@techysy/10router 1.0.4 → 1.0.6

package/app/public/i18n/literals/zh-TW.json

@@ -1,7 +1,18 @@
 {
+  "Cached": "快取",
+  "Cached Cost": "快取成本",
   "Cancel": "取消",
   "Delete": "刪除",
   "Edit": "編輯",
+  "Input Cost": "輸入成本",
+  "Input Tokens": "輸入 Token",
+  "Invite code": "邀請碼",
+  "Last Used": "最後使用",
+  "Model": "模型",
+  "Output Cost": "輸出成本",
+  "Output Tokens": "輸出 Token",
+  "Prepaid USD-credit gateway with gamified rewards (XP/airdrop). free/* models run on signup bonus credits; Anthropic models need a real top-up (402 otherwise). Third-party reseller — treat as untrusted for sensitive traffic.": "預付美元額度的聚合閘道，帶遊戲化獎勵（XP/空投）。free/* 免費模型走註冊贈送額度；Anthropic 系模型需真實儲值（否則 402）。第三方中轉，請勿經手敏感流量。",
+  "Requests": "請求",
   "Save": "保存",
   "Close": "關閉",
   "Add": "添加",
@@ -13,6 +24,8 @@
   "Login": "登錄",
   "Providers": "提供者",
   "Style": "風格",
+  "Total Cost": "總成本",
+  "Total Tokens": "總 Token",
   "Usage": "統計",
   "API Key": "API 金鑰",
   "Connected": "已連接",
@@ -22,13 +35,17 @@
   "Success": "成功",
   "Failed": "失敗",
   "Error": "錯誤",
+  "Usage by Account": "按帳號統計",
+  "Usage by API Key": "按 API 金鑰統計",
+  "Usage by Endpoint": "按端點統計",
+  "Usage by Model": "按模型統計",
   "Warning": "警告",
   "Info": "信息",
   "Loading": "載入中",
   "Search": "搜尋",
   "Filter": "篩選",
   "Sort": "排序",
-  "Export": "導出",
+  "Export": "匯出",
   "Import": "導入",
   "Refresh": "刷新",
   "Back": "返回",
@@ -275,5 +292,17 @@
   "Community": "公益站",
   "Show community welfare providers": "顯示公益站供應商",
   "Show community welfare providers (公益站) with no recharge entry": "顯示無儲值入口的公益站供應商（GoRouter / TaBiAI）",
-  "Show free community gateways with no recharge entry (GoRouter / TaBiAI)": "顯示無儲值入口的免費公益站供應商（GoRouter / TaBiAI）"
-}
+  "Show free community gateways with no recharge entry (GoRouter / TaBiAI)": "顯示無儲值入口的免費公益站供應商（GoRouter / TaBiAI）",
+  "Add Custom Provider": "新增自訂供應商",
+  "Import CodeBuddy CN Accounts": "匯入 CodeBuddy CN 帳號",
+  "Import CodeBuddy CN accounts from JSON...": "從 JSON 匯入 CodeBuddy CN 帳號…",
+  "Choose JSON file...": "選擇 JSON 檔案…",
+  "Or paste JSON": "或貼上 JSON",
+  "Failed to read file": "讀取檔案失敗",
+  "Import CodeBuddy CN OAuth accounts from a JSON export. Accounts signed by a non-CodeBuddy realm (e.g. workbuddy.cn) are skipped. Existing accounts are updated, new ones are added.": "從 JSON 檔案匯入 CodeBuddy CN 的 OAuth 帳號。非 CodeBuddy 網域（如 workbuddy.cn）簽發的帳號會被略過；既有帳號更新，新帳號則新增。",
+  "No CodeBuddy CN connections to export": "沒有可匯出的 CodeBuddy CN 連線",
+  "accounts exported": "個帳號已匯出",
+  "Export failed": "匯出失敗",
+  "Enter your current password to export CodeBuddy CN accounts.": "輸入目前密碼以匯出 CodeBuddy CN 帳號。",
+  "Enter your current password to import CodeBuddy CN accounts.": "輸入目前密碼以匯入 CodeBuddy CN 帳號。"
+}

package/app/src/mitm/server.js

@@ -1,4 +1,4 @@
-var F=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var ar=F((yh,Wn)=>{var xr=require("fs"),qt=require("path"),zr=require("os"),Da="10router",$n="9router";function Yn(){return process.platform==="win32"?qt.join(process.env.APPDATA||qt.join(zr.homedir(),"AppData","Roaming"),$n):qt.join(zr.homedir(),`.${$n}`)}function Su(){try{let e=Yn(),t=Qr();if(!xr.existsSync(e)||xr.existsSync(t)&&xr.readdirSync(t).length>0)return;xr.cpSync(e,t,{recursive:!0}),console.log(`[migration] copied legacy data dir ${e} \u2192 ${t}`)}catch(e){console.warn(`[migration] failed to migrate ${Yn()} \u2192 ${Qr()}: ${e?.message}`)}}function Qr(){return process.platform==="win32"?qt.join(process.env.APPDATA||qt.join(zr.homedir(),"AppData","Roaming"),Da):qt.join(zr.homedir(),`.${Da}`)}function Tu(){let e=process.env.DATA_DIR;if(!e)return Su(),Qr();try{return xr.mkdirSync(e,{recursive:!0}),e}catch(t){if(t?.code==="EACCES"||t?.code==="EPERM")return console.warn(`[DATA_DIR] '${e}' not writable \u2192 fallback ~/.${Da}`),Qr();throw t}}var jn=Tu(),Iu=qt.join(jn,"mitm");Wn.exports={DATA_DIR:jn,MITM_DIR:Iu}});var Sr=F((vh,Zn)=>{var Xn=require("fs"),Au=process.env.NODE_ENV==="development",Bu=(()=>{if(process.platform==="win32")return null;for(let e of["/usr/sbin/lsof","/usr/bin/lsof","/sbin/lsof"])try{return Xn.accessSync(e,Xn.constants.X_OK),e}catch{}return"lsof"})(),bu=["daily-cloudcode-pa.googleapis.com","cloudcode-pa.googleapis.com","api.individual.githubcopilot.com","q.us-east-1.amazonaws.com","codewhisperer.us-east-1.amazonaws.com","runtime.us-east-1.kiro.dev","api2.cursor.sh"],Jn={antigravity:[":generateContent",":streamGenerateContent"],copilot:["/chat/completions","/v1/messages","/responses"],kiro:["/generateAssistantResponse"],cursor:["/BidiAppend","/RunSSE","/RunPoll","/Run"]};function _u(e,t){return(Jn[e]||[]).some(r=>(t.url||"").includes(r))?!0:e==="kiro"?String(t.headers?.["x-amz-target"]||"").includes("GenerateAssistantResponse"):!1}var Nu={antigravity:{"gemini-default":"gemini-3.5-flash-low","gemini-3.5-flash-high":"gemini-3-flash-agent","gemini-3.5-flash-medium":"gemini-3.5-flash-low","gemini-3.5-flash-extra-low":"gemini-3.5-flash-extra-low","gemini-3.7-flash-high":"gemini-3.7-flash-high","gemini-3.7-flash-medium":"gemini-3.7-flash-medium","gemini-3.7-flash-low":"gemini-3.7-flash-low","gemini-3.1-pro-high":"gemini-pro-agent","gemini-3-pro-high":"gemini-pro-agent","gemini-3-pro-low":"gemini-3.1-pro-low"}},wu={antigravity:[{match:/flash.*extra.*low|extra.*low.*flash|flash.*low|low.*flash/i,alias:"gemini-3.5-flash-extra-low"},{match:/flash.*medium|medium.*flash/i,alias:"gemini-3.5-flash-low"},{match:/flash.*agent|agent.*flash|flash/i,alias:"gemini-3-flash-agent"},{match:/pro.*low|low.*pro/i,alias:"gemini-3.1-pro-low"},{match:/gemini.*pro|pro.*gemini/i,alias:"gemini-pro-agent"},{match:/opus/i,alias:"claude-opus-4-6-thinking"},{match:/sonnet|claude/i,alias:"claude-sonnet-4-6"},{match:/gpt.*oss|oss/i,alias:"gpt-oss-120b-medium"}]},Ru={antigravity:[/^tab[_-]/i]},Lu=["recordCodeAssistMetrics","recordTrajectoryAnalytics","fetchAdminControls","listExperiments","fetchUserInfo"];function ku(e){let t=(e||"").split(":")[0];return t==="api.individual.githubcopilot.com"?"copilot":t==="daily-cloudcode-pa.googleapis.com"||t==="cloudcode-pa.googleapis.com"?"antigravity":t==="q.us-east-1.amazonaws.com"||t==="codewhisperer.us-east-1.amazonaws.com"||t==="runtime.us-east-1.kiro.dev"?"kiro":t==="api2.cursor.sh"?"cursor":null}function Du(e){if(!e||e.length===0)return!1;let t=e.slice(0,Math.min(100,e.length)),a=0;for(let r=0;r<t.length;r++){let n=t[r];n<32&&n!==9&&n!==10&&n!==13&&a++,n>126&&a++}return a/t.length>.3}function Uu(e,t){let r=e.match(/\/models\/([^/:]+)/)?.[1]||null;if(Du(t))return r;try{let n=JSON.parse(t.toString());if(n.conversationState)return n.conversationState.currentMessage?.userInputMessage?.modelId||null;let s=r||n.model||null,i=String(s).replace(/^models\//,"");if(i==="gemini-3.6-flash-tiered"||i==="gemini-3.7-flash-tiered"){let o=i.includes("3.7")?"3.7":"3.6",u=n.request?.generationConfig?.thinkingConfig?.thinkingLevel||n.generationConfig?.thinkingConfig?.thinkingLevel,l=["high","medium","low"].includes(String(u).toLowerCase())?String(u).toLowerCase():"medium";return`gemini-${o}-flash-${l}`}return s}catch{return r}}Zn.exports={IS_DEV:Au,LSOF_BIN:Bu,TARGET_HOSTS:bu,URL_PATTERNS:Jn,MODEL_SYNONYMS:Nu,MODEL_PATTERNS:wu,MODEL_NO_MAP:Ru,LOG_BLACKLIST_URL_PARTS:Lu,getToolForHost:ku,isChatRequest:_u,extractModel:Uu}});var zt=F((mh,ai)=>{var Ht=require("fs"),$r=require("path"),Ua=require("zlib"),{DATA_DIR:Pu}=ar(),{LOG_BLACKLIST_URL_PARTS:Ou}=Sr();function ei(){return new Date().toLocaleTimeString("en-US",{hour12:!1})}var Vu=e=>console.log(`[${ei()}] [MITM] ${e}`),Fu=e=>console.error(`[${ei()}] \u274C [MITM] ${e}`),Gt=$r.join(Pu,"logs","mitm");Ht.existsSync(Gt)||Ht.mkdirSync(Gt,{recursive:!0});function Ku(){try{if(!Ht.existsSync(Gt))return;for(let e of Ht.readdirSync(Gt))try{Ht.rmSync($r.join(Gt,e),{recursive:!0,force:!0})}catch{}}catch{}}var Mu=/^\s*(\{\s*\}|\[\s*\]|null)?\s*$/;function ti(e,t=80){return String(e).replace(/[^a-zA-Z0-9]/g,"_").substring(0,t)}function ri(e){return e?Ou.some(t=>e.includes(t)):!1}function qu(e,t){if(!e||e.length===0)return e;try{let a=(t||"").toLowerCase();if(a.includes("gzip"))return Ua.gunzipSync(e);if(a.includes("br"))return Ua.brotliDecompressSync(e);if(a.includes("deflate"))return Ua.inflateSync(e)}catch{}return e}function Hu(e,t,a="raw"){if(ri(e.url))return null;try{let r=new Date().toISOString().replace(/[:.]/g,"-"),n=ti((e.headers.host||"")+e.url),s=$r.join(Gt,`${r}_${a}_${n}.req.json`),i=null;try{i=JSON.parse(t.toString())}catch{}return Ht.writeFileSync(s,JSON.stringify({method:e.method,url:e.url,host:e.headers.host,headers:e.headers,body:i??t.toString("utf8")},null,2)),s}catch{return null}}function Gu(e,t="raw"){if(ri(e.url))return null;let a=new Date().toISOString().replace(/[:.]/g,"-"),r=ti((e.headers.host||"")+e.url),n=$r.join(Gt,`${a}_${t}_${r}.res.txt`),s=0,i={},o=[];return{writeHeader:(u,l)=>{s=u,i=l||{}},writeChunk:u=>{u!=null&&o.push(Buffer.isBuffer(u)?u:Buffer.from(u))},end:()=>{try{let u=Buffer.concat(o),l=i["content-encoding"]||i["Content-Encoding"],f=qu(u,l).toString("utf8");if(Mu.test(f))return;let g={...i};delete g["content-encoding"],delete g["Content-Encoding"];let v=`STATUS: ${s}
+var F=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var ar=F((yh,Wn)=>{var xr=require("fs"),qt=require("path"),zr=require("os"),Da="10router",$n="9router";function Yn(){return process.platform==="win32"?qt.join(process.env.APPDATA||qt.join(zr.homedir(),"AppData","Roaming"),$n):qt.join(zr.homedir(),`.${$n}`)}function Su(){try{let e=Yn(),t=Qr();if(!xr.existsSync(e)||xr.existsSync(t)&&xr.readdirSync(t).length>0)return;xr.cpSync(e,t,{recursive:!0}),console.log(`[migration] copied legacy data dir ${e} \u2192 ${t}`)}catch(e){console.warn(`[migration] failed to migrate ${Yn()} \u2192 ${Qr()}: ${e?.message}`)}}function Qr(){return process.platform==="win32"?qt.join(process.env.APPDATA||qt.join(zr.homedir(),"AppData","Roaming"),Da):qt.join(zr.homedir(),`.${Da}`)}function Tu(){let e=process.env.DATA_DIR;if(!e)return Su(),Qr();try{return xr.mkdirSync(e,{recursive:!0}),e}catch(t){if(t?.code==="EACCES"||t?.code==="EPERM")return console.warn(`[DATA_DIR] '${e}' not writable \u2192 fallback ~/.${Da}`),Qr();throw t}}var jn=Tu(),Iu=qt.join(jn,"mitm");Wn.exports={DATA_DIR:jn,MITM_DIR:Iu}});var Sr=F((vh,Zn)=>{var Xn=require("fs"),Au=process.env.NODE_ENV==="development",Bu=(()=>{if(process.platform==="win32")return null;for(let e of["/usr/sbin/lsof","/usr/bin/lsof","/sbin/lsof"])try{return Xn.accessSync(e,Xn.constants.X_OK),e}catch{}return"lsof"})(),bu=["daily-cloudcode-pa.googleapis.com","cloudcode-pa.googleapis.com","api.individual.githubcopilot.com","q.us-east-1.amazonaws.com","codewhisperer.us-east-1.amazonaws.com","runtime.us-east-1.kiro.dev","api2.cursor.sh"],Jn={antigravity:[":generateContent",":streamGenerateContent"],copilot:["/chat/completions","/v1/messages","/responses"],kiro:["/generateAssistantResponse"],cursor:["/BidiAppend","/RunSSE","/RunPoll","/Run"]};function _u(e,t){return(Jn[e]||[]).some(r=>(t.url||"").includes(r))?!0:e==="kiro"?String(t.headers?.["x-amz-target"]||"").includes("GenerateAssistantResponse"):!1}var Nu={antigravity:{"gemini-default":"gemini-3.5-flash-low","gemini-3.5-flash-high":"gemini-3-flash-agent","gemini-3.5-flash-medium":"gemini-3.5-flash-low","gemini-3.5-flash-extra-low":"gemini-3.5-flash-extra-low","gemini-3.8-flash":"gemini-3.8-flash-medium","gemini-3.8-flash-high":"gemini-3.8-flash-high","gemini-3.8-flash-medium":"gemini-3.8-flash-medium","gemini-3.8-flash-low":"gemini-3.8-flash-low","gemini-3.7-flash-high":"gemini-3.7-flash-high","gemini-3.7-flash-medium":"gemini-3.7-flash-medium","gemini-3.7-flash-low":"gemini-3.7-flash-low","gemini-3.1-pro-high":"gemini-pro-agent","gemini-3-pro-high":"gemini-pro-agent","gemini-3-pro-low":"gemini-3.1-pro-low"}},wu={antigravity:[{match:/flash.*extra.*low|extra.*low.*flash|flash.*low|low.*flash/i,alias:"gemini-3.5-flash-extra-low"},{match:/flash.*medium|medium.*flash/i,alias:"gemini-3.5-flash-low"},{match:/flash.*agent|agent.*flash|flash/i,alias:"gemini-3-flash-agent"},{match:/pro.*low|low.*pro/i,alias:"gemini-3.1-pro-low"},{match:/gemini.*pro|pro.*gemini/i,alias:"gemini-pro-agent"},{match:/opus/i,alias:"claude-opus-4-6-thinking"},{match:/sonnet|claude/i,alias:"claude-sonnet-4-6"},{match:/gpt.*oss|oss/i,alias:"gpt-oss-120b-medium"}]},Ru={antigravity:[/^tab[_-]/i]},Lu=["recordCodeAssistMetrics","recordTrajectoryAnalytics","fetchAdminControls","listExperiments","fetchUserInfo"];function ku(e){let t=(e||"").split(":")[0];return t==="api.individual.githubcopilot.com"?"copilot":t==="daily-cloudcode-pa.googleapis.com"||t==="cloudcode-pa.googleapis.com"?"antigravity":t==="q.us-east-1.amazonaws.com"||t==="codewhisperer.us-east-1.amazonaws.com"||t==="runtime.us-east-1.kiro.dev"?"kiro":t==="api2.cursor.sh"?"cursor":null}function Du(e){if(!e||e.length===0)return!1;let t=e.slice(0,Math.min(100,e.length)),a=0;for(let r=0;r<t.length;r++){let n=t[r];n<32&&n!==9&&n!==10&&n!==13&&a++,n>126&&a++}return a/t.length>.3}function Uu(e,t){let r=e.match(/\/models\/([^/:]+)/)?.[1]||null;if(Du(t))return r;try{let n=JSON.parse(t.toString());if(n.conversationState)return n.conversationState.currentMessage?.userInputMessage?.modelId||null;let s=r||n.model||null,i=String(s).replace(/^models\//,"");if(i==="gemini-3.8-flash-tiered"||i==="gemini-3.6-flash-tiered"||i==="gemini-3.7-flash-tiered"){let o=i.includes("3.8")?"3.8":i.includes("3.7")?"3.7":"3.6",u=n.request?.generationConfig?.thinkingConfig?.thinkingLevel||n.generationConfig?.thinkingConfig?.thinkingLevel,l=["high","medium","low"].includes(String(u).toLowerCase())?String(u).toLowerCase():"medium";return`gemini-${o}-flash-${l}`}return s}catch{return r}}Zn.exports={IS_DEV:Au,LSOF_BIN:Bu,TARGET_HOSTS:bu,URL_PATTERNS:Jn,MODEL_SYNONYMS:Nu,MODEL_PATTERNS:wu,MODEL_NO_MAP:Ru,LOG_BLACKLIST_URL_PARTS:Lu,getToolForHost:ku,isChatRequest:_u,extractModel:Uu}});var zt=F((mh,ai)=>{var Ht=require("fs"),$r=require("path"),Ua=require("zlib"),{DATA_DIR:Pu}=ar(),{LOG_BLACKLIST_URL_PARTS:Ou}=Sr();function ei(){return new Date().toLocaleTimeString("en-US",{hour12:!1})}var Vu=e=>console.log(`[${ei()}] [MITM] ${e}`),Fu=e=>console.error(`[${ei()}] \u274C [MITM] ${e}`),Gt=$r.join(Pu,"logs","mitm");Ht.existsSync(Gt)||Ht.mkdirSync(Gt,{recursive:!0});function Ku(){try{if(!Ht.existsSync(Gt))return;for(let e of Ht.readdirSync(Gt))try{Ht.rmSync($r.join(Gt,e),{recursive:!0,force:!0})}catch{}}catch{}}var Mu=/^\s*(\{\s*\}|\[\s*\]|null)?\s*$/;function ti(e,t=80){return String(e).replace(/[^a-zA-Z0-9]/g,"_").substring(0,t)}function ri(e){return e?Ou.some(t=>e.includes(t)):!1}function qu(e,t){if(!e||e.length===0)return e;try{let a=(t||"").toLowerCase();if(a.includes("gzip"))return Ua.gunzipSync(e);if(a.includes("br"))return Ua.brotliDecompressSync(e);if(a.includes("deflate"))return Ua.inflateSync(e)}catch{}return e}function Hu(e,t,a="raw"){if(ri(e.url))return null;try{let r=new Date().toISOString().replace(/[:.]/g,"-"),n=ti((e.headers.host||"")+e.url),s=$r.join(Gt,`${r}_${a}_${n}.req.json`),i=null;try{i=JSON.parse(t.toString())}catch{}return Ht.writeFileSync(s,JSON.stringify({method:e.method,url:e.url,host:e.headers.host,headers:e.headers,body:i??t.toString("utf8")},null,2)),s}catch{return null}}function Gu(e,t="raw"){if(ri(e.url))return null;let a=new Date().toISOString().replace(/[:.]/g,"-"),r=ti((e.headers.host||"")+e.url),n=$r.join(Gt,`${a}_${t}_${r}.res.txt`),s=0,i={},o=[];return{writeHeader:(u,l)=>{s=u,i=l||{}},writeChunk:u=>{u!=null&&o.push(Buffer.isBuffer(u)?u:Buffer.from(u))},end:()=>{try{let u=Buffer.concat(o),l=i["content-encoding"]||i["Content-Encoding"],f=qu(u,l).toString("utf8");if(Mu.test(f))return;let g={...i};delete g["content-encoding"],delete g["Content-Encoding"];let v=`STATUS: ${s}
 HEADERS: ${JSON.stringify(g,null,2)}
 ---BODY---
 ${f}`;Ht.writeFileSync(n,v)}catch{}},file:n}}ai.exports={log:Vu,err:Fu,dumpRequest:Hu,createResponseDumper:Gu,clearDumpDir:Ku}});var $=F((Ch,ni)=>{ni.exports={options:{usePureJavaScript:!1}}});var oi=F((Eh,si)=>{var Pa={};si.exports=Pa;var ii={};Pa.encode=function(e,t,a){if(typeof t!="string")throw new TypeError('"alphabet" must be a string.');if(a!==void 0&&typeof a!="number")throw new TypeError('"maxline" must be a number.');var r="";if(!(e instanceof Uint8Array))r=zu(e,t);else{var n=0,s=t.length,i=t.charAt(0),o=[0];for(n=0;n<e.length;++n){for(var u=0,l=e[n];u<o.length;++u)l+=o[u]<<8,o[u]=l%s,l=l/s|0;for(;l>0;)o.push(l%s),l=l/s|0}for(n=0;e[n]===0&&n<e.length-1;++n)r+=i;for(n=o.length-1;n>=0;--n)r+=t[o[n]]}if(a){var c=new RegExp(".{1,"+a+"}","g");r=r.match(c).join(`\r
@@ -22,7 +22,7 @@ ${f}`;Ht.writeFileSync(n,v)}catch{}},file:n}}ai.exports={log:Vu,err:Fu,dumpReque
 Private-Lines: `+u+`\r
 `,s+=c;var S=Ia("putty-private-key-file-mac-key",t),I=Ce.util.createBuffer();mr(I,r),mr(I,n),mr(I,a),I.putInt32(i.length()),I.putBuffer(i),I.putInt32(l.length()),I.putBuffer(l);var B=Ce.hmac.create();return B.start("sha1",S),B.update(I.bytes()),s+=`\r
 Private-MAC: `+B.digest().toHex()+`\r
-`,s};Aa.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return mr(r,a),xt(r,e.e),xt(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};Aa.privateKeyToOpenSSH=function(e,t){return t?Ce.pki.encryptRsaPrivateKey(e,t,{legacy:!0,algorithm:"aes128"}):Ce.pki.privateKeyToPem(e)};Aa.getPublicKeyFingerprint=function(e,t){t=t||{};var a=t.md||Ce.md.md5.create(),r="ssh-rsa",n=Ce.util.createBuffer();mr(n,r),xt(n,e.e),xt(n,e.n),a.start(),a.update(n.getBytes());var s=a.digest();if(t.encoding==="hex"){var i=s.toHex();return t.delimiter?i.match(/.{2}/g).join(t.delimiter):i}else{if(t.encoding==="binary")return s.getBytes();if(t.encoding)throw new Error('Unknown encoding "'+t.encoding+'".')}return s};function xt(e,t){var a=t.toString(16);a[0]>="8"&&(a="00"+a);var r=Ce.util.hexToBytes(a);e.putInt32(r.length),e.putBytes(r)}function mr(e,t){e.putInt32(t.length),e.putString(t)}function Ia(){for(var e=Ce.md.sha1.create(),t=arguments.length,a=0;a<t;++a)e.update(arguments[a]);return e.digest()}});var Eo=F((sp,Co)=>{Co.exports=$();Lt();Vs();lt();jr();br();ro();sr();so();co();ho();fn();sa();$t();nn();pn();yo();yn();on();Wa();ha();tt();Za();mo();Sn();re()});var Ao=F((op,Io)=>{var So=require("path"),je=require("fs"),Ze=Eo(),{MITM_DIR:Ba}=ar(),St=So.join(Ba,"rootCA.key"),bt=So.join(Ba,"rootCA.crt");function To(e){try{let t=Ze.pki.certificateFromPem(je.readFileSync(e,"utf8")),a=new Date(Date.now()+720*60*60*1e3);return t.validity.notAfter<a}catch{return!0}}function xo(){if(process.platform!=="win32")try{je.chmodSync(St,384)}catch(e){console.warn(`\u26A0\uFE0F  Could not restrict permissions on ${St}: ${e.message}`)}}function wf(){let e=je.existsSync(St)&&je.existsSync(bt);if(e&&!To(bt))return xo(),console.log("\u2705 Root CA already exists"),{key:St,cert:bt};if(e){console.log("\u{1F510} Root CA expired or expiring soon \u2014 regenerating...");try{je.unlinkSync(St)}catch{}try{je.unlinkSync(bt)}catch{}}je.existsSync(Ba)||je.mkdirSync(Ba,{recursive:!0,mode:448}),console.log("\u{1F510} Generating Root CA certificate...");let t=Ze.pki.rsa.generateKeyPair(2048),a=Ze.pki.createCertificate();a.publicKey=t.publicKey,a.serialNumber="01",a.validity.notBefore=new Date,a.validity.notAfter=new Date,a.validity.notAfter.setFullYear(a.validity.notBefore.getFullYear()+10);let r=[{name:"commonName",value:"10Router MITM Root CA"},{name:"organizationName",value:"10Router"},{name:"countryName",value:"US"}];a.setSubject(r),a.setIssuer(r),a.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0},{name:"subjectKeyIdentifier"}]),a.sign(t.privateKey,Ze.md.sha256.create());let n=Ze.pki.privateKeyToPem(t.privateKey),s=Ze.pki.certificateToPem(a);return je.writeFileSync(St,n,{mode:384}),je.writeFileSync(bt,s),xo(),console.log("\u2705 Root CA generated successfully"),{key:St,cert:bt}}function Rf(){if(!je.existsSync(St)||!je.existsSync(bt))throw new Error("Root CA not found. Generate it first.");let e=je.readFileSync(St,"utf8"),t=je.readFileSync(bt,"utf8");return{key:Ze.pki.privateKeyFromPem(e),cert:Ze.pki.certificateFromPem(t)}}function Lf(e,t){let a=Ze.pki.rsa.generateKeyPair(2048),r=Ze.pki.createCertificate();return r.publicKey=a.publicKey,r.serialNumber=Math.floor(Math.random()*1e6).toString(),r.validity.notBefore=new Date,r.validity.notAfter=new Date,r.validity.notAfter.setFullYear(r.validity.notBefore.getFullYear()+1),r.setSubject([{name:"commonName",value:e}]),r.setIssuer(t.cert.subject.attributes),r.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0,clientAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:e},{type:2,value:`*.${e}`}]}]),r.sign(t.key,Ze.md.sha256.create()),{key:Ze.pki.privateKeyToPem(a.privateKey),cert:Ze.pki.certificateToPem(r)}}Io.exports={generateRootCA:wf,loadRootCA:Rf,generateLeafCert:Lf,isCertExpired:To,ROOT_CA_CERT_PATH:bt,ROOT_CA_KEY_PATH:St}});var bo=F((fp,Bo)=>{var up=require("path"),lp=require("fs"),{MITM_DIR:cp}=ar(),{generateRootCA:kf,loadRootCA:Df,generateLeafCert:Uf}=Ao();function Pf(){return kf()}function Of(e){try{let t=Df(),a=Uf(e,t);return{key:a.key,cert:a.cert}}catch(t){return console.error(`Failed to generate cert for ${e}:`,t.message),null}}Bo.exports={generateCert:Pf,getCertForDomain:Of}});var Ro=F((dp,wo)=>{var _o=require("fs"),Vf=require("path"),{DATA_DIR:Ff}=ar(),No=Vf.join(Ff,"mitm","aliases.json");function Kf(){try{return _o.existsSync(No)?JSON.parse(_o.readFileSync(No,"utf-8")):null}catch{return null}}function Mf(e){return Kf()?.[e]||null}wo.exports={getMitmAlias:Mf}});var Do=F((hp,ko)=>{"use strict";var Cr="1.23.2";function qf(e){return!e||typeof e!="object"||Array.isArray(e)?!1:String(e.ideName||"").toLowerCase()==="antigravity"||String(e.ideType||"").toUpperCase()==="ANTIGRAVITY"?!0:Object.prototype.hasOwnProperty.call(e,"ideVersion")}function Lo(e,t){return typeof e!="string"||!e.includes("antigravity/")?e:e.replace(/antigravity\/[^\s]+/,`antigravity/${t}`)}function Hf(e,t){let a={...t},r=Lo(a["user-agent"],Cr),n=r!==a["user-agent"];n&&(a["user-agent"]=r);try{let s=JSON.parse(e.toString());return qf(s?.metadata)?(s.metadata.ideVersion=Cr,{bodyBuffer:Buffer.from(JSON.stringify(s)),headers:a,applied:!0,version:Cr}):{bodyBuffer:e,headers:a,applied:n,version:Cr}}catch{return{bodyBuffer:e,headers:a,applied:n,version:Cr}}}ko.exports={ANTIGRAVITY_IDE_VERSION:Cr,applyAntigravityIdeVersionOverride:Hf,rewriteAntigravityUserAgent:Lo}});var _a=F((gp,Oo)=>{var{log:ba,err:pp}=zt(),Uo="http://localhost:20128",Gf=String(process.env.MITM_ROUTER_BASE||Uo).trim().replace(/\/+$/,"")||Uo,Po=process.env.ROUTER_API_KEY,zf=new Set(["host","content-length","connection","transfer-encoding","content-type","authorization"]);async function Qf(e,t="/v1/chat/completions",a={}){let r={};for(let[s,i]of Object.entries(a))zf.has(s.toLowerCase())||(r[s]=i);return await fetch(`${Gf}${t}`,{method:"POST",headers:{...r,"Content-Type":"application/json",...Po&&{Authorization:`Bearer ${Po}`}},body:JSON.stringify(e)})}async function $f(e,t,a){let r=e.headers.get("content-type")||"application/json",n=e.status||200,s={"Content-Type":r,"Cache-Control":"no-cache",Connection:"keep-alive"};if(r.includes("text/event-stream")&&(s["X-Accel-Buffering"]="no"),t.writeHead(n,s),a&&a.writeHeader(e.status,Object.fromEntries(e.headers)),!e.body){let u=await e.text().catch(()=>"");a&&(a.writeChunk(u),a.end()),t.end(u);return}let i=e.body.getReader(),o=new TextDecoder;for(;;){let{done:u,value:l}=await i.read();if(u){a&&a.end(),t.end();break}a&&a.writeChunk(l),t.write(o.decode(l,{stream:!0}))}}async function Yf(e,t,a,r){let n=e.headers.get("content-type")||"application/json",s={"Content-Type":n,"Cache-Control":"no-cache",Connection:"keep-alive"};if(n.includes("text/event-stream")&&(s["X-Accel-Buffering"]="no"),t.writeHead(200,s),!e.body){t.end(await e.text().catch(()=>""));return}let i=e.body.getReader(),o=new TextDecoder("utf-8",{fatal:!1}),u="";for(;;){let{done:l,value:c}=await i.read();if(l)break;u+=o.decode(c,{stream:!0});let f=u.split(`
+`,s};Aa.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return mr(r,a),xt(r,e.e),xt(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};Aa.privateKeyToOpenSSH=function(e,t){return t?Ce.pki.encryptRsaPrivateKey(e,t,{legacy:!0,algorithm:"aes128"}):Ce.pki.privateKeyToPem(e)};Aa.getPublicKeyFingerprint=function(e,t){t=t||{};var a=t.md||Ce.md.md5.create(),r="ssh-rsa",n=Ce.util.createBuffer();mr(n,r),xt(n,e.e),xt(n,e.n),a.start(),a.update(n.getBytes());var s=a.digest();if(t.encoding==="hex"){var i=s.toHex();return t.delimiter?i.match(/.{2}/g).join(t.delimiter):i}else{if(t.encoding==="binary")return s.getBytes();if(t.encoding)throw new Error('Unknown encoding "'+t.encoding+'".')}return s};function xt(e,t){var a=t.toString(16);a[0]>="8"&&(a="00"+a);var r=Ce.util.hexToBytes(a);e.putInt32(r.length),e.putBytes(r)}function mr(e,t){e.putInt32(t.length),e.putString(t)}function Ia(){for(var e=Ce.md.sha1.create(),t=arguments.length,a=0;a<t;++a)e.update(arguments[a]);return e.digest()}});var Eo=F((sp,Co)=>{Co.exports=$();Lt();Vs();lt();jr();br();ro();sr();so();co();ho();fn();sa();$t();nn();pn();yo();yn();on();Wa();ha();tt();Za();mo();Sn();re()});var Ao=F((op,Io)=>{var So=require("path"),je=require("fs"),Ze=Eo(),{MITM_DIR:Ba}=ar(),St=So.join(Ba,"rootCA.key"),bt=So.join(Ba,"rootCA.crt");function To(e){try{let t=Ze.pki.certificateFromPem(je.readFileSync(e,"utf8")),a=new Date(Date.now()+720*60*60*1e3);return t.validity.notAfter<a}catch{return!0}}function xo(){if(process.platform!=="win32")try{je.chmodSync(St,384)}catch(e){console.warn(`\u26A0\uFE0F  Could not restrict permissions on ${St}: ${e.message}`)}}function wf(){let e=je.existsSync(St)&&je.existsSync(bt);if(e&&!To(bt))return xo(),console.log("\u2705 Root CA already exists"),{key:St,cert:bt};if(e){console.log("\u{1F510} Root CA expired or expiring soon \u2014 regenerating...");try{je.unlinkSync(St)}catch{}try{je.unlinkSync(bt)}catch{}}je.existsSync(Ba)||je.mkdirSync(Ba,{recursive:!0,mode:448}),console.log("\u{1F510} Generating Root CA certificate...");let t=Ze.pki.rsa.generateKeyPair(2048),a=Ze.pki.createCertificate();a.publicKey=t.publicKey,a.serialNumber="01",a.validity.notBefore=new Date,a.validity.notAfter=new Date,a.validity.notAfter.setFullYear(a.validity.notBefore.getFullYear()+10);let r=[{name:"commonName",value:"10Router MITM Root CA"},{name:"organizationName",value:"10Router"},{name:"countryName",value:"US"}];a.setSubject(r),a.setIssuer(r),a.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0},{name:"subjectKeyIdentifier"}]),a.sign(t.privateKey,Ze.md.sha256.create());let n=Ze.pki.privateKeyToPem(t.privateKey),s=Ze.pki.certificateToPem(a);return je.writeFileSync(St,n,{mode:384}),je.writeFileSync(bt,s),xo(),console.log("\u2705 Root CA generated successfully"),{key:St,cert:bt}}function Rf(){if(!je.existsSync(St)||!je.existsSync(bt))throw new Error("Root CA not found. Generate it first.");let e=je.readFileSync(St,"utf8"),t=je.readFileSync(bt,"utf8");return{key:Ze.pki.privateKeyFromPem(e),cert:Ze.pki.certificateFromPem(t)}}function Lf(e,t){let a=Ze.pki.rsa.generateKeyPair(2048),r=Ze.pki.createCertificate();return r.publicKey=a.publicKey,r.serialNumber=Math.floor(Math.random()*1e6).toString(),r.validity.notBefore=new Date,r.validity.notAfter=new Date,r.validity.notAfter.setFullYear(r.validity.notBefore.getFullYear()+1),r.setSubject([{name:"commonName",value:e}]),r.setIssuer(t.cert.subject.attributes),r.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0,clientAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:e},{type:2,value:`*.${e}`}]}]),r.sign(t.key,Ze.md.sha256.create()),{key:Ze.pki.privateKeyToPem(a.privateKey),cert:Ze.pki.certificateToPem(r)}}Io.exports={generateRootCA:wf,loadRootCA:Rf,generateLeafCert:Lf,isCertExpired:To,ROOT_CA_CERT_PATH:bt,ROOT_CA_KEY_PATH:St}});var bo=F((fp,Bo)=>{var up=require("path"),lp=require("fs"),{MITM_DIR:cp}=ar(),{generateRootCA:kf,loadRootCA:Df,generateLeafCert:Uf}=Ao();function Pf(){return kf()}function Of(e){try{let t=Df(),a=Uf(e,t);return{key:a.key,cert:a.cert}}catch(t){return console.error(`Failed to generate cert for ${e}:`,t.message),null}}Bo.exports={generateCert:Pf,getCertForDomain:Of}});var Ro=F((dp,wo)=>{var _o=require("fs"),Vf=require("path"),{DATA_DIR:Ff}=ar(),No=Vf.join(Ff,"mitm","aliases.json");function Kf(){try{return _o.existsSync(No)?JSON.parse(_o.readFileSync(No,"utf-8")):null}catch{return null}}function Mf(e){return Kf()?.[e]||null}wo.exports={getMitmAlias:Mf}});var Do=F((hp,ko)=>{"use strict";var Cr="2.11.0";function qf(e){return!e||typeof e!="object"||Array.isArray(e)?!1:String(e.ideName||"").toLowerCase()==="antigravity"||String(e.ideType||"").toUpperCase()==="ANTIGRAVITY"?!0:Object.prototype.hasOwnProperty.call(e,"ideVersion")}function Lo(e,t){return typeof e!="string"||!e.includes("antigravity/")?e:e.replace(/antigravity\/[^\s]+/,`antigravity/${t}`)}function Hf(e,t){let a={...t},r=Lo(a["user-agent"],Cr),n=r!==a["user-agent"];n&&(a["user-agent"]=r);try{let s=JSON.parse(e.toString());return qf(s?.metadata)?(s.metadata.ideVersion=Cr,{bodyBuffer:Buffer.from(JSON.stringify(s)),headers:a,applied:!0,version:Cr}):{bodyBuffer:e,headers:a,applied:n,version:Cr}}catch{return{bodyBuffer:e,headers:a,applied:n,version:Cr}}}ko.exports={ANTIGRAVITY_IDE_VERSION:Cr,applyAntigravityIdeVersionOverride:Hf,rewriteAntigravityUserAgent:Lo}});var _a=F((gp,Oo)=>{var{log:ba,err:pp}=zt(),Uo="http://localhost:20128",Gf=String(process.env.MITM_ROUTER_BASE||Uo).trim().replace(/\/+$/,"")||Uo,Po=process.env.ROUTER_API_KEY,zf=new Set(["host","content-length","connection","transfer-encoding","content-type","authorization"]);async function Qf(e,t="/v1/chat/completions",a={}){let r={};for(let[s,i]of Object.entries(a))zf.has(s.toLowerCase())||(r[s]=i);return await fetch(`${Gf}${t}`,{method:"POST",headers:{...r,"Content-Type":"application/json",...Po&&{Authorization:`Bearer ${Po}`}},body:JSON.stringify(e)})}async function $f(e,t,a){let r=e.headers.get("content-type")||"application/json",n=e.status||200,s={"Content-Type":r,"Cache-Control":"no-cache",Connection:"keep-alive"};if(r.includes("text/event-stream")&&(s["X-Accel-Buffering"]="no"),t.writeHead(n,s),a&&a.writeHeader(e.status,Object.fromEntries(e.headers)),!e.body){let u=await e.text().catch(()=>"");a&&(a.writeChunk(u),a.end()),t.end(u);return}let i=e.body.getReader(),o=new TextDecoder;for(;;){let{done:u,value:l}=await i.read();if(u){a&&a.end(),t.end();break}a&&a.writeChunk(l),t.write(o.decode(l,{stream:!0}))}}async function Yf(e,t,a,r){let n=e.headers.get("content-type")||"application/json",s={"Content-Type":n,"Cache-Control":"no-cache",Connection:"keep-alive"};if(n.includes("text/event-stream")&&(s["X-Accel-Buffering"]="no"),t.writeHead(200,s),!e.body){t.end(await e.text().catch(()=>""));return}let i=e.body.getReader(),o=new TextDecoder("utf-8",{fatal:!1}),u="";for(;;){let{done:l,value:c}=await i.read();if(l)break;u+=o.decode(c,{stream:!0});let f=u.split(`
 `);u=f.pop()||"";for(let g of f){let v=g.trim();if(!v||!v.startsWith("data:"))continue;let y=v.slice(5).trim();if(y!=="[DONE]"){process.env.DEBUG_MITM&&ba(`[SSE in] ${y.slice(0,200)}`);try{let x=JSON.parse(y),S=a(x,r);if(S!=null){let I=Array.isArray(S)?S:[S];for(let B of I){if(process.env.DEBUG_MITM){let b=B.length||B.byteLength||0;ba(`[write binary frame] (${b}B) first 20B: ${Array.from(B.slice(0,20)).join(",")}`)}t.write(Buffer.from(B))}}}catch{}}}}try{let l=a(null,r);if(l!=null){let c=Array.isArray(l)?l:[l];for(let f of c)t.write(f)}}catch{}t.end()}async function jf(e,t,a,r){let n={"Content-Type":"application/vnd.amazon.eventstream","Cache-Control":"no-cache",Connection:"keep-alive"};if(t.writeHead(200,n),!e.body){t.end(await e.text().catch(()=>""));return}let s=e.body.getReader(),i=new TextDecoder("utf-8",{fatal:!1}),o="";for(;;){let{done:u,value:l}=await s.read();if(u)break;o+=i.decode(l,{stream:!0});let c=o.split(`
 `);o=c.pop()||"";for(let f of c){let g=f.trim();if(!g||!g.startsWith("data:"))continue;let v=g.slice(5).trim();if(v!=="[DONE]"){process.env.DEBUG_MITM&&ba(`[SSE in] ${v.slice(0,200)}`);try{let y=JSON.parse(v),x=a(y,r);if(x!=null){let S=Array.isArray(x)?x:[x];for(let I of S){if(process.env.DEBUG_MITM){let B=I.length||I.byteLength||0;ba(`[write binary frame] (${B}B) first 20B: ${Array.from(I.slice(0,20)).join(",")}`)}t.write(Buffer.from(I))}}}catch{}}}}try{let u=a(null,r);if(u!=null){let l=Array.isArray(u)?u:[u];for(let c of l)t.write(c)}}catch{}t.end()}Oo.exports={fetchRouter:Qf,pipeSSE:$f,pipeTransformedSSE:Yf,pipeTransformedEventStream:jf}});var Fo=F((yp,Vo)=>{var{err:Wf,createResponseDumper:Xf}=zt(),{IS_DEV:Jf}=Sr(),{fetchRouter:Zf,pipeSSE:ed}=_a();async function td(e,t,a,r){let n=Jf?Xf(e,"intercept-antigravity"):null,s=e.url.includes(":streamGenerateContent");try{let i=JSON.parse(a.toString());i.model&&(i.model=r);let o=await Zf(i,"/v1/chat/completions",e.headers);await ed(o,t,n)}catch(i){Wf(`[antigravity] ${i.message}`),n&&(n.writeChunk(`
 [ERROR] ${i.message}

package/app/src/sse/services/codebuddyCheckin.js

@@ -0,0 +1,385 @@
+// CodeBuddy CN auto daily check-in (experimental).
+// Checks every active codebuddy-cn connection into the CodeBuddy CN "billing
+// meter" once per day at a random 00:00-06:00 local slot, so free daily
+// quota is renewed without user action. Fail-open everywhere: a tick error or
+// a single connection failure never rejects the whole run or kills the server.
+
+import * as log from "../utils/logger.js";
+
+const DAILY_CHECKIN_URL = "https://www.codebuddy.cn/v2/billing/meter/daily-checkin";
+const STATUS_URL = "https://www.codebuddy.cn/v2/billing/meter/checkin-activity-status";
+
+// Random daily slot window: 00:00 - 06:00 local time (exclusive of 06:00).
+const SLOT_HOUR_MIN = 0;
+const SLOT_HOUR_MAX = 6; // upper bound exclusive for Math.floor(rand*(max-min))
+
+let started = false;
+let timerHandle = null;
+
+// ─── Pure helpers (unit-testable, no I/O) ──────────────────────────────────
+
+function decodeJwt(jwt) {
+  try {
+    const seg = String(jwt).split(".")[1];
+    const b64 = seg.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = b64 + "=".repeat((4 - (b64.length % 4)) % 4);
+    return JSON.parse(Buffer.from(pad, "base64").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function isCodeBuddyCnRealm(iss) {
+  return (
+    typeof iss === "string" &&
+    (iss.includes("codebuddy.cn") || iss.includes("copilot.tencent.com"))
+  );
+}
+
+/**
+ * Eligibility: an active codebuddy-cn OAuth connection whose access token is
+ * signed by a CodeBuddy CN Keycloak realm (has an access token at all).
+ * @param {object} conn
+ * @returns {boolean}
+ */
+export function isEligibleCbcnConnection(conn) {
+  if (!conn || !conn.accessToken) return false;
+  if (conn.provider !== "codebuddy-cn") return false;
+  if (conn.isActive === false) return false;
+  const claims = decodeJwt(conn.accessToken) || {};
+  return isCodeBuddyCnRealm(claims.iss || "");
+}
+
+function isIdempotentAlready(msg) {
+  if (typeof msg !== "string") return false;
+  // CN "今天已签到" / generic "repeat/already" markers from the CodeBuddy gateway.
+  return /已签到|签到过|重复签到|already|repeat/i.test(msg);
+}
+
+/**
+ * Map a daily-checkin HTTP result to a stable status string.
+ * @param {{ httpStatus: number, code?: number|string, msg?: string }} res
+ * @returns {"checked-in"|"already"|"failed"}
+ */
+export function mapDailyCheckinStatus({ httpStatus, code, msg } = {}) {
+  if (httpStatus >= 200 && httpStatus < 300) return "checked-in";
+  // HTTP 400 + known idempotent codes/messages ⇒ already signed in today.
+  if (httpStatus === 400) {
+    if (code === 10001 || code === "10001" || isIdempotentAlready(msg)) return "already";
+  }
+  return "failed";
+}
+
+/**
+ * Random delay (ms) until the next 00:00-06:00 local daily slot, strictly in
+ * the future within roughly (0, ~30h]. `rand` is injectable for tests.
+ * @param {number} [nowMs]
+ * @param {() => number} [rand] 0..1 uniform
+ * @returns {number}
+ */
+export function msUntilNextSlot(nowMs = Date.now(), rand = Math.random) {
+  const now = new Date(nowMs);
+  const hour = SLOT_HOUR_MIN + Math.floor(rand() * (SLOT_HOUR_MAX - SLOT_HOUR_MIN));
+  const minute = Math.floor(rand() * 60);
+  const target = new Date(now);
+  target.setHours(hour, minute, 0, 0);
+  let diff = target.getTime() - now.getTime();
+  if (diff <= 0) {
+    // Past today → next day (also keeps the timer far enough from the loop edge).
+    target.setDate(target.getDate() + 1);
+    diff = target.getTime() - now.getTime();
+  }
+  // Sanity guard: never schedule a pathological 0ms/loop. In tests callers pass
+  // a deterministic rand so this is only a belt-and-braces floor.
+  return Math.max(diff, 1000);
+}
+
+function isNonServerRuntime() {
+  if (typeof window !== "undefined") return true;
+  const phase = process.env.NEXT_PHASE || "";
+  if (phase === "phase-production-build" || phase === "phase-export" || phase === "phase-static") {
+    return true;
+  }
+  if (process.env.NEXT_RUNTIME === "edge") return true;
+  return false;
+}
+
+// ─── Dynamic I/O (lazy imports to avoid circular/coupling at eval time) ────
+
+async function loadActiveConnections() {
+  const { getProviderConnections } = await import("../../lib/db/repos/connectionsRepo.js");
+  return getProviderConnections({ provider: "codebuddy-cn" });
+}
+
+async function isEnabledSetting() {
+  const { getSettings } = await import("../../lib/localDb.js");
+  const settings = await getSettings();
+  return settings.codeBuddyCheckin === true;
+}
+
+// Reuse the existing proactive refresh pipeline (refreshes + persists the new
+// access token) exactly like backgroundTokenRefresh on a 401.
+async function refreshOne(connection) {
+  const { checkAndRefreshToken } = await import("./tokenRefresh.js");
+  const creds = await checkAndRefreshToken("codebuddy-cn", connection, { force: true });
+  return creds?.accessToken ? creds : null;
+}
+
+function proxyOptionsOf(conn) {
+  return conn?.proxyOptions || {
+    enabled: conn?.connectionProxyEnabled,
+    url: conn?.connectionProxyUrl,
+    noProxy: conn?.connectionNoProxy,
+  };
+}
+
+function cnHeaders(accessToken, uid) {
+  return {
+    Authorization: `Bearer ${accessToken}`,
+    "X-User-Id": String(uid),
+    "Content-Type": "application/json",
+    Accept: "application/json",
+  };
+}
+
+// One account check-in POST (no 401 retry here — caller decides) → raw result.
+async function postDailyCheckin(accessToken, uid, proxyOptions) {
+  const { proxyAwareFetch } = await import("open-sse/utils/proxyFetch.js");
+  const res = await proxyAwareFetch(
+    DAILY_CHECKIN_URL,
+    { method: "POST", headers: cnHeaders(accessToken, uid), body: "{}" },
+    proxyOptions
+  );
+  const text = await res.text();
+  let body = null;
+  try {
+    body = text ? JSON.parse(text) : null;
+  } catch {
+    body = null;
+  }
+  return {
+    httpStatus: res.status,
+    code: body?.code ?? body?.error_code,
+    msg: body?.msg ?? body?.message,
+    rawBody: body,
+  };
+}
+
+async function postStatus(accessToken, uid, proxyOptions) {
+  const { proxyAwareFetch } = await import("open-sse/utils/proxyFetch.js");
+  const res = await proxyAwareFetch(
+    STATUS_URL,
+    { method: "POST", headers: cnHeaders(accessToken, uid), body: "{}" },
+    proxyOptions
+  );
+  const text = await res.text();
+  let body = null;
+  try {
+    body = text ? JSON.parse(text) : null;
+  } catch {
+    body = null;
+  }
+  return { httpStatus: res.status, body };
+}
+
+// Is the account already signed in today? Used by the boot safety pass so we
+// don't re-check-in accounts that already renewed.
+function isCheckedInToday(status) {
+  const data = status?.body?.data || {};
+  return status.httpStatus === 200 && (data.today_checked_in === true || data.checked_in === true);
+}
+
+/**
+ * Check in one connection (with a single 401 → refresh → retry). Fail-open.
+ * @param {object} conn
+ * @param {{ refreshConnection?: Function }} deps
+ * @returns {Promise<{status: string, error?: string}>}
+ */
+async function checkinOne(conn, deps) {
+  const refresh = deps?.refreshConnection || refreshOne;
+  let accessToken = conn.accessToken;
+  const claims = decodeJwt(accessToken) || {};
+  const uid = claims.sub || conn.id;
+  const proxyOptions = proxyOptionsOf(conn);
+
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const result = await postDailyCheckin(accessToken, uid, proxyOptions);
+      const status = mapDailyCheckinStatus(result);
+      if (status !== "failed") return { status };
+      // 401 (invalid/expired token) → refresh once and retry.
+      if (result.httpStatus === 401 && attempt === 0) {
+        log.info("CB_CN_CHECKIN", "401 on daily-check-in, refreshing token once", {
+          id: conn.id,
+        });
+        const refreshed = await refresh(conn);
+        if (refreshed?.accessToken) accessToken = refreshed.accessToken;
+        else return { status: "failed", error: "refresh_failed" };
+        continue;
+      }
+      return { status, error: result.msg || `http_${result.httpStatus}` };
+    } catch (err) {
+      return { status: "failed", error: err?.message || String(err) };
+    }
+  }
+  return { status: "failed", error: "unexpected" };
+}
+
+// Prefer status-check to skip already-checked-in accounts (boot safety pass).
+async function checkinIfNotDone(conn, deps) {
+  const proxyOptions = proxyOptionsOf(conn);
+  const claims = decodeJwt(conn.accessToken) || {};
+  const uid = claims.sub || conn.id;
+  try {
+    const status = await postStatus(conn.accessToken, uid, proxyOptions);
+    if (isCheckedInToday(status)) return { status: "already" };
+  } catch {
+    // Status check is best-effort — fall through to a plain check-in.
+  }
+  return checkinOne(conn, deps);
+}
+
+/**
+ * One tick: list active codebuddy-cn connections and check each in. Fail-open
+ * (never rejects on a single account error). `skipIfCheckedToday` uses the
+ * status endpoint first (boot safety) to avoid duplicate renewals.
+ *
+ * @param {{ loadConnections?: Function, refreshConnection?: Function,
+ *           checkinConnection?: Function, skipIfCheckedToday?: boolean }} [deps]
+ * @returns {Promise<Array<{id: string, name: string, status: string, error?: string}>>}
+ */
+export async function runCodebuddyCheckinTick(deps = {}) {
+  const results = [];
+  const load = deps.loadConnections || loadActiveConnections;
+  let connections = [];
+  try {
+    connections = await load();
+  } catch (err) {
+    log.warn("CB_CN_CHECKIN", "Tick: failed to load codebuddy-cn connections (swallowed)", {
+      error: err?.message ?? String(err),
+    });
+    return results;
+  }
+
+  const eligible = (Array.isArray(connections) ? connections : []).filter(isEligibleCbcnConnection);
+  if (eligible.length === 0) {
+    log.debug("CB_CN_CHECKIN", "Tick: no eligible codebuddy-cn connections", {
+      total: Array.isArray(connections) ? connections.length : 0,
+    });
+    return results;
+  }
+
+  log.info("CB_CN_CHECKIN", "Daily check-in pass started", {
+    eligible: eligible.length,
+    ids: eligible.map((c) => c.id).filter(Boolean),
+  });
+
+  for (const conn of eligible) {
+    try {
+      const checkin = deps.checkinConnection || (deps.skipIfCheckedToday ? checkinIfNotDone : checkinOne);
+      const outcome = await checkin(conn, deps);
+      results.push({
+        id: conn.id,
+        name: conn.name || conn.id,
+        status: outcome.status,
+        ...(outcome.error ? { error: outcome.error } : {}),
+      });
+      const statusLabel =
+        outcome.status === "checked-in"
+          ? "签到成功"
+          : outcome.status === "already"
+            ? "今日已签到"
+            : `失败${outcome.error ? `(${outcome.error})` : ""}`;
+      log.info("CB_CN_CHECKIN", `${conn.name || conn.id}: ${statusLabel}`, {
+        id: conn.id,
+      });
+    } catch (err) {
+      results.push({ id: conn.id, name: conn.name || conn.id, status: "failed" });
+      log.warn("CB_CN_CHECKIN", "Connection check-in failed (swallowed)", {
+        id: conn?.id,
+        error: err?.message ?? String(err),
+      });
+    }
+  }
+  return results;
+}
+
+// ─── Scheduler ─────────────────────────────────────────────────────────────
+
+// Run one guarded check-in pass, reading the enable flag each fire so turning
+// the toggle off stops further work without a restart (fail-open, never throws).
+async function safeTick(how) {
+  try {
+    const on = await isEnabledSetting();
+    if (!on) {
+      log.debug("CB_CN_CHECKIN", `Scheduled ${how}: setting off, skipping`);
+      return;
+    }
+    await runCodebuddyCheckinTick({ skipIfCheckedToday: how === "boot" });
+  } catch (err) {
+    log.warn("CB_CN_CHECKIN", `Scheduled ${how} rejected (swallowed)`, {
+      error: err?.message ?? String(err),
+    });
+  }
+}
+
+function scheduleNext() {
+  if (!started) return;
+  const delayMs = msUntilNextSlot();
+  clearTimer();
+  timerHandle = setTimeout(() => {
+    safeTick("daily").finally(() => scheduleNext());
+  }, delayMs);
+  if (timerHandle.unref) timerHandle.unref();
+  log.info("CB_CN_CHECKIN", "Next daily check-in slot scheduled", {
+    delayMs: Math.round(delayMs / 1000),
+  });
+}
+
+function clearTimer() {
+  if (timerHandle) {
+    clearTimeout(timerHandle);
+    timerHandle = null;
+  }
+}
+
+/**
+ * Start the daily check-in scheduler. Runs an immediate boot safety pass
+ * (status-check + check-in of not-yet-checked-in accounts) then schedules the
+ * next random 00:00-06:00 local slot. Safe to call repeatedly (idempotent).
+ * @param {{ nowMs?: number, rand?: Function, skipBoot?: boolean }} [opts]
+ * @returns {boolean} true if started this call
+ */
+export function startCodebuddyCheckin(opts = {}) {
+  if (started) return false;
+  if (isNonServerRuntime()) {
+    log.debug("CB_CN_CHECKIN", "Skip start outside long-running server runtime");
+    return false;
+  }
+  started = true;
+
+  // Boot safety pass (only acts when the setting is on & accounts not yet in).
+  if (opts.skipBoot !== true) {
+    safeTick("boot");
+  }
+  scheduleNext();
+
+  log.info("CB_CN_CHECKIN", "Scheduler started");
+  return true;
+}
+
+export function stopCodebuddyCheckin() {
+  clearTimer();
+  if (started) {
+    started = false;
+    log.info("CB_CN_CHECKIN", "Scheduler stopped");
+  }
+}
+
+export const __internals = {
+  decodeJwt,
+  isCodeBuddyCnRealm,
+  isIdempotentAlready,
+  DAILY_CHECKIN_URL,
+  STATUS_URL,
+};