creditdaddy 0.8.0

package/src/providers.js

@@ -0,0 +1,75 @@
+/**
+ * 产品线注册表 — 按账号 provider 分发签到 / 积分 / 校验。
+ *
+ * 每个产品实现（checkin 可缺省：该产品不参与每日签到，如 ZCode）：
+ *   checkin(account, ctx) → { status: checked-in|already|limited|no-activity|failed, … }
+ *   quota(account, ctx)   → { total, used, remaining, exceeded, parts: [{ name, total, used, remaining, expiresAt, recurring }] }
+ *   verify(account)       → { name?, uid?, email? }（添加账号时补全资料，失败抛错）
+ * ctx.onRefresh(creds)：产品在 token 刷新后回调，由调用方负责持久化。
+ */
+
+import { productOf } from './constants.js';
+import { checkinOne as checkinQoder, fetchQuotaUsage, fetchUserinfo } from './qoderClient.js';
+import { checkinWorkbuddy, fetchWorkbuddyQuota, inspectToken } from './workbuddyClient.js';
+import { fetchZcodeQuota } from './zcodeClient.js';
+
+/** 从 userinfo 响应中挑一个可读的显示名 */
+export function displayNameFrom(ui) {
+  const pick = [ui?.nickname, ui?.name, ui?.username, ui?.email]
+    .map((v) => (typeof v === 'string' ? v.trim() : ''))
+    .find(Boolean);
+  return pick || null;
+}
+
+/** Qoder /api/v2/quota/usage → 统一积分结构 */
+export function normalizeQoderQuota(q) {
+  const names = [['userQuota', '套餐额度', true], ['addOnQuota', '附加额度', false], ['orgResourcePackage', '组织资源包', false]];
+  const expiresAt = Number(q?.expiresAt) > 0 && Number(q.expiresAt) < 253400000000000 ? new Date(Number(q.expiresAt)).toISOString() : null;
+  const parts = names
+    .map(([k, name, recurring]) => ({ x: q?.[k], name, recurring }))
+    .filter(({ x }) => x && Number(x.total) > 0)
+    .map(({ x, name, recurring }) => ({
+      name, recurring,
+      total: Number(x.total) || 0,
+      used: Number(x.used) || 0,
+      remaining: Number(x.remaining) || 0,
+      expiresAt,
+    }));
+  const sum = (k) => Math.round(parts.reduce((s, p) => s + p[k], 0) * 100) / 100;
+  return { total: sum('total'), used: sum('used'), remaining: sum('remaining'), parts, exceeded: Boolean(q?.isQuotaExceeded) };
+}
+
+const PRODUCTS = {
+  qoder: {
+    label: 'Qoder',
+    checkin: (account) => checkinQoder(account),
+    quota: async (account) => normalizeQoderQuota(await fetchQuotaUsage(account)),
+    verify: async (account) => {
+      const ui = await fetchUserinfo(account);
+      return { name: displayNameFrom(ui), uid: typeof ui?.id === 'string' ? ui.id : null, email: ui?.email || null };
+    },
+  },
+  workbuddy: {
+    label: 'WorkBuddy',
+    checkin: (account, ctx) => checkinWorkbuddy(account, ctx),
+    quota: (account, ctx) => fetchWorkbuddyQuota(account, ctx),
+    verify: async (account) => {
+      const info = inspectToken(account.token);
+      if (!info.provider) throw new Error('不是 WorkBuddy / CodeBuddy 的登录 token');
+      if (info.provider !== account.provider) throw new Error(`token 属于${info.provider === 'workbuddy' ? '国内版' : '国际版'}，与所选版本不符`);
+      return { uid: info.uid, name: info.name };
+    },
+  },
+  zcode: {
+    label: 'ZCode',
+    // 无 checkin：ZCode 积分来自活动领取（需阿里云验证码），不做后台自动签到
+    quota: (account) => fetchZcodeQuota(account),
+    verify: async () => {
+      throw new Error('ZCode 账号请通过「本机导入」添加（需要客户端的完整登录快照才能查询额度与切换）');
+    },
+  },
+};
+
+export function productImpl(provider) {
+  return PRODUCTS[productOf(provider)];
+}

package/src/qoderApp.js

@@ -0,0 +1,330 @@
+/**
+ * 本机 Qoder 客户端（Qoder App，Electron）集成 — 全部在本机完成，不依赖第三方包。
+ *
+ *   1. 安装探测：国际版 Qoder / 国内版 Qoder CN 的程序目录、数据目录、版本号
+ *   2. 设备风控身份：调用客户端自带的 umid/runtime-info 生成
+ *      Cosy-MachineToken / Cosy-MachineCode / Cosy-MachineType。
+ *      国际版服务端只对带风控身份的请求下发「每天领 100 Credits」活动（实测）。
+ *   3. 登录凭据读取：解密客户端数据目录下的 auth.v1.dat（Electron safeStorage）
+ *        Windows: "v10" + nonce(12) + AES-256-GCM(密文+tag)，密钥 = DPAPI 解开 Local State 的 os_crypt.encrypted_key
+ *        macOS:   "v10" + AES-128-CBC，密钥 = PBKDF2(钥匙串 "<App> Safe Storage", 'saltysalt', 1003)
+ *        Linux:   "v10" + AES-128-CBC，密钥 = PBKDF2('peanuts', 'saltysalt', 1)（v11 需系统密钥环，不支持）
+ *
+ * 协议细节来自本机 Qoder App 0.2.x 的客户端代码（campaignMainService / nativeRiskIdentityMainService）。
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawn, execFile } from 'node:child_process';
+import { dataDir } from './store.js';
+import { installedUmid, CLI_RISK_ENV } from './qoderUmid.js';
+
+const RISK_TTL_MS = 50 * 60 * 1000;        // 客户端每 60±5 分钟刷新一次，这里保守取 50 分钟
+const RISK_TIMEOUT_MS = 25_000;             // 与客户端一致
+const DEFAULT_CLIENT_VERSION = '0.2.5';
+
+const VARIANTS = [
+  { provider: 'qoder', label: 'Qoder 国际版', installName: 'Qoder', appId: 'com.qoder.app', riskEnv: 3 },
+  { provider: 'qoder-cn', label: 'Qoder 国内版', installName: 'Qoder CN', appId: 'com.qodercn.app', riskEnv: 0 },
+];
+
+const exists = (p) => { try { return fs.existsSync(p); } catch { return false; } };
+
+function candidateResourceDirs(v) {
+  const home = os.homedir();
+  if (process.platform === 'win32') {
+    const local = process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
+    const pf = process.env.ProgramFiles || 'C:\\Program Files';
+    return [
+      path.join(local, 'Programs', v.installName, 'resources'),
+      path.join(pf, v.installName, 'resources'),
+    ];
+  }
+  if (process.platform === 'darwin') {
+    return [
+      `/Applications/${v.installName}.app/Contents/Resources`,
+      path.join(home, 'Applications', `${v.installName}.app`, 'Contents', 'Resources'),
+    ];
+  }
+  const slug = v.installName.toLowerCase().replace(/\s+/g, '-');
+  return [`/opt/${v.installName}/resources`, `/opt/${slug}/resources`, `/usr/lib/${slug}/resources`];
+}
+
+function userDataDir(v) {
+  const home = os.homedir();
+  const name = `${v.appId}.stable`;
+  if (process.platform === 'win32') {
+    return path.join(process.env.APPDATA || path.join(home, 'AppData', 'Roaming'), name);
+  }
+  if (process.platform === 'darwin') return path.join(home, 'Library', 'Application Support', name);
+  return path.join(process.env.XDG_CONFIG_HOME || path.join(home, '.config'), name);
+}
+
+function readVersion(resourcesDir) {
+  try {
+    const m = JSON.parse(fs.readFileSync(path.join(resourcesDir, 'build-manifest.json'), 'utf8'));
+    if (typeof m.productVersion === 'string') return m.productVersion;
+  } catch {}
+  return null;
+}
+
+/** 探测本机已安装的 Qoder 客户端（国际版 / 国内版） */
+export function detectQoderApps() {
+  return VARIANTS.map((v) => {
+    const resources = candidateResourceDirs(v).find((d) => exists(d)) || null;
+    const exe = process.platform === 'win32' ? 'runtime-info.exe' : 'runtime-info';
+    const runtimeInfo = resources && exists(path.join(resources, 'umid', exe)) ? path.join(resources, 'umid', exe) : null;
+    const data = userDataDir(v);
+    return {
+      provider: v.provider,
+      label: v.label,
+      installed: Boolean(resources),
+      resourcesDir: resources,
+      version: resources ? readVersion(resources) : null,
+      runtimeInfo,
+      dataDir: data,
+      dataExists: exists(data),
+      signedIn: exists(path.join(data, 'auth.v1.dat')),
+    };
+  });
+}
+
+// ─── 设备风控身份 ───
+
+/** 与客户端一致的 Cosy-MachineOS 格式：x86_64_win32 / aarch64_darwin … */
+export function machineOs() {
+  const a = process.arch === 'arm64' ? 'aarch64' : process.arch === 'x64' ? 'x86_64' : process.arch;
+  return `${a}_${process.platform}`;
+}
+
+/** 与客户端一致的主机名清洗：可打印 ASCII，超长截断并附短哈希 */
+export function machineHostname(raw = os.hostname()) {
+  const e = String(raw || '').trim();
+  if (!e) return undefined;
+  const clip = (t) => {
+    if (t.length <= 96) return t;
+    const h = crypto.createHash('sha256').update(t, 'utf8').digest('hex').slice(0, 8);
+    const head = t.slice(0, 96 - 8 - 1).replace(/[-\s]+$/u, '');
+    return head ? `${head}-${h}` : `unknown-${h}`;
+  };
+  if (/^[\x21-\x7e](?:[\x20-\x7e]*[\x21-\x7e])?$/u.test(e)) return clip(e);
+  const h = crypto.createHash('sha256').update(e, 'utf8').digest('hex').slice(0, 8);
+  const n = e.replace(/[^\x21-\x7e]+/gu, '-').replace(/-{2,}/gu, '-').replace(/^-+|-+$/gu, '');
+  return clip(n ? `${n}-${h}` : `unknown-${h}`);
+}
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+/** 机器 ID：优先复用客户端的 auth.machine-id，否则在 CreditDaddy 数据目录持久化一个 */
+export function machineId(provider) {
+  const v = VARIANTS.find((x) => x.provider === provider) || VARIANTS[0];
+  for (const file of [path.join(userDataDir(v), 'auth.machine-id'), path.join(dataDir(), 'machine-id')]) {
+    try {
+      const id = fs.readFileSync(file, 'utf8').trim();
+      if (UUID_RE.test(id)) return id;
+    } catch {}
+  }
+  const id = crypto.randomUUID();
+  try {
+    fs.mkdirSync(dataDir(), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(dataDir(), 'machine-id'), id, { mode: 0o600 });
+  } catch {}
+  return id;
+}
+
+/** 客户端版本号（用于 Cosy-Version） */
+export function clientVersion(provider) {
+  const app = detectQoderApps().find((a) => a.provider === provider && a.version)
+    || detectQoderApps().find((a) => a.version);
+  return app?.version || DEFAULT_CLIENT_VERSION;
+}
+
+function runRuntimeInfo(exe, env, account) {
+  return new Promise((resolve, reject) => {
+    const withStdin = process.platform === 'darwin' || process.platform === 'win32';
+    const child = spawn(exe, withStdin ? [String(env), '--account-stdin'] : [String(env)], {
+      stdio: [withStdin ? 'pipe' : 'ignore', 'pipe', 'pipe'],
+      windowsHide: true,
+    });
+    let out = '';
+    let settled = false;
+    const done = (err, val) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (child.exitCode === null) child.kill();
+      err ? reject(err) : resolve(val);
+    };
+    const timer = setTimeout(() => done(new Error('runtime-info 超时')), RISK_TIMEOUT_MS);
+    const tryParse = () => {
+      const nl = out.indexOf('\n');
+      if (nl < 0) return false;
+      try {
+        const j = JSON.parse(out.slice(0, nl));
+        const pick = (k) => {
+          const s = typeof j[k] === 'string' ? j[k].trim() : '';
+          if (!s || s.length > 4096) throw new Error(`runtime-info 输出缺少 ${k}`);
+          return s;
+        };
+        done(null, { machineToken: pick('machineToken'), machineCode: pick('machineCode'), machineType: pick('machineType') });
+      } catch (e) { done(e); }
+      return true;
+    };
+    child.stdout.on('data', (d) => {
+      out += d.toString('utf8');
+      if (out.length > 1024 * 1024) return done(new Error('runtime-info 输出过大'));
+      tryParse();
+    });
+    child.stderr.on('data', () => {});
+    child.once('error', (e) => done(new Error(`runtime-info 启动失败：${e.message}`)));
+    child.once('close', (code) => {
+      if (!tryParse()) done(new Error(`runtime-info 退出码 ${code}`));
+    });
+    if (withStdin) {
+      child.stdin.on('error', () => {});
+      child.stdin.end(JSON.stringify({ account }) + '\n');
+    }
+  });
+}
+
+const riskCache = new Map();   // `${provider}:${uid}` → { value, at } | { promise }
+
+/**
+ * 风控身份来源：优先本机 Qoder 客户端自带的 runtime-info（国际版 env=3 / 国内版 env=0，缺失时用另一版本的），
+ * 其次是从官方 qodercli 提取的设备身份组件（Linux / fnOS，见 qoderUmid.js，env 与 qodercli 一致）。
+ */
+function riskRunner(provider) {
+  const apps = detectQoderApps().filter((a) => a.runtimeInfo);
+  const app = apps.find((a) => a.provider === provider) || apps[0];
+  if (app) return { exe: app.runtimeInfo, env: (VARIANTS.find((v) => v.provider === provider) || VARIANTS[0]).riskEnv, source: 'app' };
+  const cli = installedUmid();
+  if (cli) return { exe: cli.path, env: CLI_RISK_ENV[provider] ?? CLI_RISK_ENV.qoder, source: 'cli' };
+  return null;
+}
+
+/** 获取某账号的设备风控身份；本机既没有 Qoder 客户端也没装设备身份组件时返回 null。 */
+export async function getRiskIdentity(provider, uid) {
+  if (!uid) return null;
+  const key = `${provider}:${uid}`;
+  const hit = riskCache.get(key);
+  if (hit?.value && Date.now() - hit.at < RISK_TTL_MS) return hit.value;
+  if (hit?.promise) return hit.promise;
+
+  const runner = riskRunner(provider);
+  if (!runner) return null;
+
+  const promise = runRuntimeInfo(runner.exe, runner.env, uid)
+    .then((value) => { riskCache.set(key, { value, at: Date.now() }); return value; })
+    .catch((e) => { riskCache.delete(key); throw e; });
+  riskCache.set(key, { promise });
+  return promise;
+}
+
+export function riskIdentityAvailable() {
+  return Boolean(riskRunner('qoder'));
+}
+
+/** 风控身份来源：'app'（Qoder 客户端）/ 'cli'（qodercli 设备身份组件）/ null */
+export function riskIdentitySource() {
+  return riskRunner('qoder')?.source || null;
+}
+
+// ─── Electron safeStorage 解密 ───
+
+function dpapiUnprotect(buf) {
+  const ps = 'Add-Type -AssemblyName System.Security;'
+    + '$b=[Convert]::FromBase64String([Console]::In.ReadToEnd());'
+    + "[Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'))";
+  return new Promise((resolve, reject) => {
+    const child = execFile('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', ps],
+      { windowsHide: true, timeout: 20_000 }, (err, stdout) => {
+        if (err) return reject(new Error('DPAPI 解密失败：' + err.message));
+        resolve(Buffer.from(String(stdout).trim(), 'base64'));
+      });
+    child.stdin.end(buf.toString('base64'));
+  });
+}
+
+function macKeychainPassword(service) {
+  return new Promise((resolve) => {
+    execFile('security', ['find-generic-password', '-w', '-s', service], { timeout: 20_000 },
+      (err, stdout) => resolve(err ? null : String(stdout).trim()));
+  });
+}
+
+const keyCache = new Map();
+
+/** 取得某个 Electron userData 目录对应的 safeStorage 解密器 */
+async function safeStorageDecryptor(userData, appNames) {
+  if (keyCache.has(userData)) return keyCache.get(userData);
+  let decrypt;
+  if (process.platform === 'win32') {
+    const ls = JSON.parse(fs.readFileSync(path.join(userData, 'Local State'), 'utf8'));
+    const enc = Buffer.from(ls?.os_crypt?.encrypted_key || '', 'base64');
+    if (enc.subarray(0, 5).toString() !== 'DPAPI') throw new Error('Local State 中没有 DPAPI 密钥');
+    const key = await dpapiUnprotect(enc.subarray(5));
+    decrypt = (data) => {
+      if (data.subarray(0, 3).toString() !== 'v10') throw new Error('未知的加密格式');
+      const nonce = data.subarray(3, 15);
+      const tag = data.subarray(data.length - 16);
+      const d = crypto.createDecipheriv('aes-256-gcm', key, nonce);
+      d.setAuthTag(tag);
+      return Buffer.concat([d.update(data.subarray(15, data.length - 16)), d.final()]).toString('utf8');
+    };
+  } else {
+    let password = 'peanuts', iterations = 1;
+    if (process.platform === 'darwin') {
+      for (const n of appNames) {
+        password = await macKeychainPassword(`${n} Safe Storage`);
+        if (password) break;
+      }
+      if (!password) throw new Error('无法从钥匙串读取 Qoder 的 Safe Storage 密钥');
+      iterations = 1003;
+    }
+    const key = crypto.pbkdf2Sync(password, 'saltysalt', iterations, 16, 'sha1');
+    decrypt = (data) => {
+      const ver = data.subarray(0, 3).toString();
+      if (ver !== 'v10') throw new Error(ver === 'v11' ? '需要系统密钥环（v11），暂不支持' : '未知的加密格式');
+      const d = crypto.createDecipheriv('aes-128-cbc', key, Buffer.alloc(16, ' '));
+      return Buffer.concat([d.update(data.subarray(3)), d.final()]).toString('utf8');
+    };
+  }
+  keyCache.set(userData, decrypt);
+  return decrypt;
+}
+
+/**
+ * 读取本机 Qoder 客户端当前登录的账号（解密 auth.v1.dat）。
+ * @returns {Promise<{accounts: Array, errors: Array}>} 每个账号含 provider/token/refreshToken/expiresAt/user
+ */
+export async function readQoderAppAccounts() {
+  const accounts = [];
+  const errors = [];
+  for (const app of detectQoderApps()) {
+    const file = path.join(app.dataDir, 'auth.v1.dat');
+    if (!exists(file)) continue;
+    try {
+      const decrypt = await safeStorageDecryptor(app.dataDir, ['Qoder App', app.label.includes('国内') ? 'Qoder CN' : 'Qoder']);
+      const obj = JSON.parse(decrypt(fs.readFileSync(file)));
+      if (typeof obj?.token !== 'string' || !obj.token) throw new Error('auth.v1.dat 中没有 token');
+      accounts.push({
+        provider: app.provider,
+        source: `${app.label} 客户端`,
+        file,
+        token: obj.token,
+        refreshToken: typeof obj.refreshToken === 'string' ? obj.refreshToken : null,
+        expiresAt: typeof obj.expiresAt === 'string' ? obj.expiresAt : null,
+        user: {
+          id: obj.user?.id || null,
+          name: obj.user?.name || null,
+          email: obj.user?.email || null,
+        },
+      });
+    } catch (e) {
+      errors.push({ provider: app.provider, file, error: e.message });
+    }
+  }
+  return { accounts, errors };
+}

package/src/qoderClient.js

@@ -0,0 +1,199 @@
+/**
+ * Qoder OpenAPI 客户端 — 覆盖：userinfo、配额查询、活动列表、领取、PAT→jobToken 兑换。
+ *
+ * 签到协议对齐 Qoder App 0.2.x 客户端：
+ *   GET  /sash/api/v1/me/campaigns                 → { uid, showCampaign, claimable, campaigns:[…] }
+ *   POST /sash/api/v1/me/campaigns/{id}/claim
+ * 国际版必须携带设备风控身份（Cosy-MachineToken/Code/Type）才会下发「每天领 100 Credits」，
+ * 风控身份由本机 Qoder 客户端的 runtime-info 生成（见 qoderApp.js）；国内版无需。
+ */
+
+import {
+  OPENAPI_BASE, CN_OPENAPI_BASE,
+  USERINFO_PATH, QUOTA_USAGE_PATH,
+  CAMPAIGNS_PATH, CAMPAIGN_CLAIM_PATH, JOB_TOKEN_EXCHANGE_PATH,
+  buildQoderHeaders, buildExchangeHeaders, FETCH_TIMEOUT_MS,
+} from './constants.js';
+import { getRiskIdentity, clientVersion, machineOs, machineHostname, machineId } from './qoderApp.js';
+import { logger } from './logger.js';
+
+export function apiBase(provider) {
+  return provider === 'qoder-cn' ? CN_OPENAPI_BASE : OPENAPI_BASE;
+}
+
+async function req(url, options = {}) {
+  return fetch(url, { ...options, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+}
+
+/** PAT (pt-...) 兑换短期 job token (jt-...)。普通 JSON POST，无需 COSY 签名。 */
+export async function exchangePatToJobToken(pat, isCn = false) {
+  const url = `${isCn ? CN_OPENAPI_BASE : OPENAPI_BASE}${JOB_TOKEN_EXCHANGE_PATH}`;
+  const res = await req(url, {
+    method: 'POST',
+    headers: buildExchangeHeaders(),
+    body: JSON.stringify({ personal_token: pat }),
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => '');
+    throw new Error(`PAT 兑换失败: HTTP ${res.status} ${text.slice(0, 120)}`);
+  }
+  const data = await res.json();
+  if (!data.token) throw new Error('PAT 兑换未返回 job token');
+  return { jobToken: data.token, expiresAt: data.expires_at || null };
+}
+
+/** 解析账号的有效请求 token：PAT 先兑换成 job token */
+export async function resolveToken(account) {
+  const token = String(account.token || '').trim();
+  if (!token) return null;
+  if (token.startsWith('pt-')) {
+    try {
+      const { jobToken } = await exchangePatToJobToken(token, account.provider === 'qoder-cn');
+      return jobToken;
+    } catch {
+      return null; // 兑换失败按无 token 处理，由上层报告
+    }
+  }
+  return token;
+}
+
+/** 拉取账号信息（昵称/邮箱/uid），用于给账号起显示名 */
+export async function fetchUserinfo(account) {
+  const token = await resolveToken(account);
+  if (!token) throw new Error('token 不可用');
+  const res = await req(`${apiBase(account.provider)}${USERINFO_PATH}`, {
+    headers: buildQoderHeaders(token),
+  });
+  if (!res.ok) throw new Error(`userinfo HTTP ${res.status}`);
+  return res.json();
+}
+
+/** 查询配额/积分用量 */
+export async function fetchQuotaUsage(account) {
+  const token = await resolveToken(account);
+  if (!token) throw new Error('token 不可用');
+  const res = await req(`${apiBase(account.provider)}${QUOTA_USAGE_PATH}`, {
+    headers: buildQoderHeaders(token),
+  });
+  if (res.status === 401 || res.status === 403) throw new Error(`鉴权失败 (HTTP ${res.status})，token 可能已过期`);
+  if (!res.ok) throw new Error(`quota HTTP ${res.status}`);
+  return res.json();
+}
+
+/**
+ * 在基础请求头上叠加客户端身份与设备风控身份（与 Qoder App 的 createAuthorizedHeaders 一致）。
+ * 风控身份不可用时只加客户端身份，并在 riskError 中说明原因。
+ */
+export async function buildCampaignHeaders(account, token, uid) {
+  const headers = {
+    ...buildQoderHeaders(token),
+    'Cosy-Version': clientVersion(account.provider),
+    'Cosy-MachineOS': machineOs(),
+    'Cosy-MachineId': machineId(account.provider),
+  };
+  const host = machineHostname();
+  if (host) headers['Cosy-MachineHostname'] = host;
+  let risk = null, riskError = null;
+  try {
+    risk = await getRiskIdentity(account.provider, uid);
+    if (!risk) riskError = process.platform === 'linux' ? '未安装 Qoder 设备身份组件（面板 Qoder 页可一键安装），无法生成设备风控身份' : '本机未安装 Qoder 客户端，无法生成设备风控身份';
+  } catch (e) {
+    riskError = e.message;
+  }
+  if (risk) {
+    headers['Cosy-MachineToken'] = risk.machineToken;
+    headers['Cosy-MachineCode'] = risk.machineCode;
+    headers['Cosy-MachineType'] = risk.machineType;
+  }
+  return { headers, risk: Boolean(risk), riskError };
+}
+
+async function getCampaigns(base, headers) {
+  const res = await req(`${base}${CAMPAIGNS_PATH}`, { headers });
+  if (res.status === 401 || res.status === 403) {
+    const err = new Error(`鉴权失败 (HTTP ${res.status})，token 可能已过期`);
+    err.auth = true;
+    throw err;
+  }
+  if (!res.ok) throw new Error(`活动列表 HTTP ${res.status}`);
+  const payload = await res.json();
+  return {
+    uid: typeof payload?.uid === 'string' ? payload.uid : null,
+    campaigns: Array.isArray(payload?.campaigns) ? payload.campaigns : [],
+  };
+}
+
+const creditCampaign = (c) => c.actionType === 'CLAIM_BENEFIT';
+
+/**
+ * 对单个账号执行一次签到（领取所有可领活动）。
+ * 返回结果对象，status 取值：
+ *   checked-in  领取成功（含金额）
+ *   already     有积分活动但今日已领
+ *   no-activity 当前无可领活动（不代表今天签过）
+ *   failed      失败（错误见 error 字段）
+ * 附带 uid（Qoder 用户 ID），供调用方回写账号。
+ */
+export async function checkinOne(account) {
+  const label = account.name || account.id;
+  const base = { accountId: account.id, account: label, provider: account.provider };
+  const token = await resolveToken(account);
+  if (!token) {
+    return { ...base, status: 'failed', error: 'token 不可用（PAT 兑换失败或 token 为空）' };
+  }
+
+  try {
+    // 1) 基础请求拿 uid（风控身份按 uid 生成）；uid 已知时可直接跳过
+    let uid = account.uid || null;
+    let first = null;
+    if (!uid) {
+      first = await getCampaigns(apiBase(account.provider), buildQoderHeaders(token));
+      uid = first.uid;
+    }
+
+    // 2) 带客户端身份 + 设备风控身份重新拉取（国际版只有这样才会出现每日积分活动）
+    const { headers, risk, riskError } = await buildCampaignHeaders(account, token, uid);
+    if (riskError) logger.debug('CHECKIN', `${label}：${riskError}`);
+    const { campaigns, uid: uid2 } = (risk || !first) ? await getCampaigns(apiBase(account.provider), headers) : first;
+    uid = uid2 || uid;
+
+    const claimable = campaigns.filter((c) => creditCampaign(c) && c.claimStatus === 'CLAIMABLE');
+    if (claimable.length === 0) {
+      if (!campaigns.some(creditCampaign)) {
+        const hint = account.provider !== 'qoder' ? '当前无可领取的活动'
+          : risk ? '当前无可领取的活动（国际版每台设备每天限领一次，可能已被本机其他账号领取）'
+            : `当前无可领取的活动（${riskError || '缺少设备风控身份'}；国际版需要本机安装 Qoder 客户端）`;
+        return { ...base, uid, status: 'no-activity', message: hint, claimedAmount: 0, risk };
+      }
+      return { ...base, uid, status: 'already', message: '今日已领', claimedAmount: 0, risk };
+    }
+
+    // 3) 逐个领取
+    let totalClaimed = 0;
+    const claimedList = [];
+    const errors = [];
+    for (const c of claimable) {
+      try {
+        const claimRes = await req(`${apiBase(account.provider)}${CAMPAIGN_CLAIM_PATH(c.campaignId)}`, {
+          method: 'POST', headers,
+        });
+        if (claimRes.ok) {
+          const rj = await claimRes.json().catch(() => ({}));
+          const amount = rj.benefit?.amount || c.benefit?.amount || 0;
+          totalClaimed += amount;
+          claimedList.push({ campaignId: c.campaignId, campaignKey: c.campaignKey, amount, status: 'claimed' });
+        } else {
+          const text = await claimRes.text().catch(() => '');
+          errors.push(`HTTP ${claimRes.status} ${text.slice(0, 120)}`);
+        }
+      } catch (e) { errors.push(e.message); }
+    }
+
+    if (claimedList.length > 0) {
+      return { ...base, uid, status: 'checked-in', claimedAmount: totalClaimed, campaigns: claimedList, risk };
+    }
+    return { ...base, uid, status: 'failed', error: `领取失败：${errors.join('；') || '未知原因'}`, risk };
+  } catch (err) {
+    return { ...base, status: 'failed', error: err?.message || '网络错误' };
+  }
+}