creditdaddy 0.9.3 → 1.1.1

package/src/catpawLocal.js

@@ -0,0 +1,229 @@
+/**
+ * 妙手（美团 CatPaw）桌面客户端本机凭据读取与切换。
+ *
+ * 凭据存储（Windows）：
+ *   %APPDATA%\catpaw-moon\catx-credential.json   { ssoTokenEnc }
+ *   ssoTokenEnc = base64( iv(12B) ‖ gcmTag(16B) ‖ ciphertext )，AES-256-GCM
+ *   key = sha256( machineId + ":catpaw-desk-token-v2" )
+ *   machineId = HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid 的值（node-machine-id 同源）
+ *   明文结构 { access_token, modified_at }
+ *
+ * 额度 / 版本 / 用户信息走桌面网关（见 catpawClient.js）：
+ *   token 以 X-Auth-Token 头发送到 https://catx.nocode.cn/api/gateway/*
+ *
+ * 账号切换：妙手启动时读取该文件恢复登录，因此写入目标账号的 access_token
+ * 再重启客户端即为换号。切换前先把当前登录同步进 CreditDaddy 账号库（防丢号）。
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+
+const EXE_NAME = '妙手.exe';
+
+function credentialFile() {
+  if (process.env.CATPAW_CREDENTIAL_FILE) return process.env.CATPAW_CREDENTIAL_FILE;
+  const appData = process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming');
+  return path.join(appData, 'catpaw-moon', 'catx-credential.json');
+}
+
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+// ── 密钥派生（MachineGuid → sha256） ──
+
+let keyCache = null;   // Buffer | null（null = 本机不可用），false = 已尝试失败
+let machineIdOverride = null;   // 测试钩子：注入固定机器 ID（null = 未注入）
+let runningOverride = null;     // 测试钩子：true/false 强制运行状态（null = 真实探测）
+
+function machineId() {
+  if (machineIdOverride) return machineIdOverride;
+  if (process.platform !== 'win32') return null;
+  try {
+    const out = execFileSync('REG.exe',
+      ['QUERY', 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid'],
+      { windowsHide: true, timeout: 10_000 }).toString();
+    // MachineGuid    REG_SZ    {xxxxxxxx-....}（与 node-machine-id 一致：去空白 + 小写）
+    return out.split('REG_SZ')[1].replace(/\r+|\n+|\s+/g, '').toLowerCase();
+  } catch { return null; }
+}
+
+function tokenKey() {
+  if (machineIdOverride) {
+    return crypto.createHash('sha256').update(machineIdOverride + ':catpaw-desk-token-v2').digest();
+  }
+  if (keyCache) return keyCache;
+  if (keyCache === false) return null;
+  const id = machineId();
+  if (!id) { keyCache = false; return null; }
+  keyCache = crypto.createHash('sha256').update(id + ':catpaw-desk-token-v2').digest();
+  return keyCache;
+}
+
+/** 解密本机妙手登录凭据 → { accessToken, modifiedAt }；不可用 / 未登录返回 null */
+export function readCredential() {
+  const file = credentialFile();
+  const j = readJson(file);
+  if (!j || typeof j.ssoTokenEnc !== 'string' || !j.ssoTokenEnc) return null;
+  const key = tokenKey();
+  if (!key) return null;
+  try {
+    const blob = Buffer.from(j.ssoTokenEnc, 'base64');
+    if (blob.length < 29) return null;
+    const d = crypto.createDecipheriv('aes-256-gcm', key, blob.subarray(0, 12));
+    d.setAuthTag(blob.subarray(12, 28));
+    const plain = JSON.parse(Buffer.concat([d.update(blob.subarray(28)), d.final()]).toString('utf8'));
+    if (!plain || typeof plain.access_token !== 'string' || !plain.access_token) return null;
+    return { accessToken: plain.access_token, modifiedAt: plain.modified_at ?? null };
+  } catch { return null; }
+}
+
+/** 加密写回凭据文件（保留文件其余字段；妙手重启后即为新登录） */
+function writeCredential(accessToken) {
+  const file = credentialFile();
+  const key = tokenKey();
+  if (!key) throw new Error('无法派生本机密钥（仅支持 Windows 本机）');
+  const existing = readJson(file) || {};
+  const plain = JSON.stringify({ access_token: accessToken, modified_at: Date.now() });
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const ct = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+  const enc = Buffer.concat([iv, cipher.getAuthTag(), ct]).toString('base64');
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.tmp-${crypto.randomUUID()}`;
+  fs.writeFileSync(tmp, JSON.stringify({ ...existing, ssoTokenEnc: enc }, null, 2) + '\n', { mode: 0o600 });
+  fs.renameSync(tmp, file);
+}
+
+// ── 本机探测 ──
+
+function decodeTasklist(buf) {
+  // Windows 控制台代码页（简体中文 GBK）输出，中文名需按 gbk 解码
+  try { return new TextDecoder('gbk').decode(buf); } catch { return buf.toString('utf8'); }
+}
+
+export function catpawRunning() {
+  if (runningOverride !== null) return runningOverride;   // 测试钩子
+  if (process.platform !== 'win32') return false;
+  try {
+    const out = decodeTasklist(execFileSync('tasklist.exe',
+      ['/FI', `IMAGENAME eq ${EXE_NAME}`, '/NH'],
+      { windowsHide: true, encoding: 'buffer', timeout: 8000 }));
+    // 无匹配时 tasklist 输出 INFO 行（中文系统为 GBK 代码页，见 decodeTasklist）
+    return out.toLowerCase().includes(EXE_NAME.toLowerCase()) && !/no tasks|没有找到|没有任务/i.test(out);
+  } catch { return false; }
+}
+
+export function candidateClientPath() {
+  if (process.platform !== 'win32') return null;
+  const local = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+  const p = path.join(local, '妙手', EXE_NAME);
+  return fs.existsSync(p) ? p : null;
+}
+
+export function detectCatpaw() {
+  const file = credentialFile();
+  const cred = readCredential();
+  const clientPath = candidateClientPath();
+  return {
+    dataDir: path.dirname(file),
+    exists: fs.existsSync(file),
+    signedIn: Boolean(cred),
+    clientInstalled: Boolean(clientPath),
+    clientPath,
+    running: catpawRunning(),
+  };
+}
+
+const nap = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+
+export function terminateCatpaw({ timeoutMs = 8000 } = {}) {
+  if (process.platform !== 'win32') return { closed: false, supported: false };
+  if (!catpawRunning()) return { closed: false, running: false };
+  try { execFileSync('taskkill.exe', ['/IM', EXE_NAME, '/T'], { windowsHide: true, stdio: 'ignore', timeout: 15_000 }); } catch {}
+  let deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline && catpawRunning()) nap(250);
+  if (catpawRunning()) {
+    try { execFileSync('taskkill.exe', ['/IM', EXE_NAME, '/T', '/F'], { windowsHide: true, stdio: 'ignore', timeout: 15_000 }); } catch {}
+    deadline = Date.now() + 3000;
+    while (Date.now() < deadline && catpawRunning()) nap(250);
+  }
+  return { closed: !catpawRunning(), running: catpawRunning() };
+}
+
+/** 当前客户端登录的 token（面板「客户端当前」标识用，避免额外网络请求） */
+export function currentCatpawToken() {
+  try { return readCredential()?.accessToken || null; } catch { return null; }
+}
+
+// ── 当前会话读取与切换 ──
+
+/**
+ * 读取妙手客户端当前登录，返回标准化账号对象（供 addAccount / scan）。
+ * uid / name 通过网关 auth/current-user 补全（离线时降级为只带 token）。
+ */
+export async function liveToAccount() {
+  const cred = readCredential();
+  if (!cred) return null;
+  const account = {
+    provider: 'catpaw',
+    token: cred.accessToken,
+    refreshToken: null,
+    uid: null,
+    name: null,
+    expiresAt: null,
+    source: 'local-app',
+    meta: { capturedAt: new Date().toISOString() },
+  };
+  try {
+    const { fetchCatpawProfile } = await import('./catpawClient.js');
+    const p = await fetchCatpawProfile(cred.accessToken);
+    if (p) {
+      account.uid = p.userId ? String(p.userId) : null;
+      account.name = p.name || null;
+      if (p.mobile) account.meta.phone = p.mobile;
+      if (p.avatarUrl) account.meta.avatarUrl = p.avatarUrl;
+    }
+  } catch {}
+  return account;
+}
+
+/**
+ * 切换妙手客户端当前登录账号（写入加密凭据；客户端重启后生效）。
+ * @param {object} account 目标账号
+ * @param {{ force?: boolean }} opts
+ */
+export async function switchTo(account, { force = false } = {}) {
+  const cred = readCredential();
+  if (!cred) throw new Error('本机妙手客户端没有可用的登录凭据（无法派生本机密钥或未登录过）');
+  if (account.token === cred.accessToken) return { switched: false, alreadyActive: true };
+
+  if (!force && catpawRunning()) {
+    const err = new Error('妙手客户端正在运行，请先退出后再切换（或强制切换，切换后自动重新拉起客户端）');
+    err.catpawRunning = true;
+    throw err;
+  }
+  writeCredential(account.token);
+  return { switched: true, alreadyActive: false };
+}
+
+// ── 测试钩子（仅单元测试使用；不影响默认路径） ──
+
+/** 注入固定机器 ID 派生密钥（null 恢复真实探测）；同时复位密钥缓存 */
+export function _setMachineIdForTests(id) {
+  machineIdOverride = id || null;
+  keyCache = null;
+}
+
+/** 设置/复位「妙手是否正在运行」的探测结果（null = 真实探测） */
+export function _setRunningForTests(running) {
+  runningOverride = running === null || running === undefined ? null : Boolean(running);
+}
+
+/** 写出加密凭据（等价于切换流程里的落盘一步） */
+export function _writeCredentialForTests(accessToken) {
+  writeCredential(accessToken);
+}

package/src/checkin.js

@@ -1,12 +1,5 @@
 /**
- * 签到调度 — 逻辑对齐 10router qoderCheckin.js：
- *   - 一次 tick 扫描全部账号
- *   - 已确认完成今日签到的账号当天跳过（state.json 记忆）
- *   - "无可领活动" 不记忆（每日 10:00 (UTC+8) 刷新积分，之后还会出现可领活动）
- *   - "签到日" 以积分刷新时刻 10:00 (UTC+8) 为界，与本机时区无关
- *   - 国际版每台设备每天只能领一次（服务端按设备风控身份限领）：本机已有账号领取后，
- *     其余国际版账号标记为 limited 并当日记忆，不再反复请求
- *   - 定时器每 ~2h + 抖动执行一次；多轮签到（定时 / 手动）串行执行
+ * 签到调度：普通账号每 ~2h 扫描一次；ZCode 自动活动领取使用独立的短周期调度。
  */
 
 import { loadAccounts, loadState, saveState, withAccounts } from './store.js';
@@ -15,30 +8,51 @@ import { productOf } from './constants.js';
 import { startUsageSyncScheduler } from './tenrouter.js';
 import { refreshContext } from './accounts.js';
 import { zcodeAutoClaim } from './zcodeAutoClaim.js';
-import { autoClaimEnabled } from './zcodeClient.js';
+import { clearQuotaMark } from './zcodeGateway.js';
+import {
+  autoClaimEnabled, autoClaimUntil, enableAutoClaimFor, setAutoClaimEnabled,
+  warmZcodeAppVersion,
+} from './zcodeClient.js';
 import { logger } from './logger.js';
 
-const TICK_MS = 2 * 60 * 60 * 1000;        // 2 小时
-const TICK_JITTER_MS = 10 * 60 * 1000;     // ±10 分钟抖动，避免整点请求特征
+const TICK_MS = 2 * 60 * 60 * 1000;
+const TICK_JITTER_MS = 10 * 60 * 1000;
+const ZCODE_TICK_MS = 2 * 60 * 1000;
+const ZCODE_JITTER_MS = 15 * 1000;
+const ZCODE_FIRST_DELAY_MS = 2 * 60 * 1000;
+const ZCODE_AUTO_CLAIM_WINDOW_MS = 60 * 60 * 1000;
 
 // 每日积分刷新：10:00 (UTC+8) = 02:00 UTC。签到日 = (now - 2h) 的 UTC 日期
 const REFRESH_UTC_OFFSET_MS = 2 * 60 * 60 * 1000;
 
 let timerHandle = null;
+let zcodeTimerHandle = null;
+let zcodeExpiryTimerHandle = null;
+let zcodeExpiryAt = null;
+let zcodeNextTickAt = null;
+let zcodeLastTick = null;
+let zcodeTicking = false;
+let zcodeQueue = Promise.resolve();
 let tickQueue = Promise.resolve();
 let nextTickAt = null;
-let lastTick = null;   // { at, summary }
+let lastTick = null;
 let ticking = false;
 
 /** 调度器状态（面板展示用） */
 export function getSchedulerInfo() {
-  return { running: Boolean(timerHandle), nextTickAt, lastTick, ticking };
+  const enabled = autoClaimEnabled();
+  return {
+    running: Boolean(timerHandle), nextTickAt, lastTick, ticking,
+    zcode: {
+      enabled,
+      autoOffAt: enabled ? autoClaimUntil() : null,
+      nextTickAt: enabled ? zcodeNextTickAt : null,
+      lastTick: zcodeLastTick,
+      ticking: zcodeTicking,
+    },
+  };
 }
 
-/**
- * 当前所属的"签到日"（YYYY-MM-DD）。以 10:00 (UTC+8) 为日界：
- * 刷新前领过的记录不会让刷新后的新一轮被跳过；也不受 NAS / 海外机器时区影响。
- */
 export function dayKey(nowMs = Date.now()) {
   return new Date(nowMs - REFRESH_UTC_OFFSET_MS).toISOString().slice(0, 10);
 }
@@ -47,19 +61,131 @@ export function msUntilNextTick(nowMs = Date.now(), rand = Math.random) {
   return Math.max(TICK_MS + Math.floor(rand() * TICK_JITTER_MS), 1000);
 }
 
+export function zcodeMsUntilNextTick(rand = Math.random) {
+  return Math.max(ZCODE_TICK_MS + Math.floor(rand() * ZCODE_JITTER_MS), 1000);
+}
+
+/** 开启 ZCode 自动领取一小时；首次资格检查两分钟后开始。 */
+export function enableZcodeAutoClaimForOneHour() {
+  enableAutoClaimFor(ZCODE_AUTO_CLAIM_WINDOW_MS);
+  syncZcodeScheduler(true);
+  return autoClaimUntil();
+}
+
+/** 更新 ZCode 定时器，autoClaimUntil 是持久化的到期时间，重启后仍会生效。 */
+export function refreshZcodeScheduler() {
+  syncZcodeScheduler();
+}
+
+function clearZcodeTimers() {
+  if (zcodeTimerHandle) clearTimeout(zcodeTimerHandle);
+  if (zcodeExpiryTimerHandle) clearTimeout(zcodeExpiryTimerHandle);
+  zcodeTimerHandle = null;
+  zcodeExpiryTimerHandle = null;
+  zcodeExpiryAt = null;
+  zcodeNextTickAt = null;
+}
+
+function scheduleZcodeNextTick(delay = zcodeMsUntilNextTick()) {
+  if (!autoClaimEnabled()) {
+    syncZcodeScheduler();
+    return;
+  }
+  if (zcodeTimerHandle) clearTimeout(zcodeTimerHandle);
+  zcodeNextTickAt = new Date(Date.now() + delay).toISOString();
+  zcodeTimerHandle = setTimeout(() => {
+    zcodeTimerHandle = null;
+    zcodeNextTickAt = null;
+    runZcodeTick().catch((err) => logger.error('ZCODE-CLAIM', `资格轮询失败：${err?.message || err}`))
+      .finally(() => scheduleZcodeNextTick());
+  }, delay);
+  zcodeTimerHandle.unref?.();
+}
+
+function syncZcodeScheduler(startFresh = false) {
+  if (!autoClaimEnabled()) {
+    clearZcodeTimers();
+    return;
+  }
+
+  const expiresAt = autoClaimUntil();
+  if (startFresh && zcodeTimerHandle) {
+    clearTimeout(zcodeTimerHandle);
+    zcodeTimerHandle = null;
+    zcodeNextTickAt = null;
+  }
+  if (!zcodeTimerHandle && !zcodeTicking) scheduleZcodeNextTick(ZCODE_FIRST_DELAY_MS);
+
+  if (expiresAt && zcodeExpiryAt !== expiresAt) {
+    if (zcodeExpiryTimerHandle) clearTimeout(zcodeExpiryTimerHandle);
+    zcodeExpiryAt = expiresAt;
+    zcodeExpiryTimerHandle = setTimeout(() => {
+      zcodeExpiryTimerHandle = null;
+      setAutoClaimEnabled(false);
+      clearZcodeTimers();
+      logger.info('ZCODE-CLAIM', '一小时自动领取时段已结束，自动领取已关闭');
+    }, Math.max(0, expiresAt - Date.now()));
+    zcodeExpiryTimerHandle.unref?.();
+  }
+}
+
+function runZcodeTick(accountIds, { force = false } = {}) {
+  const run = zcodeQueue.then(async () => {
+    if (!force && !autoClaimEnabled()) return { results: [], summary: 'ZCode 自动领取已关闭' };
+    zcodeTicking = true;
+    const results = [];
+    const claimedIds = [];
+    try {
+      const accounts = (await loadAccounts()).filter((a) => a.provider === 'zcode'
+        && (!accountIds || accountIds.has(a.id)));
+      for (const account of accounts) {
+        if (!force && !autoClaimEnabled()) break;
+        const label = account.name || account.uid || account.id;
+        try {
+          const outcome = await zcodeAutoClaim(account);
+          if (!outcome) continue;
+          if (outcome.status === 'checked-in') {
+            claimedIds.push(account.id);
+            await clearQuotaMark(account.id);
+          }
+          results.push({ accountId: account.id, account: label, provider: 'zcode', status: outcome.status, message: outcome.message });
+          const lastResult = { status: outcome.status, message: outcome.message, amount: 0, at: new Date().toISOString() };
+          await withAccounts((list) => {
+            const current = list.find((a) => a.id === account.id);
+            if (current) current.lastResult = lastResult;
+          });
+        } catch (err) {
+          logger.warn('ZCODE-CLAIM', `${label} 自动领取异常：${err?.message || err}`);
+        }
+      }
+      zcodeLastTick = {
+        at: new Date().toISOString(),
+        summary: `ZCode 资格轮询完成：${results.length} 个账号返回活动结果`,
+        claimedIds, // 面板据此即时刷新这些账号的额度
+      };
+      return { results, summary: zcodeLastTick.summary };
+    } finally {
+      zcodeTicking = false;
+    }
+  });
+  zcodeQueue = run.catch(() => {});
+  return run;
+}
+
+/** 手动触发一次 ZCode 资格轮询（面板单账号 / 全部领取走这里），与定时轮共用同一队列；手动轮不受开关限制。 */
+export function pollZcodeNow(accountIds) {
+  return runZcodeTick(accountIds && accountIds.length ? new Set(accountIds) : null, { force: true });
+}
+
 async function getDoneMap(state) {
   const today = dayKey();
   const raw = state?.qoderDailyDone;
   const map = raw && typeof raw === 'object' && !Array.isArray(raw) ? { ...raw } : {};
-  // 只保留今天的记录，其余清掉
-  for (const k of Object.keys(map)) if (map[k] !== today) delete map[k];
+  for (const key of Object.keys(map)) if (map[key] !== today) delete map[key];
   return map;
 }
 
-/**
- * 执行一轮签到。多次调用会排队串行执行，避免同一账号被并发领取、state.json 互相覆盖。
- * @param {{provider?: string, product?: string, skipIfCheckedToday?: boolean, onlyAccountId?: string}} opts
- */
+/** 多次调用排队串行执行，避免并发签到和 state.json 覆盖。 */
 export function runCheckinTick(opts = {}) {
   const run = tickQueue.then(() => runTickNow(opts));
   tickQueue = run.catch(() => {});
@@ -73,16 +199,13 @@ async function runTickNow(opts) {
 
 async function runTickInner(opts) {
   const allAccounts = await loadAccounts();
-  // 没有每日签到能力的产品（如 ZCode：积分靠需验证码的活动领取）不参与签到轮
   const accounts = allAccounts.filter(
     (a) => (!opts.provider || a.provider === opts.provider)
         && (!opts.product || productOf(a.provider) === opts.product)
         && (!opts.onlyAccountId || a.id === opts.onlyAccountId)
         && typeof productImpl(a.provider)?.checkin === 'function'
   );
-
-  // ZCode 活动轮询领取：开关打开（标签页可切换，默认关）且未被筛选参数排除时参与
-  const zAccounts = (autoClaimEnabled()
+  const zAccounts = (opts.includeZcode !== false && autoClaimEnabled()
       && !opts.onlyAccountId
       && (!opts.provider || opts.provider === 'zcode')
       && (!opts.product || opts.product === 'zcode'))
@@ -97,7 +220,6 @@ async function runTickInner(opts) {
   const memo = await getDoneMap(state);
   const today = dayKey();
   const results = [];
-  // 本设备今日领取国际版每日积分的账号 { day, accountId, name }
   let deviceClaim = state?.deviceClaim?.day === today ? state.deviceClaim : null;
 
   for (const account of accounts) {
@@ -108,7 +230,7 @@ async function runTickInner(opts) {
         continue;
       }
 
-      const ctx = refreshContext(account, (m) => logger.info('CHECKIN', `${label}：${m}`));
+      const ctx = refreshContext(account, (message) => logger.info('CHECKIN', `${label}：${message}`));
       let outcome = await productImpl(account.provider).checkin(account, ctx);
       if (account.provider === 'qoder' && outcome.risk) {
         if (outcome.status === 'checked-in') {
@@ -139,7 +261,6 @@ async function runTickInner(opts) {
         memo[account.id] = today;
         logger.info('CHECKIN', `${label}：${outcome.message}`);
       } else if (outcome.status === 'no-activity') {
-        // 不记忆——积分窗口（10:00 UTC+8）打开后还会出现可领活动
         logger.debug('CHECKIN', `${label}：${outcome.message || '当前无可领取的活动'}`);
       } else {
         logger.warn('CHECKIN', `${label} 领取失败：${outcome.error || outcome.status}`);
@@ -151,34 +272,22 @@ async function runTickInner(opts) {
     }
   }
 
-  // 保存签到日历与账号 lastCheckin / lastResult / uid（在账号锁内重新读取，不覆盖期间的增删）
-  await withAccounts((all) => {
-    for (const updated of accounts) {
-      const cur = all.find((a) => a.id === updated.id);
-      if (!cur) continue;
-      cur.lastCheckin = updated.lastCheckin;
-      if (updated.lastResult) cur.lastResult = updated.lastResult;
-      if (updated.uid && !cur.uid) cur.uid = updated.uid;
-    }
-  });
-  await saveState({ ...state, qoderDailyDone: memo, deviceClaim });
+  if (accounts.length) {
+    await withAccounts((all) => {
+      for (const updated of accounts) {
+        const current = all.find((a) => a.id === updated.id);
+        if (!current) continue;
+        current.lastCheckin = updated.lastCheckin;
+        if (updated.lastResult) current.lastResult = updated.lastResult;
+        if (updated.uid && !current.uid) current.uid = updated.uid;
+      }
+    });
+    await saveState({ ...state, qoderDailyDone: memo, deviceClaim });
+  }
 
-  // ZCode 活动自动领取：每轮签到后顺带轮询（preview 为空时零请求副作用；需开关打开）。
-  // 桌面版已注册隐藏窗口验证码提供者，可静默过验证码；其它环境需要验证码时标记「需手动领取」。
-  for (const za of zAccounts) {
-    const label = za.name || za.uid || za.id;
-    try {
-      const r = await zcodeAutoClaim(za);
-      if (!r) continue;
-      results.push({ accountId: za.id, account: label, provider: 'zcode', status: r.status, message: r.message });
-      const lastResult = { status: r.status, message: r.message, amount: 0, at: new Date().toISOString() };
-      await withAccounts((list) => {
-        const cur = list.find((a) => a.id === za.id);
-        if (cur) cur.lastResult = lastResult;
-      });
-    } catch (e) {
-      logger.warn('ZCODE-CLAIM', `${label} 自动领取异常：${e.message}`);
-    }
+  if (zAccounts.length) {
+    const zResult = await runZcodeTick(new Set(zAccounts.map((a) => a.id)));
+    results.push(...zResult.results);
   }
 
   const claimed = results.filter((r) => r.status === 'checked-in');
@@ -186,44 +295,46 @@ async function runTickInner(opts) {
   const none = results.filter((r) => r.status === 'no-activity');
   const limited = results.filter((r) => r.status === 'limited');
   const already = results.length - claimed.length - failed.length - none.length - limited.length;
-  const totalCredits = claimed.reduce((s, r) => s + (r.claimedAmount || 0), 0);
+  const totalCredits = claimed.reduce((sum, r) => sum + (r.claimedAmount || 0), 0);
   const summary = `签到汇总：成功 ${claimed.length}（+${totalCredits} Credits）、已领 ${already}`
     + (limited.length ? `、本机限领 ${limited.length}` : '')
     + `、无活动 ${none.length}、失败 ${failed.length}`;
   logger.info('CHECKIN', summary);
   lastTick = { at: new Date().toISOString(), summary };
-
   return { results, summary };
 }
 
-/** 启动定时签到（每 ~2h 一轮，当天已成功的账号自动跳过） */
+/** 启动普通签到调度与 ZCode 独立轮询调度。 */
 export function startScheduler() {
   if (timerHandle) return;
-  startUsageSyncScheduler();   // 10Router 用量同步（未配置 / 未开启时不做任何事）
+  startUsageSyncScheduler();
+  warmZcodeAppVersion();
   const scheduleNext = () => {
     const delay = msUntilNextTick();
     nextTickAt = new Date(Date.now() + delay).toISOString();
     timerHandle = setTimeout(async () => {
       try {
-        await runCheckinTick({ skipIfCheckedToday: true });
+        await runCheckinTick({ skipIfCheckedToday: true, includeZcode: false });
       } catch (err) {
         logger.error('CHECKIN', `定时轮失败：${err?.message || err}`);
       } finally {
         scheduleNext();
       }
     }, delay);
-    if (timerHandle.unref) timerHandle.unref();
+    timerHandle.unref?.();
     logger.info('CHECKIN', `定时签到已启动，下次执行约 ${Math.round(delay / 60000)} 分钟后`);
   };
   scheduleNext();
-  // 启动后 15 秒先跑一轮引导签到
+  syncZcodeScheduler();
   setTimeout(() => {
-    runCheckinTick({ skipIfCheckedToday: true }).catch((e) =>
-      logger.error('CHECKIN', `引导轮失败：${e?.message || e}`));
+    runCheckinTick({ skipIfCheckedToday: true, includeZcode: false }).catch((err) =>
+      logger.error('CHECKIN', `引导轮失败：${err?.message || err}`));
   }, 15000).unref?.();
 }
 
 export function stopScheduler() {
-  if (timerHandle) { clearTimeout(timerHandle); timerHandle = null; }
+  if (timerHandle) clearTimeout(timerHandle);
+  timerHandle = null;
   nextTickAt = null;
+  clearZcodeTimers();
 }

package/src/constants.js

@@ -13,6 +13,10 @@ import { readFileSync } from 'node:fs';
 export const OPENAPI_BASE = 'https://openapi.qoder.sh';
 export const CN_OPENAPI_BASE = 'https://openapi.qoder.com.cn';
 
+// 网页端（账号设置 → 用量明细）同源 API：逐资源包明细只在这里提供，且只认浏览器登录后的会话 Cookie。
+export const WEB_BASE = 'https://qoder.com';
+export const CN_WEB_BASE = 'https://qoder.cn';
+
 export const LOGIN_URL = 'https://qoder.com/device/selectAccounts';
 export const CN_LOGIN_URL = 'https://qoder.cn/device/selectAccounts';
 
@@ -23,29 +27,41 @@ export const CAMPAIGN_CLAIM_PATH = (id) => `/sash/api/v1/me/campaigns/${encodeUR
 // 账号信息与配额
 export const USERINFO_PATH = '/api/v1/userinfo';
 export const QUOTA_USAGE_PATH = '/api/v2/quota/usage';
+// 网页端逐资源包用量明细（plan / 个人资源包 / 组织资源包，含每包到期时间）。
+// 仅接受浏览器登录的会话 Cookie（dt- / jt- token 一律 401），见 qoderClient.fetchUsageDetail。
+export const WEB_USAGE_PATH = '/api/v2/me/usages/big_model_credits';
 
 // PAT (pt-...) → 短期 job token (jt-...) 兑换（普通 JSON POST，无需 COSY 签名）
 export const JOB_TOKEN_EXCHANGE_PATH = '/api/v1/jobToken/exchange';
 
 // 账号的 provider = 产品 + 区域。新增产品时在此登记，并在 providers.js 挂上对应实现。
-export const PROVIDERS = ['qoder', 'qoder-cn', 'workbuddy', 'workbuddy-intl', 'zcode'];
+export const PROVIDERS = ['qoder', 'qoder-cn', 'workbuddy', 'workbuddy-intl', 'zcode', 'mirasim', 'catpaw'];
 export const PROVIDER_LABEL = {
   qoder: 'Qoder 国际版',
   'qoder-cn': 'Qoder 国内版',
   workbuddy: 'WorkBuddy 国内版',
   'workbuddy-intl': 'WorkBuddy 国际版',
   zcode: 'ZCode',
+  mirasim: 'mirasim',
+  catpaw: '妙手',
 };
-/** provider → 产品线（qoder / workbuddy / zcode） */
+/** provider → 产品线（qoder / workbuddy / zcode / mirasim / catpaw） */
 export const productOf = (provider) => {
   const p = String(provider);
   if (p.startsWith('workbuddy')) return 'workbuddy';
   if (p.startsWith('zcode')) return 'zcode';
+  if (p === 'mirasim') return 'mirasim';
+  if (p === 'catpaw') return 'catpaw';
   return 'qoder';
 };
 /** provider 是否国内版 */
 export const isCnProvider = (provider) => provider === 'qoder-cn' || provider === 'workbuddy';
 
+/** Qoder 网页端同源 API 的 host（用量明细逐资源包接口在这里，只认浏览器会话 Cookie） */
+export function webBase(provider) {
+  return provider === 'qoder-cn' ? CN_WEB_BASE : WEB_BASE;
+}
+
 /** 签到请求头（源自 10router qoderCheckin.js，clientType=10 与官方客户端一致） */
 export function buildQoderHeaders(token) {
   return {