feat: add isolated TikTok proxy account pool

.dockerignore

@@ -3,8 +3,11 @@
 .env.*
 backups/
 data/
+data-dev/
 videos/
+videos-dev/
 output/
+output-dev/
 __pycache__/
 *.py[cod]
 .pytest_cache/

.env.dev.example

@@ -5,13 +5,25 @@ DEEPSEEK_API_KEY=replace-with-deepseek-api-key
 SELLERSPRITE_SECRET_KEY=replace-with-sellersprite-secret-key
 FASTMOSS_MCP_API_KEY=replace-with-fastmoss-mcp-key
 
+LAN_CHAT_AVATAR_API_URL=
+LAN_CHAT_AVATAR_API_KEY=
+LAN_CHAT_AVATAR_MODEL=
+LAN_CHAT_AVATAR_TIMEOUT=90
+
 WEB_PORT=4003
 LAN_HOST=192.168.1.254
 REPORT_LAN_HOST=192.168.1.254
 REPORT_LAN_PORT=4003
 SELLERSPRITE_REDIRECT_PORT=0
 HOT_VIDEO_REPORT_SCHEDULER_ENABLED=0
+CHAT_INTENT_ROUTER_ENABLED=1
+CHAT_INTENT_ROUTER_CONFIDENCE=0.65
+CHAT_INTENT_ROUTER_TIMEOUT_SECONDS=15
+TIKTOK_PUBLISH_DRY_RUN=1
+TIKTOK_PUBLISH_FINAL_CLICK_ENABLED=0
+TIKTOK_NATIVE_SCHEDULE_LEAD_SECONDS=1800
+TIKTOK_NATIVE_SCHEDULE_MIN_MINUTES=20
 
 API_CACHE_ENABLED=1
 API_CACHE_TTL_SECONDS=604800
-HF_ENDPOINT=https://hf-mirror.com
+HF_ENDPOINT=https://hf-mirror.com

.env.example

@@ -9,6 +9,7 @@ DIRECT_VIDEO_UPLOAD_MODE=auto
 TIKTOK_MAX_BYTES=2147483648
 TIKTOK_PROXY_URL=
 TIKTOK_COOKIE=
+TIKTOK_PUBLISH_FINAL_CLICK_ENABLED=1
 DOUYIN_PROXY_URL=
 DOUYIN_COOKIE=
 SOCIAVAULT_API_KEY=replace-with-sociavault-api-key
@@ -35,7 +36,8 @@ AMAZON_MAX_PAGES=1
 DEEPSEEK_API_KEY=replace-with-deepseek-api-key
 DEEPSEEK_API_URL=https://api.deepseek.com/v1
 DEEPSEEK_MODEL=deepseek-v4-flash
-DEEPSEEK_CHAT_MODEL=deepseek-v4-pro
+DEEPSEEK_CHAT_MODEL=deepseek-v4-flash
+DEEPSEEK_REPORT_MODEL=deepseek-v4-pro
 SELLERSPRITE_SECRET_KEY=replace-with-sellersprite-secret-key
 SELLERSPRITE_MCP_URL=https://mcp.sellersprite.com/mcp
 SELLERSPRITE_CHAT_PORT=4101
@@ -44,6 +46,7 @@ FASTMOSS_MCP_API_KEY=replace-with-fastmoss-mcp-key
 FASTMOSS_MCP_URL=https://mcp.fastmoss.com/mcp
 FASTMOSS_CHAT_PORT=4102
 FASTMOSS_CACHE_TTL_SECONDS=86400
+FASTMOSS_LLM_VERIFIER_ENABLED=0
 SELLERSPRITE_REDIRECT_PORT=3001
 API_CACHE_ENABLED=1
 API_CACHE_TTL_SECONDS=604800
@@ -52,9 +55,24 @@ VIDEO_DAILY_REPORT_COMPLETED_URL=
 VIDEO_DAILY_REPORT_TOKEN=
 VIDEO_DAILY_REPORT_CALLBACK_TIMEOUT=10
 OCR_API_URL=http://127.0.0.1:4000/v1/ocr/extract
+FEISHU_CAPABILITY_API_URL=http://127.0.0.1:4000
+FEISHU_CAPABILITY_TIMEOUT_SECONDS=15
 OCR_SHARED_DIR=/home/openclaw/ocr-shared
 OCR_SERVER_SHARED_DIR=/home/openclaw/ocr-shared
 CHAT_IMAGE_MAX_BYTES=6291456
 CHAT_IMAGE_MAX_COUNT=6
+CHAT_CONTEXT_MAX_TOKENS=120000
+CHAT_INTENT_ROUTER_ENABLED=1
+CHAT_INTENT_ROUTER_CONFIDENCE=0.65
+CHAT_INTENT_ROUTER_TIMEOUT_SECONDS=15
+CHAT_HISTORY_MESSAGE_LIMIT=20
+CHAT_HISTORY_TEXT_MAX_CHARS=8000
+CHAT_HISTORY_COMPACT_CHARS=3000
+CHAT_TOOL_EVIDENCE_MAX_CHARS=6000
+CHAT_RECOVERY_EVIDENCE_MAX_CHARS=32000
+LAN_CHAT_AVATAR_API_URL=
+LAN_CHAT_AVATAR_API_KEY=
+LAN_CHAT_AVATAR_MODEL=
+LAN_CHAT_AVATAR_TIMEOUT=90
 WEB_PORT=4002
 HF_ENDPOINT=https://hf-mirror.com

AGENTS.md

@@ -236,55 +236,53 @@ Inside Compose:
 
 Do not write generated files into `scripts/` at runtime. Do not commit files from `videos/`, `output/`, `data/`, or `.env`.
 
-## Remote Server and Deployment
+## Server-Direct Development and Deployment
 
-Production runs on:
+Codex tasks for this repository run directly in the production server checkout:
 
 ```text
-openclaw@192.168.1.254:~/Video_analyzer/
+/home/openclaw/Video_analyzer
 ```
 
+Treat the current working tree as both the development workspace and the production checkout. Do not SSH or SCP back into `192.168.1.254`, and do not use development-machine SSH keys for this repository.
+
 GitHub repo:
 
 ```text
 https://github.com/Joe1905/Video_analyzer.git
 ```
 
-GitHub access rule:
+GitHub access rules:
 
-- GitHub `fetch`, `pull`, `push`, and `clone` operations must use the configured proxy path. Default to `http://127.0.0.1:7892`; if that fails, retry once with `http://127.0.0.1:7897`. Prefer explicit `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY` / lowercase environment variables, or scoped `git -c http.proxy=... -c https.proxy=...` when the proxy URL is available. Do not commit proxy credentials.
+- GitHub `fetch`, `pull`, `push`, and `clone` operations must use the server proxy at `http://127.0.0.1:7890`. Prefer explicit `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY` / lowercase environment variables, or scoped `git -c http.proxy=... -c https.proxy=...`. Do not commit proxy credentials.
 - If GitHub HTTPS fails during the initial handshake, record the concrete error and proxy state, then switch to the proxy path or another approved authenticated GitHub path. Do not blindly retry direct HTTPS.
 
-Production deploy workflow:
+Server-direct workflow:
 
-1. Make the change locally and verify it.
-2. Commit the change locally.
-3. Push the commit to GitHub through the proxy.
-4. Update the production checkout from GitHub.
-5. Rebuild/restart the affected server service and verify the endpoint.
+1. Check the current server checkout with `git status --short --branch` and preserve unrelated changes.
+2. Make the change directly in `/home/openclaw/Video_analyzer`.
+3. Verify the change in Docker Compose using the project name `-p short-video-analyzer`.
+4. Commit the verified change in the current checkout.
+5. Push the commit to GitHub through the server proxy.
+6. Rebuild or restart the affected service directly on the current server, then verify the endpoint or workflow.
 
-Server changes must be synchronized through GitHub. Do not leave manual-only code changes on the production checkout. If GitHub push is blocked by proxy or authentication, stop and report the blocker instead of treating a server-only deploy as complete. If a server-side hotfix is explicitly authorized, copy the exact change back into this repository, commit it, push it to GitHub as soon as access is restored, and update the server from GitHub.
+All production changes must still be committed and synchronized through GitHub. Do not leave manual-only or uncommitted code changes in the server checkout. If GitHub push is blocked by proxy or authentication, stop and report the blocker instead of treating the deployment as complete.
 
-Before deploying or changing server files, check both local and server status:
+Before changing or deploying files, check the current checkout:
 
 ```bash
 git status --short --branch
-ssh openclaw@192.168.1.254 "cd ~/Video_analyzer && git status --short --branch"
-```
-
-Example file deploy:
-
-```bash
-scp -i ~/.ssh/openclaw_codex_rsa scripts/web_app.py openclaw@192.168.1.254:~/Video_analyzer/scripts/
 ```
 
-Then rebuild/restart on the server:
+Example rebuild/restart on the current server:
 
 ```bash
-ssh openclaw@192.168.1.254 "cd ~/Video_analyzer && docker compose -p short-video-analyzer build && docker compose -p short-video-analyzer up -d web"
+cd /home/openclaw/Video_analyzer
+docker compose -p short-video-analyzer build
+docker compose -p short-video-analyzer up -d web
 ```
 
-Prefer a GitHub-based deploy path over ad-hoc `scp` unless the user explicitly asks for a hotfix.
+Do not use `ssh`, `scp`, or a second checkout as part of the normal development or deployment flow.
 
 ## Agent Safety Rules
 

Dockerfile

@@ -9,7 +9,8 @@ ARG all_proxy=
 ARG NO_PROXY=
 ARG no_proxy=
 
-ENV PYTHONDONTWRITEBYTECODE=1 \
+ENV DEBIAN_FRONTEND=noninteractive \
+    PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1
 
@@ -35,8 +36,21 @@ RUN python -c "import video_analyzer, os; p=os.path.join(os.path.dirname(video_a
 
 RUN pip install yt-dlp playwright httpx "scrapling[ai]" \
     && python -m playwright install --with-deps chromium \
+    && python -m playwright install chrome \
     && scrapling install
 
+RUN apt-get -o Acquire::ForceIPv4=true -o Acquire::http::Timeout=20 update \
+    && apt-get -o Acquire::ForceIPv4=true -o Acquire::http::Timeout=20 install -y --no-install-recommends \
+        novnc \
+        websockify \
+        x11vnc \
+        xvfb \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN chmod 0711 /root \
+    && groupadd --system --gid 10001 tikbrowser \
+    && useradd --system --uid 10001 --gid tikbrowser --create-home --home-dir /home/tikbrowser tikbrowser
+
 RUN pip install -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn "curl_cffi>=0.15,<0.16"
 
 RUN apt-get update \

Dockerfile.sing-box

@@ -0,0 +1,14 @@
+FROM python:3.11-slim AS downloader
+
+ARG HTTP_PROXY
+ARG HTTPS_PROXY
+ARG SING_BOX_VERSION=1.13.14
+ARG SING_BOX_SHA256=aae9172317c61760aae3dafcde889b2e51b7ea590c40d2b3c7ccdeae14b361b6
+
+COPY docker/sing-box/install.py /tmp/install-sing-box.py
+RUN python /tmp/install-sing-box.py "${SING_BOX_VERSION}" "${SING_BOX_SHA256}" /out/sing-box
+
+FROM python:3.11-slim
+
+COPY --from=downloader /out/sing-box /usr/local/bin/sing-box
+ENTRYPOINT ["/usr/local/bin/sing-box"]

docker-compose.dev.yml

@@ -1,29 +1,53 @@
 services:
   analyzer:
+    image: short-video-analyzer-dev:latest
     volumes:
       - ./videos-dev:/workspace/videos
       - ./output-dev:/workspace/output
       - ./data-dev:/workspace/data
       - ./scripts:/workspace/scripts:ro
+      - ./sellersprite_mcp_chat:/workspace/sellersprite_mcp_chat:ro
     environment:
       HOT_VIDEO_REPORT_SCHEDULER_ENABLED: "0"
 
   web:
+    image: short-video-analyzer-dev:latest
     environment:
       WEB_PORT: ${WEB_PORT:-4003}
+      PROXY_POOL_ENABLED: "1"
       LAN_HOST: ${LAN_HOST:-192.168.1.254}
       REPORT_LAN_HOST: ${REPORT_LAN_HOST:-192.168.1.254}
       REPORT_LAN_PORT: ${REPORT_LAN_PORT:-4003}
       HOT_VIDEO_REPORT_SCHEDULER_ENABLED: "0"
       SELLERSPRITE_REDIRECT_PORT: "0"
+      PROXY_REALITY_CORE: sing-box
+      PROXY_REALITY_DEFAULT_FINGERPRINT: safari
+      SING_BOX_CONFIG_PATH: /workspace/data/sing-box/config.json
+      SING_BOX_COMPOSE_PROJECT: short-video-analyzer-dev
     volumes:
       - ./videos-dev:/workspace/videos
       - ./output-dev:/workspace/output
       - ./data-dev:/workspace/data
       - ./scripts:/workspace/scripts:ro
+      - ./sellersprite_mcp_chat:/workspace/sellersprite_mcp_chat:ro
       - ${OCR_SHARED_DIR:-/home/openclaw/ocr-shared}:${OCR_SERVER_SHARED_DIR:-/home/openclaw/ocr-shared}
       - /var/run/docker.sock:/var/run/docker.sock
 
+  sing-box:
+    image: short-video-analyzer-sing-box:1.13.14
+    build:
+      context: .
+      dockerfile: Dockerfile.sing-box
+      network: host
+      args:
+        HTTP_PROXY: ${SING_BOX_DOWNLOAD_PROXY:-http://127.0.0.1:7890}
+        HTTPS_PROXY: ${SING_BOX_DOWNLOAD_PROXY:-http://127.0.0.1:7890}
+    command: -D /var/lib/sing-box -C /etc/sing-box run
+    volumes:
+      - ./data-dev/sing-box:/etc/sing-box
+    network_mode: host
+    restart: unless-stopped
+
   sellersprite-redirect:
     profiles:
-      - stable-redirect
+      - stable-redirect