creditdaddy 0.8.0

package/src/workbuddyClient.js

@@ -0,0 +1,257 @@
+/**
+ * WorkBuddy（腾讯 CodeBuddy 系）API 客户端 — 签到、积分、token 刷新。
+ *
+ * 协议对齐 WorkBuddy 桌面端与 10router 的 codebuddyCheckin / usage / tokenRefresh：
+ *   POST {host}/v2/billing/meter/checkin-activity-status   今日是否已签、连签天数、每日额度
+ *   POST {host}/v2/billing/meter/daily-checkin             签到（400 + 10001/“已签到” = 今日已签）
+ *   POST {host}/v2/billing/meter/get-user-resource         积分包（data.Response.Data.Accounts[]）
+ *   POST {host}/v2/plugin/auth/token/refresh               刷新（X-Refresh-Token 头）
+ * 请求头：Authorization Bearer + X-User-Id（JWT sub）+ X-Domain（token 所属域名）。
+ *
+ * WorkBuddy 登录 token 是 Keycloak JWT，签发方决定归属与 API 域名：
+ *   www.codebuddy.cn / www.workbuddy.cn / copilot.tencent.com → 国内版
+ *   www.codebuddy.ai / www.workbuddy.ai                       → 国际版
+ *
+ * token 只在过期或 401 时刷新：刷新会轮换 refreshToken，若该账号正登录在 WorkBuddy
+ * 客户端里，主动刷新可能让客户端手里的旧 refreshToken 失效。
+ */
+
+import { FETCH_TIMEOUT_MS } from './constants.js';
+
+const USER_AGENT = 'CLI/2.108.1 CodeBuddy/2.108.1';
+const CN_DEFAULT_HOST = 'www.codebuddy.cn';
+const INTL_DEFAULT_HOST = 'www.codebuddy.ai';
+const EXPIRY_SKEW_MS = 5 * 60 * 1000;
+
+export function decodeJwt(jwt) {
+  try {
+    const seg = String(jwt).split('.')[1];
+    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/');
+    return JSON.parse(Buffer.from(b64 + '='.repeat((4 - (b64.length % 4)) % 4), 'base64').toString('utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * 从 token 推断归属：{ provider, host, uid, expiresAt }；不是 CodeBuddy 系 token 时 provider 为 null。
+ */
+export function inspectToken(token) {
+  const c = decodeJwt(token) || {};
+  let host = null;
+  try { host = new URL(c.iss).host; } catch {}
+  let provider = null;
+  if (host && /(codebuddy|workbuddy)\.ai$/.test(host)) provider = 'workbuddy-intl';
+  else if (host && /(codebuddy|workbuddy)\.cn$|copilot\.tencent\.com$/.test(host)) provider = 'workbuddy';
+  return {
+    provider,
+    host,
+    uid: typeof c.sub === 'string' ? c.sub : null,
+    expiresAt: Number.isFinite(c.exp) ? new Date(c.exp * 1000).toISOString() : null,
+    name: c.name || c.preferred_username || c.nickname || null,
+  };
+}
+
+/** API 域名：优先客户端记录的 auth.domain，其次 token 签发方，最后按区域默认 */
+export function apiHost(account) {
+  const meta = account.meta || {};
+  const fromToken = inspectToken(account.token).host;
+  const host = meta.domain || (fromToken && fromToken !== 'copilot.tencent.com' ? fromToken : null);
+  return host || (account.provider === 'workbuddy-intl' ? INTL_DEFAULT_HOST : CN_DEFAULT_HOST);
+}
+
+function headersFor(account, token) {
+  const meta = account.meta || {};
+  const h = {
+    Accept: 'application/json',
+    'Content-Type': 'application/json',
+    Authorization: `Bearer ${token}`,
+    'X-User-Id': account.uid || inspectToken(token).uid || '',
+    'X-Domain': apiHost(account),
+    'X-Product': 'SaaS',
+    'User-Agent': USER_AGENT,
+  };
+  if (meta.enterpriseId) {
+    h['X-Enterprise-Id'] = meta.enterpriseId;
+    h['X-Tenant-Id'] = meta.enterpriseId;
+  }
+  return h;
+}
+
+async function post(account, path, token) {
+  const res = await fetch(`https://${apiHost(account)}${path}`, {
+    method: 'POST',
+    headers: headersFor(account, token),
+    body: '{}',
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+  });
+  const text = await res.text();
+  let body = null;
+  try { body = text ? JSON.parse(text) : null; } catch {}
+  return { status: res.status, body, text };
+}
+
+export function isExpired(account, now = Date.now()) {
+  const exp = account.expiresAt || inspectToken(account.token).expiresAt;
+  return Boolean(exp) && new Date(exp).getTime() - EXPIRY_SKEW_MS <= now;
+}
+
+/**
+ * 用 refreshToken 换新 token。返回 { token, refreshToken, expiresAt, refreshExpiresAt, raw } 或抛错。
+ */
+export async function refreshWorkbuddyToken(account) {
+  if (!account.refreshToken) throw new Error('没有 refreshToken，无法刷新，请重新导入该账号');
+  const hosts = [apiHost(account)];
+  if (account.provider === 'workbuddy' && !hosts.includes('copilot.tencent.com')) hosts.push('copilot.tencent.com');
+  let lastError = null;
+  for (const host of hosts) {
+    try {
+      const res = await fetch(`https://${host}/v2/plugin/auth/token/refresh`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Accept: 'application/json',
+          'User-Agent': USER_AGENT,
+          'X-Requested-With': 'XMLHttpRequest',
+          'X-Domain': host === 'copilot.tencent.com' ? 'copilot.tencent.com' : apiHost(account),
+          'X-Refresh-Token': account.refreshToken,
+          'X-Auth-Refresh-Source': 'plugin',
+          'X-Product': 'SaaS',
+          ...(account.meta?.enterpriseId ? { 'X-Enterprise-Id': account.meta.enterpriseId } : {}),
+        },
+        body: '{}',
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      });
+      const j = await res.json().catch(() => ({}));
+      const d = j?.data;
+      if (res.ok && j?.code === 0 && d?.accessToken) {
+        const now = Date.now();
+        return {
+          token: d.accessToken,
+          refreshToken: d.refreshToken || account.refreshToken,
+          expiresAt: d.expiresIn ? new Date(now + d.expiresIn * 1000).toISOString() : inspectToken(d.accessToken).expiresAt,
+          refreshExpiresAt: d.refreshExpiresIn ? new Date(now + d.refreshExpiresIn * 1000).toISOString() : null,
+          raw: d,
+        };
+      }
+      // 12153 / 401：refreshToken 已失效（账号在别处登出或会话被轮换），只能重新登录
+      if (res.status === 401 || String(j?.code) === '12153' || /refresh token is invalid/i.test(j?.msg || '')) {
+        const e = new Error('登录已失效，请在 WorkBuddy 客户端重新登录该账号后，到「添加账号 → 本机导入」同步');
+        e.authInvalid = true;
+        throw e;
+      }
+      lastError = new Error(`刷新失败：HTTP ${res.status} ${j?.msg || ''}`.trim());
+    } catch (e) {
+      if (e.authInvalid) throw e;
+      lastError = e;
+    }
+  }
+  throw lastError || new Error('刷新失败');
+}
+
+/**
+ * 以有效 token 执行 fn(token)；token 过期或返回 401 时刷新一次再重试。
+ * 刷新成功会通过 onRefresh(newCreds) 回写账号（调用方负责持久化）。
+ */
+async function withToken(account, fn, onRefresh) {
+  let token = account.token;
+  let refreshed = false;
+  const doRefresh = async () => {
+    const creds = await refreshWorkbuddyToken(account);
+    Object.assign(account, { token: creds.token, refreshToken: creds.refreshToken, expiresAt: creds.expiresAt });
+    token = creds.token;
+    refreshed = true;
+    await onRefresh?.(creds);
+  };
+  if (isExpired(account) && account.refreshToken) await doRefresh();
+  let r = await fn(token);
+  if (r.status === 401 && !refreshed && account.refreshToken) {
+    await doRefresh();
+    r = await fn(token);
+  }
+  return r;
+}
+
+const ALREADY_RE = /已签到|签到过|重复签到|already|repeat/i;
+
+/**
+ * 签到。返回与 Qoder 一致的结果对象（status: checked-in / already / failed）。
+ * @param {object} account
+ * @param {{ onRefresh?: (creds) => Promise<void>|void }} [opts]
+ */
+export async function checkinWorkbuddy(account, { onRefresh } = {}) {
+  const label = account.name || account.id;
+  const base = { accountId: account.id, account: label, provider: account.provider };
+  try {
+    // 1) 先查状态：今日已签则不再 POST
+    const st = await withToken(account, (t) => post(account, '/v2/billing/meter/checkin-activity-status', t), onRefresh);
+    if (st.status === 401) return { ...base, status: 'failed', error: '鉴权失败（401），token 已失效，请在 WorkBuddy 重新登录后重新导入' };
+    const sd = st.status === 200 && st.body?.code === 0 ? st.body.data || {} : null;
+    const streak = sd ? { streakDays: sd.streak_days ?? 0, dailyCredit: sd.daily_credit ?? null } : {};
+    if (sd && (sd.today_checked_in === true || sd.checked_in === true)) {
+      return { ...base, uid: account.uid, status: 'already', message: `今日已签（连签 ${sd.streak_days ?? 0} 天）`, claimedAmount: 0, ...streak };
+    }
+
+    // 2) 签到
+    const r = await withToken(account, (t) => post(account, '/v2/billing/meter/daily-checkin', t), onRefresh);
+    const code = r.body?.code ?? r.body?.error_code;
+    const msg = r.body?.msg ?? r.body?.message ?? '';
+    if (r.status >= 200 && r.status < 300 && (code === 0 || code === undefined)) {
+      const d = r.body?.data || {};
+      const amount = Number(d.credit ?? d.today_credit ?? d.daily_credit ?? sd?.today_credit ?? sd?.daily_credit ?? 0) || 0;
+      return { ...base, uid: account.uid, status: 'checked-in', claimedAmount: amount, message: `签到成功（连签 ${(sd?.streak_days ?? 0) + 1} 天）`, ...streak };
+    }
+    if ((r.status === 400 || (r.status === 200 && code !== 0)) && (String(code) === '10001' || ALREADY_RE.test(msg))) {
+      return { ...base, uid: account.uid, status: 'already', message: '今日已签', claimedAmount: 0, ...streak };
+    }
+    if (r.status === 404) {
+      return { ...base, status: 'no-activity', message: `${apiHost(account)} 暂无签到活动（接口 404）`, claimedAmount: 0 };
+    }
+    return { ...base, status: 'failed', error: `签到失败：HTTP ${r.status} ${msg || r.text.slice(0, 120)}`.trim() };
+  } catch (e) {
+    return { ...base, status: 'failed', error: e?.message || '网络错误' };
+  }
+}
+
+const num = (precise, plain) => {
+  const n = Number(precise ?? plain);
+  return Number.isFinite(n) ? n : 0;
+};
+const REFILL_GAP_MS = 2 * 24 * 3600e3;
+const toIso = (v) => {
+  if (v === undefined || v === null || v === '') return null;
+  const n = Number(v);
+  const d = Number.isFinite(n) ? new Date(n < 1e12 ? n * 1000 : n) : new Date(String(v).replace(' ', 'T') + (String(v).includes('+') || String(v).endsWith('Z') ? '' : '+08:00'));
+  return Number.isNaN(d.getTime()) ? null : d.toISOString();
+};
+
+/**
+ * 积分包汇总，归一成 { total, used, remaining, parts: [{ name, total, used, remaining, expiresAt, recurring }] }。
+ * 循环额度包（体验版月度额度）取 Cycle* 字段，活动赠送包取 Capacity* 字段（同 10router usage/codebuddy-cn）。
+ */
+export async function fetchWorkbuddyQuota(account, { onRefresh } = {}) {
+  const r = await withToken(account, (t) => post(account, '/v2/billing/meter/get-user-resource', t), onRefresh);
+  if (r.status === 401 || r.status === 403) throw new Error(`鉴权失败 (HTTP ${r.status})，token 可能已过期`);
+  if (r.status !== 200 || r.body?.code !== 0) throw new Error(`积分查询失败：HTTP ${r.status} ${r.body?.msg || ''}`.trim());
+  const list = r.body?.data?.Response?.Data?.Accounts;
+  const packs = Array.isArray(list) ? list : [];
+  const now = Date.now();
+  const parts = packs.map((a) => {
+    const cycleEnd = toIso(a.CycleEndTime);
+    const deductEnd = toIso(a.DeductionEndTime);
+    const recurring = Boolean(cycleEnd && deductEnd && new Date(deductEnd) - new Date(cycleEnd) > REFILL_GAP_MS);
+    // 循环包（体验版月度额度）看本周期的 Cycle* 字段；一次性赠送包看 Capacity* 字段。直接用 *Remain，不自行相减
+    const total = recurring ? num(a.CycleCapacitySizePrecise, a.CycleCapacitySize) : num(a.CapacitySizePrecise, a.CapacitySize);
+    const used = recurring ? num(a.CycleCapacityUsedPrecise, a.CycleCapacityUsed) : num(a.CapacityUsedPrecise, a.CapacityUsed);
+    const remaining = recurring ? num(a.CycleCapacityRemainPrecise, a.CycleCapacityRemain) : num(a.CapacityRemainPrecise, a.CapacityRemain);
+    return {
+      name: a.PackageName || a.SubProductName || '积分包',
+      total, used, remaining,
+      expiresAt: recurring ? cycleEnd : (deductEnd || cycleEnd),
+      recurring,
+    };
+  }).filter((p) => p.total > 0 && (!p.expiresAt || new Date(p.expiresAt).getTime() > now));
+  parts.sort((a, b) => (b.remaining > 0) - (a.remaining > 0) || String(a.expiresAt).localeCompare(String(b.expiresAt)));
+  const sum = (k) => Math.round(parts.reduce((s, p) => s + p[k], 0) * 100) / 100;
+  return { total: sum('total'), used: sum('used'), remaining: sum('remaining'), parts, exceeded: false };
+}

package/src/workbuddyLocal.js

@@ -0,0 +1,133 @@
+/**
+ * 本机 WorkBuddy 客户端凭据 — 读取已登录账号、切换当前账号。
+ *
+ * WorkBuddy（与 CodeBuddy CLI / 插件共用）把会话存成明文 JSON：
+ *   Windows: %LOCALAPPDATA%\CodeBuddyExtension\Data\Public\auth\<认证ID>.info
+ *   macOS:   ~/Library/Application Support/CodeBuddyExtension/Data/Public/auth/
+ *   Linux:   ~/.local/share/CodeBuddyExtension/Data/Public/auth/
+ * 当前会话是 workbuddy-desktop.info（国际版客户端可能用其他认证 ID），带时间戳的同名文件是客户端留下的历史会话。
+ * 文件结构：{ account: { uid, nickname, phoneNumber, enterpriseId… }, auth: { accessToken, refreshToken, expiresAt, domain… }, accounts: [...] }
+ *
+ * 切换账号：原子写入会话文件 + 删除同目录的 "<文件>.logged-out" 登出标记；
+ * WorkBuddy 监听该文件，外部改动会被直接应用（客户端日志 "External change applied to session"）。
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { inspectToken } from './workbuddyClient.js';
+
+export function workbuddyAuthDir() {
+  const home = os.homedir();
+  const tail = ['CodeBuddyExtension', 'Data', 'Public', 'auth'];
+  if (process.platform === 'win32') {
+    return path.join(process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local'), ...tail);
+  }
+  if (process.platform === 'darwin') return path.join(home, 'Library', 'Application Support', ...tail);
+  return path.join(process.env.XDG_DATA_HOME || path.join(home, '.local', 'share'), ...tail);
+}
+
+const CURRENT_RE = /^[a-z0-9-]+\.info$/i;           // workbuddy-desktop.info
+const HISTORY_RE = /^[a-z0-9-]+\.\d{4}-.*\.info$/i;  // workbuddy-desktop.<时间戳>.<pid>.<uuid>.info
+
+/** 会话 JSON → 账号记录（供 addAccount），不含网络请求 */
+export function sessionToAccount(session, source) {
+  const token = session?.auth?.accessToken;
+  if (typeof token !== 'string' || !token) return null;
+  const info = inspectToken(token);
+  if (!info.provider) return null;
+  const acc = session.account || {};
+  const auth = session.auth || {};
+  const iso = (ms) => (Number.isFinite(ms) ? new Date(ms).toISOString() : null);
+  // 除 token 外的会话字段原样保留，切换账号时用来还原会话文件
+  const { accessToken: _a, refreshToken: _r, ...authRest } = auth;
+  return {
+    provider: info.provider,
+    token,
+    refreshToken: auth.refreshToken || null,
+    expiresAt: iso(auth.expiresAt) || info.expiresAt,
+    uid: acc.uid || info.uid,
+    name: acc.nickname || acc.name || null,
+    email: acc.email || null,
+    source,
+    meta: {
+      domain: auth.domain || info.host,
+      enterpriseId: acc.enterpriseId || null,
+      phone: acc.phoneNumber || null,
+      refreshExpiresAt: iso(auth.refreshExpiresAt),
+      session: {
+        account: acc, auth: authRest, accounts: Array.isArray(session.accounts) ? session.accounts : [],
+        ...(Array.isArray(session.allAccounts) ? { allAccounts: session.allAccounts } : {}),
+      },
+    },
+  };
+}
+
+/**
+ * 读取本机 WorkBuddy 会话：当前会话 + 历史会话（按 uid 去重，保留最新）。
+ * @returns {{ dir, accounts: Array<{...账号记录, current: boolean, file, fileTime}>, errors }}
+ */
+export function readWorkbuddySessions() {
+  const dir = workbuddyAuthDir();
+  const out = { dir, accounts: [], errors: [] };
+  let names = [];
+  try { names = fs.readdirSync(dir); } catch { return out; }
+  const byUid = new Map();
+  for (const name of names) {
+    if (!CURRENT_RE.test(name) && !HISTORY_RE.test(name)) continue;
+    const file = path.join(dir, name);
+    try {
+      const current = !HISTORY_RE.test(name);
+      if (current && fs.existsSync(`${file}.logged-out`)) continue;   // 已登出
+      const rec = sessionToAccount(JSON.parse(fs.readFileSync(file, 'utf8')), current ? 'WorkBuddy 当前登录' : 'WorkBuddy 历史会话');
+      if (!rec) continue;
+      const fileTime = fs.statSync(file).mtimeMs;
+      const item = { ...rec, current, file, fileTime };
+      const prev = byUid.get(rec.uid);
+      if (!prev || (current && !prev.current) || (current === prev.current && fileTime > prev.fileTime)) byUid.set(rec.uid, item);
+    } catch (e) {
+      out.errors.push({ file, error: e.message });
+    }
+  }
+  out.accounts = [...byUid.values()].sort((a, b) => b.current - a.current || b.fileTime - a.fileTime);
+  return out;
+}
+
+/** 当前 WorkBuddy 客户端登录的 uid（未登录返回 null） */
+export function currentWorkbuddyUid() {
+  return readWorkbuddySessions().accounts.find((a) => a.current)?.uid || null;
+}
+
+/**
+ * 把账号写成 WorkBuddy 当前会话（切换账号）。需要账号带有导入时保存的会话信息。
+ * @returns {{ file, previousUid }}
+ */
+export function writeWorkbuddySession(account) {
+  const s = account.meta?.session;
+  if (!s?.account) throw new Error('该账号缺少 WorkBuddy 会话信息，请从本机重新导入后再切换');
+  const dir = workbuddyAuthDir();
+  fs.mkdirSync(dir, { recursive: true });
+  const file = path.join(dir, 'workbuddy-desktop.info');
+  let previousUid = null;
+  try { previousUid = JSON.parse(fs.readFileSync(file, 'utf8'))?.account?.uid || null; } catch {}
+
+  const ms = (iso) => (iso ? new Date(iso).getTime() : undefined);
+  const session = {
+    account: s.account,
+    auth: {
+      ...s.auth,
+      accessToken: account.token,
+      refreshToken: account.refreshToken || s.auth?.refreshToken,
+      expiresAt: ms(account.expiresAt) ?? s.auth?.expiresAt,
+      lastRefreshTime: Date.now(),
+    },
+    accounts: s.accounts || [],
+    ...(Array.isArray(s.allAccounts) ? { allAccounts: s.allAccounts } : {}),
+  };
+  const tmp = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(session, null, 2), { mode: 0o600 });
+  fs.renameSync(tmp, file);
+  try { fs.unlinkSync(`${file}.logged-out`); } catch {}
+  return { file, previousUid };
+}

package/src/zcodeAuth.js

@@ -0,0 +1,131 @@
+/**
+ * ZCode 浏览器登录 — 与 ZCode 客户端的「CLI 轮询登录」同一协议（无需 zcode:// 回调，任何浏览器都能用）：
+ *
+ *   1. POST https://zcode.z.ai/api/v1/oauth/cli/init   Authorization: Bearer <本地随机 poll token>
+ *      {provider: 'bigmodel' | 'zai'} → {flow_id, authorize_url, expires_at, poll_interval_sec}
+ *      authorize_url 的回调指向 zcode.z.ai 自己的 /oauth/cli/callback，由服务端完成换 token
+ *   2. 用户在浏览器（桌面版为隐私窗口）打开 authorize_url 登录授权
+ *   3. GET /api/v1/oauth/cli/poll/{flow_id}（同一 poll token）→ status pending / ready / failed
+ *      ready 时带 token（zcode JWT）、user、bigmodel{access_token, refresh_token} 或 zai{access_token}
+ *   4. Z.ai 的 access_token 还要换一次业务 token：POST https://api.z.ai/api/auth/z/login {token}
+ *
+ * 拿到的凭据按客户端 credentials.json 的格式（enc:v1 加密）组装，存进账号 meta，
+ * 之后与「本机导入」的账号完全一样：可查额度、可一键切换到 ZCode 客户端。
+ */
+
+import crypto from 'node:crypto';
+import * as zc from './zcrypto.js';
+import { zcodePaths } from './zcodeLocal.js';
+import { FETCH_TIMEOUT_MS } from './constants.js';
+
+const API_BASE = 'https://zcode.z.ai';
+const ZAI_BUSINESS_LOGIN_URL = 'https://api.z.ai/api/auth/z/login';
+
+async function fetchJson(url, init = {}) {
+  const res = await fetch(url, { ...init, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+  const text = await res.text();
+  let body = null;
+  try { body = text ? JSON.parse(text) : null; } catch {}
+  return { res, body };
+}
+
+const str = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);
+
+/** kind: 'zcode-bigmodel'（智谱 BigModel）| 'zcode-zai'（Z.ai 国际） */
+export async function startZcodeLogin(kind) {
+  const provider = kind === 'zcode-zai' ? 'zai' : 'bigmodel';
+  const pollToken = crypto.randomBytes(32).toString('hex');
+  const { res, body } = await fetchJson(API_BASE + '/api/v1/oauth/cli/init', {
+    method: 'POST',
+    headers: { Authorization: 'Bearer ' + pollToken, 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({ provider }),
+  });
+  const d = body?.data;
+  if (!res.ok || body?.code !== 0 || !str(d?.flow_id) || !str(d?.authorize_url)) {
+    throw new Error('ZCode 登录初始化失败：' + (body?.msg || 'HTTP ' + res.status));
+  }
+  if (!d.authorize_url.startsWith('https://')) throw new Error('ZCode 登录初始化返回了非 https 授权地址');
+  const expiresInMs = Number.isFinite(d.expires_at) ? d.expires_at * 1000 - Date.now() : 5 * 60e3;
+  return {
+    url: d.authorize_url,
+    expiresInMs: Math.max(60e3, Math.min(expiresInMs, 15 * 60e3)),
+    intervalMs: Math.max(1000, (Number(d.poll_interval_sec) || 2) * 1000),
+    data: { provider, flowId: d.flow_id, pollToken },
+  };
+}
+
+/** 单次轮询：{status:'pending'} | {status:'ok', input}；失败抛错 */
+export async function pollZcodeLogin(data) {
+  const { res, body } = await fetchJson(API_BASE + '/api/v1/oauth/cli/poll/' + encodeURIComponent(data.flowId), {
+    headers: { Authorization: 'Bearer ' + data.pollToken, Accept: 'application/json' },
+  });
+  if (res.status >= 500 || res.status === 408 || res.status === 429) return { status: 'pending' };
+  if (!res.ok || body?.code !== 0) throw new Error('ZCode 授权失败：' + (body?.msg || 'HTTP ' + res.status));
+  const d = body.data || {};
+  if (d.status === 'pending') return { status: 'pending' };
+  if (d.status === 'failed') throw new Error('ZCode 授权失败（用户取消或授权被拒绝）');
+  if (d.status !== 'ready') throw new Error('ZCode 授权返回未知状态：' + d.status);
+
+  const jwt = str(d.token);
+  const user = d.user && typeof d.user === 'object' ? d.user : {};
+  const userId = user.user_id !== undefined && user.user_id !== null ? String(user.user_id) : null;
+  let accessToken = data.provider === 'zai' ? str(d.zai?.access_token) : str(d.bigmodel?.access_token) || str(d.bigmodel?.accessToken);
+  const refreshToken = data.provider === 'bigmodel' ? str(d.bigmodel?.refresh_token) || str(d.bigmodel?.refreshToken) : null;
+  if (!jwt || !accessToken || !userId) throw new Error('ZCode 授权返回缺少 token / 用户信息（上游结构可能变化）');
+  if (data.provider === 'zai') accessToken = await resolveZaiBusinessToken(accessToken);
+
+  return { status: 'ok', input: buildAccountInput({ provider: data.provider, jwt, accessToken, refreshToken, user, userId }) };
+}
+
+/** Z.ai OAuth token → 业务 access token（与客户端 ZaiBusinessTokenResolver 一致） */
+async function resolveZaiBusinessToken(oauthToken) {
+  const { res, body } = await fetchJson(ZAI_BUSINESS_LOGIN_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({ token: oauthToken }),
+  });
+  const ok = res.ok && (body?.code === undefined || body.code === 0 || body.code === 200) && body?.success !== false;
+  const t = str(body?.data?.access_token) || str(body?.data?.accessToken);
+  if (!ok || !t) throw new Error('Z.ai 业务 token 交换失败：' + (body?.msg || 'HTTP ' + res.status));
+  return t;
+}
+
+/** 按 ZCode credentials.json 的键名组装并用本机密钥加密（与客户端写出的格式一致） */
+export function buildCredentials({ provider, jwt, accessToken, refreshToken, user, userId }, secret) {
+  const label = str(user.name) || str(user.email) || userId;
+  const userInfo = {
+    id: userId, username: label, displayName: label,
+    ...(str(user.avatar) ? { avatarUrl: user.avatar } : {}),
+    rawProfile: user,
+  };
+  const enc = (v) => zc.encryptWithSecret(v, secret);
+  const creds = {
+    'oauth:active_provider': enc(provider),
+    [`oauth:${provider}:access_token`]: enc(accessToken),
+    [`oauth:${provider}:user_info`]: enc(JSON.stringify(userInfo)),
+    zcodejwttoken: enc(jwt),
+  };
+  if (refreshToken) creds[`oauth:${provider}:refresh_token`] = enc(refreshToken);
+  return creds;
+}
+
+function buildAccountInput(parts) {
+  const secret = zc.defaultSecret(zcodePaths().home);
+  const credentials = buildCredentials(parts, secret);
+  const id = zc.identityWithSecret(credentials, secret);
+  return {
+    provider: 'zcode',
+    token: `zcode-creds:${parts.userId}`,   // 与本机导入同一标记，同一用户自动去重 / 续期
+    uid: parts.userId,
+    name: zc.identityLabel(id),
+    email: str(parts.user.email),
+    source: 'browser',
+    // 不带 config / deviceMid：同一账号再次登录时保留已保存的客户端配置与虚拟设备 ID
+    meta: {
+      credentials,
+      canonicalHash: zc.canonicalHash(credentials),
+      capturedAt: new Date().toISOString(),
+      loginProvider: parts.provider,
+    },
+  };
+}