creditdaddy 0.9.3 → 0.9.5

package/src/checkin.js

@@ -15,7 +15,7 @@ import { productOf } from './constants.js';
 import { startUsageSyncScheduler } from './tenrouter.js';
 import { refreshContext } from './accounts.js';
 import { zcodeAutoClaim } from './zcodeAutoClaim.js';
-import { autoClaimEnabled } from './zcodeClient.js';
+import { autoClaimEnabled, warmZcodeAppVersion } from './zcodeClient.js';
 import { logger } from './logger.js';
 
 const TICK_MS = 2 * 60 * 60 * 1000;        // 2 小时
@@ -200,6 +200,7 @@ async function runTickInner(opts) {
 export function startScheduler() {
   if (timerHandle) return;
   startUsageSyncScheduler();   // 10Router 用量同步（未配置 / 未开启时不做任何事）
+  warmZcodeAppVersion();       // 后台预热 ZCode 客户端版本探测（Windows 注册表，避免首个请求同步阻塞）
   const scheduleNext = () => {
     const delay = msUntilNextTick();
     nextTickAt = new Date(Date.now() + delay).toISOString();

package/src/constants.js

@@ -28,19 +28,21 @@ export const QUOTA_USAGE_PATH = '/api/v2/quota/usage';
 export const JOB_TOKEN_EXCHANGE_PATH = '/api/v1/jobToken/exchange';
 
 // 账号的 provider = 产品 + 区域。新增产品时在此登记，并在 providers.js 挂上对应实现。
-export const PROVIDERS = ['qoder', 'qoder-cn', 'workbuddy', 'workbuddy-intl', 'zcode'];
+export const PROVIDERS = ['qoder', 'qoder-cn', 'workbuddy', 'workbuddy-intl', 'zcode', 'mirasim'];
 export const PROVIDER_LABEL = {
   qoder: 'Qoder 国际版',
   'qoder-cn': 'Qoder 国内版',
   workbuddy: 'WorkBuddy 国内版',
   'workbuddy-intl': 'WorkBuddy 国际版',
   zcode: 'ZCode',
+  mirasim: 'mirasim',
 };
-/** provider → 产品线（qoder / workbuddy / zcode） */
+/** provider → 产品线（qoder / workbuddy / zcode / mirasim） */
 export const productOf = (provider) => {
   const p = String(provider);
   if (p.startsWith('workbuddy')) return 'workbuddy';
   if (p.startsWith('zcode')) return 'zcode';
+  if (p === 'mirasim') return 'mirasim';
   return 'qoder';
 };
 /** provider 是否国内版 */

package/src/daemon.js

@@ -39,6 +39,7 @@
 
 import http from 'node:http';
 import crypto from 'node:crypto';
+import os from 'node:os';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -50,6 +51,7 @@ import { addAccount, importAccounts, refreshContext } from './accounts.js';
 import { productImpl } from './providers.js';
 import { readWorkbuddySessions, writeWorkbuddySession, workbuddyAuthDir, currentWorkbuddyUid } from './workbuddyLocal.js';
 import { liveToAccount as zcodeLiveAccount, switchTo as zcodeSwitchTo, currentZcodeUid, currentZcodeIdentity, detectZcode, ensureVirtualDeviceMid, terminateZcode, zcodeRunning } from './zcodeLocal.js';
+import { liveToAccount as mirasimLiveAccount, switchTo as mirasimSwitchTo, currentMirasimUid, detectMirasim, terminateMirasim, mirasimRunning } from './mirasimLocal.js';
 import { fetchClaimPlans, claimPlan, fetchCaptchaConfig, proxyFirst, setProxyFirst, proxyUrl, setProxyUrl, autoClaimEnabled, setAutoClaimEnabled } from './zcodeClient.js';
 import { exportAccounts, parseImport, TransferError } from './transfer.js';
 import { runCheckinTick, getSchedulerInfo, dayKey } from './checkin.js';
@@ -57,12 +59,12 @@ import { detectQoderApps, readQoderAppAccounts, riskIdentityAvailable, riskIdent
 import { umidInfo, installUmid } from './qoderUmid.js';
 import * as tenrouter from './tenrouter.js';
 import { startDeviceFlow, pollDeviceFlow, LOGIN_KINDS } from './authDevice.js';
-import { detectInstalls, scanLocalTokens, putCandidate, takeCandidate } from './localDetect.js';
+import { detectInstalls, scanLocalTokens, putCandidate, peekCandidate } from './localDetect.js';
 import { PROVIDER_LABEL, APP_VERSION, PROVIDERS, PROJECT_URL } from './constants.js';
 
-const PRODUCT_IDS = ['qoder', 'workbuddy', 'zcode'];
+const PRODUCT_IDS = ['qoder', 'workbuddy', 'zcode', 'mirasim'];
 
-/** 可选访问密钥：设置 CREDITDADDY_PASSWORD 后，所有 /api/* 需要 x-qd-key 头（或 ?key=）。
+/** 可选访问密钥：设置 CREDITDADDY_PASSWORD 后，所有 /api/* 需要 x-qd-key 头。
  *  fnOS/NAS 部署监听 0.0.0.0 时由 cmd/main 自动生成并注入。 */
 const PANEL_KEY = process.env.CREDITDADDY_PASSWORD || process.env.QODERDADDY_PASSWORD || '';
 
@@ -105,15 +107,45 @@ function hostnameOf(hostHeader) {
   try { return new URL(`http://${hostHeader}`).hostname; } catch { return ''; }
 }
 
+/** 本机自身的地址 / 主机名（60s 缓存）：非回环监听时用于放行合法 Host，挡 DNS 重绑定 */
+let localHostCache = { at: 0, set: null };
+function localHosts() {
+  const now = Date.now();
+  if (!localHostCache.set || now - localHostCache.at > 60_000) {
+    const s = new Set(LOOPBACK_HOSTS);
+    try { s.add(os.hostname().toLowerCase()); } catch {}
+    try {
+      for (const list of Object.values(os.networkInterfaces())) {
+        for (const it of list || []) {
+          if (!it?.address) continue;
+          const a = it.address.toLowerCase();
+          s.add(a);
+          if (a.includes(':')) s.add(`[${a}]`);
+        }
+      }
+    } catch {}
+    localHostCache = { at: now, set: s };
+  }
+  return localHostCache.set;
+}
+
 /**
  * 浏览器侧防护，返回拒绝原因（null = 放行）：
- *   - 监听回环地址时，Host 必须是 127.0.0.1 / localhost / ::1（挡住 DNS 重绑定读取 token）
+ *   - Host 头必须是本机地址（挡住 DNS 重绑定读取 token）：
+ *     · 回环监听：只允许 127.0.0.1 / localhost / ::1
+ *     · 非回环监听（0.0.0.0 / 局域网 IP）：未设访问密钥时，允许本机全部网卡地址与主机名；
+ *       设了密钥时密钥本身就是门槛（重绑定攻击者拿不到密钥），不再校验 Host
  *   - 带 Origin 的请求必须与 Host 同源（挡住任意网页跨站 POST 添加/导入账号、触发签到）
  * 非浏览器客户端（curl、CLI、托盘菜单）不带 Origin，不受影响。
  */
 export function rejectForeignRequest(headers, bindHost) {
   const host = headers.host || '';
-  if (LOOPBACK_HOSTS.has(bindHost) && !LOOPBACK_HOSTS.has(hostnameOf(host))) {
+  const hostName = hostnameOf(host).toLowerCase();
+  const loopbackBind = LOOPBACK_HOSTS.has(bindHost);
+  if (loopbackBind && !LOOPBACK_HOSTS.has(hostName)) {
+    return 'Host 不被允许';
+  }
+  if (!loopbackBind && !PANEL_KEY && !localHosts().has(hostName)) {
     return 'Host 不被允许';
   }
   const origin = headers.origin;
@@ -127,9 +159,10 @@ export function rejectForeignRequest(headers, bindHost) {
 
 async function handleApi(req, res, url) {
   if (PANEL_KEY) {
-    const key = req.headers['x-qd-key'] || url.searchParams.get('key') || '';
+    // 只认 x-qd-key 头：query 传密会落入 fnOS / 反代的访问日志
+    const key = req.headers['x-qd-key'] || '';
     if (!keyMatches(key)) {
-      return json(res, 401, { error: '需要访问密钥（x-qd-key 头或 ?key= 参数）', code: 'PANEL_KEY' });
+      return json(res, 401, { error: '需要访问密钥（x-qd-key 头）', code: 'PANEL_KEY' });
     }
   }
   const p = url.pathname;
@@ -315,7 +348,29 @@ async function handleApi(req, res, url) {
         return json(res, e.zcodeRunning ? 409 : 400, { error: e.message, code: e.zcodeRunning ? 'ZCODE_RUNNING' : undefined });
       }
     }
-    if (!target.provider.startsWith('workbuddy')) return json(res, 400, { error: '只有 WorkBuddy / ZCode 账号支持切换' });
+    if (target.provider === 'mirasim') {
+      // 防丢号：先把当前登录同步进账号库
+      try {
+        const live = await mirasimLiveAccount();
+        if (live && live.uid !== target.uid) {
+          await addAccount(live, { trusted: true }).catch((e) => logger.warn('DAEMON', '同步 mirasim 当前登录失败：' + e.message));
+        }
+      } catch (e) {}
+      try {
+        let closedClient = false;
+        if (body?.force === true) {
+          const t = terminateMirasim();
+          closedClient = t.closed === true;
+          if (closedClient) logger.info('DAEMON', '已关闭 Mirasim 客户端（强制切换）');
+        }
+        const r = await mirasimSwitchTo(target, { force: body?.force === true });
+        logger.info('DAEMON', r.alreadyActive ? `mirasim 当前已是 ${target.name || target.id}` : `mirasim 已切换到 ${target.name || target.id}`);
+        return json(res, 200, { ok: true, closedClient, ...r });
+      } catch (e) {
+        return json(res, e.mirasimRunning ? 409 : 400, { error: e.message, code: e.mirasimRunning ? 'MIRASIM_RUNNING' : undefined });
+      }
+    }
+    if (!target.provider.startsWith('workbuddy')) return json(res, 400, { error: '只有 WorkBuddy / ZCode / mirasim 账号支持切换' });
     // 先把客户端当前会话的最新 token 收回账号库，避免被覆盖后丢失
     const cur = readWorkbuddySessions().accounts.find((a) => a.current);
     if (cur && cur.uid !== target.uid) {
@@ -350,7 +405,7 @@ async function handleApi(req, res, url) {
 
   // ── 本机检测 / 凭据扫描 ──
   if (p === '/api/local/detect' && method === 'GET') {
-    return json(res, 200, { apps: detectQoderApps(), workbuddyDir: workbuddyAuthDir(), zcode: detectZcode(), legacy: detectInstalls() });
+    return json(res, 200, { apps: detectQoderApps(), workbuddyDir: workbuddyAuthDir(), zcode: detectZcode(), mirasim: detectMirasim(), legacy: detectInstalls() });
   }
   if (p === '/api/local/scan' && method === 'POST') {
     const existing = await loadAccounts();
@@ -390,19 +445,24 @@ async function handleApi(req, res, url) {
       const z = zcodeLiveAccount();
       if (z) addRecord(z, { source: 'ZCode 当前登录', current: true });
     } catch (e) { errors.push({ file: '~/.zcode/v2/credentials.json', error: e.message }); }
-    // 4) 旧版 VS Code 系 Qoder IDE / CLI：明文 token 扫描（归属需用户选择）
+    // 4) mirasim 客户端：解密 ~/.mirasim/setting.json 的当前登录
+    try {
+      const m = await mirasimLiveAccount();
+      if (m) addRecord(m, { source: 'mirasim 当前登录', current: true });
+    } catch (e) { errors.push({ file: '~/.mirasim/setting.json', error: e.message }); }
+    // 5) 旧版 VS Code 系 Qoder IDE / CLI：明文 token 扫描（归属需用户选择）
     const det = detectInstalls();
     const dirs = det.ideDataDirs.filter(d => d.exists).map(d => d.path);
     if (det.cliDir.exists) dirs.push(det.cliDir.path);
     const legacy = await scanLocalTokens(dirs);
     for (const c of legacy.candidates) {
-      candidates.push({ ...c, provider: null, source: '旧版 Qoder IDE / CLI 文件', imported: known(null, takeCandidate(c.id)?.token) });
+      candidates.push({ ...c, provider: null, source: '旧版 Qoder IDE / CLI 文件', imported: known(null, peekCandidate(c.id)?.token) });
     }
     return json(res, 200, { candidates, errors, scanned: legacy.scanned, scannedDirs: [...dirs, wb.dir] });
   }
   if (p === '/api/local/import' && method === 'POST') {
     const body = await readBody(req);
-    const cand = takeCandidate(String(body?.candidateId || ''));
+    const cand = peekCandidate(String(body?.candidateId || ''));
     if (!cand) return json(res, 404, { error: '候选不存在或已过期，请重新扫描' });
     const record = cand.record || {
       provider: body.provider === 'qoder-cn' ? 'qoder-cn' : 'qoder',
@@ -495,6 +555,8 @@ async function handleApi(req, res, url) {
       zcodeCurrentUid: currentZcodeUid(),
       zcodeCurrentIdentity: currentZcodeIdentity(),
       zcodeClient: (() => { const d = detectZcode(); return { installed: d.exists, signedIn: d.signedIn, running: zcodeRunning() }; })(),
+      mirasimCurrentUid: currentMirasimUid(),
+      mirasimClient: (() => { const d = detectMirasim(); return { installed: d.clientInstalled, signedIn: d.signedIn, running: d.running }; })(),
       keyRequired: Boolean(PANEL_KEY),
     });
   }

package/src/localDetect.js

@@ -138,8 +138,8 @@ export function putCandidate(c) {
   return id;
 }
 
-/** 按 candidateId 取回完整候选（导入用），过期返回 null */
-export function takeCandidate(id) {
+/** 按 candidateId 读取候选（不会消费掉，导入前可反复查询）；过期返回 null */
+export function peekCandidate(id) {
   const c = candidates.get(id);
   if (!c) return null;
   if (c.at < Date.now() - CAND_TTL_MS) { candidates.delete(id); return null; }

package/src/logger.js

@@ -4,7 +4,10 @@ const RING_SIZE = 300;
 const ring = [];
 
 function ts() {
-  return new Date().toISOString().replace('T', ' ').slice(0, 19);
+  const d = new Date();
+  const pad = (n) => String(n).padStart(2, '0');
+  return d.getFullYear() + '-' + pad(d.getMonth() + 1) + '-' + pad(d.getDate())
+    + ' ' + pad(d.getHours()) + ':' + pad(d.getMinutes()) + ':' + pad(d.getSeconds());
 }
 
 export function log(level, tag, msg) {

package/src/mirasimClient.js

@@ -0,0 +1,189 @@
+/**
+ * mirasim API 客户端 — 用户资料、套餐、5h/7d 滚动窗口配额查询。
+ *
+ *   GET https://auth.mirasim.ai/auth/me      用户资料（name, email, plan, plan_exp, id）
+ *   GET https://relay.mirasim.ai/v1/limits   滚动窗口（5h, 7d, 7d_claude 等）
+ *       注：relay.mirasim.ai 对大陆直连限制区域（429），需走统一出口 fetchJsonRace 代理
+ */
+
+import { fetchJsonRace } from './zcodeClient.js';
+import { FETCH_TIMEOUT_MS } from './constants.js';
+
+const AUTH_ME_URL = 'https://auth.mirasim.ai/auth/me';
+const RELAY_LIMITS_URL = 'https://relay.mirasim.ai/v1/limits';
+const AUTH_REFRESH_URL = 'https://auth.mirasim.ai/auth/refresh';
+
+export async function fetchMirasimProfile(token) {
+  const res = await fetchJsonRace(AUTH_ME_URL, {
+    headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+    timeoutMs: FETCH_TIMEOUT_MS,
+  });
+  if (!res.ok) {
+    if (res.status === 401) { const e = new Error('mirasim 登录凭据已过期'); e.auth = true; throw e; }
+    throw new Error(`获取 mirasim 用户信息失败: HTTP ${res.status}`);
+  }
+  return res.json();
+}
+
+/**
+ * 用 refreshToken 换新凭据（refreshToken 会轮换，两个都要保存）。
+ * 返回 { token, refreshToken, expiresAt }；没有 refreshToken 或刷新失败抛错。
+ */
+export async function refreshMirasimToken(account) {
+  if (!account.refreshToken) throw new Error('没有 refreshToken，无法刷新，请在 mirasim 客户端重新登录后重新导入');
+  const res = await fetchJsonRace(AUTH_REFRESH_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: { refresh_token: account.refreshToken },
+    timeoutMs: FETCH_TIMEOUT_MS,
+  });
+  if (!res.ok) {
+    if (res.status === 401 || res.status === 403) {
+      const e = new Error('refreshToken 已失效，请在 mirasim 客户端重新登录后到「添加账号 → 本机导入」同步');
+      e.authInvalid = true;
+      throw e;
+    }
+    throw new Error(`mirasim 凭据刷新失败: HTTP ${res.status}`);
+  }
+  const d = await res.json();
+  const token = d.access_token || d.accessToken;
+  if (!token) throw new Error('mirasim 刷新响应缺少 access_token（上游结构可能变化）');
+  let expiresAt = null;
+  try {
+    const p = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString('utf8'));
+    if (Number.isFinite(p.exp)) expiresAt = new Date(p.exp * 1000).toISOString();
+  } catch {}
+  return { token, refreshToken: d.refresh_token || d.refreshToken || account.refreshToken, expiresAt };
+}
+
+/**
+ * 以有效 token 执行 fn(token)；401 时刷新一次再重试。
+ * 刷新成功经 ctx.onRefresh(newCreds) 回写账号库与 setting.json（调用方负责持久化）。
+ */
+async function withToken(account, fn, ctx) {
+  let token = account.token;
+  let refreshed = false;
+  const doRefresh = async () => {
+    const creds = await refreshMirasimToken(account);
+    account.token = creds.token;
+    account.refreshToken = creds.refreshToken;
+    if (creds.expiresAt) account.expiresAt = creds.expiresAt;
+    token = creds.token;
+    refreshed = true;
+    await ctx?.onRefresh?.(creds);
+  };
+  let r = await fn(token);
+  if (r.status === 401 && !refreshed) {
+    await doRefresh();
+    r = await fn(token);
+  }
+  return r;
+}
+
+/** 统一配额结构（对齐 Qoder/WorkBuddy/ZCode） */
+export function normalizeMirasimLimits(limits, profile = null) {
+  const windows = Array.isArray(limits?.windows) ? limits.windows : [];
+  const epochToIso = (sec) => (Number.isFinite(sec) && sec > 0 ? new Date(sec * 1000).toISOString() : null);
+
+  const WINDOW_LABELS = {
+    '5h': '5小时窗口',
+    '7d': '7天全局窗口',
+    '7d_claude': '7天 Claude 上限',
+    '7d_sonnet': '7天 Sonnet 上限',
+    '7d_opus': '7天 Opus 上限',
+    '7d_fable': '7天 Fable 上限',
+  };
+
+  const parts = windows.map((w) => {
+    const budget = Number(w.budget) || 0;
+    const used = Number(w.used) || 0;
+    const remaining = Math.max(0, budget - used);
+    const usedPct = budget > 0 ? Math.min(100, Math.round((used / budget) * 1000) / 10) : 0;
+    const remPct = Math.max(0, Math.round((100 - usedPct) * 10) / 10);
+
+    return {
+      name: WINDOW_LABELS[w.name] || w.name,
+      total: budget,
+      used,
+      remaining,
+      percent: usedPct,
+      remainingPercentage: remPct,
+      unit: '',
+      resetAt: epochToIso(w.reset_at),
+      expiresAt: epochToIso(w.reset_at),
+      recurring: true,
+    };
+  });
+
+  // 瓶颈短板原则：5h 窗口与 7d 全局窗口是“与”的关系（任何一个见底，请求就发不出去）
+  // 逻辑上：周额度没了，5 小时即使是 100% 也没有意义！所以主额度必须反映实际可用状态
+  const w5h = parts.find((p) => p.name.includes('5小时'));
+  const w7d = parts.find((p) => p.name.includes('7天全局'));
+  const bottleneck = w7d && w7d.remainingPercentage <= 0 ? w7d
+    : w5h && w5h.remainingPercentage <= 0 ? w5h
+    : w7d && w5h ? (w7d.remainingPercentage < w5h.remainingPercentage ? w7d : w5h)
+    : parts[0] || null;
+
+  const rem = bottleneck ? bottleneck.remainingPercentage : 0;
+  const isExhausted = bottleneck ? bottleneck.remainingPercentage <= 0 : false;
+
+  return {
+    total: 100,
+    used: 100 - rem,
+    remaining: rem,
+    unit: '%',
+    plan: profile?.plan ? String(profile.plan).toUpperCase() : (limits?.paid ? 'PRO' : 'FREE'),
+    planExpiresAt: epochToIso(profile?.plan_exp),
+    bottleneckLabel: isExhausted ? (bottleneck?.name || '额度') + '已用尽' : null,
+    parts,
+    empty: parts.length === 0,
+    exceeded: limits?.suspended === true || isExhausted,
+  };
+}
+
+/** 查询 mirasim 完整配额；401 时自动用 refreshToken 续期一次并重试（ctx.onRefresh 回写凭据） */
+export async function fetchMirasimQuota(account, ctx = {}) {
+  if (!account.token) throw new Error('账号缺少 token');
+
+  const getProfile = (token) => fetchJsonRace(AUTH_ME_URL, {
+    headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+    timeoutMs: FETCH_TIMEOUT_MS,
+  });
+  const getLimits = (token) => fetchJsonRace(RELAY_LIMITS_URL, {
+    headers: { Authorization: `Bearer ${token}`, 'x-mirasim-probe': 'usage', Accept: 'application/json' },
+    timeoutMs: FETCH_TIMEOUT_MS,
+  });
+
+  let profile = null;
+  try {
+    const pres = await withToken(account, getProfile, ctx);
+    if (pres.ok) profile = await pres.json();
+  } catch (e) {
+    // 刷新也失败 / 网络错误：没有 refreshToken 或 refreshToken 失效时如实抛出，其余继续试 limits
+    if (e.authInvalid) throw e;
+  }
+
+  const res = await withToken(account, getLimits, ctx).catch((e) => {
+    if (e.authInvalid) throw e;
+    throw new Error(`查询额度失败：${e.message}`);
+  });
+
+  if (!res.ok) {
+    if (res.status === 401) { const e = new Error('mirasim 登录凭据已过期，请在 mirasim 客户端重新登录后重新导入'); e.auth = true; throw e; }
+    if (res.status === 429) {
+      // 区域受限时返回 profile 里的基础套餐信息，不完全阻断
+      return {
+        total: 100, used: 0, remaining: 100, unit: '%',
+        plan: profile?.plan || 'Plus',
+        planExpiresAt: profile?.plan_exp ? new Date(profile.plan_exp * 1000).toISOString() : null,
+        parts: [],
+        empty: false,
+        warning: '云端限流或直连网络受限（配置代理后可查询实时 5h/7d 窗口）',
+      };
+    }
+    throw new Error(`查询额度失败: HTTP ${res.status}`);
+  }
+
+  const limits = await res.json();
+  return normalizeMirasimLimits(limits, profile);
+}