creditdaddy 0.8.0

package/src/transfer.js

@@ -0,0 +1,141 @@
+/**
+ * 账号导入 / 导出 — 与 10router 的 OAuth 迁移文件互通。
+ *
+ * 加密信封与 10router src/lib/auth/secureTransfer.js 逐字节一致（10router-oauth-secure-v1）：
+ *   scrypt(N=16384, r=8, p=1, 32B) 由口令派生密钥 → AES-256-GCM；salt/iv/tag/payload 均为标准 base64
+ *
+ * 解密后的载荷（两边通用）：
+ *   { provider, exportedAt, accounts: [{ provider, name, email, uid, accessToken, refreshToken, expiresAt, providerSpecificData }] }
+ * CreditDaddy 另写入 format/version，并保留旧字段 token 以兼容 v0.1.x 的导入。
+ *
+ * 能导入：CreditDaddy（含更名前的 QoderDaddy）明文/加密导出、10router 加密导出（取 qoder / qoder-cn / codebuddy-cn / codebuddy-intl 账号）、
+ * [{name,provider,token}] 数组。10router 的 codebuddy-* 映射为 WorkBuddy。
+ */
+
+import crypto from 'node:crypto';
+import { PROVIDERS, productOf } from './constants.js';
+
+export const TRANSFER_FORMAT = '10router-oauth-secure-v1';
+export const EXPORT_FORMAT = 'creditdaddy-accounts';
+const OWN_FORMATS = new Set([EXPORT_FORMAT, 'qoderdaddy-accounts']);   // 兼容更名前的 QoderDaddy 导出
+const KDF = { alg: 'scrypt', N: 16384, r: 8, p: 1, keyLen: 32 };
+
+// 10router 的提供商 ID → 本工具 provider
+const PROVIDER_ALIASES = { 'codebuddy-cn': 'workbuddy', 'codebuddy-intl': 'workbuddy-intl', codebuddy: 'workbuddy' };
+const toProvider = (p) => (PROVIDERS.includes(p) ? p : PROVIDER_ALIASES[p] || null);
+
+const b64 = (buf) => Buffer.from(buf).toString('base64');
+const unb64 = (s) => Buffer.from(String(s || ''), 'base64');
+
+export class TransferError extends Error {
+  constructor(code, message) { super(message); this.code = code; }
+}
+
+function deriveKey(password, salt, kdf = KDF) {
+  return crypto.scryptSync(String(password), salt, kdf.keyLen || 32, {
+    N: kdf.N || KDF.N, r: kdf.r || KDF.r, p: kdf.p || KDF.p, maxmem: 64 * 1024 * 1024,
+  });
+}
+
+export function sealTransfer(payload, password) {
+  if (typeof password !== 'string' || password.length < 4) {
+    throw new TransferError('PASSPHRASE_TOO_SHORT', '加密口令至少 4 个字符');
+  }
+  const salt = crypto.randomBytes(16);
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', deriveKey(password, salt), iv);
+  const ct = Buffer.concat([cipher.update(Buffer.from(JSON.stringify(payload), 'utf8')), cipher.final()]);
+  return {
+    format: TRANSFER_FORMAT,
+    kdf: { ...KDF, salt: b64(salt) },
+    cipher: 'aes-256-gcm',
+    iv: b64(iv),
+    tag: b64(cipher.getAuthTag()),
+    payload: b64(ct),
+  };
+}
+
+export function openTransfer(blob, password) {
+  if (blob?.format !== TRANSFER_FORMAT) throw new TransferError('UNSUPPORTED_FORMAT', '不是加密迁移文件');
+  if (!password) throw new TransferError('NEED_PASSWORD', '该文件已加密，请输入导出时设置的口令');
+  try {
+    const decipher = crypto.createDecipheriv('aes-256-gcm', deriveKey(password, unb64(blob.kdf?.salt), blob.kdf), unb64(blob.iv));
+    decipher.setAuthTag(unb64(blob.tag));
+    const plain = Buffer.concat([decipher.update(unb64(blob.payload)), decipher.final()]);
+    return JSON.parse(plain.toString('utf8'));
+  } catch {
+    throw new TransferError('WRONG_PASSWORD', '口令错误或文件已损坏');
+  }
+}
+
+/** 构造导出载荷（10router 兼容字段 + CreditDaddy 旧字段） */
+export function buildExportPayload(accounts, { provider, product } = {}) {
+  const list = accounts.filter((a) => (!provider || a.provider === provider) && (!product || productOf(a.provider) === product));
+  const providers = [...new Set(list.map((a) => a.provider))];
+  return {
+    format: EXPORT_FORMAT,
+    version: 2,
+    provider: providers.length === 1 ? providers[0] : (provider || null),
+    exportedAt: new Date().toISOString(),
+    accounts: list.map((a) => ({
+      provider: a.provider,
+      name: a.name || a.email || null,
+      email: a.email || null,
+      uid: a.uid || null,
+      accessToken: a.token,
+      token: a.token,
+      refreshToken: a.refreshToken || null,
+      expiresAt: a.expiresAt || null,
+      createdAt: a.createdAt,
+      providerSpecificData: { authMethod: a.token.startsWith('pt-') ? 'pat' : 'device', userId: a.uid || null },
+      ...(a.meta && Object.keys(a.meta).length ? { meta: a.meta } : {}),
+    })),
+  };
+}
+
+/** 导出：给口令则输出 10router 兼容的加密信封，否则输出明文载荷 */
+export function exportAccounts(accounts, { password, provider, product } = {}) {
+  const payload = buildExportPayload(accounts, { provider, product });
+  return password ? sealTransfer(payload, password) : payload;
+}
+
+/**
+ * 解析任意支持的导入文件，统一成 normalizeAccountInput 可接受的记录。
+ * @returns {{ accounts: Array, skipped: number, source: string }}
+ */
+export function parseImport(data, { password } = {}) {
+  let source = 'creditdaddy';
+  let payload = data;
+  if (data?.format === TRANSFER_FORMAT) {
+    payload = openTransfer(data, password);
+    source = OWN_FORMATS.has(payload?.format) ? 'creditdaddy' : '10router';
+  }
+  const list = Array.isArray(payload) ? payload : payload?.accounts;
+  if (!Array.isArray(list)) {
+    throw new TransferError('BAD_FORMAT', '无法识别的文件：应为 CreditDaddy 或 10router 导出的 JSON');
+  }
+  const fallbackProvider = toProvider(payload?.provider);
+
+  const accounts = [];
+  let skipped = 0;
+  for (const item of list) {
+    // 显式标注了其他提供商（如 10router 的 cursor 账号）→ 跳过；未标注才用文件级 provider
+    const provider = item?.provider ? toProvider(item.provider) : fallbackProvider;
+    const token = item?.accessToken || item?.access_token || item?.token || item?.apiKey;
+    if (!provider || typeof token !== 'string' || !token.trim()) { skipped++; continue; }
+    const psd = item.providerSpecificData || {};
+    const email = typeof item.email === 'string' && item.email.includes('@') && !/^qoder(-cn)?-user-/.test(item.email) ? item.email : null;
+    accounts.push({
+      provider,
+      token,
+      name: item.name || item.nickname || email || null,
+      email,
+      uid: item.uid || psd.userId || null,
+      refreshToken: item.refreshToken || item.refresh_token || null,
+      expiresAt: item.expiresAt ?? (item.expiresIn ? Date.now() + Number(item.expiresIn) * 1000 : null),
+      source: source === '10router' ? '10router' : 'import',
+      ...(item.meta && typeof item.meta === 'object' ? { meta: item.meta } : {}),
+    });
+  }
+  return { accounts, skipped, source };
+}

package/src/usageSync.js

@@ -0,0 +1,319 @@
+/**
+ * 本机 AI 工具用量 → 10Router 用量统计（与 10router-sync 插件 scripts/export-usage.mjs 同一口径）。
+ *
+ * 来源：
+ *   zcode     ~/.zcode/cli/db/db.sqlite 的 model_usage（只导出官方渠道 builtin: / account:，
+ *             自定义 / 网关渠道的流量已由 10Router 自身记账，导出会重复计数）
+ *   opencode  ~/.local/share/opencode/opencode.db 的 session
+ *   mirasim   ~/.mirasim/insights/usage-YYYY-MM.ndjson（跳过经 10Router 中转的调用）
+ *   mimo      ~/.local/share/mimocode/mimocode.db 的 message（assistant 轮次）
+ * 行结构与插件一致（provider 前缀 zcode- / opencode- / mirasim- / mimo-，cost 记 0 或源值），
+ * 10Router 按行签名去重，重复同步不会产生重复数据。
+ *
+ * 增量：每个来源记住已同步到的最大时间戳，下一轮只发这之后（回退 2 天重叠兜底迟到行）的行；
+ * 首次同步发送全部历史。SQLite 用 Node 内置 node:sqlite（Node 22.5+ / 桌面版 Electron 37 均可用），
+ * 读取前先把数据库连同 -wal/-shm 复制到临时目录，绝不触碰客户端正在写的原文件。
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+export const SOURCES = ['zcode', 'opencode', 'mirasim', 'mimo'];
+export const SOURCE_LABEL = { zcode: 'ZCode', opencode: 'OpenCode', mirasim: 'mirasim', mimo: '小米 MiMo' };
+const OVERLAP_MS = 2 * 86400e3;
+
+let sqliteMod;
+/** node:sqlite 是否可用（Node 22.5+）；不可用时 SQLite 来源跳过，mirasim（ndjson）仍可同步 */
+export async function sqliteAvailable() {
+  if (sqliteMod === undefined) {
+    try {
+      // 屏蔽 “SQLite is an experimental feature” 警告，避免刷进日志
+      const emit = process.emitWarning;
+      process.emitWarning = (w, ...rest) => (String(w).includes('SQLite') ? undefined : emit.call(process, w, ...rest));
+      try { sqliteMod = await import('node:sqlite'); } finally { process.emitWarning = emit; }
+    } catch { sqliteMod = null; }
+  }
+  return Boolean(sqliteMod);
+}
+
+// ── 路径 ──
+
+export function sourcePaths(home = os.homedir(), env = process.env, platform = process.platform) {
+  const local = env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
+  const zcode = [path.join(home, '.zcode', 'cli', 'db', 'db.sqlite')];
+  try {
+    const projects = path.join(home, '.zcode', 'projects');
+    for (const name of fs.readdirSync(projects)) zcode.push(path.join(projects, name, 'db.sqlite'));
+  } catch {}
+  const opencode = [path.join(home, '.local', 'share', 'opencode', 'opencode.db')];
+  if (platform === 'win32') opencode.push(path.join(local, 'opencode', 'opencode.db'));
+  const mimo = [path.join(home, '.local', 'share', 'mimocode', 'mimocode.db')];
+  if (platform === 'win32') {
+    mimo.push(path.join(home, 'AppData', 'Roaming', 'Xiaomi MiMo', 'mimocode.db'));
+    mimo.push(path.join(home, 'AppData', 'Roaming', 'Xiaomi MiMo', 'mimocode', 'mimocode.db'));
+    mimo.push(path.join(local, 'mimocode', 'mimocode.db'));
+  }
+  const exist = (list) => list.filter((p) => { try { return fs.statSync(p).isFile(); } catch { return false; } });
+  let mirasim = [];
+  const insights = path.join(home, '.mirasim', 'insights');
+  try {
+    mirasim = fs.readdirSync(insights).filter((f) => /^usage-\d{4}-\d{2}\.ndjson$/.test(f)).sort().map((f) => path.join(insights, f));
+  } catch {}
+  return { zcode: exist(zcode), opencode: exist(opencode), mirasim, mimo: exist(mimo) };
+}
+
+/** 本机检测到哪些来源 */
+export async function detectSources() {
+  const p = sourcePaths();
+  const sqlite = await sqliteAvailable();
+  return SOURCES.map((id) => ({
+    id, label: SOURCE_LABEL[id],
+    found: p[id].length > 0,
+    files: p[id].length,
+    supported: id === 'mirasim' || sqlite,
+  }));
+}
+
+// ── 行转换（与插件一致） ──
+
+const OFFICIAL_PREFIXES = ['builtin:', 'account:'];
+const isOfficialProvider = (id) => OFFICIAL_PREFIXES.some((p) => String(id || '').startsWith(p));
+const statusTo10r = (s) => (s === 'completed' ? 'ok' : 'error');   // cancelled 也消耗了 token，记 error
+
+export function convertZcodeRow(row) {
+  const tokens = {
+    prompt_tokens: row.input_tokens || 0,
+    completion_tokens: row.output_tokens || 0,
+    ...(row.reasoning_tokens ? { reasoning_tokens: row.reasoning_tokens } : {}),
+    ...(row.cache_creation_input_tokens ? { cache_creation_input_tokens: row.cache_creation_input_tokens } : {}),
+    ...(row.cache_read_input_tokens ? { cache_read_input_tokens: row.cache_read_input_tokens } : {}),
+  };
+  return {
+    timestamp: new Date(row.started_at || row.completed_at || Date.now()).toISOString(),
+    provider: 'zcode-' + String(row.provider_id || 'unknown').replace(/^(builtin:|account:)/, ''),
+    model: row.model_id || 'unknown',
+    connectionId: null, apiKey: null,
+    endpoint: 'zcode://' + (row.agent || 'session'),
+    cost: 0,   // 官方渠道是订阅套餐，不是按量计费
+    status: statusTo10r(row.status),
+    tokens,
+    meta: {
+      source: 'zcode', zcodeProviderId: row.provider_id || null, agent: row.agent || null,
+      sessionId: row.session_id || null, durationMs: row.duration_ms ?? null, planUsage: true,
+    },
+  };
+}
+
+export function convertOpencodeSession(s) {
+  let modelId = 'unknown', providerID = 'opencode';
+  if (s.model) {
+    try {
+      const m = typeof s.model === 'string' ? JSON.parse(s.model) : s.model;
+      modelId = m.id || 'unknown';
+      providerID = m.providerID || 'opencode';
+    } catch { modelId = String(s.model); }
+  }
+  const tokens = { prompt_tokens: s.tokens_input || 0, completion_tokens: s.tokens_output || 0 };
+  if (s.tokens_cache_read) tokens.cache_read_input_tokens = s.tokens_cache_read;
+  return {
+    timestamp: new Date(s.time_created).toISOString(),
+    provider: 'opencode-' + providerID,
+    model: modelId,
+    connectionId: null, apiKey: null,
+    endpoint: 'opencode://desktop',
+    cost: s.cost || 0,
+    status: 'ok',
+    tokens,
+    meta: {
+      source: 'opencode', opencodeSessionId: s.id || null, title: s.title || null, agent: s.agent || null,
+      reasoning_tokens: s.tokens_reasoning || 0, cache_write_tokens: s.tokens_cache_write || 0,
+    },
+  };
+}
+
+export function convertMimoMessage(row, d) {
+  const t = d.tokens || {};
+  const tokens = {
+    prompt_tokens: t.input || 0,
+    completion_tokens: t.output || 0,
+    ...(t.reasoning ? { reasoning_tokens: t.reasoning } : {}),
+    ...(t.cache?.read ? { cache_read_input_tokens: t.cache.read } : {}),
+    ...(t.cache?.write ? { cache_creation_input_tokens: t.cache.write } : {}),
+  };
+  return {
+    timestamp: new Date(d.time?.completed || d.time?.created || row.time_created || Date.now()).toISOString(),
+    provider: 'mimo-' + (d.providerID || 'mimo'),
+    model: d.modelID || 'unknown',
+    connectionId: null, apiKey: null,
+    endpoint: 'mimo://' + (d.agent || 'desktop'),
+    cost: d.cost || 0,
+    status: 'ok',
+    tokens,
+    meta: { source: 'mimo', mimoMessageId: row.id || null, sessionId: row.session_id || null, agent: d.agent || null, mode: d.mode || null, planUsage: true },
+  };
+}
+
+/** mirasim 调用若经本机 / 局域网的 10Router 中转，10Router 自己已记过账，再导入会重复 */
+export function isSelfHostedUpstream(upstreamHost, endpointUrl) {
+  if (!upstreamHost) return false;
+  let host = upstreamHost, port = null;
+  try {
+    const u = new URL(upstreamHost.includes('://') ? upstreamHost : `http://${upstreamHost}`);
+    host = u.hostname;
+    port = u.port ? Number(u.port) : 80;
+  } catch {}
+  const isPrivate = host === 'localhost' || /^(127\.|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(host);
+  if (!isPrivate) return false;
+  if (endpointUrl) {
+    try { if (new URL(endpointUrl).hostname === host) return true; } catch {}
+  }
+  return port === 20127 || port === 20128 || port === 80 || port === 443;
+}
+
+export function convertMirasimRow(e) {
+  // mirasim 的 input 只算净新增（缓存分列），真实输入 = input + cacheRead + cacheWrite
+  const tokens = { prompt_tokens: (e.input || 0) + (e.cacheRead || 0) + (e.cacheWrite || 0), completion_tokens: e.output || 0 };
+  if (e.cacheRead) tokens.cache_read_input_tokens = e.cacheRead;
+  if (e.cacheWrite) tokens.cache_creation_input_tokens = e.cacheWrite;
+  if (e.reasoning) tokens.reasoning_tokens = e.reasoning;
+  const ok = (e.status || 0) >= 200 && (e.status || 0) < 400;
+  return {
+    timestamp: e.ts,
+    provider: 'mirasim-' + String(e.provider || 'unknown'),
+    model: e.model || 'unknown',
+    connectionId: null, apiKey: null,
+    endpoint: 'mirasim://' + (e.agent || e.leg || 'relay'),
+    cost: 0,
+    status: ok ? 'ok' : 'error',
+    tokens,
+    meta: {
+      source: 'mirasim', mirasimCallId: e.id || null, relayCallId: e.relayCallId || null, agent: e.agent || null,
+      leg: e.leg || null, viaRelay: e.viaRelay ?? null, upstreamHost: e.upstreamHost || null, effort: e.effort || null,
+      httpStatus: e.status ?? null, durationMs: e.durationMs ?? null, repo: e.repo || null, workspace: e.workspace || null,
+      planUsage: true,
+    },
+  };
+}
+
+// ── 读取 ──
+
+function withSnapshot(dbPath, fn) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'creditdaddy-usage-'));
+  try {
+    const dst = path.join(tmp, 'db.sqlite');
+    fs.copyFileSync(dbPath, dst);
+    for (const sfx of ['-wal', '-shm']) if (fs.existsSync(dbPath + sfx)) fs.copyFileSync(dbPath + sfx, dst + sfx);
+    const db = new sqliteMod.DatabaseSync(dst, { readOnly: true });
+    try { return fn(db); } finally { db.close(); }
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+function collectZcode(files) {
+  const out = [];
+  const seen = new Set();
+  let skippedCustom = 0;
+  for (const f of files) {
+    withSnapshot(f, (db) => {
+      let rows;
+      try {
+        rows = db.prepare('SELECT logical_request_id, provider_id, model_id, agent, status, started_at, completed_at, duration_ms, input_tokens, output_tokens, reasoning_tokens, cache_creation_input_tokens, cache_read_input_tokens FROM model_usage ORDER BY started_at ASC').all();
+      } catch {
+        rows = db.prepare('SELECT logical_request_id, provider_id, model_id, agent, status, started_at, completed_at, duration_ms, input_tokens, output_tokens FROM model_usage ORDER BY started_at ASC').all();
+      }
+      for (const r of rows) {
+        if (!isOfficialProvider(r.provider_id)) { skippedCustom++; continue; }
+        if (r.provider_id && r.logical_request_id) {
+          const k = `${r.provider_id}|${r.logical_request_id}`;
+          if (seen.has(k)) continue;
+          seen.add(k);
+        }
+        out.push(convertZcodeRow(r));
+      }
+    });
+  }
+  return { entries: out, notes: skippedCustom ? [`跳过 ${skippedCustom} 行自定义 / 网关渠道（已在别处记账）`] : [] };
+}
+
+// OpenCode 一个会话一行（会话级累计），会话还在继续时 token 会变 → 签名变 → 10Router 去重拦不住，
+// 同一会话会被记成两行。所以最近 OPENCODE_SETTLE_MS 内仍在更新的会话先不同步，等它停下来再同步。
+const OPENCODE_SETTLE_MS = 60 * 60 * 1000;
+function collectOpencode(files, now = Date.now()) {
+  const out = [];
+  let active = 0;
+  for (const f of files) {
+    withSnapshot(f, (db) => {
+      for (const r of db.prepare('SELECT id, title, model, agent, cost, tokens_input, tokens_output, tokens_reasoning, tokens_cache_read, tokens_cache_write, time_created, time_updated FROM session ORDER BY time_created ASC').all()) {
+        if (Number.isFinite(r.time_updated) && now - r.time_updated < OPENCODE_SETTLE_MS) { active++; continue; }
+        out.push(convertOpencodeSession(r));
+      }
+    });
+  }
+  return { entries: out, notes: active ? [`暂不同步 ${active} 个进行中的会话（1 小时内仍有更新，结束后再同步，避免同一会话记两行）`] : [] };
+}
+
+function collectMimo(files) {
+  const out = [];
+  const seen = new Set();
+  for (const f of files) {
+    withSnapshot(f, (db) => {
+      for (const r of db.prepare('SELECT id, session_id, time_created, data FROM message ORDER BY time_created ASC').all()) {
+        let d;
+        try { d = JSON.parse(r.data); } catch { continue; }
+        if (d.role !== 'assistant') continue;
+        if (r.id) { if (seen.has(r.id)) continue; seen.add(r.id); }
+        const t = d.tokens || {};
+        if (!((t.input || 0) + (t.output || 0) + (t.reasoning || 0) + (t.cache?.read || 0) + (t.cache?.write || 0))) continue;
+        out.push(convertMimoMessage(r, d));
+      }
+    });
+  }
+  return { entries: out, notes: [] };
+}
+
+function collectMirasim(files, endpoint) {
+  const out = [];
+  const seen = new Set();
+  let selfHosted = 0;
+  for (const f of files) {
+    for (const line of fs.readFileSync(f, 'utf8').split('\n')) {
+      if (!line.trim()) continue;
+      let e;
+      try { e = JSON.parse(line); } catch { continue; }
+      if (!e || typeof e !== 'object') continue;
+      if (e.id) { if (seen.has(e.id)) continue; seen.add(e.id); }
+      if (isSelfHostedUpstream(e.upstreamHost, endpoint)) { selfHosted++; continue; }
+      if (!((e.input || 0) + (e.output || 0) + (e.cacheRead || 0) + (e.cacheWrite || 0))) continue;
+      out.push(convertMirasimRow(e));
+    }
+  }
+  return { entries: out, notes: selfHosted ? [`跳过 ${selfHosted} 行经 10Router 中转的调用（已在 10Router 记账）`] : [] };
+}
+
+/** 读取某来源的全部行：{ entries, notes, files }；来源不存在返回 entries=[] */
+export async function collectSource(id, { endpoint, paths = sourcePaths() } = {}) {
+  const files = paths[id] || [];
+  if (!files.length) return { entries: [], notes: [], files: 0 };
+  if (id !== 'mirasim' && !(await sqliteAvailable())) throw new Error('需要 Node 22.5+（node:sqlite）才能读取 ' + SOURCE_LABEL[id] + ' 的数据库');
+  const r = id === 'zcode' ? collectZcode(files)
+    : id === 'opencode' ? collectOpencode(files)
+      : id === 'mimo' ? collectMimo(files)
+        : collectMirasim(files, endpoint);
+  return { ...r, files: files.length };
+}
+
+/** 增量筛选：只保留 watermark - 重叠 之后的行；返回 { selected, maxTs } */
+export function selectSince(entries, watermarkIso) {
+  const since = watermarkIso ? new Date(watermarkIso).getTime() - OVERLAP_MS : -Infinity;
+  let maxTs = watermarkIso || null;
+  const selected = [];
+  for (const e of entries) {
+    const t = new Date(e.timestamp).getTime();
+    if (!Number.isFinite(t)) continue;
+    if (t >= since) selected.push(e);
+    if (!maxTs || t > new Date(maxTs).getTime()) maxTs = new Date(t).toISOString();
+  }
+  return { selected, maxTs };
+}

package/src/workbuddyAuth.js

@@ -0,0 +1,126 @@
+/**
+ * WorkBuddy / CodeBuddy 浏览器登录 — 与 WorkBuddy 桌面端（platform=WorkBuddy）同一流程：
+ *
+ *   1. POST {host}/v2/plugin/auth/state?platform=WorkBuddy        → {state, authUrl}
+ *   2. 用户在浏览器（桌面版为隐私窗口）打开 authUrl 登录
+ *   3. GET  {host}/v2/plugin/auth/token?state=…                   code 11217 = 等待；成功返回 accessToken 等
+ *   4. GET  {host}/v2/plugin/login/account?state=…（Bearer）       code 12151 = 等待；返回当前账号
+ *   5. GET  {host}/v2/plugin/accounts（Bearer）                    账号列表（best-effort）
+ *
+ * 3~5 组装成与 workbuddy-desktop.info 相同结构的会话，经 sessionToAccount 入库，
+ * 因此浏览器登录的账号与「本机导入」一样可签到、查积分、一键切换 WorkBuddy 客户端。
+ * 国内版走 www.codebuddy.cn（WorkBuddy 客户端默认域名），国际版走 www.codebuddy.ai。
+ */
+
+import { FETCH_TIMEOUT_MS } from './constants.js';
+import { sessionToAccount } from './workbuddyLocal.js';
+
+const HOSTS = { workbuddy: 'www.codebuddy.cn', 'workbuddy-intl': 'www.codebuddy.ai' };
+const PLATFORM = 'WorkBuddy';
+const USER_AGENT = 'CLI/2.108.1 CodeBuddy/2.108.1';
+const RETRY_FETCH_TOKEN = 11217;
+const RETRY_FETCH_ACCOUNT = 12151;
+const ACCOUNT_MAX_ATTEMPTS = 8;   // 拿到 token 后账号信息迟迟不就绪时，退化为仅 token 入库
+
+function headers(host, extra = {}) {
+  return {
+    Accept: 'application/json',
+    'Content-Type': 'application/json',
+    'User-Agent': USER_AGENT,
+    'X-Requested-With': 'XMLHttpRequest',
+    'X-Domain': host,
+    'X-Product': 'SaaS',
+    ...extra,
+  };
+}
+const ANON = { 'X-No-Authorization': 'true', 'X-No-User-Id': 'true', 'X-No-Enterprise-Id': 'true', 'X-No-Department-Info': 'true' };
+
+async function fetchJson(url, init = {}) {
+  const res = await fetch(url, { ...init, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+  const text = await res.text();
+  let body = null;
+  try { body = text ? JSON.parse(text) : null; } catch {}
+  return { res, body };
+}
+
+export async function startWorkbuddyLogin(provider) {
+  const host = HOSTS[provider] || HOSTS.workbuddy;
+  const { res, body } = await fetchJson(`https://${host}/v2/plugin/auth/state?platform=${PLATFORM}`, {
+    method: 'POST',
+    headers: headers(host, { 'X-No-Authorization': 'true', 'X-No-User-Id': 'true' }),
+    body: '{}',
+  });
+  const d = body?.data;
+  if (!res.ok || body?.code !== 0 || !d?.state || !d?.authUrl) {
+    throw new Error('WorkBuddy 登录初始化失败：' + (body?.msg || 'HTTP ' + res.status));
+  }
+  return {
+    url: d.authUrl,
+    expiresInMs: 10 * 60e3,
+    intervalMs: 3000,
+    data: { provider, host, state: d.state, token: null, accountAttempts: 0 },
+  };
+}
+
+/** 单次轮询（按阶段推进，状态存在 data 上）：{status:'pending'} | {status:'ok', input}；失败抛错 */
+export async function pollWorkbuddyLogin(data) {
+  const { host, state } = data;
+  if (!data.token) {
+    const { res, body } = await fetchJson(`https://${host}/v2/plugin/auth/token?state=${encodeURIComponent(state)}`, {
+      headers: headers(host, ANON),
+    });
+    if (body?.code === RETRY_FETCH_TOKEN) return { status: 'pending' };
+    if (res.status >= 500 || res.status === 429) return { status: 'pending' };
+    if (!res.ok || body?.code !== 0 || !body?.data?.accessToken) {
+      throw new Error('WorkBuddy 授权失败：' + (body?.msg || 'HTTP ' + res.status));
+    }
+    const now = Date.now();
+    const t = body.data;
+    data.token = {
+      ...t,
+      domain: t.domain || host,
+      lastRefreshTime: now,
+      ...(Number.isFinite(t.expiresIn) ? { expiresAt: now + t.expiresIn * 1000 } : {}),
+      ...(Number.isFinite(t.refreshExpiresIn) ? { refreshExpiresAt: now + t.refreshExpiresIn * 1000 } : {}),
+    };
+  }
+
+  const auth = { Authorization: `Bearer ${data.token.accessToken}` };
+  let account = null;
+  data.accountAttempts++;
+  try {
+    const { res, body } = await fetchJson(`https://${host}/v2/plugin/login/account?state=${encodeURIComponent(state)}`, {
+      headers: headers(host, { ...auth, 'X-No-User-Id': 'true', 'X-No-Enterprise-Id': 'true', 'X-No-Department-Info': 'true' }),
+    });
+    if (res.ok && body?.code === 0 && body.data && typeof body.data === 'object') account = body.data;
+    else if (data.accountAttempts < ACCOUNT_MAX_ATTEMPTS
+      && (body?.code === RETRY_FETCH_ACCOUNT || res.status === 401 || res.status === 403 || res.status >= 500)) {
+      return { status: 'pending' };
+    }
+  } catch {
+    if (data.accountAttempts < ACCOUNT_MAX_ATTEMPTS) return { status: 'pending' };
+  }
+
+  let list = [];
+  if (account) {
+    try {
+      const { res, body } = await fetchJson(`https://${host}/v2/plugin/accounts`, { headers: headers(host, auth) });
+      if (res.ok && Array.isArray(body?.data?.accounts)) list = body.data.accounts;
+    } catch {}
+  }
+
+  // 与 WorkBuddy 客户端的会话文件同构；拿不到账号信息时只保留 token（可签到 / 查积分，不能切换客户端）
+  const session = account
+    ? {
+      account: { ...(list.find((a) => a.uid === account.uid) || {}), ...account, lastLogin: true },
+      accounts: list.filter((a) => a.pluginEnabled),
+      allAccounts: list,
+      auth: data.token,
+    }
+    : { auth: data.token };
+  const input = sessionToAccount(session, '浏览器登录');
+  if (!input) throw new Error('WorkBuddy 返回的 token 无法识别（签发方不是 CodeBuddy / WorkBuddy）');
+  if (!account) delete input.meta.session;
+  input.source = 'browser';
+  return { status: 'ok', input };
+}