creditdaddy 0.8.0

package/src/authDevice.js

@@ -0,0 +1,205 @@
+/**
+ * 浏览器登录（统一入口）：面板发起 → 浏览器 / 隐私窗口里授权 → 面板轮询 → 自动入库。
+ *
+ *   qoder / qoder-cn            Qoder 设备码登录（PKCE + nonce，与官方 qodercli 同流程，移植自 10router）
+ *   workbuddy / workbuddy-intl  WorkBuddy / CodeBuddy 登录（state 轮询，见 workbuddyAuth.js）
+ *   zcode-bigmodel / zcode-zai  ZCode 登录（客户端 CLI 轮询流程，见 zcodeAuth.js）
+ *
+ * Qoder 流程：
+ *   1. 本地生成 PKCE 对 (verifier/challenge-S256) + nonce + machine_id
+ *   2. 打开 verificationUriComplete（qoder.com/device/selectAccounts?challenge=...）选择账号授权
+ *   3. 带 nonce+verifier 轮询 openapi.qoder.sh/api/v1/deviceToken/poll，202/404=等待，200=拿到 dt- token
+ *   token 约 30 天有效；上游 refresh 对该流程 403，过期后重新走一遍登录即可。
+ *
+ * 会话只存在内存里（授权是短时动作，重启重来即可）；面板每 2s 轮询一次，
+ * 各流程按自己的上游间隔节流，未到时间直接回 pending。
+ */
+
+import crypto from 'node:crypto';
+import {
+  OPENAPI_BASE, CN_OPENAPI_BASE,
+  LOGIN_URL, CN_LOGIN_URL,
+  USERINFO_PATH, PROVIDER_LABEL,
+} from './constants.js';
+import { publicAccount } from './store.js';
+import { addAccount } from './accounts.js';
+import { logger } from './logger.js';
+import { startWorkbuddyLogin, pollWorkbuddyLogin } from './workbuddyAuth.js';
+import { startZcodeLogin, pollZcodeLogin } from './zcodeAuth.js';
+
+const FETCH_TIMEOUT_MS = 15000;
+const QODER_TTL_MS = 5 * 60 * 1000;   // Qoder 授权链接 5 分钟有效
+const QODER_POLL_MS = 2000;
+
+const sessions = new Map();
+
+function base64Url(buf) {
+  return buf.toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+}
+
+async function fetchWithTimeout(url, init = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort('timeout'), FETCH_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// ── Qoder ──
+export function endpointsFor(provider) {
+  const cn = provider === 'qoder-cn';
+  return {
+    deviceTokenUrl: (cn ? CN_OPENAPI_BASE : OPENAPI_BASE) + '/api/v1/deviceToken/poll',
+    loginUrl: cn ? CN_LOGIN_URL : LOGIN_URL,
+    userInfoUrl: (cn ? CN_OPENAPI_BASE : OPENAPI_BASE) + USERINFO_PATH,
+  };
+}
+
+function startQoderLogin(provider) {
+  const ep = endpointsFor(provider);
+  const verifier = base64Url(crypto.randomBytes(32));
+  const challenge = base64Url(crypto.createHash('sha256').update(verifier).digest());
+  const nonce = crypto.randomUUID();
+  const params = new URLSearchParams({ challenge, challenge_method: 'S256', machine_id: crypto.randomUUID(), nonce });
+  return {
+    url: ep.loginUrl + '?' + params.toString(),
+    expiresInMs: QODER_TTL_MS,
+    intervalMs: QODER_POLL_MS,
+    data: { provider, nonce, verifier },
+  };
+}
+
+/** 用户资料（best-effort，失败不阻断登录） */
+async function fetchQoderProfile(provider, accessToken) {
+  try {
+    const res = await fetchWithTimeout(endpointsFor(provider).userInfoUrl, {
+      headers: { Authorization: 'Bearer ' + accessToken, Accept: 'application/json', 'User-Agent': 'Go-http-client/2.0' },
+    });
+    if (!res.ok) return { name: null, email: null };
+    const b = await res.json();
+    return { name: (b.name || b.username || '').trim() || null, email: (b.email || '').trim() || null };
+  } catch { return { name: null, email: null }; }
+}
+
+async function pollQoderLogin(data) {
+  const url = endpointsFor(data.provider).deviceTokenUrl
+    + '?nonce=' + encodeURIComponent(data.nonce)
+    + '&verifier=' + encodeURIComponent(data.verifier)
+    + '&challenge_method=S256';
+  const res = await fetchWithTimeout(url, { headers: { Accept: 'application/json', 'User-Agent': 'Go-http-client/2.0' } });
+  if (res.status === 202 || res.status === 404) return { status: 'pending' };
+
+  const text = await res.text();
+  if (!res.ok) {
+    let msg = '轮询失败 HTTP ' + res.status;
+    try { const b = JSON.parse(text); if (b.message) msg += '：' + b.message; } catch {}
+    throw new Error(msg);
+  }
+  let body;
+  try { body = JSON.parse(text); } catch (e) { throw new Error('轮询返回非 JSON：' + e.message); }
+  if (!body.token) throw new Error('轮询返回 200 但没有 token（上游结构可能变化）');
+
+  const profile = await fetchQoderProfile(data.provider, body.token);
+  return {
+    status: 'ok',
+    input: {
+      provider: data.provider,
+      token: body.token,
+      name: profile.name || profile.email || null,
+      email: profile.email,
+      uid: body.user_id || null,
+      refreshToken: body.refresh_token || body.refreshToken || null,
+      expiresAt: body.expires_at || (body.expires_in ? Date.now() + Number(body.expires_in) * 1000 : null),
+      source: 'device',
+    },
+  };
+}
+
+// ── 统一入口 ──
+const FLOWS = {
+  qoder: { start: startQoderLogin, poll: pollQoderLogin },
+  'qoder-cn': { start: startQoderLogin, poll: pollQoderLogin },
+  workbuddy: { start: startWorkbuddyLogin, poll: pollWorkbuddyLogin },
+  'workbuddy-intl': { start: startWorkbuddyLogin, poll: pollWorkbuddyLogin },
+  'zcode-bigmodel': { start: startZcodeLogin, poll: pollZcodeLogin },
+  'zcode-zai': { start: startZcodeLogin, poll: pollZcodeLogin },
+};
+export const LOGIN_KINDS = Object.keys(FLOWS);
+const KIND_LABEL = { 'zcode-bigmodel': 'ZCode（BigModel）', 'zcode-zai': 'ZCode（Z.ai）' };
+const labelOf = (kind) => KIND_LABEL[kind] || PROVIDER_LABEL[kind] || kind;
+
+function gcSessions() {
+  const now = Date.now();
+  for (const [k, s] of sessions) if (s.expiresAt < now || s.done) sessions.delete(k);
+}
+
+/** 创建一次登录会话，返回浏览器授权地址 */
+export async function startDeviceFlow(kind) {
+  const flow = FLOWS[kind];
+  if (!flow) throw new Error('不支持的登录类型：' + kind);
+  gcSessions();
+  const r = await flow.start(kind);
+  const sessionId = crypto.randomUUID();
+  sessions.set(sessionId, {
+    kind, data: r.data,
+    expiresAt: Date.now() + r.expiresInMs,
+    intervalMs: r.intervalMs, nextPollAt: 0,
+    done: false, busy: false,
+  });
+  logger.info('DEVICE', '发起浏览器登录（' + labelOf(kind) + '）');
+  return {
+    sessionId,
+    url: r.url,
+    expiresIn: Math.floor(r.expiresInMs / 1000),
+    interval: Math.max(1, Math.floor(r.intervalMs / 1000)),
+  };
+}
+
+/**
+ * 面板侧轮询入口。返回：
+ *   { status: 'pending' }                                  继续等
+ *   { status: 'ok', account, already }                     成功（already=账号已存在）
+ *   { status: 'expired' }                                  会话过期，重新发起
+ *   { status: 'failed', error }                            终态失败
+ */
+export async function pollDeviceFlow(sessionId) {
+  gcSessions();
+  const session = sessions.get(sessionId);
+  if (!session) return { status: 'expired' };
+  if (Date.now() > session.expiresAt) {
+    sessions.delete(sessionId);
+    return { status: 'expired' };
+  }
+  // 节流：未到上游轮询间隔、或上一轮还在进行，直接回 pending
+  if (session.busy || Date.now() < session.nextPollAt) return { status: 'pending' };
+  session.busy = true;
+  session.nextPollAt = Date.now() + session.intervalMs;
+
+  let result;
+  try {
+    result = await FLOWS[session.kind].poll(session.data);
+  } catch (err) {
+    sessions.delete(sessionId);
+    logger.warn('DEVICE', labelOf(session.kind) + ' 登录失败：' + err.message);
+    return { status: 'failed', error: err.message };
+  } finally {
+    session.busy = false;
+  }
+  if (result.status === 'pending') return { status: 'pending' };
+
+  let added;
+  try {
+    added = await addAccount(result.input, { trusted: true });
+  } catch (e) {
+    sessions.delete(sessionId);
+    return { status: 'failed', error: e.message };
+  }
+  session.done = true;
+  const { account, duplicate } = added;
+  logger.info('DEVICE', duplicate
+    ? labelOf(session.kind) + ' 登录成功：账号已存在，已更新凭据（' + (account.name || account.id) + '）'
+    : labelOf(session.kind) + ' 登录成功：' + (account.name || account.id));
+  return { status: 'ok', account: publicAccount(account), already: duplicate };
+}

package/src/checkin.js

@@ -0,0 +1,200 @@
+/**
+ * 签到调度 — 逻辑对齐 10router qoderCheckin.js：
+ *   - 一次 tick 扫描全部账号
+ *   - 已确认完成今日签到的账号当天跳过（state.json 记忆）
+ *   - "无可领活动" 不记忆（每日 10:00 (UTC+8) 刷新积分，之后还会出现可领活动）
+ *   - "签到日" 以积分刷新时刻 10:00 (UTC+8) 为界，与本机时区无关
+ *   - 国际版每台设备每天只能领一次（服务端按设备风控身份限领）：本机已有账号领取后，
+ *     其余国际版账号标记为 limited 并当日记忆，不再反复请求
+ *   - 定时器每 ~2h + 抖动执行一次；多轮签到（定时 / 手动）串行执行
+ */
+
+import { loadAccounts, loadState, saveState, withAccounts } from './store.js';
+import { productImpl } from './providers.js';
+import { productOf } from './constants.js';
+import { startUsageSyncScheduler } from './tenrouter.js';
+import { refreshContext } from './accounts.js';
+import { logger } from './logger.js';
+
+const TICK_MS = 2 * 60 * 60 * 1000;        // 2 小时
+const TICK_JITTER_MS = 10 * 60 * 1000;     // ±10 分钟抖动，避免整点请求特征
+
+// 每日积分刷新：10:00 (UTC+8) = 02:00 UTC。签到日 = (now - 2h) 的 UTC 日期
+const REFRESH_UTC_OFFSET_MS = 2 * 60 * 60 * 1000;
+
+let timerHandle = null;
+let tickQueue = Promise.resolve();
+let nextTickAt = null;
+let lastTick = null;   // { at, summary }
+let ticking = false;
+
+/** 调度器状态（面板展示用） */
+export function getSchedulerInfo() {
+  return { running: Boolean(timerHandle), nextTickAt, lastTick, ticking };
+}
+
+/**
+ * 当前所属的"签到日"（YYYY-MM-DD）。以 10:00 (UTC+8) 为日界：
+ * 刷新前领过的记录不会让刷新后的新一轮被跳过；也不受 NAS / 海外机器时区影响。
+ */
+export function dayKey(nowMs = Date.now()) {
+  return new Date(nowMs - REFRESH_UTC_OFFSET_MS).toISOString().slice(0, 10);
+}
+
+export function msUntilNextTick(nowMs = Date.now(), rand = Math.random) {
+  return Math.max(TICK_MS + Math.floor(rand() * TICK_JITTER_MS), 1000);
+}
+
+async function getDoneMap(state) {
+  const today = dayKey();
+  const raw = state?.qoderDailyDone;
+  const map = raw && typeof raw === 'object' && !Array.isArray(raw) ? { ...raw } : {};
+  // 只保留今天的记录，其余清掉
+  for (const k of Object.keys(map)) if (map[k] !== today) delete map[k];
+  return map;
+}
+
+/**
+ * 执行一轮签到。多次调用会排队串行执行，避免同一账号被并发领取、state.json 互相覆盖。
+ * @param {{provider?: string, product?: string, skipIfCheckedToday?: boolean, onlyAccountId?: string}} opts
+ */
+export function runCheckinTick(opts = {}) {
+  const run = tickQueue.then(() => runTickNow(opts));
+  tickQueue = run.catch(() => {});
+  return run;
+}
+
+async function runTickNow(opts) {
+  ticking = true;
+  try { return await runTickInner(opts); } finally { ticking = false; }
+}
+
+async function runTickInner(opts) {
+  // 没有每日签到能力的产品（如 ZCode：积分靠需验证码的活动领取）不参与签到轮
+  const accounts = (await loadAccounts()).filter(
+    (a) => (!opts.provider || a.provider === opts.provider)
+        && (!opts.product || productOf(a.provider) === opts.product)
+        && (!opts.onlyAccountId || a.id === opts.onlyAccountId)
+        && typeof productImpl(a.provider)?.checkin === 'function'
+  );
+
+  if (accounts.length === 0) {
+    return { results: [], summary: '没有匹配的账号' };
+  }
+
+  const state = await loadState();
+  const memo = await getDoneMap(state);
+  const today = dayKey();
+  const results = [];
+  // 本设备今日领取国际版每日积分的账号 { day, accountId, name }
+  let deviceClaim = state?.deviceClaim?.day === today ? state.deviceClaim : null;
+
+  for (const account of accounts) {
+    const label = account.name || account.id;
+    try {
+      if (opts.skipIfCheckedToday && memo[account.id] === today) {
+        results.push({ accountId: account.id, account: label, provider: account.provider, status: 'already', memoized: true });
+        continue;
+      }
+
+      const ctx = refreshContext(account, (m) => logger.info('CHECKIN', `${label}：${m}`));
+      let outcome = await productImpl(account.provider).checkin(account, ctx);
+      if (account.provider === 'qoder' && outcome.risk) {
+        if (outcome.status === 'checked-in') {
+          deviceClaim = { day: today, accountId: account.id, name: label };
+        } else if (outcome.status === 'no-activity' && deviceClaim && deviceClaim.accountId !== account.id) {
+          outcome = { ...outcome, status: 'limited', message: `本机今日国际版额度已由「${deviceClaim.name}」领取（Qoder 每台设备每天限领一次）` };
+        }
+      }
+      results.push(outcome);
+      if (outcome.uid && !account.uid) account.uid = outcome.uid;
+      account.lastResult = {
+        status: outcome.status,
+        message: outcome.error || outcome.message || null,
+        amount: outcome.claimedAmount || 0,
+        ...(outcome.streakDays !== undefined ? { streakDays: outcome.streakDays + (outcome.status === 'checked-in' ? 1 : 0) } : {}),
+        at: new Date().toISOString(),
+      };
+
+      if (outcome.status === 'checked-in') {
+        memo[account.id] = today;
+        account.lastCheckin = new Date().toISOString();
+        logger.info('CHECKIN', `${label} 领取成功 +${outcome.claimedAmount} Credits`);
+      } else if (outcome.status === 'already') {
+        memo[account.id] = today;
+        account.lastCheckin = account.lastCheckin || new Date().toISOString();
+        logger.info('CHECKIN', `${label}：${outcome.message || '今日已领'}`);
+      } else if (outcome.status === 'limited') {
+        memo[account.id] = today;
+        logger.info('CHECKIN', `${label}：${outcome.message}`);
+      } else if (outcome.status === 'no-activity') {
+        // 不记忆——积分窗口（10:00 UTC+8）打开后还会出现可领活动
+        logger.debug('CHECKIN', `${label}：${outcome.message || '当前无可领取的活动'}`);
+      } else {
+        logger.warn('CHECKIN', `${label} 领取失败：${outcome.error || outcome.status}`);
+      }
+    } catch (err) {
+      results.push({ accountId: account.id, account: label, provider: account.provider, status: 'failed', error: err?.message || String(err) });
+      account.lastResult = { status: 'failed', message: err?.message || String(err), amount: 0, at: new Date().toISOString() };
+      logger.error('CHECKIN', `${label} 异常：${err?.message || err}`);
+    }
+  }
+
+  // 保存签到日历与账号 lastCheckin / lastResult / uid（在账号锁内重新读取，不覆盖期间的增删）
+  await withAccounts((all) => {
+    for (const updated of accounts) {
+      const cur = all.find((a) => a.id === updated.id);
+      if (!cur) continue;
+      cur.lastCheckin = updated.lastCheckin;
+      if (updated.lastResult) cur.lastResult = updated.lastResult;
+      if (updated.uid && !cur.uid) cur.uid = updated.uid;
+    }
+  });
+  await saveState({ ...state, qoderDailyDone: memo, deviceClaim });
+
+  const claimed = results.filter((r) => r.status === 'checked-in');
+  const failed = results.filter((r) => r.status === 'failed');
+  const none = results.filter((r) => r.status === 'no-activity');
+  const limited = results.filter((r) => r.status === 'limited');
+  const already = results.length - claimed.length - failed.length - none.length - limited.length;
+  const totalCredits = claimed.reduce((s, r) => s + (r.claimedAmount || 0), 0);
+  const summary = `签到汇总：成功 ${claimed.length}（+${totalCredits} Credits）、已领 ${already}`
+    + (limited.length ? `、本机限领 ${limited.length}` : '')
+    + `、无活动 ${none.length}、失败 ${failed.length}`;
+  logger.info('CHECKIN', summary);
+  lastTick = { at: new Date().toISOString(), summary };
+
+  return { results, summary };
+}
+
+/** 启动定时签到（每 ~2h 一轮，当天已成功的账号自动跳过） */
+export function startScheduler() {
+  if (timerHandle) return;
+  startUsageSyncScheduler();   // 10Router 用量同步（未配置 / 未开启时不做任何事）
+  const scheduleNext = () => {
+    const delay = msUntilNextTick();
+    nextTickAt = new Date(Date.now() + delay).toISOString();
+    timerHandle = setTimeout(async () => {
+      try {
+        await runCheckinTick({ skipIfCheckedToday: true });
+      } catch (err) {
+        logger.error('CHECKIN', `定时轮失败：${err?.message || err}`);
+      } finally {
+        scheduleNext();
+      }
+    }, delay);
+    if (timerHandle.unref) timerHandle.unref();
+    logger.info('CHECKIN', `定时签到已启动，下次执行约 ${Math.round(delay / 60000)} 分钟后`);
+  };
+  scheduleNext();
+  // 启动后 15 秒先跑一轮引导签到
+  setTimeout(() => {
+    runCheckinTick({ skipIfCheckedToday: true }).catch((e) =>
+      logger.error('CHECKIN', `引导轮失败：${e?.message || e}`));
+  }, 15000).unref?.();
+}
+
+export function stopScheduler() {
+  if (timerHandle) { clearTimeout(timerHandle); timerHandle = null; }
+  nextTickAt = null;
+}

package/src/constants.js

@@ -0,0 +1,79 @@
+/**
+ * CreditDaddy 常量 — 支持的产品线与 Qoder 官方 OpenAPI 端点（WorkBuddy 端点见 workbuddyClient.js）。
+ *
+ * 端点与请求头结构来自社区逆向成果（10router 项目实测可用）：
+ *   openapi.qoder.sh      国际版：活动/签到、userinfo、配额、PAT 兑换
+ *   openapi.qoder.com.cn  国内版：同上
+ *
+ * ⚠️ 非官方接口，Qoder 调整服务端时可能失效。
+ */
+
+import { readFileSync } from 'node:fs';
+
+export const OPENAPI_BASE = 'https://openapi.qoder.sh';
+export const CN_OPENAPI_BASE = 'https://openapi.qoder.com.cn';
+
+export const LOGIN_URL = 'https://qoder.com/device/selectAccounts';
+export const CN_LOGIN_URL = 'https://qoder.cn/device/selectAccounts';
+
+// 活动（签到）列表与领取
+export const CAMPAIGNS_PATH = '/sash/api/v1/me/campaigns?clientType=10';
+export const CAMPAIGN_CLAIM_PATH = (id) => `/sash/api/v1/me/campaigns/${encodeURIComponent(id)}/claim`;
+
+// 账号信息与配额
+export const USERINFO_PATH = '/api/v1/userinfo';
+export const QUOTA_USAGE_PATH = '/api/v2/quota/usage';
+
+// PAT (pt-...) → 短期 job token (jt-...) 兑换（普通 JSON POST，无需 COSY 签名）
+export const JOB_TOKEN_EXCHANGE_PATH = '/api/v1/jobToken/exchange';
+
+// 账号的 provider = 产品 + 区域。新增产品时在此登记，并在 providers.js 挂上对应实现。
+export const PROVIDERS = ['qoder', 'qoder-cn', 'workbuddy', 'workbuddy-intl', 'zcode'];
+export const PROVIDER_LABEL = {
+  qoder: 'Qoder 国际版',
+  'qoder-cn': 'Qoder 国内版',
+  workbuddy: 'WorkBuddy 国内版',
+  'workbuddy-intl': 'WorkBuddy 国际版',
+  zcode: 'ZCode',
+};
+/** provider → 产品线（qoder / workbuddy / zcode） */
+export const productOf = (provider) => {
+  const p = String(provider);
+  if (p.startsWith('workbuddy')) return 'workbuddy';
+  if (p.startsWith('zcode')) return 'zcode';
+  return 'qoder';
+};
+/** provider 是否国内版 */
+export const isCnProvider = (provider) => provider === 'qoder-cn' || provider === 'workbuddy';
+
+/** 签到请求头（源自 10router qoderCheckin.js，clientType=10 与官方客户端一致） */
+export function buildQoderHeaders(token) {
+  return {
+    Authorization: `Bearer ${token}`,
+    'Cosy-ClientType': '10',
+    'Cosy-Version': '0.3.3',
+    'Cosy-MachineOS':
+      process.platform === 'win32' ? 'windows'
+        : process.platform === 'darwin' ? 'macos' : 'linux',
+    'User-Agent': 'Qoder',
+    Accept: 'application/json',
+  };
+}
+
+/** PAT 兑换请求头（源自 10router qoderModels.js，模拟官方 qodercli） */
+export function buildExchangeHeaders() {
+  return {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+    'User-Agent': 'qodercli/1.0.0',
+    'Cosy-Version': '1.0.0',
+    'Cosy-ClientType': '5',
+  };
+}
+
+export const FETCH_TIMEOUT_MS = 15000;
+
+// 版本号 / 项目主页以 package.json 为唯一来源（桌面版 / fpk 打包时都会一并拷入 package.json）
+const PKG = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+export const APP_VERSION = PKG.version;
+export const PROJECT_URL = PKG.homepage || 'https://github.com/techysy/CreditDaddy';