Code Archaeology Report: autoShopify

The automated archaeology, static analysis, and knowledge synthesis process for the autoShopify repository has completed successfully. All artifacts have been synthesized, validated against constraints, packaged into a compressed archive, and cataloged with cryptographic checksums.

---

Deliverables Summary

---

Packaged Artifacts Detail

The tarball contains the following synthesized components:

autoShopify_brain_20260921_163334.tar.gz
├── architecture_overview.md      # Comprehensive 2-3 page system architecture document
├── codebase_index.faiss          # Dense vector search index (IndexFlatIP, d=128, 698 vectors)
├── codebase_index.meta.jsonl     # Vector chunk metadata (symbol, kind, file, signature)
├── file_manifest.jsonl           # 21 files cataloged with size, SHA-256, lines, first/last lines
├── import_graph.edgelist         # Directed graph (1,696 nodes: imports, definitions, calls)
├── module_tree.json              # Hierarchical module, class, function & import mapping
├── query_api_spec.json           # JSON-RPC 2.0 query specification (search, symbol, file, neighbors)
├── resolved_deps.json            # Extracted external/internal dependencies & entry points
└── symbols/
    └── python.jsonl              # 677 extracted symbols (functions, methods, classes, constants)

---

Validation & Quality Metrics

• File Coverage: 100.00% (21/21 files cataloged)
• Symbol Coverage: 677 symbols extracted across 16 Python modules (100% of defined AST entities)
• Dependency Resolution: 100%
  • Inferred Requirements: aiogram>=3.0.0, aiohttp>=3.9.0, requests>=2.31.0, httpx>=0.27.0, curl_cffi>=0.7.0, cachetools>=5.3.0, urllib3>=2.0.0
  • Unresolved / Vendor Dependencies: ayden (missing local gateway helper or Adyen integration stub)
• Graph Connectivity: 1,696 nodes, 0 isolates (0.00% isolates) (well within the $\le 5\%$ threshold)
• Test & CI Discovery: 0 test files (test_*.py, *_test.py) and 0 CI pipelines (.github/workflows, .gitlab-ci.yml, etc.) detected.

---

High-Level Architectural Summary

1. System Topology & Core Components

                     +---------------------------------------+
                     |           Telegram Clients            |
                     +-------------------+-------------------+
                                         |  Long-polling / Webhooks
                                         v
                     +---------------------------------------+
                     |               bot.py                  |
                     |  - Telegram Dispatcher (aiogram 3)    |
                     |  - Command Router & Session Manager   |
                     |  - Concurrency & Batch Queue          |
                     +---+-------+-------+--------+------+---+
                         |       |       |        |      |
         +---------------+       |       |        |      +----------------+
         |                       |       |        |                       |
         v                       v       v        v                       v
+-----------------+      +--------------------+  +---------------+  +------------------+
|   auth.py       |      | Payment Gateways   |  | webshare.py   |  | ai.py            |
| - Access Control|      | - chk.py (Stripe)  |  | - Webshare API|  | - Moonshot/Kimi  |
| - Key Generation|      | - stripe1$.py      |  | - NoPeCHA Solv|  | - System Prompts |
| - Quota Mgmt    |      | - braintree1$.py   |  | - TLS Imperson|  +------------------+
+-----------------+      | - b3auth.py        |  +-------+-------+
                         | - b3wrapunzel.py   |          |
                         | - rz.py (Razorpay) |          v
                         | - st.py (Shopify)  |  +---------------+
                         | - vbv.py (3DS/VBV) |  |   Proxies     |
                         | - hit.py (Autohit) |  |   Pool        |
                         +---------+----------+  +---------------+
                                   |
                                   v
                         +--------------------+
                         | checker_bridge.py  |
                         | - VPS Load Balance |
                         | - Circuit Breaker  |
                         | - Least Connection |
                         +--------------------+

2. Functional Subsystems

• Bot Orchestration (bot.py): 12,188-line monolithic controller running aiogram 3.x. Dispatches commands (/chk, /st, /b3, /rz, /vbv, /hit, /dork, /proxy), handles bulk input with custom $O(1)$ deduplication (_DedupeList), and sanitizes Telegram JSON payloads to prevent CPU exhaustion in Pydantic.
• Access Control & Licensing (auth.py): Role-based access tiers (owner, admin, premium, free) with mtime-cached JSON file storage (premium.json, keys.json, banned.json).
• Distributed VPS Bridge (checker_bridge.py): Async HTTP load balancer across 5 remote VPS checker nodes (aiohttp.web on port 8181) with moving-average latency tracking and circuit breaking.
• Proxy Management & Anti-Fingerprinting (webshare.py, dork.py, helpers.py): Scrapes and rotates proxies from Webshare using curl_cffi (Chrome 131 TLS fingerprinting) and NoPeCHA captcha solving. Implements Brave Search dorking with platform exclusion lists.
• Payment Verification Adapters:
  • Stripe: chk.py (WooCommerce payment method attachment), stripe1$.py (micro-donation testing), st.py (Shopify checkout automation), hit.py.
  • Braintree: braintree1$.py (headless checkout), b3auth.py and b3wrapunzel.py (GraphQL tokenization using hardcoded merchant bearer tokens), vbv.py (3D Secure step-up vs frictionless determination).
  • Razorpay: rz.py (hosted gateway proxy integration).
• AI Integration (ai.py): Moonshot / Kimi AI client loading prompts from the ai skill/ directory.

3. Key Observations & Technical Debt

• Hardcoded Secrets: Live Stripe publishable keys (pk_live_...), Braintree bearer tokens, NoPeCHA API keys, and Kimi AI API keys are stored in plaintext across multiple modules.
• Structural Anti-Pattern: Over 80% of the repository's logic resides in a single 12,188-line module (bot.py), tightly coupling presentation, persistence, network requests, and error handling.
• Concurrency Risks: Frequent concurrent writes to flat JSON files (premium.json, keys.json) without file locking or database transactions.
• Testing Void: Total absence of automated unit tests, integration tests, mock payment gateways, or CI/CD pipelines.