.get("planType") or ""
+                existing["status"] = "unknown"
+                existing["lastCheckedAt"] = 0
+                updated += 1
+            else:
+                rec = {
+                    "id": str(uuid.uuid4()),
+                    "email": item.get("email") or "",
+                    "password": item.get("password") or "",
+                    "clientId": item.get("clientId") or "",
+                    "refreshToken": item.get("refreshToken") or "",
+                    "accessToken": item.get("accessToken") or "",
+                    "chatgptAccountId": item.get("chatgptAccountId") or "",
+                    "planType": item.get("planType") or "",
+                    "note": "",
+                    "status": "unknown",
+                    "lastCheckedAt": 0,
+                    "createdAt": int(time.time() * 1000),
+                }
+                items.append(rec)
+                if key:
+                    by_email[key] = rec
+                if rec.get("accessToken"):
+                    by_at[str(rec["accessToken"])] = rec
+                if rec.get("refreshToken"):
+                    by_rt[str(rec["refreshToken"])] = rec
+                added += 1
+        save_probe(items)
+        total = len(items)
+    # 导入后触发未知状态账号的自动刷新（若开启）
+    if (added + updated) > 0 and _auto_refresh_state()["enabled"]:
+        threading.Thread(target=_run_probe_auto_refresh, name="probe-import-refresh", daemon=True).start()
+    return jsonify({"added": added, "updated": updated, "parsed": len(parsed), "total": total})
+
+
+# ---------- PUT /api/probe/accounts（编辑）----------
+@bp.put("/api/probe/accounts")
+def api_probe_edit():
+    body = request.get_json(silent=True) or {}
+    acc_id = str(body.get("id") or "")
+    if not acc_id:
+        return jsonify({"error": "缺少 id"}), 400
+    with _probe_lock:
+        items = load_probe()
+        acc = next((a for a in items if str(a.get("id")) == acc_id), None)
+        if not acc:
+            return jsonify({"error": "账号不存在"}), 404
+        if body.get("email") is not None:
+            acc["email"] = str(body.get("email") or "").strip()
+        if body.get("accessToken") is not None:
+            acc["accessToken"] = str(body.get("accessToken") or "").strip()
+        if body.get("refreshToken") is not None:
+            acc["refreshToken"] = str(body.get("refreshToken") or "").strip()
+        if body.get("chatgptAccountId") is not None:
+            acc["chatgptAccountId"] = str(body.get("chatgptAccountId") or "").strip()
+        if body.get("password") is not None:
+            acc["password"] = str(body.get("password") or "")
+        if body.get("twoFactorSecret") is not None:
+            acc["twoFactorSecret"] = str(body.get("twoFactorSecret") or "").strip()
+        if body.get("note") is not None:
+            acc["note"] = str(body.get("note") or "")
+        # 编辑后：可解 JWT 且原为 invalid 则回到 unknown 等待下次校验
+        payload = decode_jwt_payload(acc.get("accessToken"))
+        if payload and payload.get("exp"):
+            acc["status"] = "unknown" if acc.get("status") == "invalid" else (acc.get("status") or "unknown")
+        save_probe(items)
+        enriched = enrich_probe_account(acc)
+    return jsonify({"account": enriched})
+
+
+# ---------- POST /api/probe/accounts/refresh（刷新一个）----------
+@bp.post("/api/probe/accounts/refresh")
+def api_probe_refresh():
+    body = request.get_json(silent=True) or {}
+    acc_id = str(body.get("id") or "")
+    if not acc_id:
+        return jsonify({"error": "缺少 id"}), 400
+    result = _refresh_probe_by_id(acc_id)
+    if not result.get("ok") and result.get("notFound"):
+        return jsonify({"error": "账号不存在"}), 404
+    return jsonify(result)
+
+
+# ---------- POST /api/probe/accounts/detect（用 access_token 实时查真实套餐 FREE/PLUS/PRO）----------
+# 优先实时调用 chatgpt.com/backend-api/accounts/check（curl_cffi 子进程，读 plan_type +
+# has_active_subscription）——这是账号“当前真实级别”，而非 AT 内 JWT 的历史标记。
+# 若 AT 已过期且有 refreshToken，先刷新拿到最新 AT 再校验；实时校验失败(区域/被拦/无网络)时
+# 回退用 AT 内 JWT 字段，并在返回中标注 source=jwt 与失败原因，绝不谎报为实时结果。
+@bp.post("/api/probe/accounts/detect")
+def api_probe_detect():
+    body = request.get_json(silent=True) or {}
+    acc_id = str(body.get("id") or "")
+    if not acc_id:
+        return jsonify({"error": "缺少 id"}), 400
+    with _probe_lock:
+        acc = next((a for a in load_probe() if str(a.get("id")) == acc_id), None)
+        if acc is None:
+            return jsonify({"error": "账号不存在"}), 404
+        has_rt = bool(acc.get("refreshToken"))
+        payload = decode_jwt_payload(acc.get("accessToken"))
+        exp = int(payload.get("exp") or 0) if payload else 0
+    # AT 过期且有 refreshToken：先刷新，拿到可用于实时校验的最新 AT
+    refreshed = False
+    if has_rt and (not exp or exp <= int(time.time())):
+        refreshed = bool(_refresh_probe_by_id(acc_id).get("ok"))
+
+    with _probe_lock:
+        items = load_probe()
+        acc = next((a for a in items if str(a.get("id")) == acc_id), None)
+        if acc is None:
+            return jsonify({"error": "账号不存在"}), 404
+        access_token = str(acc.get("accessToken") or "")
+        account_id = str(acc.get("chatgptAccountId") or "")
+
+    if not access_token:
+        with _probe_lock:
+            items = load_probe()
+            acc = next((a for a in items if str(a.get("id")) == acc_id), None)
+            pub = enrich_probe_account(acc) if acc else {}
+        return jsonify({"ok": False, "error": "缺少 Access Token，无法检测套餐", "account": pub})
+
+    # 实时 accounts/check
+    live = _live_plan_check(access_token, account_id)
+    if live.get("ok") and (live.get("plan") or live.get("active")):
+        plan = str(live.get("plan") or ("plus" if live.get("active") else "")).strip().lower()
+        with _probe_lock:
+            items = load_probe()
+            acc = next((a for a in items if str(a.get("id")) == acc_id), None)
+            if acc is None:
+                return jsonify({"error": "账号不存在"}), 404
+            if plan:
+                acc["planType"] = plan
+                acc["livePlanType"] = plan  # 实时检测权威值，enrich 优先使用，避免被 JWT/再导入覆盖
+            if live.get("accountId") and not acc.get("chatgptAccountId"):
+                acc["chatgptAccountId"] = live.get("accountId")
+            acc["lastCheckedAt"] = int(time.time() * 1000)
+            pub = enrich_probe_account(acc)
+            save_probe(items)
+        return jsonify({
+            "ok": True,
+            "source": "live",
+            "refreshed": refreshed,
+            "active": bool(live.get("active")),
+            "planType": pub.get("planType"),
+            "planLabel": pub.get("planLabel"),
+            "account": pub,
+        })
+
+    # 实时失败 → 回退 JWT，如实标注
+    with _probe_lock:
+        items = load_probe()
+        acc = next((a for a in items if str(a.get("id")) == acc_id), None)
+        if acc is None:
+            return jsonify({"error": "账号不存在"}), 404
+        pub = enrich_probe_account(acc)
+        acc["planType"] = pub.get("planType")
+        acc["lastCheckedAt"] = int(time.time() * 1000)
+        save_probe(items)
+    reason = str(live.get("error") or "").strip()
+    if live.get("httpStatus"):
+        reason = f"HTTP {live.get('httpStatus')} {reason}".strip()
+    return jsonify({
+        "ok": True,
+        "source": "jwt",
+        "refreshed": refreshed,
+        "liveError": reason or "实时校验失败",
+        "planType": pub.get("planType"),
+        "planLabel": pub.get("planLabel"),
+        "account": pub,
+    })
+
+
+# ---------- 批量检测：≤5 线程并发跑实时套餐校验 ----------
+def _probe_detect_once(acc_id: str) -> bool:
+    """对单个账号跑实时 accounts/check（代理→直连兜底），写回 planType/livePlanType。
+    per-account 异常不抛出（由 _safe_detect_one 兜底），返回是否成功检测到套餐。"""
+    with _probe_lock:
+        items = load_probe()
+        acc = next((a for a in items if str(a.get("id")) == str(acc_id)), None)
+        if not acc:
+            return False
+        access_token = str(acc.get("accessToken") or "")
+        account_id = str(acc.get("chatgptAccountId") or "")
+    if not access_token:
+        return False
+    live = _live_plan_check(access_token, account_id)  # 不持锁跑子进程，允许并发
+    with _probe_lock:
+        items = load_probe()
+        acc = next((a for a in items if str(a.get("id")) == str(acc_id)), None)
+        if not acc:
+            return False
+        acc["lastCheckedAt"] = int(time.time() * 1000)
+        if live.get("ok") and (live.get("plan") or live.get("active")):
+            plan = str(live.get("plan") or ("plus" if live.get("active") else "")).strip().lower()
+            if plan:
+                acc["planType"] = plan
+                acc["livePlanType"] = plan
+            if live.get("accountId") and not acc.get("chatgptAccountId"):
+                acc["chatgptAccountId"] = live.get("accountId")
+            save_probe(items)
+            return True
+        save_probe(items)
+        return False
+
+
+def _safe_detect_one(acc_id: str) -> bool:
+    try:
+        return _probe_detect_once(acc_id)
+    except Exception:
+        return False
+
+
+def _run_probe_detect_batch(ids: list) -> None:
+    from concurrent.futures import ThreadPoolExecutor, as_completed
+    with _probe_detect_lock:
+        _probe_detect.update({"running": True, "total": len(ids), "done": 0, "ok": 0, "fail": 0,
+                              "startedAt": int(time.time() * 1000), "finishedAt": 0})
+    try:
+        with ThreadPoolExecutor(max_workers=5) as ex:
+            futs = [ex.submit(_safe_detect_one, i) for i in ids]
+            for fut in as_completed(futs):
+                ok = False
+                try:
+                    ok = bool(fut.result())
+                except Exception:
+                    ok = False
+                with _probe_detect_lock:
+                    _probe_detect["done"] += 1
+                    if ok:
+                        _probe_detect["ok"] += 1
+                    else:
+                        _probe_detect["fail"] += 1
+    finally:
+        with _probe_detect_lock:
+            _probe_detect["running"] = False
+            _probe_detect["finishedAt"] = int(time.time() * 1000)
+
+
+# ---------- POST /api/probe/accounts/detect-batch（选中或全部，≤5 线程）----------
+@bp.post("/api/probe/accounts/detect-batch")
+def api_probe_detect_batch():
+    body = request.get_json(silent=True) or {}
+    ids = body.get("ids")
+    with _probe_lock:
+        items = load_probe()
+        if ids:
+            idset = {str(x) for x in ids}
+            targets = [str(a.get("id")) for a in items if str(a.get("id")) in idset and a.get("accessToken")]
+        else:
+            targets = [str(a.get("id")) for a in items if a.get("accessToken")]
+    with _probe_detect_lock:
+        if _probe_detect["running"]:
+            return jsonify({"ok": False, "error": "批量检测正在进行中", "status": dict(_probe_detect)}), 409
+    if not targets:
+        return jsonify({"ok": False, "error": "没有可检测的账号（需有 Access Token）"}), 400
+    threading.Thread(target=_run_probe_detect_batch, args=(targets,), name="probe-detect-batch", daemon=True).start()
+    return jsonify({"ok": True, "total": len(targets)})
+
+
+# ---------- GET /api/probe/accounts/detect-batch/status（进度轮询）----------
+@bp.get("/api/probe/accounts/detect-batch/status")
+def api_probe_detect_batch_status():
+    with _probe_detect_lock:
+        return jsonify(dict(_probe_detect))
+
+
+# ---------- GET/POST /api/probe/accounts/auto-refresh（开关 + 间隔）----------
+@bp.get("/api/probe/accounts/auto-refresh")
+def api_probe_auto_get():
+    return jsonify(_auto_refresh_state())
+
+
+@bp.post("/api/probe/accounts/auto-refresh")
+def api_probe_auto_post():
+    body = request.get_json(silent=True) or {}
+    s = load_settings()
+    enabled = body.get("enabled")
+    s["probeTokenAutoRefresh"] = enabled is not False and enabled != "false"
+    if body.get("intervalMin") is not None:
+        s["probeTokenAutoRefreshMin"] = _clamp_int(body.get("intervalMin"), 5, 1440, 15)
+    save_settings(s)
+    _probe_auto_wake.set()  # 唤醒调度线程，使新配置立即生效
+    if body.get("runNow"):
+        threading.Thread(target=_run_probe_auto_refresh, name="probe-run-now", daemon=True).start()
+    return jsonify(_auto_refresh_state())
+
+
+# ---------- DELETE /api/probe/accounts（ids / all）----------
+@bp.delete("/api/probe/accounts")
+def api_probe_delete():
+    body = request.get_json(silent=True) or {}
+    with _probe_lock:
+        items = load_probe()
+        before = len(items)
+        if body.get("all"):
+            items = []
+        else:
+            ids = {str(i) for i in (body.get("ids") or [])}
+            items = [a for a in items if str(a.get("id")) not in ids]
+        save_probe(items)
+        total = len(items)
+    return jsonify({"removed": before - total, "total": total})
+
+
+# ---------- POST /api/probe/accounts/export-at（批量导出 AT，一行一个）----------
+@bp.post("/api/probe/accounts/export-at")
+def api_probe_export_at():
+    body = request.get_json(silent=True) or {}
+    ids = body.get("ids")
+    items = load_probe()
+    base = [a for a in items if str(a.get("id")) in {str(i) for i in ids}] if ids else items
+    tokens = [str(a.get("accessToken") or "").strip() for a in base]
+    tokens = [t for t in tokens if t]
+    ts = time.strftime("%Y-%m-%dT%H-%M-%S", time.gmtime())
+    return Response(
+        "\n".join(tokens) + ("\n" if tokens else ""),
+        mimetype="text/plain",
+        headers={"Content-Disposition": f'attachment; filename="probe_at_export_{ts}.txt"',
+                 "X-Export-Count": str(len(tokens))},
+    )
+
+
+# ---------- POST /api/probe/accounts/export-sub（批量导出 SUB2API JSON）----------
+@bp.post("/api/probe/accounts/export-sub")
+def api_probe_export_sub():
+    body = request.get_json(silent=True) or {}
+    ids = body.get("ids")
+    items = load_probe()
+    base = [a for a in items if str(a.get("id")) in {str(i) for i in ids}] if ids else items
+    # 有第二阶段 SUB 令牌的用 SUB 令牌导出；否则回退第一阶段 refreshToken（clientId 用 sub2api 默认常量）。
+    with_rt = [a for a in base if str(a.get("subRefreshToken") or a.get("refreshToken") or "").strip()]
+    accounts = []
+    for a in with_rt:
+        email = a.get("email") or ""
+        sub_rt = str(a.get("subRefreshToken") or "").strip()
+        if sub_rt:
+            credentials = {"refresh_token": sub_rt, "client_id": a.get("subClientId") or SUB2API_DEFAULT_CLIENT_ID, "email": email}
+            if a.get("subAccessToken"):
+                credentials["access_token"] = a.get("subAccessToken")
+        else:
+            credentials = {"refresh_token": a.get("refreshToken"), "client_id": SUB2API_DEFAULT_CLIENT_ID, "email": email}
+            if a.get("accessToken"):
+                credentials["access_token"] = a.get("accessToken")
+        if a.get("chatgptAccountId"):
+            credentials["chatgpt_account_id"] = a.get("chatgptAccountId")
+        accounts.append({
+            "name": email, "platform": "openai", "type": "oauth",
+            "credentials": credentials, "extra": {"email": email},
+            "concurrency": 1, "priority": 1, "rate_multiplier": 1, "auto_pause_on_expired": True,
+        })
+    payload = {
+        "type": "sub2api-data", "version": 1,
+        "exported_at": time.strftime("%Y-%m-%dT%H:%M:%S.000Z", time.gmtime()),
+        "proxies": [], "accounts": accounts,
+    }
+    ts = time.strftime("%Y-%m-%dT%H-%M-%S", time.gmtime())
+    return Response(
+        json.dumps(payload, ensure_ascii=False, indent=2),
+        mimetype="application/json",
+        headers={"Content-Disposition": f'attachment; filename="sub2api_export_{ts}.json"',
+                 "X-Export-Count": str(len(accounts))},
+    )
+
+
+# ---------- POST /api/probe/accounts/export-pw（批量导出账密，一行一个 email----password）----------
+@bp.post("/api/probe/accounts/export-pw")
+def api_probe_export_pw():
+    body = request.get_json(silent=True) or {}
+    ids = body.get("ids")
+    items = load_probe()
+    base = [a for a in items if str(a.get("id")) in {str(i) for i in ids}] if ids else items
+    # 首行表头 + 每行 email----password----twoFactorSecret（字段缺失留空但保留分隔符）。
+    lines = ["账号----密码----2FA"]
+    for a in base:
+        email = str(a.get("email") or "").strip()
+        if not email:
+            continue
+        pw = str(a.get("password") or "").strip()
+        tfa = str(a.get("twoFactorSecret") or "").strip()
+        lines.append(f"{email}----{pw}----{tfa}")
+    ts = time.strftime("%Y-%m-%dT%H-%M-%S", time.gmtime())
+    return Response(
+        "\n".join(lines) + "\n",
+        mimetype="text/plain",
+        headers={"Content-Disposition": f'attachment; filename="probe_pw_export_{ts}.txt"',
+                 "X-Export-Count": str(max(0, len(lines) - 1))},  # 数据行数（不含表头）
+    )
+
+
+# ==========================================================================
+# 设置：代理池 + 接码/SMS 配置的读写（供页面「设置」弹窗使用）
+# ==========================================================================
+def _proxy_to_line(p: dict) -> str:
+    if p.get("raw"):
+        return str(p["raw"])
+    host = p.get("host") or ""
+    port = p.get("port") or ""
+    user = p.get("username") or ""
+    pw = p.get("password") or ""
+    if user:
+        return f"{host}:{port}:{user}:{pw}"
+    return f"{host}:{port}"
+
+
+def _parse_proxy_line(line: str):
+    line = line.strip()
+    if not line:
+        return None
+    # 支持 scheme://user:pass@host:port
+    m = re.match(r"^(?:(\w+)://)?(?:([^:@/]+):([^@/]*)@)?([^:/@]+):(\d+)$", line)
+    if m:
+        _scheme, u1, p1, host, port = m.groups()
+        rec = {"raw": line, "host": host, "port": int(port)}
+        if u1:
+            rec["username"] = u1
+            rec["password"] = p1 or ""
+        return rec
+    # 支持 host:port:user:pass
+    parts = line.split(":")
+    if len(parts) == 2:
+        return {"raw": line, "host": parts[0], "port": int(parts[1])} if parts[1].isdigit() else None
+    if len(parts) >= 4 and parts[1].isdigit():
+        return {"raw": line, "host": parts[0], "port": int(parts[1]), "username": parts[2], "password": ":".join(parts[3:])}
+    return None
+
+
+@bp.get("/api/account-config")
+def api_account_config_get():
+    proxies = load_proxies()
+    settings = load_settings()
+    sms = settings.get("sms") or {}
+    provider = sms.get("provider") or "smscode"
+    prov_cfg = sms.get(provider) or {}
+    mb = load_mailbox()
+
+    def _sms_view(cfg: dict) -> dict:
+        cfg = cfg or {}
+        country = cfg.get("country")
+        if country in (None, ""):
+            country = cfg.get("countryId")
+        return {
+            "apiKey": cfg.get("apiKey") or "",
+            "baseUrl": cfg.get("baseUrl") or "",
+            "country": "" if country in (None, "") else country,
+            "maxPrice": cfg.get("maxPrice") or "",
+            "service": cfg.get("service") or "",
+        }
+
+    return jsonify({
+        "proxies": [_proxy_to_line(p) for p in proxies],
+        "proxyCount": len(proxies),
+        "sms": {
+            "provider": provider,
+            "pollTimeout": sms.get("pollTimeout") or 180000,
+            **_sms_view(prov_cfg),
+        },
+        "smsAll": {p: _sms_view(sms.get(p) or {}) for p in ("smscode", "smsbower", "herosms")},
+        "providers": ["smscode", "smsbower", "herosms"],
+        "mailbox": {
+            "entries": [_mailbox_public(e) for e in mb.get("entries", [])],
+            "count": len(mb.get("entries", [])),
+            "unused": sum(1 for e in mb.get("entries", []) if not e.get("used")),
+            "split": bool(mb.get("split")),
+        },
+        # 浏览器注册（CloakBrowser）设置：license key + 固定注册密码（与 proxy/sms/mailbox 同一套 settings.json 持久化）。
+        "cloak": {
+            "licenseKey": settings.get("cloakLicenseKey") or "",
+            "regPassword": settings.get("regPassword") or "",
+        },
+    })
+
+
+@bp.post("/api/account-config")
+def api_account_config_post():
+    body = request.get_json(silent=True) or {}
+    result = {"proxySaved": False, "smsSaved": False}
+
+    # 代理池：支持传字符串（一行一个）或已解析数组
+    if "proxies" in body:
+        raw = body.get("proxies")
+        lines = raw.split("\n") if isinstance(raw, str) else [str(x) for x in (raw or [])]
+        parsed = []
+        bad = []
+        for ln in lines:
+            ln = ln.strip()
+            if not ln:
+                continue
+            rec = _parse_proxy_line(ln)
+            if rec:
+                parsed.append(rec)
+            else:
+                bad.append(ln)
+        CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+        PROXY_FILE.write_text(json.dumps(parsed, ensure_ascii=False, indent=2), encoding="utf-8")
+        result["proxySaved"] = True
+        result["proxyCount"] = len(parsed)
+        result["proxyBad"] = bad
+
+    # 接码/SMS 配置
+    if "sms" in body and isinstance(body["sms"], dict):
+        sms_in = body["sms"]
+        settings = load_settings()
+        sms = settings.get("sms") or {}
+        provider = sms_in.get("provider") if sms_in.get("provider") in ("smscode", "smsbower", "herosms") else (sms.get("provider") or "smscode")
+        sms["provider"] = provider
+        if sms_in.get("pollTimeout") is not None:
+            try:
+                sms["pollTimeout"] = int(sms_in["pollTimeout"])
+            except (TypeError, ValueError):
+                pass
+        prov_cfg = dict(sms.get(provider) or {})
+        if sms_in.get("apiKey") is not None:
+            prov_cfg["apiKey"] = str(sms_in.get("apiKey") or "")
+        if sms_in.get("baseUrl"):
+            prov_cfg["baseUrl"] = str(sms_in.get("baseUrl"))
+        if sms_in.get("country") is not None:
+            raw_country = str(sms_in.get("country") or "").strip()
+            country_val: object = ""
+            if raw_country:
+                country_val = int(raw_country) if raw_country.isdigit() else raw_country
+            # smscode 用 countryId，其余(smsbower/herosms)用 country
+            if provider == "smscode":
+                prov_cfg["countryId"] = country_val
+            else:
+                prov_cfg["country"] = country_val
+        if sms_in.get("maxPrice") is not None:
+            prov_cfg["maxPrice"] = str(sms_in.get("maxPrice") or "").strip()
+        sms[provider] = prov_cfg
+        settings["sms"] = sms
+        save_settings(settings)
+        result["smsSaved"] = True
+
+    # 邮箱池：这里只更新 split 开关，条目增改删走 /api/mailbox/* 独立接口（避免清掉 used 状态）
+    if "mailbox" in body and isinstance(body["mailbox"], dict):
+        mb = load_mailbox()
+        mb["split"] = bool(body["mailbox"].get("split"))
+        save_mailbox(mb)
+        result["mailboxSaved"] = True
+
+    # 浏览器注册（CloakBrowser）license key：存到 settings.json 的 cloakLicenseKey，
+    # 供 cloak_reg_runner.mjs 启动隐身 Chromium 时使用（Pro 用最新二进制）。
+    if "cloak" in body and isinstance(body["cloak"], dict):
+        settings = load_settings()
+        if body["cloak"].get("licenseKey") is not None:
+            settings["cloakLicenseKey"] = str(body["cloak"].get("licenseKey") or "").strip()
+        # 固定注册密码：两种注册模式共用（reg_password.mjs 优先读 settings.regPassword）；
+        # 留空则清空，运行时回退到内置默认强口令。
+        if body["cloak"].get("regPassword") is not None:
+            settings["regPassword"] = str(body["cloak"].get("regPassword") or "").strip()
+        save_settings(settings)
+        result["cloakSaved"] = True
+
+    return jsonify(result)
+
+
+# ---------- 邮箱池条目管理 ----------
+@bp.post("/api/mailbox/import")
+def api_mailbox_import():
+    body = request.get_json(silent=True) or {}
+    parsed = parse_mailbox_lines(body.get("text") or "")
+    with _plus_lock:
+        mb = load_mailbox()
+        entries, added = merge_mailbox_entries(mb.get("entries", []), parsed)
+        mb["entries"] = entries
+        save_mailbox(mb)
+    return jsonify({
+        "added": added,
+        "parsed": len(parsed),
+        "count": len(entries),
+        "unused": sum(1 for e in entries if not e.get("used")),
+        "entries": [_mailbox_public(e) for e in entries],
+    })
+
+
+@bp.post("/api/mailbox/update")
+def api_mailbox_update():
+    body = request.get_json(silent=True) or {}
+    email = str(body.get("email") or "").strip().lower()
+    if not email:
+        return jsonify({"ok": False, "error": "缺少邮箱"}), 400
+    with _plus_lock:
+        mb = load_mailbox()
+        e = next((x for x in mb.get("entries", []) if x.get("email", "").lower() == email), None)
+        if not e:
+            return jsonify({"ok": False, "error": "邮箱不存在"}), 404
+        if body.get("credential") is not None:
+            cred = str(body.get("credential") or "").strip()
+            if cred:
+                e["credential"] = cred
+                e["type"] = "api" if re.match(r"^https?://", cred, re.I) else "imap"
+        if body.get("used") is not None:
+            e["used"] = bool(body.get("used"))
+        save_mailbox(mb)
+    return jsonify({"ok": True, "entry": _mailbox_public(e)})
+
+
+@bp.post("/api/mailbox/split-generate")
+def api_mailbox_split_generate():
+    """为每个主邮箱(local 不含 +)生成 count 个 local+XXXX 别名，复用主邮箱凭证，并入列表。"""
+    body = request.get_json(silent=True) or {}
+    try:
+        count = max(1, min(200, int(body.get("count") or 10)))
+    except (TypeError, ValueError):
+        count = 10
+    with _plus_lock:
+        mb = load_mailbox()
+        entries = mb.get("entries", [])
+        existing = {e.get("email", "").lower() for e in entries}
+        added = 0
+        for e in list(entries):
+            email = e.get("email", "")
+            if "@" not in email:
+                continue
+            local, _, domain = email.partition("@")
+            if "+" in local:
+                continue  # 已是别名不再分裂
+            for _ in range(count):
+                alias = ""
+                for _try in range(50):
+                    cand = f"{local}+{uuid.uuid4().hex[:4]}@{domain}"
+                    if cand.lower() not in existing:
+                        alias = cand
+                        break
+                if not alias:
+                    continue
+                existing.add(alias.lower())
+                entries.append({
+                    "email": alias,
+                    "credential": e.get("credential", ""),
+                    "type": e.get("type", "imap"),
+                    "used": False,
+                    "alias_of": email,
+                })
+                added += 1
+        mb["entries"] = entries
+        save_mailbox(mb)
+    return jsonify({
+        "added": added,
+        "count": len(entries),
+        "unused": sum(1 for e in entries if not e.get("used")),
+        "entries": [_mailbox_public(e) for e in entries],
+    })
+
+
+@bp.post("/api/mailbox/delete")
+def api_mailbox_delete():
+    body = request.get_json(silent=True) or {}
+    targets = {str(x).strip().lower() for x in (body.get("emails") or [])}
+    one = str(body.get("email") or "").strip().lower()
+    if one:
+        targets.add(one)
+    if not targets:
+        return jsonify({"ok": False, "error": "缺少邮箱"}), 400
+    with _plus_lock:
+        mb = load_mailbox()
+        before = len(mb.get("entries", []))
+        mb["entries"] = [e for e in mb.get("entries", []) if e.get("email", "").lower() not in targets]
+        save_mailbox(mb)
+        entries = mb["entries"]
+    return jsonify({
+        "ok": True,
+        "removed": before - len(entries),
+        "count": len(entries),
+        "unused": sum(1 for e in entries if not e.get("used")),
+        "entries": [_mailbox_public(e) for e in entries],
+    })
+
+
+@bp.post("/api/mailbox/clear")
+def api_mailbox_clear():
+    """清空邮箱池全部条目（前端已做主题化二次确认）。"""
+    with _plus_lock:
+        mb = load_mailbox()
+        removed = len(mb.get("entries", []))
+        mb["entries"] = []
+        save_mailbox(mb)
+    return jsonify({"ok": True, "removed": removed, "count": 0, "unused": 0, "entries": []})
+
+
+@bp.post("/api/sms/balance")
+def api_sms_balance():
+    """查询接码平台余额（smsbower / herosms 走 handler_api.php 的 getBalance）。"""
+    body = request.get_json(silent=True) or {}
+    settings = load_settings()
+    sms = settings.get("sms") or {}
+    provider = str(body.get("provider") or sms.get("provider") or "smsbower").strip()
+    prov_cfg = sms.get(provider) or {}
+    api_key = str(body.get("apiKey") or prov_cfg.get("apiKey") or "").strip()
+    base_url = str(body.get("baseUrl") or prov_cfg.get("baseUrl") or "").strip()
+    if not api_key:
+        return jsonify({"ok": False, "error": "未配置 API Key"})
+    if not base_url:
+        return jsonify({"ok": False, "error": "未配置 Base URL"})
+    if httpx is None:
+        return jsonify({"ok": False, "error": "httpx 不可用"})
+    try:
+        r = httpx.get(base_url, params={"api_key": api_key, "action": "getBalance"}, timeout=20)
+        text = (r.text or "").strip()
+        if text.startswith("ACCESS_BALANCE"):
+            bal = text.split(":", 1)[1].strip() if ":" in text else ""
+            return jsonify({"ok": True, "provider": provider, "balance": bal, "raw": text})
+        errmap = {
+            "BAD_KEY": "API 密钥不正确",
+            "BAD_ACTION": "动作错误",
+            "ERROR_SQL": "服务端错误，请稍后再试",
+        }
+        return jsonify({"ok": False, "error": errmap.get(text, text or f"HTTP {r.status_code}")})
+    except Exception as exc:
+        return jsonify({"ok": False, "error": f"{type(exc).__name__}: {exc}"})
+
+
+@bp.post("/api/mailbox/test")
+def api_mailbox_test():
+    body = request.get_json(silent=True) or {}
+    email = str(body.get("email") or "").strip()
+    credential = str(body.get("credential") or "").strip()
+    if not credential:
+        for e in load_mailbox().get("entries", []):
+            if e.get("email", "").lower() == email.lower():
+                credential = e.get("credential", "")
+                break
+    if not _EMAIL_RE.match(email) or not credential:
+        return jsonify({"ok": False, "error": "缺少邮箱或凭证"}), 400
+    try:
+        if re.match(r"^https?://", credential, re.I):
+            return jsonify(_mailbox_test_api(email, credential))
+        return jsonify(_mailbox_test_imap(email, credential))
+    except Exception as exc:
+        return jsonify({"ok": False, "error": f"{type(exc).__name__}: {exc}"})
+
+
+# 启动 TOKEN 自动刷新后台调度线程（daemon）
+_probe_auto_thread = threading.Thread(target=_auto_refresh_loop, name="probe-auto-refresh", daemon=True)
+_probe_auto_thread.start()
diff --git a/app.py b/app.py
new file mode 100644
index 0000000..ddb1ae3
--- /dev/null
+++ b/app.py
@@ -0,0 +1,62 @@
+"""开源版 —— GPT 管理（account-manager）精简 Flask 应用。
+
+本应用只真实运行「GPT管理」这一开源功能（account_manager 蓝图，页面 /account-manager/、
+API 前缀 /api/plus 与 /api/probe）。其余功能（批量直开 / 协议支付 / 提取链接 / 直卡直开）
+不放任何代码，改为在右侧内容区用 iframe 内嵌对应线上服务（见 /embed/<target>）。
+
+本地预览默认端口 5090，避免和可能在跑的 5088 冲突。
+"""
+from __future__ import annotations
+
+import os
+
+try:
+    from dotenv import load_dotenv
+    load_dotenv()
+except Exception:
+    pass
+
+from flask import Flask, redirect, render_template, abort
+
+app = Flask(__name__, template_folder="templates", static_folder="static")
+
+# 注册子进程回读验证码用的内部地址默认指向本应用端口（仅注册功能相关）。
+os.environ.setdefault("ACCOUNT_MGR_BASE", "http://127.0.0.1:5090")
+
+# ---- 外链内嵌配置：菜单 key -> (标题, 目标 URL) ----
+# 服务器不改动；这里只是让本地 shell 用 iframe 指向这些线上服务。
+EMBEDS = {
+    "card-link": ("直卡直开", "https://card.153.ink/card-link/"),
+    "card-flow": ("批量直开(试用3天)", "https://reg.gpt2api.com/card-flow/?embed=1"),
+    "protocol": ("协议支付(试用3天)", "https://reg.gpt2api.com/protocol/?embed=1"),
+    "pay": ("提取链接(试用3天)", "https://reg.gpt2api.com/pay/?embed=1"),
+}
+
+GITHUB_URL = "https://github.com/432539/gpt"
+
+
+@app.get("/")
+def home():
+    return redirect("/account-manager/")
+
+
+@app.get("/embed/<target>")
+def embed(target: str):
+    item = EMBEDS.get(target)
+    if not item:
+        abort(404)
+    title, url = item
+    return render_template("embed.html", active=target, embed_title=title, embed_url=url)
+
+
+# --- 注册「GPT管理」(account-manager) 蓝图（唯一开源的真实功能）---
+try:
+    from account_manager import bp as account_manager_bp
+    app.register_blueprint(account_manager_bp)
+    app.logger.info("account_manager blueprint registered (/account-manager/, /api/plus*, /api/probe*)")
+except Exception as exc:  # 保持主应用可用，即便该蓝图导入失败
+    app.logger.warning("account_manager blueprint registration failed: %s", exc)
+
+
+if __name__ == "__main__":
+    app.run(host=os.getenv("HOST", "127.0.0.1"), port=int(os.getenv("PORT", "5090")), debug=False, threaded=True)
diff --git a/plan_check_session.py b/plan_check_session.py
new file mode 100644
index 0000000..45a1c48
--- /dev/null
+++ b/plan_check_session.py
@@ -0,0 +1,138 @@
+"""通过 access_token 实时调用 ChatGPT 后端 accounts/check 查询真实套餐级别。
+
+用 curl_cffi(firefox144 指纹)绕过 Cloudflare，读取 plan_type / has_active_subscription。
+作为独立脚本，由主程序用 .venv 的 python 以子进程方式调用（stdin 传 JSON，stdout 回 JSON），
+与 card_bind_session.py 的调用方式一致（主程序 C:\\Python311 的 curl_cffi 版本过旧，不支持 firefox144）。
+
+stdin  : {"access_token": "...", "account_id": "(可选)", "proxy": "(可选, DIRECT 或 http/socks URL)"}
+stdout : {"ok": bool, "httpStatus": int, "plan": "free|plus|pro|...", "active": bool,
+          "subPlan": "", "accountId": "", "error": ""}
+"""
+import sys
+import json
+import uuid
+import base64
+
+from curl_cffi.requests import Session
+
+CHECK_URL = "https://chatgpt.com/backend-api/accounts/check/v4-2023-04-27"
+UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0"
+
+
+def _decode_jwt(token: str) -> dict:
+    try:
+        seg = token.split(".")[1].replace("-", "+").replace("_", "/")
+        seg += "=" * ((4 - len(seg) % 4) % 4)
+        data = json.loads(base64.b64decode(seg).decode("utf-8", "replace"))
+        return data if isinstance(data, dict) else {}
+    except Exception:
+        return {}
+
+
+def _account_id_from_token(token: str) -> str:
+    auth = (_decode_jwt(token) or {}).get("https://api.openai.com/auth") or {}
+    return str(auth.get("chatgpt_account_id") or "")
+
+
+def _walk_plan(data):
+    """深扫响应，取 plan_type / has_active_subscription / subscription_plan（对齐 probe.js）。"""
+    plan = ""
+    active = False
+    sub = ""
+    stack = [data]
+    while stack:
+        cur = stack.pop()
+        if isinstance(cur, dict):
+            for k, v in cur.items():
+                kl = str(k).lower()
+                if kl == "plan_type" and isinstance(v, str) and not plan:
+                    plan = v
+                if kl == "has_active_subscription" and v is True:
+                    active = True
+                if kl == "subscription_plan" and isinstance(v, str) and not sub:
+                    sub = v
+                stack.append(v)
+        elif isinstance(cur, list):
+            stack.extend(cur)
+    return plan, active, sub
+
+
+def _account_id_from_payload(data) -> str:
+    if not isinstance(data, dict):
+        return ""
+    ordering = data.get("account_ordering")
+    if isinstance(ordering, list):
+        for x in ordering:
+            if x and x != "default":
+                return str(x)
+    accounts = data.get("accounts")
+    if isinstance(accounts, dict):
+        for k in accounts.keys():
+            if k and k != "default":
+                return str(k)
+    return ""
+
+
+def main():
+    try:
+        payload = json.loads(sys.stdin.read() or "{}")
+    except Exception:
+        payload = {}
+    token = str(payload.get("access_token") or "").strip()
+    account_id = str(payload.get("account_id") or "").strip() or _account_id_from_token(token)
+    proxy = str(payload.get("proxy") or "").strip()
+    if not token:
+        print(json.dumps({"ok": False, "httpStatus": 0, "error": "missing_access_token"}))
+        return
+
+    http = Session(impersonate="firefox144")
+    http.trust_env = False
+    if proxy and proxy.upper() != "DIRECT":
+        http.proxies = {"http": proxy, "https": proxy}
+
+    device_id = str(uuid.uuid4())
+    headers = {
+        "Authorization": "Bearer " + token,
+        "Accept": "application/json",
+        "User-Agent": UA,
+        "Origin": "https://chatgpt.com",
+        "Referer": "https://chatgpt.com/",
+        "OAI-Device-Id": device_id,
+        "oai-device-id": device_id,
+    }
+    if account_id:
+        headers["ChatGPT-Account-Id"] = account_id
+        headers["ChatGPT-Account-ID"] = account_id
+
+    try:
+        # 暖身，拿 Cloudflare cookie
+        try:
+            http.get(
+                "https://chatgpt.com/",
+                headers={"User-Agent": UA, "Accept-Language": "en-US,en;q=0.9"},
+                timeout=25,
+            )
+        except Exception:
+            pass
+        r = http.get(CHECK_URL, headers=headers, timeout=30)
+        status = r.status_code
+        if status == 200:
+            data = r.json()
+            plan, active, sub = _walk_plan(data)
+            print(json.dumps({
+                "ok": True,
+                "httpStatus": status,
+                "plan": plan or "",
+                "active": bool(active),
+                "subPlan": sub or "",
+                "accountId": account_id or _account_id_from_payload(data),
+            }))
+        else:
+            body = (r.text or "")[:300]
+            print(json.dumps({"ok": False, "httpStatus": status, "error": body or ("HTTP " + str(status))}))
+    except Exception as exc:  # noqa: BLE001
+        print(json.dumps({"ok": False, "httpStatus": 0, "error": str(exc)}))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..dd9f416
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,4 @@
+Flask>=3.0,<4
+httpx>=0.27,<1
+curl_cffi>=0.11,<1
+python-dotenv>=1.0,<2
diff --git a/static/account-manager.css b/static/account-manager.css
new file mode 100644
index 0000000..6866d69
--- /dev/null
+++ b/static/account-manager.css
@@ -0,0 +1,458 @@
+@charset "UTF-8";
+
+/* 账号管理 —— 复用 app-shell.css 的蓝色企业风令牌，仅补充本页所需组件 */
+
+/* ---------- 统计卡片 ---------- */
+.am-stats {
+  display: grid;
+  grid-template-columns: repeat(4, 1fr);
+  gap: 16px;
+  margin-bottom: 16px;
+}
+.am-stat-card {
+  background: var(--card);
+  border: 1px solid var(--line);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow);
+  padding: 18px 20px;
+}
+.am-stat-num { font-size: 28px; color: var(--blue-700); line-height: 1.1; }
+.am-stat-label { margin-top: 6px; color: var(--ink-500); font-size: 13px; }
+
+/* ---------- 工具栏 ---------- */
+.am-toolbar {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex-wrap: wrap;
+  margin-bottom: 14px;
+}
+.am-search {
+  position: relative;
+  flex: 0 0 260px;
+  max-width: 260px;
+}
+.am-search-icon {
+  position: absolute;
+  left: 10px;
+  top: 50%;
+  transform: translateY(-50%);
+  font-size: 13px;
+  opacity: .6;
+  pointer-events: none;
+}
+.am-search input { padding-left: 30px; }
+.am-filter { width: 130px; flex: 0 0 130px; }
+.am-toolbar-spacer { flex: 1 1 auto; }
+.am-toolbar button { flex: 0 0 auto; }
+
+/* 协议注册（占位·绿色按钮） */
+.am-btn-green { background: #16a34a; border-color: #16a34a; color: #fff; }
+.am-btn-green:hover:not(:disabled) { background: #15803d; border-color: #15803d; color: #fff; }
+
+/* 工具栏下拉菜单（批量操作 / 删除） */
+.am-dropdown { position: relative; display: inline-flex; flex: 0 0 auto; }
+.am-dropdown-toggle .am-caret { font-size: 11px; opacity: .85; }
+.am-dropdown-menu {
+  position: absolute; top: calc(100% + 6px); right: 0; z-index: 45;
+  min-width: 168px; padding: 6px;
+  background: var(--card); border: 1px solid var(--line);
+  border-radius: var(--radius-sm); box-shadow: var(--shadow-pop);
+  display: none; flex-direction: column; gap: 2px;
+}
+.am-dropdown.open .am-dropdown-menu { display: flex; }
+.am-dropdown-menu button {
+  width: 100%; height: 34px; justify-content: flex-start;
+  background: #fff; color: var(--ink-700); border: 1px solid transparent;
+  border-radius: var(--radius-sm); font-size: 13px;
+}
+.am-dropdown-menu button:hover:not(:disabled) { background: var(--blue-50); color: var(--blue-700); border-color: var(--blue-100); }
+.am-dropdown-menu button.danger-item { color: var(--danger); }
+.am-dropdown-menu button.danger-item:hover:not(:disabled) { background: var(--danger-soft); color: var(--danger); border-color: #fecaca; }
+
+/* 批量检测进度文案 */
+.am-detect-status { font-size: 13px; color: var(--blue-700); background: var(--blue-50); border: 1px solid var(--blue-100); padding: 4px 10px; border-radius: var(--radius-sm); }
+.am-detect-status[hidden] { display: none; }
+
+/* ---------- 表格 ---------- */
+.am-table-wrap { border: 1px solid var(--line); border-radius: var(--radius-sm); overflow: hidden; }
+.am-table { width: 100%; border-collapse: collapse; font-size: 13px; }
+.am-table thead th {
+  background: var(--blue-50);
+  color: var(--ink-700);
+  text-align: left;
+  font-weight: 400;
+  padding: 10px 12px;
+  border-bottom: 1px solid var(--line);
+  white-space: nowrap;
+}
+.am-table tbody td {
+  padding: 10px 12px;
+  border-bottom: 1px solid var(--line-soft);
+  color: var(--ink-900);
+  vertical-align: middle;
+}
+.am-table tbody tr:hover { background: var(--blue-50); }
+.am-table .col-check { width: 40px; text-align: center; }
+.am-table .col-idx { width: 52px; color: var(--ink-500); }
+.am-table .col-ops { width: 150px; }
+
+.email-cell { display: flex; align-items: center; gap: 6px; }
+.email-cell .text-mono { font-family: var(--mono); }
+.pw-cell { display: flex; align-items: center; gap: 6px; }
+.pw-mask { letter-spacing: 2px; color: var(--ink-500); }
+.pw-text { font-family: var(--mono); }
+.icon-btn {
+  height: 24px; width: 24px; padding: 0;
+  border: 1px solid var(--line);
+  border-radius: var(--radius-sm);
+  background: #fff; color: var(--ink-500);
+  cursor: pointer; font-size: 13px; line-height: 1;
+  display: inline-flex; align-items: center; justify-content: center;
+}
+/* 悬停对比修复：全局 button:hover:not(:disabled) 会把背景变成深蓝(blue-700)，
+   其特异度(0,2,1)高于原来的 .icon-btn:hover(0,2,0)，导致深底+蓝字不可读。
+   这里用 button.<class>:hover:not(:disabled)(0,3,1) 提高特异度，并同时固定浅底+深字。 */
+button.icon-btn:hover:not(:disabled) { background: var(--blue-50); color: var(--blue-700); border-color: var(--blue-100); }
+
+.row-ops { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
+.op-link {
+  height: 28px; padding: 0 10px;
+  border: 1px solid var(--line); background: #fff; color: var(--ink-700);
+  border-radius: var(--radius-sm); cursor: pointer; font-size: 13px;
+}
+button.op-link:hover:not(:disabled) { background: var(--blue-50); color: var(--blue-700); border-color: var(--blue-100); }
+.op-link.danger { color: var(--danger); border-color: #fecaca; }
+button.op-link.danger:hover:not(:disabled) { background: var(--danger-soft); color: var(--danger); border-color: #fecaca; }
+.op-link.detect { color: var(--blue-700); border-color: var(--blue-100); }
+button.op-link.detect:hover:not(:disabled) { background: var(--blue-50); color: var(--blue-700); border-color: var(--blue-100); }
+
+/* 状态药丸 */
+.sk-tag {
+  display: inline-flex; align-items: center; gap: 4px;
+  padding: 2px 9px; border-radius: 4px; font-size: 12px;
+  border: 1px solid var(--line);
+}
+.sk-tag.has { background: var(--ok-soft); color: #047857; border-color: #a7f3d0; cursor: pointer; }
+.sk-tag.none { background: #f1f5f9; color: var(--ink-500); }
+.sk-tag.banned { background: var(--danger-soft); color: #991b1b; border-color: #fecaca; }
+.code-chip {
+  display: inline-flex; align-items: center; gap: 4px;
+  padding: 2px 8px; border-radius: 4px; font-size: 12px;
+  background: var(--blue-50); color: var(--blue-700); border: 1px solid var(--blue-100);
+  cursor: pointer; font-family: var(--mono);
+}
+.muted { color: var(--ink-400); }
+
+/* ---------- 分页 ---------- */
+.am-pager {
+  display: flex; align-items: center; justify-content: space-between;
+  margin-top: 14px; gap: 12px; flex-wrap: wrap;
+}
+.am-pager-left, .am-pager-right { display: flex; align-items: center; gap: 8px; }
+.am-pager-label { color: var(--ink-500); font-size: 13px; }
+.am-pagesize { width: 84px; height: 32px; }
+.am-pager-info { color: var(--ink-500); font-size: 13px; }
+
+/* ---------- 导入弹窗 ---------- */
+.am-modal {
+  position: fixed; inset: 0; z-index: 60;
+  background: rgba(15, 23, 42, .45);
+  display: flex; align-items: center; justify-content: center;
+  padding: 20px;
+}
+.am-modal[hidden] { display: none; }
+.am-modal-dialog {
+  width: 560px; max-width: 100%;
+  background: var(--card); border-radius: var(--radius);
+  box-shadow: var(--shadow-pop); padding: 20px;
+}
+.am-modal-head { display: flex; align-items: center; justify-content: space-between; margin-bottom: 10px; }
+.am-modal-head b { font-size: 15px; }
+button.am-modal-close {
+  height: 28px; width: 28px; padding: 0; font-size: 18px; line-height: 1;
+  background: #fff; color: var(--ink-600); border: 1px solid var(--line); border-radius: var(--radius-sm);
+}
+button.am-modal-close:hover:not(:disabled) { background: var(--blue-50); color: var(--blue-700); border-color: var(--blue-100); }
+.am-modal-dialog textarea { min-height: 200px; margin: 8px 0; }
+.am-modal-actions { display: flex; gap: 10px; justify-content: flex-end; margin-top: 8px; }
+
+/* 通用确认弹窗:紧凑尺寸 + 危险(删除)确定按钮红色 */
+.am-modal-confirm { width: 420px; }
+.am-modal-confirm .hint { margin: 4px 0 16px; color: var(--ink-700); font-size: 14px; line-height: 1.6; }
+.am-prompt-input {
+  width: 100%; height: 38px; padding: 0 12px; margin: 0 0 16px; box-sizing: border-box;
+  border: 1px solid var(--line); border-radius: var(--radius-sm);
+  font-size: 14px; color: var(--ink-900); font-family: var(--mono);
+}
+.am-prompt-input:focus { outline: none; border-color: var(--blue-500, var(--blue-600)); box-shadow: 0 0 0 3px var(--blue-50); }
+.am-prompt-input[hidden] { display: none; }
+
+/* 邮箱编辑弹窗 */
+.am-mb-edit-field { margin: 0 0 14px; }
+.am-mb-edit-lbl { display: block; margin: 0 0 6px; font-size: 13px; color: var(--ink-700); }
+.am-mb-edit-email { font-family: var(--mono); font-size: 14px; color: var(--ink-900); word-break: break-all; }
+.am-mb-edit-field .am-prompt-input { margin: 0; }
+.am-mb-edit-used { margin: 0 0 4px; }
+#confirmOk.danger { background: var(--danger); border-color: var(--danger); color: #fff; }
+#confirmOk.danger:hover:not(:disabled) { background: #b91c1c; border-color: #b91c1c; color: #fff; }
+
+/* ---------- 查收抽屉 ---------- */
+.am-drawer { position: fixed; inset: 0; z-index: 70; }
+.am-drawer[hidden] { display: none; }
+.am-drawer-mask { position: absolute; inset: 0; background: rgba(15, 23, 42, .35); }
+.am-drawer-panel {
+  position: absolute; top: 0; right: 0; height: 100%; width: 460px; max-width: 90vw;
+  background: var(--card); box-shadow: var(--shadow-pop);
+  display: flex; flex-direction: column;
+}
+.am-drawer-head {
+  display: flex; align-items: flex-start; justify-content: space-between;
+  padding: 16px 20px; border-bottom: 1px solid var(--line);
+}
+.am-drawer-head b { font-size: 15px; }
+.am-drawer-addr { color: var(--ink-500); font-size: 12px; margin-top: 4px; font-family: var(--mono); }
+.am-drawer-head-actions { display: flex; align-items: center; gap: 8px; }
+.am-drawer-body { flex: 1; overflow-y: auto; padding: 16px 20px; }
+.msg-item { border: 1px solid var(--line); border-radius: var(--radius-sm); padding: 12px; margin-bottom: 10px; }
+.msg-from { color: var(--ink-500); font-size: 12px; }
+.msg-subject { color: var(--ink-900); margin: 3px 0; }
+.msg-time { color: var(--ink-400); font-size: 12px; }
+.msg-code { margin-top: 8px; }
+.msg-body { margin-top: 8px; color: var(--ink-700); font-size: 12px; white-space: pre-wrap; max-height: 160px; overflow: auto; }
+.drawer-loading, .drawer-empty { color: var(--ink-400); text-align: center; padding: 40px 0; }
+
+/* ---------- 拿 RT 进度面板 ---------- */
+.am-rt-panel {
+  position: fixed; right: 20px; bottom: 20px; z-index: 55;
+  width: 420px; max-width: calc(100vw - 40px);
+  background: var(--card); border: 1px solid var(--line);
+  border-radius: var(--radius); box-shadow: var(--shadow-pop);
+  display: flex; flex-direction: column; max-height: 60vh;
+}
+.am-rt-panel[hidden] { display: none; }
+.am-rt-head {
+  display: flex; align-items: center; gap: 10px;
+  padding: 12px 14px; border-bottom: 1px solid var(--line);
+}
+.am-rt-head b { font-size: 14px; }
+.am-rt-summary { flex: 1; color: var(--ink-500); font-size: 12px; }
+.am-rt-logs { flex: 1; overflow-y: auto; padding: 10px 14px; font-family: var(--mono); font-size: 12px; }
+.am-rt-line { padding: 2px 0; color: var(--ink-700); white-space: pre-wrap; word-break: break-all; }
+.am-rt-line.ok { color: #047857; }
+.am-rt-line.warn { color: #92400e; }
+.am-rt-line.error { color: #991b1b; }
+
+/* ---------- Toast ---------- */
+.am-toast {
+  position: fixed; left: 50%; bottom: 32px; transform: translateX(-50%) translateY(20px);
+  background: var(--ink-900); color: #fff; padding: 10px 18px; border-radius: var(--radius-sm);
+  font-size: 13px; opacity: 0; pointer-events: none; transition: opacity .2s, transform .2s; z-index: 90;
+  box-shadow: var(--shadow-pop);
+}
+.am-toast.show { opacity: 1; transform: translateX(-50%) translateY(0); }
+.am-toast.ok { background: #047857; }
+.am-toast.err { background: #b91c1c; }
+
+@media (max-width: 1100px) { .am-stats { grid-template-columns: repeat(2, 1fr); } }
+
+/* ---------- 自动刷新开关 ---------- */
+.am-auto-refresh {
+  display: inline-flex; align-items: center; gap: 8px; margin: 0;
+  color: var(--ink-700); font-size: 13px; cursor: pointer; white-space: nowrap;
+}
+.am-auto-refresh input { width: 15px; height: 15px; }
+.am-auto-refresh .muted { color: var(--ink-400); font-size: 12px; }
+
+/* ---------- Plan / 状态 药丸 ---------- */
+.pb-plan-tag {
+  display: inline-flex; align-items: center; padding: 2px 9px; border-radius: 4px;
+  font-size: 12px; background: #f1f5f9; color: var(--ink-600, #475569); border: 1px solid var(--line);
+}
+.pb-plan-tag.plus {
+  background: linear-gradient(135deg, #fbbf24, #d97706);
+  color: #fff; border-color: #d97706; font-weight: 600; letter-spacing: .3px;
+  box-shadow: 0 1px 4px rgba(217, 119, 6, .35);
+}
+.pb-plan-tag.pro { background: #f5f3ff; color: #6d28d9; border-color: #ddd6fe; font-weight: 600; }
+.pb-plan-tag.free { background: #f1f5f9; color: var(--ink-500); }
+
+/* 批量直开「已开通」徽标：绿色系，与 pb-status.ok / at-chip.has 同一语义色 */
+.pb-opened-tag {
+  display: inline-flex; align-items: center; padding: 2px 9px; border-radius: 4px;
+  font-size: 12px; font-weight: 600;
+  background: var(--ok-soft); color: #047857; border: 1px solid #a7f3d0;
+}
+
+.pb-status { display: inline-flex; align-items: center; gap: 4px; padding: 2px 9px; border-radius: 4px; font-size: 12px; border: 1px solid var(--line); }
+.pb-status.ok { background: var(--ok-soft); color: #047857; border-color: #a7f3d0; }
+.pb-status.expiring { background: var(--warn-soft); color: #92400e; border-color: #fde68a; }
+.pb-status.invalid { background: var(--danger-soft); color: #991b1b; border-color: #fecaca; }
+.pb-status.unknown { background: #f1f5f9; color: var(--ink-500); }
+
+.pb-exp-main { color: var(--ink-900); }
+.pb-exp-sub { color: var(--ink-400); font-size: 12px; }
+.pb-exp-cell.expired .pb-exp-sub { color: var(--danger); }
+
+.at-cell { display: flex; align-items: center; gap: 6px; }
+.at-chip { display: inline-flex; align-items: center; gap: 4px; padding: 2px 8px; border-radius: 4px; font-size: 12px; }
+.at-chip.has { background: var(--ok-soft); color: #047857; border: 1px solid #a7f3d0; cursor: pointer; }
+.at-chip.none { background: #f1f5f9; color: var(--ink-500); border: 1px solid var(--line); }
+.rt-chip { display: inline-flex; align-items: center; gap: 4px; padding: 2px 8px; border-radius: 4px; font-size: 12px; }
+.rt-chip.has { background: var(--blue-50); color: var(--blue-700); border: 1px solid var(--blue-100); cursor: pointer; }
+.rt-chip.none { background: #f1f5f9; color: var(--ink-500); border: 1px solid var(--line); }
+.sub-chip { display: inline-flex; align-items: center; justify-content: center; min-width: 30px; padding: 2px 8px; border-radius: 4px; font-size: 12px; font-weight: 600; }
+.sub-chip.yes { background: var(--blue-50); color: var(--blue-700); border: 1px solid var(--blue-100); }
+.sub-chip.no  { background: #f1f5f9; color: var(--ink-500); border: 1px solid var(--line); }
+
+/* ---------- 编辑 / 设置 弹窗控件 ---------- */
+.am-mono-area { min-height: 72px; font-family: var(--mono); font-size: 12px; }
+/* AT / Refresh Token 框调矮：约 3 行高（用更高优先级覆盖上面 .am-modal-dialog textarea 的 min-height:200px） */
+.am-modal-dialog textarea.am-mono-area-sm { min-height: 52px; max-height: 72px; resize: vertical; }
+/* 邮箱池「清空」按钮：次要按钮上加红色语义 */
+button.am-danger { color: var(--danger); border-color: #fecaca; }
+button.am-danger:hover:not(:disabled) { background: var(--danger-soft); color: var(--danger); border-color: #fecaca; }
+.am-modal-dialog label { display: block; margin-bottom: 10px; color: var(--ink-700); }
+.am-modal-dialog label > input,
+.am-modal-dialog label > textarea,
+.am-modal-dialog label > select { margin-top: 4px; }
+.am-modal-wide { width: 720px; max-width: 100%; }
+.am-set-block { margin-bottom: 18px; }
+.am-set-proxies { min-height: 140px; }
+.am-set-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }
+.am-set-grid label { margin-bottom: 0; }
+/* 协议注册弹窗 */
+.reg-avail { margin: 12px 0 4px; font-size: 13px; color: var(--ink-700); }
+.reg-avail b { color: var(--blue-700); font-size: 15px; }
+
+/* 协议注册：右下角浮层 */
+.reg-panel {
+  position: fixed; right: 20px; bottom: 20px; z-index: 3000;
+  width: 380px; background: #fff;
+  border: 1px solid var(--line); border-radius: var(--radius); box-shadow: 0 12px 40px rgba(15, 23, 42, .22);
+  display: flex; flex-direction: column; overflow: hidden;
+}
+.reg-panel[hidden] { display: none; }
+.reg-panel-head {
+  display: flex; align-items: center; gap: 8px;
+  padding: 10px 12px; background: var(--blue-600); color: #fff;
+}
+.reg-panel-title { flex: 0 0 auto; font-size: 14px; }
+.reg-panel-stat { flex: 1 1 auto; font-size: 12px; color: rgba(255, 255, 255, .9); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.reg-panel-tools { flex: 0 0 auto; display: flex; gap: 6px; }
+.reg-panel-btn {
+  height: 24px; min-width: 24px; padding: 0 8px;
+  background: rgba(255, 255, 255, .18); color: #fff;
+  border: 0; border-radius: var(--radius-sm); cursor: pointer; font-size: 13px; line-height: 24px;
+}
+button.reg-panel-btn:hover:not(:disabled) { background: rgba(255, 255, 255, .32); }
+.reg-panel-body { padding: 12px; }
+.reg-panel.min .reg-panel-body { display: none; }
+.reg-progress { height: 8px; background: var(--blue-50); border-radius: 999px; overflow: hidden; margin-bottom: 10px; }
+.reg-progress-bar { height: 100%; width: 0; background: var(--blue-600); transition: width .3s ease; }
+.reg-logs {
+  height: 220px; overflow-y: auto; overflow-x: hidden; scroll-behavior: smooth;
+  font-family: var(--mono); font-size: 12px; line-height: 1.6;
+  background: #0f172a; color: #cbd5e1; border-radius: var(--radius-sm); padding: 8px 10px;
+}
+.reg-log-line {
+  display: block; white-space: pre-wrap; word-break: break-word;
+  padding: 1px 0; border-left: 2px solid transparent; padding-left: 6px;
+}
+.reg-log-ts { color: #64748b; margin-right: 6px; }
+.reg-log-acct { color: #60a5fa; margin-right: 6px; }
+.reg-log-msg { color: #cbd5e1; }
+.reg-log-line.lv-ok { border-left-color: #4ade80; }
+.reg-log-line.lv-ok .reg-log-msg { color: #4ade80; }
+.reg-log-line.lv-error { border-left-color: #f87171; }
+.reg-log-line.lv-error .reg-log-msg { color: #f87171; }
+.reg-log-line.lv-warn { border-left-color: #fbbf24; }
+.reg-log-line.lv-warn .reg-log-msg { color: #fbbf24; }
+.reg-log-line.lv-info { border-left-color: #334155; }
+.reg-log-line.lv-info .reg-log-msg { color: #cbd5e1; }
+/* 兼容旧结构（span.lv-*） */
+.reg-log-line .lv-ok { color: #4ade80; }
+.reg-log-line .lv-error { color: #f87171; }
+.reg-log-line .lv-warn { color: #fbbf24; }
+.reg-log-line .lv-info { color: #94a3b8; }
+
+.am-sms-testbar { display: flex; gap: 10px; align-items: center; margin-top: 12px; }
+.am-sms-bal { font-size: 13px; }
+.am-sms-bal.ok { color: var(--blue-700); }
+.am-sms-bal.err { color: var(--danger); }
+
+/* 设置弹窗内的 Tab */
+.am-set-tabs { display: flex; gap: 8px; margin: 4px 0 16px; border-bottom: 1px solid var(--line); padding-bottom: 12px; }
+.am-set-tab {
+  height: 34px; padding: 0 16px;
+  background: #fff; color: var(--ink-700);
+  border: 1px solid var(--line); border-radius: var(--radius-sm);
+  cursor: pointer; font-size: 14px;
+}
+button.am-set-tab:hover:not(:disabled) { background: var(--blue-50); color: var(--blue-700); border-color: var(--blue-100); }
+.am-set-tab.active, button.am-set-tab.active:hover:not(:disabled) {
+  background: var(--blue-600); color: #fff; border-color: var(--blue-600);
+}
+.am-set-panel[hidden] { display: none; }
+
+/* 邮箱池 */
+.am-set-check { display: flex; align-items: center; gap: 8px; margin: 4px 0 8px; font-size: 13px; color: var(--ink-700); cursor: pointer; }
+.am-set-check input { width: auto; margin: 0; }
+.am-set-check code { background: var(--blue-50); color: var(--blue-700); padding: 1px 5px; border-radius: 4px; font-family: var(--mono); }
+.am-mb-splitbar { display: flex; gap: 8px; align-items: center; margin: 2px 0 8px; font-size: 13px; color: var(--ink-700); }
+.am-mb-splitbar[hidden] { display: none; }
+.am-mb-splitnum { width: 72px; }
+.am-mb-importbar { display: flex; gap: 10px; align-items: center; margin: 8px 0; }
+.am-mb-importbar .hint { margin: 0; }
+.am-mb-splitbar { flex-wrap: wrap; }
+.am-mb-splitbar .am-mb-count { margin: 0 0 0 auto; }
+#mbImportBox[hidden] { display: none; }
+#mbImportBox { margin: 8px 0; }
+.am-mb-list { border: 1px solid var(--line); border-radius: var(--radius-sm); max-height: 260px; overflow: auto; }
+.am-mb-row { display: flex; align-items: center; gap: 10px; padding: 6px 10px; border-bottom: 1px solid var(--line-soft); font-size: 13px; }
+.am-mb-row:last-child { border-bottom: 0; }
+.am-mb-addr { flex: 1 1 auto; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; color: var(--ink-900); font-family: var(--mono); }
+.am-mb-badge { flex: 0 0 auto; padding: 1px 8px; border-radius: 999px; font-size: 12px; }
+.am-mb-badge.free { background: var(--blue-50); color: var(--blue-700); border: 1px solid var(--blue-100); }
+.am-mb-badge.used { background: #f1f5f9; color: var(--ink-500); border: 1px solid var(--line); }
+.am-mb-tag { flex: 0 0 auto; color: var(--ink-400); font-size: 12px; }
+.am-mb-ops { flex: 0 0 auto; display: flex; gap: 6px; }
+.am-mb-testbar { display: flex; gap: 10px; align-items: center; margin: 6px 0 10px; }
+.am-mb-select { flex: 1; min-width: 0; }
+.am-mb-result { border: 1px solid var(--line); border-radius: var(--radius-sm); padding: 10px 12px; max-height: 220px; overflow: auto; background: #fff; }
+.am-mb-result[hidden] { display: none; }
+.am-mb-loading, .am-mb-empty { color: var(--ink-400); text-align: center; padding: 16px 0; font-size: 13px; }
+.am-mb-head { color: var(--blue-700); font-size: 13px; margin-bottom: 8px; }
+.am-mb-item { border-bottom: 1px solid var(--line-soft); padding: 8px 0; }
+.am-mb-item:last-child { border-bottom: 0; }
+.am-mb-subj { color: var(--ink-900); font-size: 13px; }
+.am-mb-meta { color: var(--ink-400); font-size: 12px; margin-top: 2px; word-break: break-all; }
+.am-mb-code { margin-top: 4px; font-size: 13px; color: var(--ink-700); }
+.am-mb-code b { color: var(--blue-700); font-family: var(--mono); font-size: 15px; letter-spacing: 1px; }
+.topbar-actions button { margin-right: 4px; }
+
+/* ---------- GPT 账号表：固定列宽（table-layout: fixed）---------- */
+.am-table-gpt { table-layout: fixed; width: 100%; }
+.am-table-gpt .col-check  { width: 40px; }
+.am-table-gpt .col-idx    { width: 48px; }
+.am-table-gpt .col-email  { width: 240px; }
+.am-table-gpt .col-at     { width: 190px; }
+.am-table-gpt .col-rt     { width: 96px; }
+.am-table-gpt .col-sub    { width: 64px; text-align: center; }
+.am-table-gpt .col-status { width: 84px; }
+.am-table-gpt .col-ops    { width: 300px; }
+/* 邮箱过长时省略号 + title 悬浮提示 */
+.am-table-gpt .email-cell { min-width: 0; }
+.am-table-gpt .email-cell .am-email {
+  flex: 0 1 auto; min-width: 0;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+/* FREE / PLUS 徽标统一靠右、等宽居中，保证跨行竖向对齐 */
+.am-table-gpt .email-cell .pb-plan-tag {
+  margin-left: auto; flex: none;
+  min-width: 48px; justify-content: center; white-space: nowrap;
+}
+.am-table-gpt .email-cell .pb-opened-tag { flex: none; white-space: nowrap; }
+/* 操作列按钮保持单行不换行 */
+.am-table-gpt .row-ops { flex-wrap: nowrap; white-space: nowrap; }
+.am-table-gpt tbody td { overflow: hidden; }
diff --git a/static/account-manager.js b/static/account-manager.js
new file mode 100644
index 0000000..437bfe0
--- /dev/null
+++ b/static/account-manager.js
@@ -0,0 +1,1241 @@
+/* 账号管理 —— GPT 账号(sub2api/probe) 为主 + PLUS 邮箱(查收/拿RT) 为辅。
+   GPT 侧移植自 auto public/app.js 的 renderProbeAccounts 等；PLUS 侧沿用先前实现。 */
+(function () {
+  'use strict';
+
+  const API_BASE = (document.documentElement.getAttribute('data-api-base') || '').replace(/\/$/, '');
+  const $ = (sel) => document.querySelector(sel);
+
+  const state = {
+    activeTab: 'gpt',
+    // GPT / probe
+    probe: [],
+    probeSelected: new Set(),
+    probeShowPw: new Set(),
+    probeAutoRefresh: null,
+    pbPage: 1,
+    pbPageSize: 10,
+    pbOpenedOnly: false,
+    // PLUS
+    plus: [],
+    plSelected: new Set(),
+    plShowPw: new Set(),
+    plCodes: new Map(),
+    plStatusMap: new Map(),
+    plSearch: '',
+    plFilter: 'all',
+    plPage: 1,
+    plPageSize: 10,
+  };
+  const SUB2API_DEFAULT_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+
+  // ---------- 工具 ----------
+  function escapeHtml(s) {
+    return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
+      { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
+    ));
+  }
+  function domainOf(email) { const m = String(email || '').split('@'); return m[1] || ''; }
+  function fmtTime(t) { if (!t) return ''; const d = new Date(t); return Number.isNaN(d.getTime()) ? String(t) : d.toLocaleString(); }
+  function fmtClock(t) { if (!t) return ''; const d = new Date(t); return Number.isNaN(d.getTime()) ? '' : d.toLocaleTimeString(); }
+
+  let toastTimer = null;
+  function toast(msg, type) {
+    const el = $('#amToast');
+    el.textContent = msg;
+    el.className = 'am-toast show' + (type === 'ok' ? ' ok' : type === 'err' ? ' err' : '');
+    clearTimeout(toastTimer);
+    toastTimer = setTimeout(() => { el.className = 'am-toast'; }, 2600);
+  }
+  async function copyText(text, okMsg) {
+    try { await navigator.clipboard.writeText(String(text || '')); toast(okMsg || '已复制', 'ok'); }
+    catch { toast('复制失败', 'err'); }
+  }
+  // 主题化确认弹窗（替代原生 confirm），返回 Promise<boolean>
+  function confirmDialog(message, opts) {
+    opts = opts || {};
+    return new Promise((resolve) => {
+      const modal = $('#confirmModal');
+      const okBtn = $('#confirmOk');
+      const cancelBtn = $('#confirmCancel');
+      const closeX = $('#confirmCloseX');
+      const input = $('#confirmInput'); if (input) input.hidden = true;
+      $('#confirmTitle').textContent = opts.title || '确认操作';
+      $('#confirmMsg').textContent = String(message == null ? '' : message);
+      okBtn.textContent = opts.okText || '确定';
+      okBtn.className = opts.danger ? 'danger' : '';
+      let done = false;
+      const cleanup = (val) => {
+        if (done) return; done = true;
+        modal.hidden = true;
+        okBtn.removeEventListener('click', onOk);
+        cancelBtn.removeEventListener('click', onCancel);
+        closeX.removeEventListener('click', onCancel);
+        modal.removeEventListener('mousedown', onBackdrop);
+        document.removeEventListener('keydown', onKey);
+        resolve(val);
+      };
+      const onOk = () => cleanup(true);
+      const onCancel = () => cleanup(false);
+      const onBackdrop = (e) => { if (e.target === modal) cleanup(false); };
+      const onKey = (e) => { if (e.key === 'Escape') cleanup(false); else if (e.key === 'Enter') cleanup(true); };
+      okBtn.addEventListener('click', onOk);
+      cancelBtn.addEventListener('click', onCancel);
+      closeX.addEventListener('click', onCancel);
+      modal.addEventListener('mousedown', onBackdrop);
+      document.addEventListener('keydown', onKey);
+      modal.hidden = false;
+      okBtn.focus();
+    });
+  }
+  function promptDialog(message, opts) {
+    opts = opts || {};
+    return new Promise((resolve) => {
+      const modal = $('#confirmModal');
+      const okBtn = $('#confirmOk');
+      const cancelBtn = $('#confirmCancel');
+      const closeX = $('#confirmCloseX');
+      const input = $('#confirmInput');
+      $('#confirmTitle').textContent = opts.title || '请输入';
+      $('#confirmMsg').textContent = String(message == null ? '' : message);
+      okBtn.textContent = opts.okText || '确定';
+      okBtn.className = '';
+      input.hidden = false;
+      input.value = opts.value || '';
+      input.placeholder = opts.placeholder || '';
+      let done = false;
+      const cleanup = (val) => {
+        if (done) return; done = true;
+        modal.hidden = true;
+        input.hidden = true;
+        okBtn.removeEventListener('click', onOk);
+        cancelBtn.removeEventListener('click', onCancel);
+        closeX.removeEventListener('click', onCancel);
+        modal.removeEventListener('mousedown', onBackdrop);
+        document.removeEventListener('keydown', onKey);
+        resolve(val);
+      };
+      const onOk = () => cleanup(input.value);
+      const onCancel = () => cleanup(null);
+      const onBackdrop = (e) => { if (e.target === modal) cleanup(null); };
+      const onKey = (e) => { if (e.key === 'Escape') cleanup(null); else if (e.key === 'Enter') cleanup(input.value); };
+      okBtn.addEventListener('click', onOk);
+      cancelBtn.addEventListener('click', onCancel);
+      closeX.addEventListener('click', onCancel);
+      modal.addEventListener('mousedown', onBackdrop);
+      document.addEventListener('keydown', onKey);
+      modal.hidden = false;
+      setTimeout(() => input.focus(), 0);
+    });
+  }
+  async function api(method, path, body) {
+    const opts = { method, headers: {} };
+    if (body !== undefined) { opts.headers['Content-Type'] = 'application/json'; opts.body = JSON.stringify(body); }
+    const res = await fetch(API_BASE + path, opts);
+    const ct = res.headers.get('content-type') || '';
+    const data = ct.includes('application/json') ? await res.json() : {};
+    if (!res.ok) throw new Error(data.error || ('HTTP ' + res.status));
+    return data;
+  }
+  async function downloadPost(path, body, fallbackName) {
+    const res = await fetch(API_BASE + path, {
+      method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body || {}),
+    });
+    if (!res.ok) throw new Error('HTTP ' + res.status);
+    const count = res.headers.get('X-Export-Count');
+    const blob = await res.blob();
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url; a.download = fallbackName;
+    document.body.appendChild(a); a.click(); a.remove();
+    URL.revokeObjectURL(url);
+    return count;
+  }
+  function paginate(list, page, size) {
+    const total = list.length;
+    const pages = Math.max(1, Math.ceil(total / size));
+    const p = Math.min(Math.max(1, page), pages);
+    const startIdx = (p - 1) * size;
+    return { items: list.slice(startIdx, startIdx + size), page: p, pages, total, startIdx };
+  }
+
+  // ==========================================================================
+  // Tabs + 统计卡片
+  // ==========================================================================
+  // 视图切换已下线：拿RT 能力已并入账号管理（工具栏「重拿RT」），页面固定展示 sub2api 账号管理主视图。
+  // 旧 PLUS 邮箱视图的 DOM 仍保留但隐藏，避免删除后遗留坏引用/JS 报错（后端接口不动）。
+  function switchTab() {
+    state.activeTab = 'gpt';
+    const vg = $('#view-gpt'); if (vg) vg.hidden = false;
+    const vp = $('#view-plus'); if (vp) vp.hidden = true;
+    renderStats();
+    loadProbe();
+  }
+  function renderStats() {
+    if (state.activeTab === 'gpt') {
+      const okCount = state.probe.filter((a) => a.status === 'ok').length;
+      const renewed = state.probeAutoRefresh && state.probeAutoRefresh.lastResult ? (state.probeAutoRefresh.lastResult.refreshed || 0) : 0;
+      $('#statAL').textContent = '账号总数'; $('#statA').textContent = state.probe.length;
+      $('#statBL').textContent = '已选中'; $('#statB').textContent = state.probeSelected.size;
+      $('#statCL').textContent = '有效 AT'; $('#statC').textContent = okCount;
+      $('#statDL').textContent = '续期数量'; $('#statD').textContent = renewed;
+      updateBatchLabel();
+    } else {
+      $('#statAL').textContent = 'PLUS 总数'; $('#statA').textContent = state.plus.length;
+      $('#statBL').textContent = '已选中'; $('#statB').textContent = state.plSelected.size;
+      $('#statCL').textContent = 'PLUS数量'; $('#statC').textContent = state.plus.filter((a) => a.isPlus).length;
+      $('#statDL').textContent = 'RT提取数量'; $('#statD').textContent = state.plus.filter((a) => a.codexRt).length;
+    }
+  }
+
+  // ==========================================================================
+  // GPT 账号管理（probe / sub2api）
+  // ==========================================================================
+  function formatTokenExp(a) {
+    const exp = Number(a.tokenExp) || 0;
+    if (!exp) return '<span class="muted">未知</span>';
+    const main = new Date(exp * 1000).toLocaleString();
+    const sec = a.tokenExpiresInSec;
+    const expired = a.tokenExpired === true || (typeof sec === 'number' && sec <= 0);
+    let sub = '';
+    if (expired) sub = '已过期';
+    else if (typeof sec === 'number') {
+      const d = Math.floor(sec / 86400), h = Math.floor((sec % 86400) / 3600), m = Math.floor((sec % 3600) / 60);
+      sub = d > 0 ? `剩余 ${d} 天 ${h} 小时` : h > 0 ? `剩余 ${h} 小时 ${m} 分` : `剩余 ${m} 分`;
+    }
+    return `<div class="pb-exp-cell${expired ? ' expired' : ''}"><div class="pb-exp-main">${escapeHtml(main)}</div><div class="pb-exp-sub">${escapeHtml(sub)}</div></div>`;
+  }
+  function statusPill(a) {
+    const s = a.status || 'unknown';
+    const label = { ok: '有效', expiring: '临期', invalid: '失效', unknown: '未知' }[s] || '未知';
+    return `<span class="pb-status ${s}">${label}</span>`;
+  }
+  function renderAutoRefreshHint() {
+    const ar = state.probeAutoRefresh;
+    const cb = $('#pbAutoRefresh');
+    const hint = $('#pbAutoRefreshHint');
+    if (!ar) { if (cb) cb.checked = true; if (hint) hint.textContent = '—'; return; }
+    if (cb) cb.checked = ar.enabled !== false;
+    if (!hint) return;
+    if (ar.running) { hint.textContent = '刷新中…'; return; }
+    if (!ar.enabled) { hint.textContent = '已关闭'; return; }
+    const parts = [`每 ${ar.intervalMin || 15} 分钟`];
+    if (ar.lastRunAt) parts.push(`上次 ${fmtClock(ar.lastRunAt)}`);
+    if (ar.lastResult) parts.push(`续期 ${ar.lastResult.refreshed || 0}`);
+    hint.textContent = parts.join(' · ');
+  }
+  let pbUnknownKickAt = 0;
+  function kickUnknownIfNeeded() {
+    const ar = state.probeAutoRefresh;
+    if (!ar || ar.enabled === false || ar.running) return;
+    const unknowns = state.probe.filter((a) => (a.status === 'unknown') && a.hasRefresh);
+    if (!unknowns.length) return;
+    const now = Date.now();
+    if (now - pbUnknownKickAt < 30000) return;
+    pbUnknownKickAt = now;
+    api('POST', '/api/probe/accounts/auto-refresh', { enabled: true, runNow: true })
+      .then((next) => { state.probeAutoRefresh = next; renderAutoRefreshHint(); setTimeout(() => loadProbe(true), 3000); })
+      .catch(() => {});
+  }
+  async function loadProbe(skipKick) {
+    try {
+      const data = await api('GET', '/api/probe/accounts');
+      state.probe = data.accounts || [];
+      state.probeAutoRefresh = data.autoRefresh || null;
+      renderProbe();
+      if (!skipKick) kickUnknownIfNeeded();
+    } catch (e) { toast('加载 GPT 账号失败：' + e.message, 'err'); }
+  }
+  async function pbDetectOne(id, btn) {
+    if (btn) btn.disabled = true;
+    toast('正在通过 AT 检测套餐…', 'info');
+    try {
+      const r = await api('POST', '/api/probe/accounts/detect', { id });
+      await loadProbe(true);
+      if (r.ok && r.source === 'live') {
+        toast('实时检测：' + (r.planLabel || '未知') + (r.active ? '（订阅有效）' : '') + (r.refreshed ? '｜已刷新TOKEN' : ''), 'ok');
+      } else if (r.ok) {
+        toast('实时校验失败（' + (r.liveError || '未知') + '），已回退 AT 标记：' + (r.planLabel || '未知'), 'err');
+      } else {
+        toast(r.error || '检测失败', 'err');
+      }
+    } catch (e) {
+      toast('检测失败：' + e.message, 'err');
+    } finally {
+      if (btn) btn.disabled = false;
+    }
+  }
+  function pbFiltered() { return state.pbOpenedOnly ? state.probe.filter((a) => a.opened) : state.probe; }
+  function pbPageItems() { return paginate(pbFiltered(), state.pbPage, state.pbPageSize).items; }
+  function renderProbe() {
+    const tbody = $('#pbRows');
+    const total = state.probe.length;
+    const list = pbFiltered();
+    const pg = paginate(list, state.pbPage, state.pbPageSize);
+    state.pbPage = pg.page;
+    tbody.innerHTML = '';
+    renderAutoRefreshHint();
+
+    // 空态与表格互斥：真正 0 账号→导入提示；有账号但筛选无结果→无匹配结果；否则→表格
+    const emptyEl = $('#pbEmpty');
+    const tableEl = $('#pbTable');
+    if (total === 0) {
+      emptyEl.innerHTML = '<b>暂无 GPT 账号</b><span>点击「导入账号」粘贴 sub2api.json、每行 email----password----clientId----refreshToken，或每行一个 access token。</span>';
+      emptyEl.hidden = false;
+      tableEl.hidden = true;
+      $('#pbPageInfo').textContent = `第 1 / 1 页，共 0 条`;
+      $('#pbCheckAll').checked = false;
+      renderStats();
+      return;
+    }
+    if (list.length === 0) {
+      emptyEl.innerHTML = '<b>无匹配结果</b><span>当前搜索/筛选条件下没有账号。</span>';
+      emptyEl.hidden = false;
+      tableEl.hidden = true;
+      $('#pbPageInfo').textContent = `第 1 / 1 页，共 0 条`;
+      $('#pbCheckAll').checked = false;
+      renderStats();
+      return;
+    }
+    emptyEl.hidden = true;
+    tableEl.hidden = false;
+
+    pg.items.forEach((a, i) => {
+      const sel = state.probeSelected.has(a.id);
+      const showPw = state.probeShowPw.has(a.id);
+      const planKey = String(a.planType || '').toLowerCase();
+      const planCls = ['free', 'plus', 'pro'].includes(planKey) ? planKey : '';
+      const atCell = a.hasAccess
+        ? `<span class="at-chip has" data-pb-copy-at="${escapeHtml(a.id)}" title="点击复制 Access Token">有 AT ⧉</span>`
+        : '<span class="at-chip none">无</span>';
+      const rtCell = a.hasRefresh
+        ? `<span class="rt-chip has" data-pb-copy-rt="${escapeHtml(a.id)}" title="点击复制 Refresh Token">有 ⧉</span>`
+        : '<span class="rt-chip none">无</span>';
+      const subCell = a.subOk
+        ? '<span class="sub-chip yes" title="第二阶段 SUB / sub2api 授权成功">是</span>'
+        : '<span class="sub-chip no" title="未取得 SUB 授权">否</span>';
+
+      const tr = document.createElement('tr');
+      tr.innerHTML = `
+        <td class="col-check"><input type="checkbox" data-pb-check="${escapeHtml(a.id)}" ${sel ? 'checked' : ''}></td>
+        <td class="col-idx">${pg.startIdx + i + 1}</td>
+        <td>
+          <div class="email-cell">
+            <span class="text-mono am-email" title="${escapeHtml(a.email || '(无邮箱)')}">${escapeHtml(a.email || '(无邮箱)')}</span>
+            <span class="pb-plan-tag ${planCls}">${escapeHtml(a.planLabel || '未知')}</span>
+            ${a.opened ? `<span class="pb-opened-tag" title="批量直开已开通${a.activatedAt ? '：' + fmtTime(a.activatedAt) : ''}">已开通</span>` : ''}
+          </div>
+          ${a.note ? `<div class="muted" style="font-size:12px">${escapeHtml(a.note)}</div>` : ''}
+        </td>
+        <td><div class="at-cell">${atCell}${a.hasAccess ? formatTokenExp(a) : ''}</div></td>
+        <td>${rtCell}</td>
+        <td class="col-sub">${subCell}</td>
+        <td>${statusPill(a)}</td>
+        <td class="col-ops">
+          <div class="row-ops">
+            <button class="op-link detect" data-pb-detect="${escapeHtml(a.id)}" title="通过 AT 检测真实套餐">检测</button>
+            <button class="op-link" data-pb-edit="${escapeHtml(a.id)}">编辑</button>
+            <button class="op-link" data-pb-refresh="${escapeHtml(a.id)}">刷新TOKEN</button>
+            <button class="op-link danger" data-pb-del="${escapeHtml(a.id)}">删除</button>
+          </div>
+        </td>`;
+      tbody.appendChild(tr);
+    });
+
+    $('#pbPageInfo').textContent = `第 ${pg.page} / ${pg.pages} 页，共 ${pg.total} 条`;
+    $('#pbCheckAll').checked = pg.items.length > 0 && pg.items.every((a) => state.probeSelected.has(a.id));
+    renderStats();
+  }
+
+  // 导入 sub2api
+  function pbParseCount(text) {
+    text = String(text || '').trim();
+    if (!text) return 0;
+    try {
+      const obj = JSON.parse(text);
+      const arr = Array.isArray(obj) ? obj : (obj && Array.isArray(obj.accounts) ? obj.accounts : []);
+      return arr.filter((a) => a && (a.name || a.email || (a.credentials && (a.credentials.access_token || a.credentials.refresh_token)))).length;
+    } catch { /* not JSON — count lines */ }
+    const emailRe = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    let n = 0; const seen = new Set();
+    const add = (k) => { if (k && !seen.has(k)) { seen.add(k); n++; } };
+    for (const raw of text.split(/\r?\n/)) {
+      const line = raw.trim(); if (!line) continue;
+      const delim = line.includes('----') ? '----' : line.includes('\t') ? '\t' : line.includes('|') ? '|' : null;
+      if (delim) {
+        const parts = line.split(delim).map((s) => s.trim()).filter(Boolean);
+        if (parts.length >= 4 && emailRe.test(parts[0])) add('email:' + parts[0].toLowerCase());
+        continue;
+      }
+      const ws = line.split(/\s+/).filter(Boolean);
+      if (ws.length >= 4 && emailRe.test(ws[0])) add('email:' + ws[0].toLowerCase());
+      else add('at:' + (ws.length === 1 ? ws[0] : line));  // 裸 access token
+    }
+    return n;
+  }
+  function updatePbParsePreview() { $('#pbParsePreview').textContent = `识别到 ${pbParseCount($('#pbImportText').value)} 个有效账号`; }
+  function openPbImport() { $('#pbImportText').value = ''; updatePbParsePreview(); $('#pbImportModal').hidden = false; }
+  function closePbImport() { $('#pbImportModal').hidden = true; }
+  async function doPbImport() {
+    const text = $('#pbImportText').value.trim();
+    if (!text) return toast('请粘贴 sub2api.json 或账号行', 'err');
+    try {
+      const r = await api('POST', '/api/probe/accounts/import', { text });
+      closePbImport();
+      toast(`导入完成：新增 ${r.added}｜更新 ${r.updated}｜共 ${r.total}`, 'ok');
+      await loadProbe(true);
+      if ((r.added + r.updated) > 0) setTimeout(() => loadProbe(true), 3000);
+    } catch (e) { toast('导入失败：' + e.message, 'err'); }
+  }
+
+  // 编辑
+  function openPbEdit(id) {
+    const a = state.probe.find((x) => String(x.id) === String(id));
+    if (!a) return toast('账号不存在', 'err');
+    $('#pbEditId').value = a.id;
+    $('#pbEditEmail').value = a.email || '';
+    $('#pbEditPassword').value = a.password || '';
+    $('#pbEditTwoFactor').value = a.twoFactorSecret || '';
+    $('#pbEditAccessToken').value = a.accessToken || '';
+    $('#pbEditRefreshToken').value = a.refreshToken || '';
+    $('#pbEditAccountId').value = a.chatgptAccountId || '';
+    $('#pbEditNote').value = a.note || '';
+    $('#pbEditModal').hidden = false;
+  }
+  function closePbEdit() { $('#pbEditModal').hidden = true; }
+  async function savePbEdit() {
+    const id = $('#pbEditId').value; if (!id) return;
+    try {
+      await api('PUT', '/api/probe/accounts', {
+        id,
+        email: $('#pbEditEmail').value.trim(),
+        password: $('#pbEditPassword').value.trim(),
+        twoFactorSecret: $('#pbEditTwoFactor').value.trim(),
+        accessToken: $('#pbEditAccessToken').value.trim(),
+        refreshToken: $('#pbEditRefreshToken').value.trim(),
+        chatgptAccountId: $('#pbEditAccountId').value.trim(),
+        note: $('#pbEditNote').value.trim(),
+      });
+      closePbEdit();
+      toast('已保存', 'ok');
+      loadProbe(true);
+    } catch (e) { toast('保存失败：' + e.message, 'err'); }
+  }
+  async function pbRefreshOne(id) {
+    try {
+      toast('正在刷新 TOKEN…');
+      const r = await api('POST', '/api/probe/accounts/refresh', { id });
+      if (r.ok) toast('TOKEN 已刷新，状态：有效', 'ok');
+      else toast(`刷新失败：${r.error || 'unknown'}`, 'err');
+      loadProbe(true);
+    } catch (e) { toast('刷新失败：' + e.message, 'err'); loadProbe(true); }
+  }
+  async function pbDeleteOne(id) {
+    if (!(await confirmDialog('确认删除该 GPT 账号？', { title: '删除账号', okText: '删除', danger: true }))) return;
+    try {
+      const r = await api('DELETE', '/api/probe/accounts', { ids: [id] });
+      state.probeSelected.delete(id);
+      toast(`已删除 ${r.removed} 个`, 'ok');
+      loadProbe(true);
+    } catch (e) { toast('删除失败：' + e.message, 'err'); }
+  }
+  async function pbDeleteSelected() {
+    const ids = Array.from(state.probeSelected);
+    if (!ids.length) return toast('请先勾选要删除的账号', 'err');
+    if (!(await confirmDialog(`确认删除所选 ${ids.length} 个 GPT 账号？`, { title: '删除所选', okText: '删除', danger: true }))) return;
+    try {
+      const r = await api('DELETE', '/api/probe/accounts', { ids });
+      state.probeSelected.clear();
+      toast(`已删除 ${r.removed} 个`, 'ok');
+      loadProbe(true);
+    } catch (e) { toast('删除失败：' + e.message, 'err'); }
+  }
+  async function pbDeleteAll() {
+    if (!state.probe.length) return toast('没有账号可清空');
+    if (!(await confirmDialog(`确认清空全部 ${state.probe.length} 个 GPT 账号？`, { title: '清空账号', okText: '清空', danger: true }))) return;
+    try {
+      const r = await api('DELETE', '/api/probe/accounts', { all: true });
+      state.probeSelected.clear();
+      toast(`已清空（删除 ${r.removed} 个）`, 'ok');
+      loadProbe(true);
+    } catch (e) { toast('清空失败：' + e.message, 'err'); }
+  }
+  // 删除失效(status==='invalid')/删除过期(tokenExpired===true)：前端按 enriched 字段收集 id，走通用 DELETE
+  async function pbDeleteByFilter(kind) {
+    let ids;
+    const label = kind === 'invalid' ? '失效' : '过期';
+    if (kind === 'invalid') ids = state.probe.filter((a) => a.status === 'invalid').map((a) => a.id);
+    else ids = state.probe.filter((a) => a.tokenExpired === true).map((a) => a.id);
+    if (!ids.length) return toast('没有符合条件的账号');
+    if (!(await confirmDialog(`确认删除 ${ids.length} 个${label}账号？`, { title: `删除${label}账号`, okText: '删除', danger: true }))) return;
+    try {
+      const r = await api('DELETE', '/api/probe/accounts', { ids });
+      ids.forEach((id) => state.probeSelected.delete(id));
+      toast(`已删除 ${r.removed} 个${label}账号`, 'ok');
+      loadProbe(true);
+    } catch (e) { toast('删除失败：' + e.message, 'err'); }
+  }
+  // 批量检测：≤5 线程实时套餐校验（选中优先，否则全部）
+  let detectPoll = null;
+  async function pbDetectBatch() {
+    const ids = Array.from(state.probeSelected);
+    const body = ids.length ? { ids } : {};
+    const startTs = Date.now();
+    try {
+      const r = await api('POST', '/api/probe/accounts/detect-batch', body);
+      if (!r.ok) return toast(r.error || '无法启动批量检测', 'err');
+      toast(`已开始批量检测 ${r.total} 个账号`, 'ok');
+      startDetectPolling(startTs);
+    } catch (e) { toast('启动失败：' + e.message, 'err'); }
+  }
+  function startDetectPolling(startTs) {
+    const btn = $('#btnPbDetectBatch');
+    const statusEl = $('#pbDetectStatus');
+    if (btn) btn.disabled = true;
+    if (detectPoll) clearInterval(detectPoll);
+    const tick = async () => {
+      try {
+        const s = await api('GET', '/api/probe/accounts/detect-batch/status');
+        if (statusEl) { statusEl.hidden = false; statusEl.textContent = `批量检测 ${s.done}/${s.total}（成功 ${s.ok} · 失败 ${s.fail}）`; }
+        const finished = !s.running && s.finishedAt && s.finishedAt >= (startTs - 2000);
+        if (finished) {
+          clearInterval(detectPoll); detectPoll = null;
+          if (btn) btn.disabled = false;
+          toast(`批量检测完成：成功 ${s.ok} / 共 ${s.total}`, 'ok');
+          await loadProbe(true);
+          setTimeout(() => { if (statusEl) { statusEl.hidden = true; } }, 4000);
+        }
+      } catch (e) { /* 轮询期临时错误忽略，继续下次 */ }
+    };
+    tick();
+    detectPoll = setInterval(tick, 1200);
+  }
+  // 工具栏下拉：点击切换、外部点击/Esc 关闭
+  function initDropdowns() {
+    const dds = Array.from(document.querySelectorAll('.am-dropdown'));
+    const closeAll = () => dds.forEach((o) => { o.classList.remove('open'); const t = o.querySelector('.am-dropdown-toggle'); if (t) t.setAttribute('aria-expanded', 'false'); });
+    dds.forEach((dd) => {
+      const toggle = dd.querySelector('.am-dropdown-toggle');
+      if (!toggle) return;
+      toggle.addEventListener('click', (e) => {
+        e.stopPropagation();
+        const willOpen = !dd.classList.contains('open');
+        closeAll();
+        if (willOpen) { dd.classList.add('open'); toggle.setAttribute('aria-expanded', 'true'); }
+      });
+      dd.querySelectorAll('.am-dropdown-menu button').forEach((b) => b.addEventListener('click', closeAll));
+    });
+    document.addEventListener('click', closeAll);
+    document.addEventListener('keydown', (e) => { if (e.key === 'Escape') closeAll(); });
+  }
+  function pbExportIds() { return state.probeSelected.size ? Array.from(state.probeSelected) : null; }
+  async function pbExportAt() {
+    if (!state.probe.length) return toast('没有可导出的账号');
+    try {
+      const ts = new Date().toISOString().replace(/[:.]/g, '-');
+      const count = await downloadPost('/api/probe/accounts/export-at', { ids: pbExportIds() }, `probe_at_export_${ts}.txt`);
+      toast(`已导出 ${count || 0} 个 AT（一行一个）`, 'ok');
+    } catch (e) { toast('导出失败：' + e.message, 'err'); }
+  }
+  async function pbExportSub() {
+    if (!state.probe.length) return toast('没有可导出的账号');
+    try {
+      const ts = new Date().toISOString().replace(/[:.]/g, '-');
+      const count = await downloadPost('/api/probe/accounts/export-sub', { ids: pbExportIds() }, `sub2api_export_${ts}.json`);
+      toast(`已导出 ${count || 0} 个账号（SUB2API 格式）`, 'ok');
+    } catch (e) { toast('导出失败：' + e.message, 'err'); }
+  }
+  async function pbExportPw() {
+    if (!state.probe.length) return toast('没有可导出的账号');
+    try {
+      const ts = new Date().toISOString().replace(/[:.]/g, '-');
+      const count = await downloadPost('/api/probe/accounts/export-pw', { ids: pbExportIds() }, `probe_pw_export_${ts}.txt`);
+      toast(`已导出 ${count || 0} 个账密（email----password）`, 'ok');
+    } catch (e) { toast('导出失败：' + e.message, 'err'); }
+  }
+  function updateBatchLabel() {
+    const btn = $('#ddBatchToggle');
+    if (!btn) return;
+    const n = state.probeSelected.size;
+    btn.innerHTML = (n ? `批量操作（已选 ${n}）` : '批量操作') + ' <span class="am-caret">▾</span>';
+    const rb = $('#btnPbRefetch');
+    if (rb) rb.textContent = n ? `重拿RT（${n}）` : '重拿RT';
+    const bp = $('#btnPbBindPhone');
+    if (bp) bp.textContent = n ? `批量绑手机拿RT（${n}）` : '批量绑手机拿RT';
+  }
+  async function toggleAutoRefresh(enabled) {
+    try {
+      const ar = await api('POST', '/api/probe/accounts/auto-refresh', { enabled: !!enabled });
+      state.probeAutoRefresh = ar;
+      renderAutoRefreshHint();
+      toast(ar.enabled ? '已开启自动刷新 TOKEN' : '已关闭自动刷新 TOKEN', 'ok');
+    } catch (e) { toast('切换失败：' + e.message, 'err'); renderAutoRefreshHint(); }
+  }
+
+  // ==========================================================================
+  // 设置弹窗（代理池 + 接码）
+  // ==========================================================================
+  function setSettingsTab(name) {
+    document.querySelectorAll('.am-set-tab').forEach(b => b.classList.toggle('active', b.dataset.setTab === name));
+    document.querySelectorAll('.am-set-panel').forEach(p => { p.hidden = p.dataset.setPanel !== name; });
+  }
+  let mbEntries = [];
+  function renderMbList(entries, count, unused) {
+    if (Array.isArray(entries)) mbEntries = entries;
+    const list = $('#mbList');
+    $('#setMbCount').textContent = `共 ${count != null ? count : mbEntries.length} 个（未使用 ${unused != null ? unused : mbEntries.filter(e => !e.used).length}）`;
+    if (!mbEntries.length) { list.innerHTML = '<div class="am-mb-empty">邮箱池为空，粘贴后点「导入到列表」</div>'; return; }
+    list.innerHTML = mbEntries.map(e => `
+      <div class="am-mb-row" data-email="${escapeHtml(e.email)}">
+        <span class="am-mb-addr" title="${escapeHtml(e.email)}">${escapeHtml(e.email)}</span>
+        <span class="am-mb-badge ${e.used ? 'used' : 'free'}">${e.used ? '已使用' : '未使用'}</span>
+        <span class="am-mb-tag">${e.type === 'api' ? 'API' : 'IMAP'}</span>
+        <span class="am-mb-ops">
+          <button class="op-link" data-mb-test="${escapeHtml(e.email)}">测试</button>
+          <button class="op-link" data-mb-edit="${escapeHtml(e.email)}">编辑</button>
+          <button class="op-link danger" data-mb-del="${escapeHtml(e.email)}">删除</button>
+        </span>
+      </div>`).join('');
+  }
+  async function importMailbox() {
+    const text = $('#setMailbox').value.trim();
+    if (!text) { toast('请先粘贴 邮箱----凭证', 'err'); return; }
+    try {
+      const r = await api('POST', '/api/mailbox/import', { text });
+      renderMbList(r.entries, r.count, r.unused);
+      $('#setMailbox').value = '';
+      $('#mbImportBox').hidden = true;
+      toast(`已导入 ${r.added} 个（解析 ${r.parsed}），共 ${r.count} 个`, 'ok');
+    } catch (e) { toast('导入失败：' + e.message, 'err'); }
+  }
+  async function generateSplitAliases() {
+    // 防呆：分裂读的是「已入库的邮箱池」，不读粘贴框。若批量导入框里还有未导入文本，用户多半是
+    // 粘完直接点了分裂——此时分裂会加到旧池、粘贴内容丢失（历史「邮箱加错了」的根因）。先拦下提示。
+    const pending = ($('#setMailbox').value || '').trim();
+    if (pending) {
+      await confirmDialog('检测到「批量导入」框里有未导入的内容。请先点『导入到列表』把它们入库，再生成分裂别名。', {
+        title: '请先导入', okText: '知道了', cancelText: '', danger: false,
+      });
+      // 顺手展开导入框并聚焦，引导用户先导入。
+      $('#mbImportBox').hidden = false;
+      setTimeout(() => $('#setMailbox').focus(), 0);
+      return;
+    }
+    const n = Math.max(1, Math.min(200, Number($('#mbSplitCount').value) || 10));
+    try {
+      const r = await api('POST', '/api/mailbox/split-generate', { count: n });
+      renderMbList(r.entries, r.count, r.unused);
+      toast(`已生成 ${r.added} 个分裂邮箱`, 'ok');
+    } catch (e) { toast('生成失败：' + e.message, 'err'); }
+  }
+  async function clearAllMailbox() {
+    if (!await confirmDialog('确定清空邮箱池的全部条目？此操作不可恢复。', { title: '清空邮箱池', okText: '清空', danger: true })) return;
+    try {
+      const r = await api('POST', '/api/mailbox/clear', {});
+      renderMbList(r.entries || [], r.count != null ? r.count : 0, r.unused != null ? r.unused : 0);
+      toast('已清空邮箱池', 'ok');
+    } catch (e) { toast('清空失败：' + e.message, 'err'); }
+  }
+  let mbEditingEmail = '';
+  function editMailbox(email) {
+    const e = mbEntries.find(x => (x.email || '').toLowerCase() === (email || '').toLowerCase());
+    if (!e) { toast('邮箱不存在', 'err'); return; }
+    mbEditingEmail = e.email;
+    $('#mbEditEmail').textContent = e.email;
+    $('#mbEditCred').value = e.credential || '';
+    $('#mbEditUsed').checked = !!e.used;
+    $('#mbEditModal').hidden = false;
+    setTimeout(() => $('#mbEditCred').focus(), 0);
+  }
+  function closeMbEdit() { $('#mbEditModal').hidden = true; mbEditingEmail = ''; }
+  async function saveMbEdit() {
+    if (!mbEditingEmail) return;
+    const credential = $('#mbEditCred').value.trim();
+    const used = $('#mbEditUsed').checked;
+    try {
+      await api('POST', '/api/mailbox/update', { email: mbEditingEmail, credential, used });
+      // 本地同步并重算未使用数
+      const e = mbEntries.find(x => (x.email || '').toLowerCase() === mbEditingEmail.toLowerCase());
+      if (e) {
+        if (credential) { e.credential = credential; e.type = /^https?:\/\//i.test(credential) ? 'api' : 'imap'; }
+        e.used = used;
+      }
+      renderMbList(mbEntries);
+      closeMbEdit();
+      toast('已保存', 'ok');
+    } catch (e) { toast('更新失败：' + e.message, 'err'); }
+  }
+  async function deleteMailbox(email) {
+    if (!await confirmDialog(`确定删除邮箱「${email}」？`, { title: '删除邮箱', danger: true })) return;
+    try {
+      const r = await api('POST', '/api/mailbox/delete', { email });
+      renderMbList(r.entries, r.count, r.unused);
+      toast('已删除', 'ok');
+    } catch (e) { toast('删除失败：' + e.message, 'err'); }
+  }
+
+  // ==========================================================================
+  // 协议注册（后台任务 + 右下角进度浮层）
+  // ==========================================================================
+  let regTimer = null;
+  // 增量渲染去重用：记录已渲染日志的 key，避免每次轮询整体重绘（那是卡顿主因）
+  const regLogKeys = new Set();
+  const REG_LOG_MAX_LINES = 500;
+  function regLogKey(l) { return `${l.ts || 0}|${l.level || ''}|${l.account || ''}|${l.msg || ''}`; }
+  function appendRegLogs(logs) {
+    const box = $('#regLogs');
+    if (!box) return;
+    const atBottom = box.scrollTop + box.clientHeight >= box.scrollHeight - 28;
+    const frag = document.createDocumentFragment();
+    let added = 0;
+    for (const l of (logs || [])) {
+      const k = regLogKey(l);
+      if (regLogKeys.has(k)) continue;
+      regLogKeys.add(k);
+      const t = new Date(l.ts || Date.now()).toLocaleTimeString('zh-CN', { hour12: false });
+      const lv = String(l.level || 'info').replace(/[^a-z]/gi, '') || 'info';
+      const div = document.createElement('div');
+      div.className = 'reg-log-line lv-' + lv;
+      // 不再渲染账号邮箱（节省空间）；后端日志对象仍带 account，仅前端不显示。
+      div.innerHTML = `<span class="reg-log-ts">${t}</span> <span class="reg-log-msg">${escapeHtml(l.msg || '')}</span>`;
+      frag.appendChild(div);
+      added++;
+    }
+    if (!added) return;
+    box.appendChild(frag);
+    while (box.childElementCount > REG_LOG_MAX_LINES) box.removeChild(box.firstElementChild);
+    if (atBottom) box.scrollTop = box.scrollHeight; // 用户上滚查看历史时不强制吸底
+  }
+  async function clearRegLogs() {
+    regLogKeys.clear();
+    const box = $('#regLogs');
+    if (box) box.innerHTML = '';
+    try { await api('POST', '/api/reg/logs/clear', {}); } catch (e) { /* 后端无此接口也无妨 */ }
+  }
+  // 注册方式切换：仅浏览器注册时显示「无头/有头」选择。
+  function syncRegMode() {
+    const isBrowser = $('#regMode') && $('#regMode').value === 'browser';
+    if ($('#regHeadlessWrap')) $('#regHeadlessWrap').hidden = !isBrowser;
+  }
+  async function openRegModal() {
+    $('#regUnused').textContent = '…';
+    syncRegMode();
+    $('#regModal').hidden = false;
+    try {
+      const s = await api('GET', '/api/reg/status');
+      $('#regUnused').textContent = s.unused != null ? s.unused : '?';
+      if (s.unused) $('#regCount').value = Math.min(Number($('#regCount').value) || 10, s.unused) || s.unused;
+    } catch (e) { $('#regUnused').textContent = '?'; }
+  }
+  function closeRegModal() { $('#regModal').hidden = true; }
+  async function startReg() {
+    const count = Math.max(1, Number($('#regCount').value) || 1);
+    const threads = Math.max(1, Math.min(20, Number($('#regThreads').value) || 1));
+    const mode = ($('#regMode') && $('#regMode').value) || 'protocol';
+    const headless = !($('#regHeadless') && $('#regHeadless').value === '0'); // 有头=false，其余无头
+    const label = mode === 'browser' ? '浏览器注册' : '协议注册';
+    try {
+      const r = await api('POST', '/api/reg/start', { count, threads, mode, headless });
+      closeRegModal();
+      toast(`已开始${label}：${r.started} 个`, 'ok');
+      showRegPanel();
+      startRegPoll();
+    } catch (e) { toast('启动失败：' + e.message, 'err'); }
+  }
+  async function stopReg() {
+    try { await api('POST', '/api/reg/stop', {}); toast('已请求停止，将在进行中的账号完成后结束', 'ok'); }
+    catch (e) { toast('停止失败：' + e.message, 'err'); }
+  }
+  // 「重拿RT」：对勾选账号用 codex 客户端重新登录拿 RT（需要手机验证会自动接码），复用注册日志浮层。
+  async function refetchSelected() {
+    const ids = Array.from(state.probeSelected);
+    if (!ids.length) return toast('请先勾选要重拿 RT 的账号', 'err');
+    if (!(await confirmDialog(`确认对所选 ${ids.length} 个账号重拿 RT？将用 codex 重新登录（需要时自动接码）。`,
+      { title: '重拿RT', okText: '开始' }))) return;
+    const btn = $('#btnPbRefetch');
+    if (btn) { btn.disabled = true; }
+    try {
+      const r = await api('POST', '/api/probe/refetch-rt', { ids });
+      toast(`已开始重拿 RT：${r.started} 个`, 'ok');
+      showRegPanel();
+      startRegPoll();
+    } catch (e) {
+      toast('启动失败：' + e.message, 'err');
+    } finally {
+      if (btn) { btn.disabled = false; }
+    }
+  }
+  // 「批量绑手机拿RT」：对「跳过手机注册」的待绑手机账号（勾选优先；不选则后端自动挑全部 phonePending）
+  // 补做手机验证并拿 RT。底层与重拿RT同一 codex 登录流程，成功后 SUB=是、清 phonePending。复用注册日志浮层。
+  async function bindPhoneSelected() {
+    const ids = Array.from(state.probeSelected);
+    const tip = ids.length
+      ? `确认对所选 ${ids.length} 个账号补绑手机并拿 RT？`
+      : '未勾选账号：将对库里全部「待绑手机（无RT）」账号批量补绑手机拿 RT，确认？';
+    if (!(await confirmDialog(tip + '\n将用邮箱+固定密码重新登录，需要时自动接码（多国轮试）。',
+      { title: '批量绑手机拿RT', okText: '开始' }))) return;
+    const btn = $('#btnPbBindPhone');
+    if (btn) { btn.disabled = true; }
+    try {
+      const r = await api('POST', '/api/probe/bind-phone-rt', { ids });
+      toast(`已开始绑手机拿 RT：${r.started} 个`, 'ok');
+      showRegPanel();
+      startRegPoll();
+    } catch (e) {
+      toast('启动失败：' + e.message, 'err');
+    } finally {
+      if (btn) { btn.disabled = false; }
+    }
+  }
+  function showRegPanel() { $('#regPanel').hidden = false; $('#regPanel').classList.remove('min'); }
+  function renderRegStatus(s) {
+    const total = s.total || 0, done = s.done || 0;
+    const pct = total ? Math.round(done / total * 100) : 0;
+    $('#regProgressBar').style.width = pct + '%';
+    $('#regPanelStat').textContent = `${done}/${total} · 成功 ${s.ok || 0} · 失败 ${s.fail || 0}${s.running ? '' : ' · 已结束'}`;
+    appendRegLogs(s.logs || []);
+    $('#regPanelStop').hidden = !s.running;
+    $('#regPanelClose').hidden = !!s.running;
+  }
+  function startRegPoll() {
+    if (regTimer) clearInterval(regTimer);
+    const tick = async () => {
+      try {
+        const s = await api('GET', '/api/reg/status');
+        renderRegStatus(s);
+        if (!s.running) { clearInterval(regTimer); regTimer = null; loadProbe(); }
+      } catch (e) { /* 忽略单次轮询错误 */ }
+    };
+    tick();
+    regTimer = setInterval(tick, 1500);
+  }
+  async function resumeRegPanel() {
+    // 页面加载/切换回来时，若后台有任务在跑或刚结束，恢复浮层
+    try {
+      const s = await api('GET', '/api/reg/status');
+      if (s.running || (s.total && s.logs && s.logs.length)) {
+        showRegPanel();
+        if (s.running) startRegPoll(); else renderRegStatus(s);
+      }
+    } catch (e) { /* ignore */ }
+  }
+  let smsAllCfg = {};
+  function fillSmsFields(v) {
+    v = v || {};
+    $('#setSmsApiKey').value = v.apiKey || '';
+    $('#setSmsBaseUrl').value = v.baseUrl || '';
+    $('#setSmsCountry').value = (v.country === 0 || v.country) ? v.country : '';
+    $('#setSmsMaxPrice').value = v.maxPrice || '';
+  }
+  async function testSmsBalance() {
+    const el = $('#smsBalanceResult');
+    el.className = 'am-sms-bal'; el.textContent = '查询中…';
+    try {
+      const r = await api('POST', '/api/sms/balance', {
+        provider: $('#setSmsProvider').value,
+        apiKey: $('#setSmsApiKey').value.trim(),
+        baseUrl: $('#setSmsBaseUrl').value.trim(),
+      });
+      if (r.ok) { el.className = 'am-sms-bal ok'; el.textContent = '余额：' + r.balance; }
+      else { el.className = 'am-sms-bal err'; el.textContent = '失败：' + (r.error || '未知错误'); }
+    } catch (e) { el.className = 'am-sms-bal err'; el.textContent = '失败：' + e.message; }
+  }
+  async function openSettings() {
+    try {
+      const cfg = await api('GET', '/api/account-config');
+      $('#setProxies').value = (cfg.proxies || []).join('\n');
+      $('#setProxyCount').textContent = `共 ${cfg.proxyCount || 0} 条`;
+      const sms = cfg.sms || {};
+      smsAllCfg = cfg.smsAll || {};
+      $('#setSmsProvider').value = sms.provider || 'smscode';
+      fillSmsFields(sms);
+      $('#setSmsPollTimeout').value = sms.pollTimeout || 180000;
+      $('#smsBalanceResult').textContent = '';
+      const mb = cfg.mailbox || {};
+      $('#setMailbox').value = '';
+      $('#mbImportBox').hidden = true;
+      $('#setMbSplit').checked = !!mb.split;
+      renderMbList(mb.entries || [], mb.count, mb.unused);
+      $('#mbTestResult').hidden = true; $('#mbTestResult').innerHTML = '';
+      const cloak = cfg.cloak || {};
+      if ($('#setCloakKey')) $('#setCloakKey').value = cloak.licenseKey || '';
+      if ($('#setRegPassword')) $('#setRegPassword').value = cloak.regPassword || '';
+      setSettingsTab('proxy');
+      $('#settingsModal').hidden = false;
+    } catch (e) { toast('读取设置失败：' + e.message, 'err'); }
+  }
+  function closeSettings() { $('#settingsModal').hidden = true; }
+  async function saveSettings() {
+    try {
+      const r = await api('POST', '/api/account-config', {
+        proxies: $('#setProxies').value,
+        sms: {
+          provider: $('#setSmsProvider').value,
+          apiKey: $('#setSmsApiKey').value.trim(),
+          baseUrl: $('#setSmsBaseUrl').value.trim(),
+          country: $('#setSmsCountry').value.trim(),
+          maxPrice: $('#setSmsMaxPrice').value.trim(),
+          pollTimeout: Number($('#setSmsPollTimeout').value) || 180000,
+        },
+        mailbox: {
+          split: $('#setMbSplit').checked,
+        },
+        cloak: {
+          licenseKey: ($('#setCloakKey') && $('#setCloakKey').value.trim()) || '',
+          regPassword: ($('#setRegPassword') && $('#setRegPassword').value.trim()) || '',
+        },
+      });
+      const bad = (r.proxyBad || []).length;
+      toast(`已保存${r.proxySaved ? `：代理 ${r.proxyCount} 条` : ''}${bad ? `（忽略无效 ${bad} 行）` : ''}${r.smsSaved ? '，接码已更新' : ''}${r.mailboxSaved ? '，邮箱池设置已更新' : ''}${r.cloakSaved ? '，浏览器KEY已更新' : ''}`, 'ok');
+      $('#setProxyCount').textContent = `共 ${r.proxyCount || 0} 条`;
+      closeSettings();
+    } catch (e) { toast('保存失败：' + e.message, 'err'); }
+  }
+  async function testMailbox(email) {
+    email = (email || '').trim();
+    if (!email) { toast('请选择一个邮箱', 'err'); return; }
+    const box = $('#mbTestResult');
+    box.hidden = false;
+    box.innerHTML = '<div class="am-mb-loading">正在测试收件…</div>';
+    try {
+      const r = await api('POST', '/api/mailbox/test', { email });
+      if (!r.ok) { box.innerHTML = `<div class="am-mb-empty">测试失败：${escapeHtml(r.error || '未知错误')}</div>`; return; }
+      const msgs = r.messages || [];
+      const head = `<div class="am-mb-head">✓ 连接成功（${escapeHtml(r.type === 'api' ? '取件API' : (r.host || 'IMAP'))}），最新 ${msgs.length} 封</div>`;
+      const rows = msgs.length ? msgs.map(m => `
+        <div class="am-mb-item">
+          <div class="am-mb-subj">${escapeHtml(m.subject || '(无主题)')}</div>
+          <div class="am-mb-meta">${escapeHtml(m.from || '')} ${m.date ? '· ' + escapeHtml(m.date) : ''}</div>
+          ${m.code ? `<div class="am-mb-code">验证码 <b>${escapeHtml(m.code)}</b> <button class="op-link" data-copy="${escapeHtml(m.code)}">复制</button></div>` : ''}
+        </div>`).join('') : '<div class="am-mb-empty">收件箱暂无邮件</div>';
+      box.innerHTML = head + rows;
+    } catch (e) { box.innerHTML = `<div class="am-mb-empty">测试失败：${escapeHtml(e.message)}</div>`; }
+  }
+
+  // ==========================================================================
+  // PLUS 邮箱（保留原有：查收 / 拿RT / 删除封号）
+  // ==========================================================================
+  function plMatchFilter(a) {
+    switch (state.plFilter) {
+      case 'rt': return !!a.codexRt;
+      case 'nort': return !a.codexRt && !(a.banned === true || a.codexStatus === 'banned');
+      case 'banned': return a.banned === true || a.codexStatus === 'banned';
+      default: return true;
+    }
+  }
+  function plFiltered() {
+    const q = state.plSearch.trim().toLowerCase();
+    return state.plus.filter((a) => {
+      if (!plMatchFilter(a)) return false;
+      if (!q) return true;
+      return a.email.toLowerCase().includes(q) || domainOf(a.email).toLowerCase().includes(q) || (a.note || '').toLowerCase().includes(q);
+    });
+  }
+  function plPageItems() { return paginate(plFiltered(), state.plPage, state.plPageSize).items; }
+  async function loadPlus() {
+    try { const { accounts } = await api('GET', '/api/plus'); state.plus = accounts || []; renderPlus(); }
+    catch (e) { toast('加载失败：' + e.message, 'err'); }
+  }
+  function renderPlus() {
+    const list = plFiltered();
+    const pg = paginate(list, state.plPage, state.plPageSize);
+    state.plPage = pg.page;
+    const tbody = $('#plRows');
+    tbody.innerHTML = '';
+    $('#plEmpty').hidden = state.plus.length !== 0;
+    pg.items.forEach((a, i) => {
+      const key = a.email.toLowerCase();
+      const isSel = state.plSelected.has(key);
+      const showPw = state.plShowPw.has(key);
+      const absIdx = pg.startIdx + i + 1;
+      const rtHtml = a.codexRt
+        ? `<span class="rt-chip has" data-pl-copy-codexrt="${escapeHtml(a.email)}" title="点击复制 Codex Refresh Token">✔ 有</span>`
+        : (a.banned === true || a.codexStatus === 'banned')
+          ? '<span class="pb-status invalid">⛔ 已封号</span>'
+          : '<span class="rt-chip none">— 无</span>';
+      const tr = document.createElement('tr');
+      tr.innerHTML = `
+        <td class="col-check"><input type="checkbox" data-pl-check="${escapeHtml(a.email)}" ${isSel ? 'checked' : ''}></td>
+        <td class="col-idx">${absIdx}</td>
+        <td>
+          <div class="email-cell"><span class="text-mono">${escapeHtml(a.email)}</span>
+            <button class="icon-btn" data-copy="${escapeHtml(a.email)}" title="复制邮箱">⧉</button></div>
+          ${a.note ? `<div class="muted" style="font-size:12px">${escapeHtml(a.note)}</div>` : ''}
+        </td>
+        <td>
+          <div class="pw-cell">
+            <span class="${showPw ? 'pw-text' : 'pw-mask'}">${showPw ? escapeHtml(a.password) : '••••••••'}</span>
+            <button class="icon-btn" data-pl-toggle-pw="${escapeHtml(a.email)}" title="显示/隐藏">${showPw ? '🙈' : '👁'}</button>
+            <button class="icon-btn" data-pl-copy-pw="${escapeHtml(a.email)}" title="复制密码">⧉</button>
+          </div>
+        </td>
+        <td><span class="muted">—</span></td>
+        <td>${rtHtml}</td>
+        <td class="col-ops">
+          <div class="row-ops">
+            <button class="op-link" data-pl-inbox="${escapeHtml(a.email)}">查收</button>
+            <button class="op-link danger" data-pl-del="${escapeHtml(a.email)}">删除</button>
+          </div>
+        </td>`;
+      tbody.appendChild(tr);
+    });
+    $('#plPageInfo').textContent = `第 ${pg.page} / ${pg.pages} 页，共 ${pg.total} 条`;
+    $('#plCheckAll').checked = plPageItems().length > 0 && plPageItems().every((a) => state.plSelected.has(a.email.toLowerCase()));
+    renderStats();
+  }
+  function localParsePlus(text) {
+    const out = [], seen = new Set();
+    for (const raw of String(text).split(/\r?\n/)) {
+      const line = raw.trim(); if (!line) continue;
+      let parts = line.includes('----') ? line.split('----') : line.includes('\t') ? line.split('\t') : line.includes('|') ? line.split('|') : line.split(/\s+/);
+      parts = parts.map((s) => s.trim()).filter(Boolean);
+      if (parts.length < 4) continue;
+      if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(parts[0])) continue;
+      const k = parts[0].toLowerCase(); if (seen.has(k)) continue; seen.add(k); out.push(parts[0]);
+    }
+    return out;
+  }
+  function updatePlParsePreview() { $('#plParsePreview').textContent = `识别到 ${localParsePlus($('#plImportText').value).length} 个有效账号`; }
+  function openPlImport() { $('#plImportText').value = ''; updatePlParsePreview(); $('#plImportModal').hidden = false; }
+  function closePlImport() { $('#plImportModal').hidden = true; }
+  async function doPlImport() {
+    const text = $('#plImportText').value;
+    if (!localParsePlus(text).length) return toast('未识别到有效账号', 'err');
+    try { const r = await api('POST', '/api/plus/import', { text }); closePlImport(); await loadPlus(); toast(`导入完成：新增 ${r.added}，更新 ${r.updated}`, 'ok'); }
+    catch (e) { toast('导入失败：' + e.message, 'err'); }
+  }
+  async function plDelete(emails, msg) {
+    if (!emails.length) return;
+    if (!(await confirmDialog(msg || `确认删除选中的 ${emails.length} 个账号？此操作不可恢复。`, { title: '删除账号', okText: '删除', danger: true }))) return;
+    try {
+      const r = await api('DELETE', '/api/plus', { emails });
+      emails.forEach((e) => { const k = e.toLowerCase(); state.plSelected.delete(k); state.plCodes.delete(k); state.plStatusMap.delete(k); });
+      await loadPlus();
+      toast(`已删除 ${r.removed} 个账号`, 'ok');
+    } catch (e) { toast('删除失败：' + e.message, 'err'); }
+  }
+  function plDeleteBanned() {
+    const banned = state.plus.filter((a) => a.banned === true || a.codexStatus === 'banned');
+    if (!banned.length) return toast('没有已封号的账号');
+    plDelete(banned.map((a) => a.email), `检测到 ${banned.length} 个已封号账号，确认全部删除？`);
+  }
+  let rtPoll = null;
+  async function plGetRT() {
+    const targets = state.plSelected.size ? state.plus.filter((a) => state.plSelected.has(a.email.toLowerCase())) : plFiltered();
+    if (!targets.length) return toast('没有可拿 RT 的账号');
+    if (!(await confirmDialog(`将对 ${targets.length} 个账号复刻 Codex OAuth 授权流程换取 refresh_token。是否开始？`, { title: '批量拿 RT', okText: '开始' }))) return;
+    try {
+      const r = await api('POST', '/api/plus/get-rt', { emails: targets.map((a) => a.email) });
+      $('#rtPanel').hidden = false; $('#rtLogs').innerHTML = '';
+      toast(`已开始拿 RT ${r.started} 个账号`, 'ok');
+      startRtPolling();
+    } catch (e) { toast('启动失败：' + e.message, 'err'); }
+  }
+  function startRtPolling() {
+    if (rtPoll) clearInterval(rtPoll);
+    let ticks = 0;
+    const tick = async () => {
+      ticks++;
+      try {
+        const s = await api('GET', '/api/plus/rt-status');
+        $('#rtSummary').textContent = `进度 ${s.done}/${s.total} · 成功 ${s.ok} · 封号 ${s.banned} · 失败 ${s.fail}`;
+        const box = $('#rtLogs');
+        box.innerHTML = (s.logs || []).map((l) => `<div class="am-rt-line ${escapeHtml(l.level)}">${escapeHtml(fmtTime(l.ts))} ${l.account ? '[' + escapeHtml(l.account) + '] ' : ''}${escapeHtml(l.msg)}</div>`).join('');
+        box.scrollTop = box.scrollHeight;
+        if (state.activeTab === 'plus') await loadPlus();
+        if (!s.running && ticks > 1) { clearInterval(rtPoll); rtPoll = null; }
+      } catch { /* ignore */ }
+      if (ticks > 300 && rtPoll) { clearInterval(rtPoll); rtPoll = null; }
+    };
+    tick(); rtPoll = setInterval(tick, 3000);
+  }
+  async function plExport() {
+    const base = state.plSelected.size ? state.plus.filter((a) => state.plSelected.has(a.email.toLowerCase())) : plFiltered();
+    const withRt = base.filter((a) => typeof a.codexRt === 'string' && a.codexRt);
+    if (!withRt.length) return toast('没有可导出的账号（需先批量拿RT）');
+    try {
+      const ts = new Date().toISOString().replace(/[:.]/g, '-');
+      const count = await downloadPost('/api/plus/export', { emails: withRt.map((a) => a.email) }, `sub2api_export_${ts}.json`);
+      toast(`已导出 ${count || withRt.length} 个账号（SUB2API 格式）`, 'ok');
+    } catch (e) { toast('导出失败：' + e.message, 'err'); }
+  }
+  // 查收
+  let currentInboxEmail = '';
+  function openInbox(email) { currentInboxEmail = email; $('#inboxAddr').textContent = email; $('#inboxBody').innerHTML = '<div class="drawer-loading">正在查收邮件…</div>'; $('#inboxDrawer').hidden = false; refreshInbox(); }
+  function closeInbox() { $('#inboxDrawer').hidden = true; currentInboxEmail = ''; }
+  async function refreshInbox() {
+    const email = currentInboxEmail; if (!email) return;
+    $('#inboxBody').innerHTML = '<div class="drawer-loading">正在查收邮件…</div>';
+    try {
+      const { messages } = await api('POST', '/api/plus/inbox', { email });
+      renderInbox(messages);
+      const withCode = (messages || []).find((m) => m.extracted_code);
+      if (withCode) state.plCodes.set(email.toLowerCase(), withCode.extracted_code);
+    } catch (e) { $('#inboxBody').innerHTML = `<div class="drawer-empty">${escapeHtml(e.message)}</div>`; toast('查收失败：' + e.message, 'err'); }
+  }
+  function renderInbox(messages) {
+    const body = $('#inboxBody');
+    if (!messages || !messages.length) { body.innerHTML = '<div class="drawer-empty">当前收件箱暂无邮件。<br>请在目标平台触发验证码后点击「刷新」。</div>'; return; }
+    body.innerHTML = '';
+    messages.forEach((m) => {
+      const item = document.createElement('div'); item.className = 'msg-item';
+      const bodyText = m.body || m.snippet || '';
+      item.innerHTML = `
+        <div class="msg-from">${escapeHtml(m.from_addr || '（未知发送者）')}</div>
+        <div class="msg-subject">${escapeHtml(m.subject || '（无主题）')}</div>
+        <div class="msg-time">${escapeHtml(fmtTime(m.received_at))}</div>
+        ${m.extracted_code ? `<div class="msg-code"><span class="code-chip" data-copy-code="${escapeHtml(m.extracted_code)}">${escapeHtml(m.extracted_code)} ⧉</span></div>` : ''}
+        ${bodyText ? `<div class="msg-body">${escapeHtml(bodyText)}</div>` : ''}`;
+      body.appendChild(item);
+    });
+  }
+
+  // ==========================================================================
+  // 事件绑定
+  // ==========================================================================
+  function bind() {
+    $('#btnSettings').addEventListener('click', openSettings);
+    $('#settingsClose').addEventListener('click', closeSettings);
+    $('#settingsCancel').addEventListener('click', closeSettings);
+    $('#btnSaveSettings').addEventListener('click', saveSettings);
+    document.querySelectorAll('.am-set-tab').forEach(b => b.addEventListener('click', () => setSettingsTab(b.dataset.setTab)));
+    $('#setSmsProvider').addEventListener('change', (e) => {
+      fillSmsFields(smsAllCfg[e.target.value] || {});
+      $('#smsBalanceResult').textContent = '';
+    });
+    $('#smsBalanceBtn').addEventListener('click', testSmsBalance);
+    $('#mbSplitGen').addEventListener('click', generateSplitAliases);
+    $('#mbToggleImport').addEventListener('click', () => {
+      const box = $('#mbImportBox');
+      box.hidden = !box.hidden;
+      if (!box.hidden) setTimeout(() => $('#setMailbox').focus(), 0);
+    });
+    $('#mbImportBtn').addEventListener('click', importMailbox);
+    $('#mbClearAll').addEventListener('click', clearAllMailbox);
+    $('#mbList').addEventListener('click', (e) => {
+      const t = e.target.closest('[data-mb-test],[data-mb-edit],[data-mb-del]');
+      if (!t) return;
+      if (t.dataset.mbTest) testMailbox(t.dataset.mbTest);
+      else if (t.dataset.mbEdit) editMailbox(t.dataset.mbEdit);
+      else if (t.dataset.mbDel) deleteMailbox(t.dataset.mbDel);
+    });
+    $('#mbEditSave').addEventListener('click', saveMbEdit);
+    $('#mbEditCancel').addEventListener('click', closeMbEdit);
+    $('#mbEditCloseX').addEventListener('click', closeMbEdit);
+    $('#mbEditModal').addEventListener('mousedown', (e) => { if (e.target === $('#mbEditModal')) closeMbEdit(); });
+    $('#mbTestResult').addEventListener('click', (e) => {
+      const c = e.target.closest('[data-copy]');
+      if (c) copyText(c.dataset.copy, '已复制验证码');
+    });
+
+    // GPT toolbar
+    $('#pbAutoRefresh').addEventListener('change', (e) => toggleAutoRefresh(e.target.checked));
+    $('#pbOpenedOnly').addEventListener('change', (e) => { state.pbOpenedOnly = e.target.checked; state.pbPage = 1; renderProbe(); });
+    // 协议注册：占位功能，仅提示（不接入任何注册后端）
+    $('#btnPbRefetch').addEventListener('click', refetchSelected);
+    if ($('#btnPbBindPhone')) $('#btnPbBindPhone').addEventListener('click', bindPhoneSelected);
+    $('#btnProtocolReg').addEventListener('click', openRegModal);
+    if ($('#regMode')) $('#regMode').addEventListener('change', syncRegMode);
+    $('#regCloseX').addEventListener('click', closeRegModal);
+    $('#regCancel').addEventListener('click', closeRegModal);
+    $('#regStart').addEventListener('click', startReg);
+    $('#regPanelMin').addEventListener('click', () => $('#regPanel').classList.toggle('min'));
+    $('#regPanelStop').addEventListener('click', stopReg);
+    $('#regPanelClear').addEventListener('click', clearRegLogs);
+    $('#regPanelClose').addEventListener('click', () => { $('#regPanel').hidden = true; });
+    $('#btnPbImport').addEventListener('click', openPbImport);
+    $('#pbImportText').addEventListener('input', updatePbParsePreview);
+    $('#btnDoPbImport').addEventListener('click', doPbImport);
+    $('#pbImportClose').addEventListener('click', closePbImport);
+    $('#pbImportCancel').addEventListener('click', closePbImport);
+    $('#btnPbDetectBatch').addEventListener('click', pbDetectBatch);
+    $('#btnPbExportAt').addEventListener('click', pbExportAt);
+    $('#btnPbExportSub').addEventListener('click', pbExportSub);
+    $('#btnPbExportPw').addEventListener('click', pbExportPw);
+    $('#btnPbDelSel').addEventListener('click', pbDeleteSelected);
+    $('#btnPbDelAll').addEventListener('click', pbDeleteAll);
+    $('#btnPbDelInvalid').addEventListener('click', () => pbDeleteByFilter('invalid'));
+    $('#btnPbDelExpired').addEventListener('click', () => pbDeleteByFilter('expired'));
+    initDropdowns();
+    $('#pbPageSize').addEventListener('change', (e) => { state.pbPageSize = Number(e.target.value); state.pbPage = 1; renderProbe(); });
+    $('#pbPagePrev').addEventListener('click', () => { state.pbPage -= 1; renderProbe(); });
+    $('#pbPageNext').addEventListener('click', () => { state.pbPage += 1; renderProbe(); });
+    $('#pbCheckAll').addEventListener('change', (e) => {
+      const items = pbPageItems();
+      if (e.target.checked) items.forEach((a) => state.probeSelected.add(a.id));
+      else items.forEach((a) => state.probeSelected.delete(a.id));
+      renderProbe();
+    });
+    $('#pbRows').addEventListener('change', (e) => {
+      const cb = e.target.closest('[data-pb-check]'); if (!cb) return;
+      cb.checked ? state.probeSelected.add(cb.dataset.pbCheck) : state.probeSelected.delete(cb.dataset.pbCheck);
+      renderStats();
+      $('#pbCheckAll').checked = pbPageItems().every((a) => state.probeSelected.has(a.id));
+    });
+    $('#pbRows').addEventListener('click', (e) => {
+      const t = e.target.closest('[data-pb-detect],[data-pb-edit],[data-pb-refresh],[data-pb-del],[data-pb-copy-at],[data-pb-copy-rt],[data-pb-copy-email],[data-pb-toggle-pw],[data-pb-copy-pw]');
+      if (!t) return;
+      const find = (id) => state.probe.find((x) => String(x.id) === String(id));
+      if (t.dataset.pbDetect) return pbDetectOne(t.dataset.pbDetect, t);
+      if (t.dataset.pbEdit) return openPbEdit(t.dataset.pbEdit);
+      if (t.dataset.pbRefresh) return pbRefreshOne(t.dataset.pbRefresh);
+      if (t.dataset.pbDel) return pbDeleteOne(t.dataset.pbDel);
+      if (t.dataset.pbCopyAt) return copyText(find(t.dataset.pbCopyAt).accessToken, '已复制 Access Token');
+      if (t.dataset.pbCopyRt) return copyText(find(t.dataset.pbCopyRt).refreshToken, '已复制 Refresh Token');
+      if (t.dataset.pbCopyEmail) return copyText(find(t.dataset.pbCopyEmail).email, '已复制邮箱');
+      if (t.dataset.pbTogglePw) { const id = t.dataset.pbTogglePw; state.probeShowPw.has(id) ? state.probeShowPw.delete(id) : state.probeShowPw.add(id); return renderProbe(); }
+      if (t.dataset.pbCopyPw) return copyText(find(t.dataset.pbCopyPw).password, '已复制密码');
+    });
+    $('#pbEditClose').addEventListener('click', closePbEdit);
+    $('#pbEditCancel').addEventListener('click', closePbEdit);
+    $('#btnSavePbEdit').addEventListener('click', savePbEdit);
+
+    // PLUS toolbar
+    $('#plSearch').addEventListener('input', (e) => { state.plSearch = e.target.value; state.plPage = 1; renderPlus(); });
+    $('#plFilter').addEventListener('change', (e) => { state.plFilter = e.target.value; state.plPage = 1; renderPlus(); });
+    $('#plCheckAll').addEventListener('change', (e) => {
+      const items = plPageItems();
+      if (e.target.checked) items.forEach((a) => state.plSelected.add(a.email.toLowerCase()));
+      else items.forEach((a) => state.plSelected.delete(a.email.toLowerCase()));
+      renderPlus();
+    });
+    $('#plPageSize').addEventListener('change', (e) => { state.plPageSize = Number(e.target.value); state.plPage = 1; renderPlus(); });
+    $('#plPagePrev').addEventListener('click', () => { state.plPage -= 1; renderPlus(); });
+    $('#plPageNext').addEventListener('click', () => { state.plPage += 1; renderPlus(); });
+    $('#plRows').addEventListener('change', (e) => {
+      const cb = e.target.closest('[data-pl-check]'); if (!cb) return;
+      const k = cb.dataset.plCheck.toLowerCase();
+      cb.checked ? state.plSelected.add(k) : state.plSelected.delete(k);
+      renderStats();
+    });
+    $('#plRows').addEventListener('click', (e) => {
+      const t = e.target.closest('[data-copy],[data-pl-toggle-pw],[data-pl-copy-pw],[data-pl-copy-codexrt],[data-pl-inbox],[data-pl-del]');
+      if (!t) return;
+      const find = (email) => state.plus.find((x) => x.email.toLowerCase() === String(email).toLowerCase());
+      if (t.dataset.copy) return copyText(t.dataset.copy, '已复制邮箱');
+      if (t.dataset.plTogglePw) { const k = t.dataset.plTogglePw.toLowerCase(); state.plShowPw.has(k) ? state.plShowPw.delete(k) : state.plShowPw.add(k); return renderPlus(); }
+      if (t.dataset.plCopyPw) return copyText(find(t.dataset.plCopyPw).password, '已复制密码');
+      if (t.dataset.plCopyCodexrt) return copyText(find(t.dataset.plCopyCodexrt).codexRt, '已复制 Codex RT');
+      if (t.dataset.plInbox) return openInbox(t.dataset.plInbox);
+      if (t.dataset.plDel) return plDelete([t.dataset.plDel]);
+    });
+    $('#btnPlImport').addEventListener('click', openPlImport);
+    $('#plImportText').addEventListener('input', updatePlParsePreview);
+    $('#btnDoPlImport').addEventListener('click', doPlImport);
+    $('#plImportClose').addEventListener('click', closePlImport);
+    $('#plImportCancel').addEventListener('click', closePlImport);
+    $('#btnPlGetRT').addEventListener('click', plGetRT);
+    $('#btnPlExport').addEventListener('click', plExport);
+    $('#btnPlDelete').addEventListener('click', () => { if (!state.plSelected.size) return toast('请先选择账号'); plDelete(Array.from(state.plSelected)); });
+    $('#btnPlDeleteBanned').addEventListener('click', plDeleteBanned);
+    $('#inboxClose').addEventListener('click', closeInbox);
+    $('#inboxMask').addEventListener('click', closeInbox);
+    $('#inboxRefresh').addEventListener('click', refreshInbox);
+    $('#inboxBody').addEventListener('click', (e) => { const c = e.target.closest('[data-copy-code]'); if (c) copyText(c.dataset.copyCode, '已复制验证码'); });
+    $('#rtPanelClose').addEventListener('click', () => { $('#rtPanel').hidden = true; if (rtPoll) { clearInterval(rtPoll); rtPoll = null; } });
+  }
+
+  bind();
+  switchTab('gpt');
+  resumeRegPanel();
+})();
diff --git a/static/app-shell.css b/static/app-shell.css
new file mode 100644
index 0000000..36a1290
--- /dev/null
+++ b/static/app-shell.css
@@ -0,0 +1,360 @@
+@charset "UTF-8";
+
+/* ==========================================================================
+   App Shell — 统一设计系统(参考 auto 项目 · 蓝色企业风 · 全局非加粗)
+   左右布局:蓝色渐变侧栏 + 右侧功能区
+   所有功能页共用;功能样式在各自 css 里补充(复用下方令牌)
+   ========================================================================== */
+
+:root {
+  color-scheme: light;
+  /* 品牌蓝 */
+  --blue-700: #1e40af;
+  --blue-600: #2563eb;
+  --blue-500: #3b82f6;
+  --blue-100: #dbeafe;
+  --blue-50:  #eff6ff;
+  /* 墨色文字 */
+  --ink-900: #0f172a;
+  --ink-700: #334155;
+  --ink-500: #64748b;
+  --ink-400: #94a3b8;
+  /* 线与底 */
+  --line: #e2e8f0;
+  --line-soft: #eef2f7;
+  --bg: #f4f7fb;
+  --card: #ffffff;
+  /* 语义色 */
+  --danger: #dc2626;
+  --danger-soft: #fef2f2;
+  --ok: #059669;
+  --ok-soft: #ecfdf5;
+  --warn: #b45309;
+  --warn-soft: #fffbeb;
+  /* 圆角/阴影/字体 */
+  --radius: 6px;
+  --radius-sm: 4px;
+  --shadow: 0 1px 2px rgba(15, 23, 42, .04), 0 8px 24px rgba(15, 23, 42, .06);
+  --shadow-pop: 0 12px 40px rgba(15, 23, 42, .18);
+  --font: "Inter", -apple-system, "Segoe UI", "Microsoft YaHei", "PingFang SC", "Noto Sans SC", sans-serif;
+  --mono: "SFMono-Regular", "Cascadia Mono", Consolas, "Liberation Mono", monospace;
+
+  /* 兼容旧令牌名(功能页 css 复用) */
+  --primary: #2563eb;
+  --primary-dark: #1e40af;
+  --primary-light: #3b82f6;
+  --panel: #ffffff;
+  --panel2: #f8fafc;
+  --line-strong: #cbd5e1;
+  --text: #0f172a;
+  --muted: #64748b;
+}
+
+/* 全局:一律不加粗,盒模型统一 */
+* { box-sizing: border-box; font-weight: 400 !important; }
+html, body { margin: 0; padding: 0; height: 100%; }
+body {
+  background: var(--bg);
+  color: var(--ink-900);
+  font-family: var(--font);
+  font-size: 14px;
+  line-height: 1.55;
+  -webkit-font-smoothing: antialiased;
+}
+h1, h2, h3, h4 { margin: 0; }
+code, .text-mono { font-family: var(--mono); }
+input, textarea, button, select { font-family: inherit; font-size: 14px; color: inherit; }
+
+/* 统一滚动条 */
+* { scrollbar-width: thin; scrollbar-color: #cbd5e1 transparent; }
+*::-webkit-scrollbar { width: 10px; height: 10px; }
+*::-webkit-scrollbar-track { background: transparent; }
+*::-webkit-scrollbar-thumb { background: #cbd5e1; border-radius: 4px; border: 2px solid transparent; background-clip: padding-box; }
+*::-webkit-scrollbar-thumb:hover { background: #94a3b8; background-clip: padding-box; }
+
+/* ---------- 布局骨架 ---------- */
+.layout { display: flex; min-height: 100vh; }
+
+/* ---------- 侧栏(蓝色渐变) ---------- */
+.sidebar {
+  width: 224px;
+  flex-shrink: 0;
+  background: linear-gradient(180deg, var(--blue-700), var(--blue-600));
+  color: #fff;
+  display: flex;
+  flex-direction: column;
+  position: sticky;
+  top: 0;
+  height: 100vh;
+}
+.sidebar-brand {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 18px;
+  border-bottom: 1px solid rgba(255, 255, 255, .12);
+}
+.sidebar-brand .logo-box {
+  width: 36px;
+  height: 36px;
+  border-radius: 9px;
+  background: rgba(255, 255, 255, .18);
+  border: 1px solid rgba(255, 255, 255, .3);
+  display: grid;
+  place-items: center;
+  color: #fff;
+  font-size: 18px;
+  letter-spacing: .5px;
+}
+.sidebar-brand .brand-text { display: flex; flex-direction: column; line-height: 1.3; }
+.sidebar-brand .brand-text b { color: #fff; font-size: 16px; letter-spacing: 1px; }
+.sidebar-brand .brand-text small { color: rgba(255, 255, 255, .78); font-size: 12px; }
+
+.sidebar-menu { flex: 1 1 auto; padding: 14px 12px; display: flex; flex-direction: column; gap: 6px; overflow-y: auto; }
+/* 底部固定链接组：被主菜单的 flex:1 顶到侧栏底部，并用分隔线与主导航区分 */
+.menu-foot {
+  margin-top: auto;
+  flex: 0 0 auto;
+  padding: 12px;
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  border-top: 1px solid rgba(255, 255, 255, .12);
+}
+.menu-item {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 11px 14px;
+  border-radius: var(--radius-sm);
+  color: rgba(255, 255, 255, .82);
+  text-decoration: none;
+  font-size: 14px;
+  transition: background .15s, color .15s;
+}
+.menu-item:hover { background: rgba(255, 255, 255, .12); color: #fff; }
+.menu-item.active { background: rgba(255, 255, 255, .18); color: #fff; }
+.menu-item .icon { font-size: 18px; width: 20px; text-align: center; }
+/* 导航图标：CSS mask + currentColor（白色），替代 emoji */
+.menu-item .nav-ic {
+  width: 18px; height: 18px; text-align: initial; flex: 0 0 auto;
+  background-color: currentColor;
+  -webkit-mask: var(--icon) center / contain no-repeat;
+  mask: var(--icon) center / contain no-repeat;
+  opacity: .9;
+}
+.menu-item:hover .nav-ic, .menu-item.active .nav-ic { opacity: 1; }
+.nav-ic-accounts {
+  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z'/%3E%3C/svg%3E");
+}
+.nav-ic-cardflow {
+  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M20 4H4c-1.11 0-1.99.89-1.99 2L2 18c0 1.11.89 2 2 2h16c1.11 0 2-.89 2-2V6c0-1.11-.89-2-2-2zm0 14H4v-6h16v6zm0-10H4V6h16v2z'/%3E%3C/svg%3E");
+}
+.nav-ic-protocol {
+  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M7 2v11h3v9l7-12h-4l4-8z'/%3E%3C/svg%3E");
+}
+.nav-ic-pay {
+  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z'/%3E%3C/svg%3E");
+}
+.nav-ic-cardlink {
+  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z'/%3E%3C/svg%3E");
+}
+.nav-ic-github {
+  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M12 .5C5.73.5.5 5.73.5 12c0 5.08 3.29 9.39 7.86 10.91.58.11.79-.25.79-.56 0-.27-.01-1.16-.02-2.1-3.2.7-3.87-1.36-3.87-1.36-.53-1.34-1.29-1.7-1.29-1.7-1.05-.72.08-.71.08-.71 1.16.08 1.77 1.2 1.77 1.2 1.03 1.77 2.7 1.26 3.36.96.1-.75.4-1.26.73-1.55-2.55-.29-5.24-1.28-5.24-5.68 0-1.26.45-2.28 1.19-3.09-.12-.29-.52-1.46.11-3.04 0 0 .97-.31 3.18 1.18a11.1 11.1 0 0 1 5.79 0c2.2-1.49 3.17-1.18 3.17-1.18.63 1.58.23 2.75.11 3.04.74.81 1.19 1.83 1.19 3.09 0 4.41-2.69 5.38-5.25 5.67.41.35.78 1.05.78 2.12 0 1.53-.01 2.76-.01 3.14 0 .31.21.68.8.56A11.51 11.51 0 0 0 23.5 12C23.5 5.73 18.27.5 12 .5z'/%3E%3C/svg%3E");
+}
+.nav-ic-qq {
+  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M20 2H4c-1.1 0-1.99.9-1.99 2L2 22l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm-2 12H6v-2h12v2zm0-3H6V9h12v2zm0-3H6V6h12v2z'/%3E%3C/svg%3E");
+}
+.menu-item .count {
+  margin-left: auto;
+  min-width: 18px; height: 18px; padding: 0 5px;
+  border-radius: 4px; background: #f87171; color: #fff;
+  font-size: 11px; display: flex; align-items: center; justify-content: center;
+}
+
+/* ---------- 主区域 ---------- */
+.main { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+.topbar {
+  height: 60px;
+  flex-shrink: 0;
+  background: var(--card);
+  border-bottom: 1px solid var(--line);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0 28px;
+}
+.topbar-title { font-size: 18px; color: var(--ink-900); letter-spacing: .3px; }
+.topbar-actions { display: flex; align-items: center; gap: 8px; font-size: 13px; color: var(--ink-500); }
+.topbar-actions .dot { width: 8px; height: 8px; border-radius: 50%; background: #34d399; box-shadow: 0 0 0 3px rgba(52, 211, 153, .16); }
+
+.content { flex: 1; padding: 22px 28px 60px; min-width: 0; width: 100%; }
+
+/* ---------- 面板/卡片 ---------- */
+.card, .panel {
+  background: var(--card);
+  border: 1px solid var(--line);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow);
+  padding: 18px 20px;
+  margin-bottom: 16px;
+}
+
+.section-title {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 14px;
+  margin-bottom: 14px;
+}
+.section-title b { font-size: 14px; color: var(--ink-900); }
+.section-title small { color: var(--ink-500); font-size: 12px; }
+
+/* 药丸标签 */
+.tag {
+  display: inline-flex;
+  align-items: center;
+  padding: 2px 9px;
+  border-radius: 4px;
+  font-size: 12px;
+  background: var(--blue-50);
+  color: var(--blue-700);
+  border: 1px solid var(--blue-100);
+}
+.badge {
+  display: inline-flex;
+  align-items: center;
+  padding: 2px 9px;
+  border-radius: 4px;
+  font-size: 12px;
+  background: var(--blue-50);
+  color: var(--blue-700);
+  border: 1px solid var(--blue-100);
+}
+
+/* ---------- 表单控件 ---------- */
+label { display: block; margin-bottom: 6px; font-size: 13px; color: var(--ink-500); }
+label > span { color: var(--ink-500); }
+
+input, textarea {
+  width: 100%;
+  border: 1px solid var(--line);
+  background: #fff;
+  color: var(--ink-900);
+  border-radius: var(--radius-sm);
+  padding: 10px 12px;
+  outline: none;
+  transition: border-color .15s, box-shadow .15s;
+}
+input:not([type="checkbox"]):not([type="radio"]) { height: 38px; padding: 0 12px; }
+textarea { resize: vertical; font-family: var(--mono); line-height: 1.6; }
+input:focus, textarea:focus { border-color: var(--blue-500); box-shadow: 0 0 0 3px rgba(59, 130, 246, .12); }
+
+/* 下拉框:统一箭头样式 */
+select {
+  width: 100%;
+  height: 38px;
+  padding: 0 34px 0 12px;
+  border: 1px solid var(--line);
+  border-radius: var(--radius-sm);
+  background: #fff url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 24 24' fill='none' stroke='%2364748b' stroke-width='2'%3E%3Cpath d='M6 9l6 6 6-6'/%3E%3C/svg%3E") no-repeat right 10px center;
+  color: var(--ink-900);
+  cursor: pointer;
+  outline: none;
+  -webkit-appearance: none;
+  appearance: none;
+  transition: border-color .15s, box-shadow .15s;
+}
+select:focus { border-color: var(--blue-500); box-shadow: 0 0 0 3px rgba(59, 130, 246, .12); }
+select option { background: #fff; color: var(--ink-900); }
+input[type="checkbox"], input[type="radio"] { width: 15px; height: 15px; accent-color: var(--blue-600); cursor: pointer; }
+
+/* ---------- 统一按钮 ---------- */
+button, .btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 6px;
+  height: 38px;
+  padding: 0 16px;
+  border: 1px solid var(--blue-600);
+  border-radius: var(--radius-sm);
+  background: var(--blue-600);
+  color: #fff;
+  font-size: 14px;
+  cursor: pointer;
+  white-space: nowrap;
+  transition: background .15s, border-color .15s, color .15s;
+}
+button:hover:not(:disabled), .btn:hover:not(:disabled), .btn-primary:hover:not(:disabled) { background: var(--blue-700); border-color: var(--blue-700); }
+button:disabled, .btn:disabled { opacity: .55; cursor: not-allowed; }
+
+/* 次要 / 幽灵按钮 */
+button.secondary, button.ghost, .btn-ghost, .btn-secondary,
+.load-card-button, .copy-one-button, .remove-pair, .add-at-button {
+  background: #fff;
+  color: var(--ink-700);
+  border-color: var(--line);
+}
+button.secondary:hover:not(:disabled), button.ghost:hover:not(:disabled),
+.btn-ghost:hover:not(:disabled), .btn-secondary:hover:not(:disabled),
+.load-card-button:hover:not(:disabled), .copy-one-button:hover:not(:disabled) {
+  background: var(--blue-50);
+  color: var(--blue-700);
+  border-color: var(--blue-100);
+}
+
+/* 危险按钮 */
+.btn-danger, button.danger {
+  background: #fff; color: var(--danger); border-color: #fecaca;
+}
+.btn-danger:hover:not(:disabled), button.danger:hover:not(:disabled) { background: var(--danger-soft); }
+
+/* 小尺寸 */
+.small, .btn-sm { height: 32px; padding: 0 12px; font-size: 13px; }
+
+/* ---------- 提示框(status/hint) ---------- */
+.status {
+  margin-top: 16px;
+  padding: 11px 14px;
+  border-radius: var(--radius-sm);
+  background: #fff;
+  border: 1px solid var(--line);
+  border-left: 3px solid var(--blue-600);
+  color: var(--ink-700);
+  font-size: 13px;
+  white-space: pre-wrap;
+}
+.status.ok { border-left-color: var(--ok); background: var(--ok-soft); color: #047857; }
+.status.error { border-left-color: var(--danger); background: var(--danger-soft); color: #991b1b; }
+.status.warn { border-left-color: var(--warn); background: var(--warn-soft); color: #92400e; }
+
+.hint { color: var(--ink-500); font-size: 13px; margin: 0 0 12px; }
+.hint code { background: var(--blue-50); color: var(--blue-700); padding: 1px 6px; border-radius: 5px; font-size: 12px; }
+
+/* ---------- 空态 ---------- */
+.empty {
+  min-height: 300px;
+  border: 1px dashed var(--line-strong);
+  border-radius: var(--radius);
+  display: grid;
+  place-content: center;
+  text-align: center;
+  gap: 6px;
+  color: var(--ink-400);
+  background: #fbfcfd;
+}
+.empty b { font-size: 15px; color: var(--ink-700); }
+.empty[hidden] { display: none; }
+
+/* ---------- 响应式:窄屏侧栏收窄为图标 ---------- */
+@media (max-width: 960px) {
+  .sidebar { width: 64px; }
+  .sidebar-brand { justify-content: center; padding: 16px 0; }
+  .sidebar-brand .brand-text { display: none; }
+  .menu-item { justify-content: center; padding: 11px 0; }
+  .menu-item span:not(.icon):not(.count) { display: none; }
+}
+@media (max-width: 820px) {
+  .content, .topbar { padding-left: 16px; padding-right: 16px; }
+}
diff --git a/templates/_sidebar.html b/templates/_sidebar.html
new file mode 100644
index 0000000..544a491
--- /dev/null
+++ b/templates/_sidebar.html
@@ -0,0 +1,18 @@
+{# 共享侧边栏：一级平铺菜单（企业蓝）。active 取值：gpt / card-flow / protocol / pay / card-link #}
+<aside class="sidebar">
+  <div class="sidebar-brand">
+    <span class="logo-box">C</span>
+    <span class="brand-text"><b>ChatGpt</b><small>神奇的发烧友</small></span>
+  </div>
+  <nav class="sidebar-menu">
+    <a class="menu-item {{ 'active' if active == 'gpt' else '' }}" href="/account-manager/"><span class="icon nav-ic nav-ic-accounts"></span><span>GPT管理</span></a>
+    <a class="menu-item {{ 'active' if active == 'card-link' else '' }}" href="/embed/card-link"><span class="icon nav-ic nav-ic-cardlink"></span><span>直卡直开</span></a>
+    <a class="menu-item {{ 'active' if active == 'card-flow' else '' }}" href="/embed/card-flow"><span class="icon nav-ic nav-ic-cardflow"></span><span>批量直开(试用3天)</span></a>
+    <a class="menu-item {{ 'active' if active == 'protocol' else '' }}" href="/embed/protocol"><span class="icon nav-ic nav-ic-protocol"></span><span>协议支付(试用3天)</span></a>
+    <a class="menu-item {{ 'active' if active == 'pay' else '' }}" href="/embed/pay"><span class="icon nav-ic nav-ic-pay"></span><span>提取链接(试用3天)</span></a>
+  </nav>
+  <div class="menu-foot">
+    <a class="menu-item" href="https://github.com/432539/gpt" target="_blank" rel="noopener"><span class="nav-ic nav-ic-github"></span><span>开源地址</span></a>
+    <a class="menu-item" href="#" title="点击复制 QQ 群号" onclick="navigator.clipboard&&navigator.clipboard.writeText('19302577');return false;"><span class="nav-ic nav-ic-qq"></span><span>QQ群 19302577</span></a>
+  </div>
+</aside>
diff --git a/templates/account-manager.html b/templates/account-manager.html
new file mode 100644
index 0000000..551cfe4
--- /dev/null
+++ b/templates/account-manager.html
@@ -0,0 +1,413 @@
+<!doctype html>
+<html lang="zh-CN" data-api-base="{{ request.script_root }}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>账号管理</title>
+  <link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="{{ url_for('static', filename='app-shell.css', v='13') }}">
+  <link rel="stylesheet" href="{{ url_for('static', filename='account-manager.css', v='24') }}">
+</head>
+<body>
+<div class="layout">
+  {% set active = 'gpt' %}
+  {% include '_sidebar.html' %}
+
+  <div class="main">
+    <header class="topbar">
+      <div class="topbar-title">账号管理</div>
+      <div class="topbar-actions">
+        <button id="btnSettings" class="secondary small" type="button">⚙ 设置</button>
+        <span class="dot"></span>服务运行中
+      </div>
+    </header>
+
+    <div class="content">
+      <!-- 统计卡片 -->
+      <section class="am-stats">
+        <div class="am-stat-card"><div class="am-stat-num" id="statA">0</div><div class="am-stat-label" id="statAL">账号总数</div></div>
+        <div class="am-stat-card"><div class="am-stat-num" id="statB">0</div><div class="am-stat-label" id="statBL">已选中</div></div>
+        <div class="am-stat-card"><div class="am-stat-num" id="statC">0</div><div class="am-stat-label" id="statCL">有效 AT</div></div>
+        <div class="am-stat-card"><div class="am-stat-num" id="statD">0</div><div class="am-stat-label" id="statDL">续期数量</div></div>
+      </section>
+
+      <!-- ============ GPT 账号管理（primary） ============ -->
+      <section class="card am-view" id="view-gpt">
+        <div class="am-toolbar">
+          <label class="am-auto-refresh" title="对未知状态、已过期或临近过期（<1天）的账号自动用 refresh_token 续期/校验">
+            <input type="checkbox" id="pbAutoRefresh">
+            <span>自动刷新 TOKEN</span>
+            <span class="muted" id="pbAutoRefreshHint">—</span>
+          </label>
+          <label class="am-auto-refresh" title="只显示「批量直开」已开通成功的账号">
+            <input type="checkbox" id="pbOpenedOnly">
+            <span>只看已开通</span>
+          </label>
+          <span id="pbDetectStatus" class="am-detect-status" hidden></span>
+          <div class="am-toolbar-spacer"></div>
+          <div class="am-dropdown" id="ddBatch">
+            <button id="ddBatchToggle" class="am-dropdown-toggle secondary" type="button" aria-haspopup="true" aria-expanded="false">批量操作 <span class="am-caret">▾</span></button>
+            <div class="am-dropdown-menu" role="menu">
+              <button id="btnPbDetectBatch" type="button" role="menuitem">批量检测</button>
+              <button id="btnPbExportAt" type="button" role="menuitem">批量导出 AT</button>
+              <button id="btnPbExportSub" type="button" role="menuitem">批量导出 SUB 格式</button>
+              <button id="btnPbExportPw" type="button" role="menuitem">导出账密</button>
+            </div>
+          </div>
+          <div class="am-dropdown" id="ddDelete">
+            <button class="am-dropdown-toggle danger" type="button" aria-haspopup="true" aria-expanded="false">删除 <span class="am-caret">▾</span></button>
+            <div class="am-dropdown-menu" role="menu">
+              <button id="btnPbDelSel" class="danger-item" type="button" role="menuitem">删除所选</button>
+              <button id="btnPbDelAll" class="danger-item" type="button" role="menuitem">删除全部</button>
+              <button id="btnPbDelInvalid" class="danger-item" type="button" role="menuitem">删除失效</button>
+              <button id="btnPbDelExpired" class="danger-item" type="button" role="menuitem">删除过期</button>
+            </div>
+          </div>
+          <button id="btnPbRefetch" class="secondary" type="button" title="对勾选账号用 codex 客户端重新登录拿 RT（需要手机验证会自动接码）">重拿RT</button>
+          <button id="btnPbBindPhone" class="secondary" type="button" title="对「跳过手机注册」的待绑手机账号（勾选或全部）补做手机验证并拿 RT">批量绑手机拿RT</button>
+          <button id="btnProtocolReg" class="am-btn-green" type="button">账号注册</button>
+          <button id="btnPbImport" type="button">导入账号</button>
+        </div>
+
+        <div class="am-table-wrap">
+          <table class="am-table am-table-gpt" id="pbTable">
+            <thead>
+              <tr>
+                <th class="col-check"><input type="checkbox" id="pbCheckAll"></th>
+                <th class="col-idx">#</th>
+                <th class="col-email">邮箱</th>
+                <th class="col-at">AT + 有效期</th>
+                <th class="col-rt">RefreshToken</th>
+                <th class="col-sub">SUB</th>
+                <th class="col-status">状态</th>
+                <th class="col-ops">操作</th>
+              </tr>
+            </thead>
+            <tbody id="pbRows"></tbody>
+          </table>
+          <div class="empty" id="pbEmpty" hidden></div>
+        </div>
+
+        <div class="am-pager">
+          <div class="am-pager-left">
+            <span class="am-pager-label">每页</span>
+            <select id="pbPageSize" class="am-pagesize">
+              <option value="10">10</option>
+              <option value="50">50</option>
+              <option value="100">100</option>
+              <option value="500">500</option>
+              <option value="1000">1000</option>
+              <option value="5000">5000</option>
+            </select>
+            <span class="am-pager-label">条</span>
+          </div>
+          <div class="am-pager-right">
+            <span class="am-pager-info" id="pbPageInfo">第 1 / 1 页，共 0 条</span>
+            <button id="pbPagePrev" class="secondary small" type="button">上一页</button>
+            <button id="pbPageNext" class="secondary small" type="button">下一页</button>
+          </div>
+        </div>
+      </section>
+
+      <!-- ============ PLUS 邮箱（secondary，保留原有查收 / 拿RT） ============ -->
+      <section class="card am-view" id="view-plus" hidden>
+        <div class="am-toolbar">
+          <div class="am-search">
+            <span class="am-search-icon">🔍</span>
+            <input type="text" id="plSearch" placeholder="搜索邮箱 / 域名 / 备注" autocomplete="off">
+          </div>
+          <select id="plFilter" class="am-filter" title="按 RT 状态筛选">
+            <option value="all">全部</option>
+            <option value="rt">已拿到RT</option>
+            <option value="nort">未拿到RT</option>
+            <option value="banned">已封号</option>
+          </select>
+          <div class="am-toolbar-spacer"></div>
+          <button id="btnPlImport" type="button">批量导入</button>
+          <button id="btnPlGetRT" type="button">批量拿RT</button>
+          <button id="btnPlExport" class="secondary" type="button">批量导出</button>
+          <button id="btnPlDeleteBanned" class="danger" type="button">批量删除封号</button>
+          <button id="btnPlDelete" class="danger" type="button">删除选中</button>
+        </div>
+
+        <div class="am-table-wrap">
+          <table class="am-table">
+            <thead>
+              <tr>
+                <th class="col-check"><input type="checkbox" id="plCheckAll"></th>
+                <th class="col-idx">#</th>
+                <th>邮箱</th>
+                <th>密码</th>
+                <th>是否是PLUS</th>
+                <th>是否有RT</th>
+                <th class="col-ops">操作</th>
+              </tr>
+            </thead>
+            <tbody id="plRows"></tbody>
+          </table>
+          <div class="empty" id="plEmpty" hidden>
+            <b>暂无 PLUS 账号</b>
+            <span>点击「批量导入」开始添加。</span>
+          </div>
+        </div>
+
+        <div class="am-pager">
+          <div class="am-pager-left">
+            <span class="am-pager-label">每页</span>
+            <select id="plPageSize" class="am-pagesize">
+              <option value="10">10</option>
+              <option value="100">100</option>
+              <option value="500">500</option>
+              <option value="1000">1000</option>
+              <option value="5000">5000</option>
+            </select>
+            <span class="am-pager-label">条</span>
+          </div>
+          <div class="am-pager-right">
+            <span class="am-pager-info" id="plPageInfo">第 1 / 1 页，共 0 条</span>
+            <button id="plPagePrev" class="secondary small" type="button">上一页</button>
+            <button id="plPageNext" class="secondary small" type="button">下一页</button>
+          </div>
+        </div>
+      </section>
+    </div>
+  </div>
+</div>
+
+<!-- sub2api 导入弹窗 -->
+<div id="pbImportModal" class="am-modal" hidden>
+  <div class="am-modal-dialog">
+    <div class="am-modal-head"><b>导入 GPT 账号 (sub2api)</b><button id="pbImportClose" class="am-modal-close" type="button" aria-label="关闭">×</button></div>
+    <p class="hint">支持三种格式：① 粘贴 <code>sub2api.json</code> 导出内容（含 accounts 数组）；② 每行 <code>email----password----clientId----refreshToken</code>；③ 每行一个 <code>access token</code>。</p>
+    <textarea id="pbImportText" spellcheck="false" autocomplete="off" placeholder='粘贴 sub2api JSON、每行 email----password----clientId----refreshToken，或每行一个 access token'></textarea>
+    <div id="pbParsePreview" class="hint">识别到 0 个有效账号</div>
+    <div class="am-modal-actions">
+      <button id="btnDoPbImport" type="button">导入</button>
+      <button id="pbImportCancel" class="secondary" type="button">取消</button>
+    </div>
+  </div>
+</div>
+
+<!-- GPT 账号编辑弹窗 -->
+<div id="pbEditModal" class="am-modal" hidden>
+  <div class="am-modal-dialog">
+    <div class="am-modal-head"><b>编辑 GPT 账号</b><button id="pbEditClose" class="am-modal-close" type="button" aria-label="关闭">×</button></div>
+    <input type="hidden" id="pbEditId">
+    <label>邮箱<input type="text" id="pbEditEmail" autocomplete="off"></label>
+    <label>密码<input type="text" id="pbEditPassword" autocomplete="off"></label>
+    <label>2FA 密钥<input type="text" id="pbEditTwoFactor" spellcheck="false" autocomplete="off" placeholder="base32 密钥"></label>
+    <label>Access Token (AT)<textarea id="pbEditAccessToken" class="am-mono-area am-mono-area-sm" rows="3" spellcheck="false" autocomplete="off"></textarea></label>
+    <label>Refresh Token<textarea id="pbEditRefreshToken" class="am-mono-area am-mono-area-sm" rows="3" spellcheck="false" autocomplete="off"></textarea></label>
+    <label>ChatGPT Account ID<input type="text" id="pbEditAccountId" autocomplete="off"></label>
+    <label>备注<input type="text" id="pbEditNote" autocomplete="off"></label>
+    <div class="am-modal-actions">
+      <button id="btnSavePbEdit" type="button">保存</button>
+      <button id="pbEditCancel" class="secondary" type="button">取消</button>
+    </div>
+  </div>
+</div>
+
+<!-- 设置弹窗：代理池 / 接码设置 / 邮箱池 -->
+<div id="settingsModal" class="am-modal" hidden>
+  <div class="am-modal-dialog am-modal-wide">
+    <div class="am-modal-head"><b>设置</b><button id="settingsClose" class="am-modal-close" type="button" aria-label="关闭">×</button></div>
+    <div class="am-set-tabs">
+      <button class="am-set-tab active" data-set-tab="proxy" type="button">代理池</button>
+      <button class="am-set-tab" data-set-tab="sms" type="button">接码设置</button>
+      <button class="am-set-tab" data-set-tab="mailbox" type="button">邮箱池</button>
+      <button class="am-set-tab" data-set-tab="browser" type="button">浏览器</button>
+    </div>
+
+    <div class="am-set-panel" data-set-panel="proxy">
+      <div class="am-set-block">
+        <div class="section-title"><b>代理池</b><small>一行一个，支持 <code>host:port</code>、<code>host:port:user:pass</code> 或 <code>scheme://user:pass@host:port</code></small></div>
+        <textarea id="setProxies" class="am-mono-area am-set-proxies" spellcheck="false" autocomplete="off" placeholder="host:port:user:pass"></textarea>
+        <div class="hint" id="setProxyCount">共 0 条</div>
+      </div>
+    </div>
+
+    <div class="am-set-panel" data-set-panel="sms" hidden>
+      <div class="am-set-block">
+        <div class="section-title"><b>接码 / SMS 配置</b><small>拿 RT 若触发手机验证时使用</small></div>
+        <div class="am-set-grid">
+          <label>Provider
+            <select id="setSmsProvider">
+              <option value="smscode">smscode</option>
+              <option value="smsbower">smsbower</option>
+              <option value="herosms">herosms</option>
+            </select>
+          </label>
+          <label>API Key<input type="text" id="setSmsApiKey" autocomplete="off" placeholder="接码平台 API Key"></label>
+          <label>Base URL<input type="text" id="setSmsBaseUrl" autocomplete="off" placeholder="https://..."></label>
+          <label>国家 (country)<input type="text" id="setSmsCountry" autocomplete="off" placeholder="国家代码，如 22"></label>
+          <label>最高金额 (maxPrice)<input type="text" id="setSmsMaxPrice" autocomplete="off" placeholder="如 5"></label>
+          <label>Poll Timeout (ms)<input type="number" id="setSmsPollTimeout" autocomplete="off" placeholder="180000"></label>
+        </div>
+        <div class="am-sms-testbar">
+          <button id="smsBalanceBtn" class="secondary small" type="button">测试 / 查询余额</button>
+          <span id="smsBalanceResult" class="am-sms-bal"></span>
+        </div>
+      </div>
+    </div>
+
+    <div class="am-set-panel" data-set-panel="mailbox" hidden>
+      <div class="am-set-block">
+        <div class="section-title"><b>邮箱池</b><small>一行一个，格式 <code>邮箱----专用密码</code> 或 <code>邮箱----取件API链接</code></small></div>
+        <label class="am-set-check"><input type="checkbox" id="setMbSplit"> 分裂邮箱（为主邮箱生成 <code>local+XXXX@domain</code> 别名，共用同一收件箱）</label>
+        <div class="am-mb-splitbar" id="mbSplitBar">
+          每个主邮箱生成 <input type="number" id="mbSplitCount" class="am-mb-splitnum" min="1" max="200" value="10"> 个别名
+          <button id="mbSplitGen" class="secondary small" type="button">生成到列表</button>
+          <button id="mbToggleImport" class="secondary small" type="button">批量导入</button>
+          <button id="mbClearAll" class="secondary small am-danger" type="button">清空</button>
+          <span class="hint am-mb-count" id="setMbCount">共 0 个（未使用 0）</span>
+        </div>
+        <div id="mbImportBox" hidden>
+          <textarea id="setMailbox" class="am-mono-area am-set-proxies" spellcheck="false" autocomplete="off" placeholder="name@icloud.com----abcd-efgh-ijkl-mnop（粘贴后点「导入到列表」）"></textarea>
+          <div class="am-mb-importbar">
+            <button id="mbImportBtn" class="secondary small" type="button">导入到列表</button>
+          </div>
+        </div>
+        <div id="mbList" class="am-mb-list"></div>
+        <div id="mbTestResult" class="am-mb-result" hidden></div>
+      </div>
+    </div>
+
+    <div class="am-set-panel" data-set-panel="browser" hidden>
+      <div class="am-set-block">
+        <div class="section-title"><b>浏览器注册（CloakBrowser）</b><small>「账号注册」选择浏览器注册时使用，隐身 Chromium 自带指纹随机</small></div>
+        <div class="am-set-grid">
+          <label>CloakBrowser KEY<input type="text" id="setCloakKey" autocomplete="off" placeholder="cb_xxxxxxxx（license key）"></label>
+          <label>注册密码<input type="text" id="setRegPassword" autocomplete="off" placeholder="留空用内置默认强口令"></label>
+        </div>
+        <div class="hint">留空则以免费额度启动（可能受限）。首次运行会自动下载隐身 Chromium（需联网，约 200MB）。</div>
+        <div class="hint">注册密码：两种注册方式共用，所有账号统一用此口令；改后新注册生效（旧账号仍是旧口令）。</div>
+      </div>
+    </div>
+
+    <div class="am-modal-actions">
+      <button id="btnSaveSettings" type="button">保存</button>
+      <button id="settingsCancel" class="secondary" type="button">取消</button>
+    </div>
+  </div>
+</div>
+
+<!-- PLUS 批量导入弹窗 -->
+<div id="plImportModal" class="am-modal" hidden>
+  <div class="am-modal-dialog">
+    <div class="am-modal-head"><b>批量导入 PLUS 账号</b><button id="plImportClose" class="am-modal-close" type="button" aria-label="关闭">×</button></div>
+    <p class="hint">每行一个账号，格式：<code>email----password----clientId----refreshToken</code>（也兼容 <code>|</code> / 制表符 / 空白分隔）。</p>
+    <textarea id="plImportText" spellcheck="false" autocomplete="off" placeholder="email----password----clientId----refreshToken"></textarea>
+    <div id="plParsePreview" class="hint">识别到 0 个有效账号</div>
+    <div class="am-modal-actions">
+      <button id="btnDoPlImport" type="button">导入</button>
+      <button id="plImportCancel" class="secondary" type="button">取消</button>
+    </div>
+  </div>
+</div>
+
+<!-- 查收抽屉 -->
+<div id="inboxDrawer" class="am-drawer" hidden>
+  <div class="am-drawer-mask" id="inboxMask"></div>
+  <div class="am-drawer-panel">
+    <div class="am-drawer-head">
+      <div><b>收件箱</b><div class="am-drawer-addr" id="inboxAddr"></div></div>
+      <div class="am-drawer-head-actions">
+        <button id="inboxRefresh" class="secondary small" type="button">刷新</button>
+        <button id="inboxClose" class="am-modal-close" type="button" aria-label="关闭">×</button>
+      </div>
+    </div>
+    <div class="am-drawer-body" id="inboxBody"></div>
+  </div>
+</div>
+
+<!-- 拿 RT 进度面板 -->
+<div id="rtPanel" class="am-rt-panel" hidden>
+  <div class="am-rt-head">
+    <b>批量拿 RT</b>
+    <span id="rtSummary" class="am-rt-summary"></span>
+    <button id="rtPanelClose" class="am-modal-close" type="button" aria-label="关闭">×</button>
+  </div>
+  <div class="am-rt-logs" id="rtLogs"></div>
+</div>
+
+<!-- 通用确认弹窗（替代原生 confirm/alert，主题化） -->
+<div id="confirmModal" class="am-modal" hidden>
+  <div class="am-modal-dialog am-modal-confirm">
+    <div class="am-modal-head"><b id="confirmTitle">确认操作</b><button id="confirmCloseX" class="am-modal-close" type="button" aria-label="关闭">×</button></div>
+    <p class="hint" id="confirmMsg"></p>
+    <input id="confirmInput" class="am-prompt-input" type="text" autocomplete="off" spellcheck="false" hidden>
+    <div class="am-modal-actions">
+      <button id="confirmOk" type="button">确定</button>
+      <button id="confirmCancel" class="secondary" type="button">取消</button>
+    </div>
+  </div>
+</div>
+
+<!-- 邮箱编辑弹窗 -->
+<div id="mbEditModal" class="am-modal" hidden>
+  <div class="am-modal-dialog am-modal-confirm">
+    <div class="am-modal-head"><b>编辑邮箱</b><button id="mbEditCloseX" class="am-modal-close" type="button" aria-label="关闭">×</button></div>
+    <div class="am-mb-edit-field"><span class="am-mb-edit-lbl">邮箱</span><div id="mbEditEmail" class="am-mb-edit-email"></div></div>
+    <div class="am-mb-edit-field"><span class="am-mb-edit-lbl">凭证（专用密码 / 取件 API 链接）</span>
+      <input id="mbEditCred" class="am-prompt-input" type="text" autocomplete="off" spellcheck="false" placeholder="专用密码 或 https://取件API…"></div>
+    <label class="am-set-check am-mb-edit-used"><input type="checkbox" id="mbEditUsed"> 已使用</label>
+    <div class="am-modal-actions">
+      <button id="mbEditSave" type="button">保存</button>
+      <button id="mbEditCancel" class="secondary" type="button">取消</button>
+    </div>
+  </div>
+</div>
+
+<!-- 协议注册：设置弹窗 -->
+<div id="regModal" class="am-modal" hidden>
+  <div class="am-modal-dialog">
+    <div class="am-modal-head"><b>账号注册</b><button id="regCloseX" class="am-modal-close" type="button" aria-label="关闭">×</button></div>
+    <p class="hint">使用「设置」中已配置的代理池、接码、邮箱池，对<b>未使用</b>邮箱注册。任务后台运行，切换页面不会中断。</p>
+    <div class="am-set-grid">
+      <label>注册方式
+        <select id="regMode">
+          <option value="protocol">协议注册（HTTP 直连）</option>
+          <option value="browser">浏览器注册（CloakBrowser）</option>
+        </select>
+      </label>
+      <label id="regHeadlessWrap" hidden>浏览器模式
+        <select id="regHeadless">
+          <option value="1">无头（后台运行）</option>
+          <option value="0">有头（显示窗口）</option>
+        </select>
+      </label>
+      <label>本次注册数量<input type="number" id="regCount" min="1" value="10"></label>
+      <label>线程数<input type="number" id="regThreads" min="1" max="20" value="3"></label>
+    </div>
+    <div class="reg-avail">未使用邮箱剩余：<b id="regUnused">…</b> 个</div>
+    <div class="am-modal-actions">
+      <button id="regStart" type="button">开始注册</button>
+      <button id="regCancel" class="secondary" type="button">取消</button>
+    </div>
+  </div>
+</div>
+
+<!-- 协议注册：右下角进度浮层 -->
+<div id="regPanel" class="reg-panel" hidden>
+  <div class="reg-panel-head" id="regPanelHead">
+    <b class="reg-panel-title">账号注册</b>
+    <span class="reg-panel-stat" id="regPanelStat"></span>
+    <span class="reg-panel-tools">
+      <button id="regPanelClear" class="reg-panel-btn" type="button" title="清空日志">清空</button>
+      <button id="regPanelMin" class="reg-panel-btn" type="button" title="最小化">—</button>
+      <button id="regPanelStop" class="reg-panel-btn" type="button" title="停止任务">停止</button>
+      <button id="regPanelClose" class="reg-panel-btn" type="button" title="关闭" hidden>×</button>
+    </span>
+  </div>
+  <div class="reg-panel-body">
+    <div class="reg-progress"><div class="reg-progress-bar" id="regProgressBar"></div></div>
+    <div class="reg-logs" id="regLogs"></div>
+  </div>
+</div>
+
+<div id="amToast" class="am-toast" role="status" aria-live="polite"></div>
+
+  <script src="{{ url_for('static', filename='account-manager.js', v='24') }}"></script>
+</body>
+</html>
diff --git a/templates/embed.html b/templates/embed.html
new file mode 100644
index 0000000..3452388
--- /dev/null
+++ b/templates/embed.html
@@ -0,0 +1,50 @@
+<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>{{ embed_title }}</title>
+  <link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="{{ url_for('static', filename='app-shell.css', v='13') }}">
+  <style>
+    /* 右侧内容区占满高度，内嵌 iframe 铺满 */
+    .main { height: 100vh; overflow: hidden; }
+    .embed-content { flex: 1; min-height: 0; padding: 0; position: relative; background: var(--bg); }
+    .embed-frame { width: 100%; height: 100%; border: 0; display: block; background: #fff; }
+    .embed-fallback {
+      position: absolute; inset: 0; display: none;
+      flex-direction: column; align-items: center; justify-content: center; gap: 12px;
+      text-align: center; color: var(--ink-500); padding: 24px;
+    }
+    .embed-fallback b { color: var(--ink-900); font-size: 16px; }
+    .embed-fallback .btn { text-decoration: none; }
+  </style>
+</head>
+<body>
+<div class="layout">
+  {% include '_sidebar.html' %}
+
+  <div class="main">
+    <header class="topbar">
+      <div class="topbar-title">{{ embed_title }}</div>
+      <div class="topbar-actions">
+        <a class="secondary small btn" href="{{ embed_url }}" target="_blank" rel="noopener">新标签打开 ↗</a>
+        <span class="dot"></span>线上服务
+      </div>
+    </header>
+
+    <div class="embed-content">
+      <iframe class="embed-frame" src="{{ embed_url }}" title="{{ embed_title }}"
+              referrerpolicy="no-referrer-when-downgrade"
+              allow="clipboard-read; clipboard-write"></iframe>
+      <div class="embed-fallback" id="embedFallback">
+        <b>该服务暂时无法在此页内嵌显示</b>
+        <span>可能因目标站点的安全策略（X-Frame-Options / CSP）或自签名证书导致。</span>
+        <a class="btn" href="{{ embed_url }}" target="_blank" rel="noopener">在新标签页打开 {{ embed_title }} ↗</a>
+      </div>
+    </div>
+  </div>
+</div>
+</body>
+</html>