creditdaddy 0.9.3 → 1.1.1

package/src/localDetect.js

@@ -138,8 +138,8 @@ export function putCandidate(c) {
   return id;
 }
 
-/** 按 candidateId 取回完整候选（导入用），过期返回 null */
-export function takeCandidate(id) {
+/** 按 candidateId 读取候选（不会消费掉，导入前可反复查询）；过期返回 null */
+export function peekCandidate(id) {
   const c = candidates.get(id);
   if (!c) return null;
   if (c.at < Date.now() - CAND_TTL_MS) { candidates.delete(id); return null; }

package/src/logger.js

@@ -1,16 +1,50 @@
-/** 轻量日志：环形缓冲（供面板查看）+ 控制台输出 */
+/** 轻量日志：环形缓冲（供面板查看）+ 控制台输出 + 按日期归档落盘 */
 
 const RING_SIZE = 300;
 const ring = [];
 
+// ─── 按日期归档：logs/daemon-YYYY-MM-DD.log（跨天自动换文件） ───
+import fsSync from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+let archiveDir = null;
+try {
+  const explicit = process.env.CREDITDADDY_HOME || process.env.QODERDADDY_HOME;
+  const base = explicit || path.join(os.homedir(), '.creditdaddy');
+  archiveDir = path.join(base, 'logs');
+  fsSync.mkdirSync(archiveDir, { recursive: true });
+} catch { archiveDir = null; }
+
+let archiveDay = null;
+let archiveStream = null;
+
+function archiveLine(line) {
+  if (!archiveDir) return;
+  try {
+    const day = line.at.slice(0, 10);
+    if (archiveDay !== day || !archiveStream) {
+      if (archiveStream) archiveStream.end();
+      archiveStream = fsSync.createWriteStream(path.join(archiveDir, `daemon-${day}.log`), { flags: 'a' });
+      archiveDay = day;
+    }
+    archiveStream.write('[' + line.at + '] ' + line.level.toUpperCase() + ' [' + line.tag + '] ' + line.msg + '\n');
+  } catch { // 落盘失败不拖累主流程
+  }
+}
+
 function ts() {
-  return new Date().toISOString().replace('T', ' ').slice(0, 19);
+  const d = new Date();
+  const pad = (n) => String(n).padStart(2, '0');
+  return d.getFullYear() + '-' + pad(d.getMonth() + 1) + '-' + pad(d.getDate())
+    + ' ' + pad(d.getHours()) + ':' + pad(d.getMinutes()) + ':' + pad(d.getSeconds());
 }
 
 export function log(level, tag, msg) {
   const line = { at: ts(), level, tag, msg: String(msg) };
   ring.push(line);
   if (ring.length > RING_SIZE) ring.shift();
+  archiveLine(line);
   const prefix = level === 'error' ? '✗' : level === 'warn' ? '!' : '·';
   console.error(`[${line.at}] ${prefix} [${tag}] ${line.msg}`);
 }
@@ -25,3 +59,10 @@ export const logger = {
 export function getLogs(limit = 100) {
   return ring.slice(-limit);
 }
+
+/** 测试收尾用：归档流的句柄不关，测试进程的临时目录在 Windows 上删不掉 */
+export function closeArchiveStream() {
+  try { archiveStream?.end(); } catch {}
+  archiveStream = null;
+  archiveDay = null;
+}

package/src/mirasimClient.js

@@ -0,0 +1,189 @@
+/**
+ * mirasim API 客户端 — 用户资料、套餐、5h/7d 滚动窗口配额查询。
+ *
+ *   GET https://auth.mirasim.ai/auth/me      用户资料（name, email, plan, plan_exp, id）
+ *   GET https://relay.mirasim.ai/v1/limits   滚动窗口（5h, 7d, 7d_claude 等）
+ *       注：relay.mirasim.ai 对大陆直连限制区域（429），需走统一出口 fetchJsonRace 代理
+ */
+
+import { fetchJsonRace } from './zcodeClient.js';
+import { FETCH_TIMEOUT_MS } from './constants.js';
+
+const AUTH_ME_URL = 'https://auth.mirasim.ai/auth/me';
+const RELAY_LIMITS_URL = 'https://relay.mirasim.ai/v1/limits';
+const AUTH_REFRESH_URL = 'https://auth.mirasim.ai/auth/refresh';
+
+export async function fetchMirasimProfile(token) {
+  const res = await fetchJsonRace(AUTH_ME_URL, {
+    headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+    timeoutMs: FETCH_TIMEOUT_MS,
+  });
+  if (!res.ok) {
+    if (res.status === 401) { const e = new Error('mirasim 登录凭据已过期'); e.auth = true; throw e; }
+    throw new Error(`获取 mirasim 用户信息失败: HTTP ${res.status}`);
+  }
+  return res.json();
+}
+
+/**
+ * 用 refreshToken 换新凭据（refreshToken 会轮换，两个都要保存）。
+ * 返回 { token, refreshToken, expiresAt }；没有 refreshToken 或刷新失败抛错。
+ */
+export async function refreshMirasimToken(account) {
+  if (!account.refreshToken) throw new Error('没有 refreshToken，无法刷新，请在 mirasim 客户端重新登录后重新导入');
+  const res = await fetchJsonRace(AUTH_REFRESH_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: { refresh_token: account.refreshToken },
+    timeoutMs: FETCH_TIMEOUT_MS,
+  });
+  if (!res.ok) {
+    if (res.status === 401 || res.status === 403) {
+      const e = new Error('refreshToken 已失效，请在 mirasim 客户端重新登录后到「添加账号 → 本机导入」同步');
+      e.authInvalid = true;
+      throw e;
+    }
+    throw new Error(`mirasim 凭据刷新失败: HTTP ${res.status}`);
+  }
+  const d = await res.json();
+  const token = d.access_token || d.accessToken;
+  if (!token) throw new Error('mirasim 刷新响应缺少 access_token（上游结构可能变化）');
+  let expiresAt = null;
+  try {
+    const p = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString('utf8'));
+    if (Number.isFinite(p.exp)) expiresAt = new Date(p.exp * 1000).toISOString();
+  } catch {}
+  return { token, refreshToken: d.refresh_token || d.refreshToken || account.refreshToken, expiresAt };
+}
+
+/**
+ * 以有效 token 执行 fn(token)；401 时刷新一次再重试。
+ * 刷新成功经 ctx.onRefresh(newCreds) 回写账号库与 setting.json（调用方负责持久化）。
+ */
+async function withToken(account, fn, ctx) {
+  let token = account.token;
+  let refreshed = false;
+  const doRefresh = async () => {
+    const creds = await refreshMirasimToken(account);
+    account.token = creds.token;
+    account.refreshToken = creds.refreshToken;
+    if (creds.expiresAt) account.expiresAt = creds.expiresAt;
+    token = creds.token;
+    refreshed = true;
+    await ctx?.onRefresh?.(creds);
+  };
+  let r = await fn(token);
+  if (r.status === 401 && !refreshed) {
+    await doRefresh();
+    r = await fn(token);
+  }
+  return r;
+}
+
+/** 统一配额结构（对齐 Qoder/WorkBuddy/ZCode） */
+export function normalizeMirasimLimits(limits, profile = null) {
+  const windows = Array.isArray(limits?.windows) ? limits.windows : [];
+  const epochToIso = (sec) => (Number.isFinite(sec) && sec > 0 ? new Date(sec * 1000).toISOString() : null);
+
+  const WINDOW_LABELS = {
+    '5h': '5小时窗口',
+    '7d': '7天全局窗口',
+    '7d_claude': '7天 Claude 上限',
+    '7d_sonnet': '7天 Sonnet 上限',
+    '7d_opus': '7天 Opus 上限',
+    '7d_fable': '7天 Fable 上限',
+  };
+
+  const parts = windows.map((w) => {
+    const budget = Number(w.budget) || 0;
+    const used = Number(w.used) || 0;
+    const remaining = Math.max(0, budget - used);
+    const usedPct = budget > 0 ? Math.min(100, Math.round((used / budget) * 1000) / 10) : 0;
+    const remPct = Math.max(0, Math.round((100 - usedPct) * 10) / 10);
+
+    return {
+      name: WINDOW_LABELS[w.name] || w.name,
+      total: budget,
+      used,
+      remaining,
+      percent: usedPct,
+      remainingPercentage: remPct,
+      unit: '',
+      resetAt: epochToIso(w.reset_at),
+      expiresAt: epochToIso(w.reset_at),
+      recurring: true,
+    };
+  });
+
+  // 瓶颈短板原则：5h 窗口与 7d 全局窗口是“与”的关系（任何一个见底，请求就发不出去）
+  // 逻辑上：周额度没了，5 小时即使是 100% 也没有意义！所以主额度必须反映实际可用状态
+  const w5h = parts.find((p) => p.name.includes('5小时'));
+  const w7d = parts.find((p) => p.name.includes('7天全局'));
+  const bottleneck = w7d && w7d.remainingPercentage <= 0 ? w7d
+    : w5h && w5h.remainingPercentage <= 0 ? w5h
+    : w7d && w5h ? (w7d.remainingPercentage < w5h.remainingPercentage ? w7d : w5h)
+    : parts[0] || null;
+
+  const rem = bottleneck ? bottleneck.remainingPercentage : 0;
+  const isExhausted = bottleneck ? bottleneck.remainingPercentage <= 0 : false;
+
+  return {
+    total: 100,
+    used: 100 - rem,
+    remaining: rem,
+    unit: '%',
+    plan: profile?.plan ? String(profile.plan).toUpperCase() : (limits?.paid ? 'PRO' : 'FREE'),
+    planExpiresAt: epochToIso(profile?.plan_exp),
+    bottleneckLabel: isExhausted ? (bottleneck?.name || '额度') + '已用尽' : null,
+    parts,
+    empty: parts.length === 0,
+    exceeded: limits?.suspended === true || isExhausted,
+  };
+}
+
+/** 查询 mirasim 完整配额；401 时自动用 refreshToken 续期一次并重试（ctx.onRefresh 回写凭据） */
+export async function fetchMirasimQuota(account, ctx = {}) {
+  if (!account.token) throw new Error('账号缺少 token');
+
+  const getProfile = (token) => fetchJsonRace(AUTH_ME_URL, {
+    headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+    timeoutMs: FETCH_TIMEOUT_MS,
+  });
+  const getLimits = (token) => fetchJsonRace(RELAY_LIMITS_URL, {
+    headers: { Authorization: `Bearer ${token}`, 'x-mirasim-probe': 'usage', Accept: 'application/json' },
+    timeoutMs: FETCH_TIMEOUT_MS,
+  });
+
+  let profile = null;
+  try {
+    const pres = await withToken(account, getProfile, ctx);
+    if (pres.ok) profile = await pres.json();
+  } catch (e) {
+    // 刷新也失败 / 网络错误：没有 refreshToken 或 refreshToken 失效时如实抛出，其余继续试 limits
+    if (e.authInvalid) throw e;
+  }
+
+  const res = await withToken(account, getLimits, ctx).catch((e) => {
+    if (e.authInvalid) throw e;
+    throw new Error(`查询额度失败：${e.message}`);
+  });
+
+  if (!res.ok) {
+    if (res.status === 401) { const e = new Error('mirasim 登录凭据已过期，请在 mirasim 客户端重新登录后重新导入'); e.auth = true; throw e; }
+    if (res.status === 429) {
+      // 区域受限时返回 profile 里的基础套餐信息，不完全阻断
+      return {
+        total: 100, used: 0, remaining: 100, unit: '%',
+        plan: profile?.plan || 'Plus',
+        planExpiresAt: profile?.plan_exp ? new Date(profile.plan_exp * 1000).toISOString() : null,
+        parts: [],
+        empty: false,
+        warning: '云端限流或直连网络受限（配置代理后可查询实时 5h/7d 窗口）',
+      };
+    }
+    throw new Error(`查询额度失败: HTTP ${res.status}`);
+  }
+
+  const limits = await res.json();
+  return normalizeMirasimLimits(limits, profile);
+}

package/src/mirasimLocal.js

@@ -0,0 +1,386 @@
+/**
+ * mirasim（原生 AI 编程开发环境）本机凭据与切号引擎。
+ *
+ * 凭据存储：
+ *   ~/.mirasim/setting.json        auth: { token, refreshToken, userId, name, exp }（mrs1: 加密）
+ *   ~/.mirasim/secret.key          DPAPI 加密的 master key（Windows 上是 hex 字符串；旧版）
+ *   %APPDATA%\@mirasim\desktop\secret-key.enc
+ *                                  新版桌面端：Electron safeStorage 密文（v10 + AES-256-GCM，
+ *                                  密钥 = 同目录 Local State 的 os_crypt.encrypted_key 经 DPAPI 解开），
+ *                                  明文即 64 字符 hex master key
+ *   MIRASIM_SECRET_KEY / MIRASIM_APP_SECRET_KEY  环境变量（64 字符 hex，客户端也会注入给子进程）
+ *
+ * 加密格式：
+ *   mrs1:<base64(12B IV + 16B tag + ciphertext)>，AES-256-GCM，
+ *   key = DPAPI Unprotect(secret.key) → utf16le 字符串（64 字符 hex）→ Buffer
+ *
+ * 账号切换：
+ *   - mirasim 正在运行时可提示或强制退出
+ *   - 切换前先把当前登录同步进 CreditDaddy 账号库（防丢号）
+ *   - 将目标账号的 auth 替换写回 setting.json（保留其他所有配置，如 models、workspaces 等）
+ *   - 桌面端切号成功后可一键拉起 Mirasim.exe
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { execFile, execFileSync, execSync } from 'node:child_process';
+
+const ENC_PREFIX = 'mrs1:';
+
+export function mirasimHome() {
+  return process.env.MIRASIM_HOME || path.join(os.homedir(), '.mirasim');
+}
+
+/** 新版桌面端（Electron）userData 目录 */
+export function mirasimDesktopDataDir() {
+  if (process.env.MIRASIM_DESKTOP_DATA_DIR) return process.env.MIRASIM_DESKTOP_DATA_DIR;
+  const roaming = process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming');
+  return path.join(roaming, '@mirasim', 'desktop');
+}
+
+export function mirasimPaths() {
+  const h = mirasimHome();
+  const desktop = mirasimDesktopDataDir();
+  return {
+    home: h,
+    setting: path.join(h, 'setting.json'),
+    secretKey: path.join(h, 'secret.key'),
+    secretKeyEnc: path.join(desktop, 'secret-key.enc'),
+    localState: path.join(desktop, 'Local State'),
+    insights: path.join(h, 'insights'),
+  };
+}
+
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+function atomicWriteJson(file, obj) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.tmp-${crypto.randomUUID()}`;
+  fs.writeFileSync(tmp, JSON.stringify(obj, null, 2) + '\n', { mode: 0o600 });
+  fs.renameSync(tmp, file);
+}
+
+// ── DPAPI 解密 master key ──
+
+let masterKeyCache = null;
+let masterKeyFromSecretFile = false; // 只有取自 ~/.mirasim/secret.key 的密钥才回写该文件
+
+function persistMasterKey(paths, key) {
+  try {
+    fs.mkdirSync(paths.home, { recursive: true, mode: 0o700 });
+    if (process.platform === 'win32') {
+      const script = 'Add-Type -AssemblyName System.Security;'
+        + '$b=[Convert]::FromBase64String([Console]::In.ReadToEnd());'
+        + "[Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Protect($b,$null,'CurrentUser'))";
+      const encoded = Buffer.from(script, 'utf16le').toString('base64');
+      const encrypted = execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded], {
+        input: Buffer.from(key.toString('hex'), 'utf16le').toString('base64'), windowsHide: true, timeout: 15_000, encoding: 'utf8',
+      }).trim();
+      fs.writeFileSync(paths.secretKey, Buffer.from(encrypted, 'base64').toString('hex'), { mode: 0o600 });
+    } else {
+      fs.writeFileSync(paths.secretKey, key.toString('hex'), { mode: 0o600 });
+    }
+    return true;
+  } catch { return false; }
+}
+
+function readEnvironmentMasterKey() {
+  const value = process.env.MIRASIM_SECRET_KEY || process.env.MIRASIM_APP_SECRET_KEY;
+  if (!value) return null;
+  const hex = value.trim();
+  if (!/^[0-9a-f]{64}$/i.test(hex)) return null;
+  return Buffer.from(hex, 'hex');
+}
+
+function dpapiUnprotect(buf) {
+  const script = 'Add-Type -AssemblyName System.Security;'
+    + '$b=[Convert]::FromBase64String([Console]::In.ReadToEnd());'
+    + "[Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'))";
+  // 使用 -EncodedCommand 传入 UTF-16LE Base64，避免命令行参数中包含敏感 API 关键字被杀毒软件误报
+  const encoded = Buffer.from(script, 'utf16le').toString('base64');
+  return new Promise((resolve, reject) => {
+    const child = execFile('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded],
+      { windowsHide: true, timeout: 15_000 }, (err, stdout) => {
+        if (err) return reject(new Error('DPAPI 解密失败：' + err.message));
+        resolve(Buffer.from(String(stdout).trim(), 'base64'));
+      });
+    child.stdin.end(buf.toString('base64'));
+  });
+}
+
+/** 新版桌面端 secret-key.enc（Electron safeStorage，仅 Windows）→ master key；读不到返回 null */
+async function readSafeStorageMasterKey(p) {
+  if (process.platform !== 'win32' || !fs.existsSync(p.secretKeyEnc)) return null;
+  try {
+    const enc = fs.readFileSync(p.secretKeyEnc);
+    const ek = Buffer.from(readJson(p.localState)?.os_crypt?.encrypted_key || '', 'base64');
+    if (enc.length < 3 + 12 + 16 || enc.subarray(0, 3).toString('latin1') !== 'v10') return null;
+    if (ek.subarray(0, 5).toString('latin1') !== 'DPAPI') return null;
+    const aesKey = await dpapiUnprotect(ek.subarray(5));
+    const decipher = crypto.createDecipheriv('aes-256-gcm', aesKey, enc.subarray(3, 15));
+    decipher.setAuthTag(enc.subarray(enc.length - 16));
+    const hex = Buffer.concat([decipher.update(enc.subarray(15, enc.length - 16)), decipher.final()]).toString('utf8').trim();
+    return /^[0-9a-f]{64}$/i.test(hex) ? Buffer.from(hex, 'hex') : null;
+  } catch { return null; }
+}
+
+/**
+ * 取得解开后的 32 字节 master key Buffer（未配置或解密失败返回 null）。
+ * 依次尝试：~/.mirasim/secret.key（旧版）→ 桌面端 secret-key.enc（新版）→ 环境变量。
+ */
+export async function getMasterKey() {
+  const p = mirasimPaths();
+  // 旧版 secret.key 读过后被删：用缓存解密，并原样写回修复
+  if (masterKeyCache) {
+    if (masterKeyFromSecretFile && !fs.existsSync(p.secretKey)) persistMasterKey(p, masterKeyCache);
+    return masterKeyCache;
+  }
+  const fromFile = await readSecretKeyFile(p);
+  if (fromFile) { masterKeyFromSecretFile = true; return (masterKeyCache = fromFile); }
+  const fromDesktop = await readSafeStorageMasterKey(p);
+  if (fromDesktop) return (masterKeyCache = fromDesktop);
+  const fromEnv = readEnvironmentMasterKey();
+  if (fromEnv) return (masterKeyCache = fromEnv);
+  return null;
+}
+
+/** 旧版 ~/.mirasim/secret.key → master key；没有或解不开返回 null */
+async function readSecretKeyFile(p) {
+  if (!fs.existsSync(p.secretKey)) return null;
+  try {
+    const raw = fs.readFileSync(p.secretKey, 'utf8').trim();
+    if (process.platform === 'win32') {
+      const bin = /^[0-9a-f]+$/i.test(raw) ? Buffer.from(raw, 'hex') : Buffer.from(raw, 'base64');
+      const unprotected = await dpapiUnprotect(bin);
+      // Windows 存放的是 utf16le 编码的 64 字符 hex 密钥
+      const hex = unprotected.toString('utf16le').trim();
+      if (/^[0-9a-f]{64}$/i.test(hex)) return Buffer.from(hex, 'hex');
+      const utf8 = unprotected.toString('utf8').trim();
+      if (/^[0-9a-f]{64}$/i.test(utf8)) return Buffer.from(utf8, 'hex');
+    } else {
+      // macOS / Linux 下如果有直接存 hex 或钥匙串导出
+      if (/^[0-9a-f]{64}$/i.test(raw)) return Buffer.from(raw, 'hex');
+    }
+  } catch {}
+  return null;
+}
+
+export function isEncrypted(v) {
+  return typeof v === 'string' && v.startsWith(ENC_PREFIX);
+}
+
+/** 解密 mrs1: 字符串 */
+export function decryptWithKey(value, key) {
+  if (!isEncrypted(value)) return value;
+  if (!key) throw new Error('缺少 mirasim master key，无法解密');
+  const raw = Buffer.from(value.slice(ENC_PREFIX.length), 'base64');
+  if (raw.length < 28) throw new Error('mrs1 格式长度不正确');
+  const iv = raw.subarray(0, 12);
+  const tag = raw.subarray(12, 28);
+  const ct = raw.subarray(28);
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ct), decipher.final()]).toString('utf8');
+}
+
+/** 加密成 mrs1: 字符串（切号写回时保证与客户端格式一致） */
+export function encryptWithKey(plain, key) {
+  if (!key) return plain;
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const ct = Buffer.concat([cipher.update(String(plain), 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return ENC_PREFIX + Buffer.concat([iv, tag, ct]).toString('base64');
+}
+
+// ── 本机探测 ──
+
+export function detectMirasim() {
+  const p = mirasimPaths();
+  const exists = fs.existsSync(p.setting);
+  let signedIn = false;
+  if (exists) {
+    const s = readJson(p.setting);
+    signedIn = Boolean(s && s.auth && (s.auth.token || s.auth.userId));
+  }
+  const clientPath = candidateClientPath();
+  return {
+    dataDir: p.home,
+    exists,
+    signedIn,
+    clientInstalled: Boolean(clientPath),
+    clientPath,
+    running: mirasimRunning(),
+  };
+}
+
+export function candidateClientPath() {
+  const home = os.homedir();
+  if (process.platform === 'win32') {
+    const local = process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
+    const p1 = path.join(local, 'Programs', '@mirasimdesktop', 'Mirasim.exe');
+    if (fs.existsSync(p1)) return p1;
+    const p2 = path.join(process.env.ProgramFiles || 'C:\\Program Files', '@mirasimdesktop', 'Mirasim.exe');
+    if (fs.existsSync(p2)) return p2;
+  } else if (process.platform === 'darwin') {
+    const p = '/Applications/Mirasim.app/Contents/MacOS/Mirasim';
+    if (fs.existsSync(p)) return p;
+  }
+  return null;
+}
+
+export function mirasimRunning() {
+  if (process.platform !== 'win32') return false;
+  try {
+    const out = execSync('tasklist /FI "IMAGENAME eq Mirasim.exe" /NH', { windowsHide: true, encoding: 'utf8' });
+    return /mirasim\.exe/i.test(out);
+  } catch { return false; }
+}
+
+const nap = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+
+export function terminateMirasim({ timeoutMs = 8000 } = {}) {
+  if (process.platform !== 'win32') return { closed: false, supported: false };
+  if (!mirasimRunning()) return { closed: false, running: false };
+  try { execSync('taskkill /IM Mirasim.exe /T', { windowsHide: true, stdio: 'ignore' }); } catch {}
+  let deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline && mirasimRunning()) nap(250);
+  if (mirasimRunning()) {
+    try { execSync('taskkill /IM Mirasim.exe /T /F', { windowsHide: true, stdio: 'ignore' }); } catch {}
+    deadline = Date.now() + 3000;
+    while (Date.now() < deadline && mirasimRunning()) nap(250);
+  }
+  return { closed: !mirasimRunning(), running: mirasimRunning() };
+}
+
+// ── 当前会话读取与切换 ──
+
+/** 读取当前登录的 mirasim 账号，返回标准化账号对象（供 addAccount / scan） */
+export async function liveToAccount() {
+  const p = mirasimPaths();
+  const s = readJson(p.setting);
+  if (!s || !s.auth || !s.auth.token) return null;
+
+  const key = await getMasterKey();
+  let token = s.auth.token;
+  let refreshToken = s.auth.refreshToken;
+  if (isEncrypted(token)) {
+    if (!key) {
+      // 明确区分「已登录但缺密钥」「解密失败」「未登录（返回 null）」
+      const where = process.platform === 'win32' ? `${p.secretKey} / ${p.secretKeyEnc}` : p.secretKey;
+      const err = new Error(`已登录但读不到 mirasim 密钥（已检查 ${where} 与环境变量 MIRASIM_SECRET_KEY / MIRASIM_APP_SECRET_KEY）。请完全退出全部 Mirasim 进程后重启并登录，再重新扫描`);
+      err.code = 'MISSING_SECRET_KEY';
+      throw err;
+    }
+    try {
+      token = decryptWithKey(token, key);
+      refreshToken = refreshToken ? decryptWithKey(refreshToken, key) : null;
+    } catch (e) {
+      const err = new Error(`解密凭据失败：${e.message}`);
+      err.code = 'DECRYPT_FAILED';
+      throw err;
+    }
+  }
+
+  const userId = s.auth.userId || (token.includes('.') ? (() => {
+    try { return JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString('utf8')).sub; } catch { return null; }
+  })() : null);
+
+  const expiresAt = s.auth.exp ? new Date(s.auth.exp * 1000).toISOString() : null;
+
+  return {
+    provider: 'mirasim',
+    token,
+    refreshToken,
+    uid: userId,
+    name: s.auth.name || null,
+    expiresAt,
+    source: 'local-app',
+    meta: {
+      encryptedAuth: s.auth, // 原始密文备份，切换时可原样写回
+      capturedAt: new Date().toISOString(),
+    },
+  };
+}
+
+export function currentMirasimUid() {
+  const p = mirasimPaths();
+  const s = readJson(p.setting);
+  return s?.auth?.userId || null;
+}
+
+/**
+ * 把刷新后的凭据写回 ~/.mirasim/setting.json（仅当该账号正是客户端当前登录时调用，
+ * 避免 mirasim 客户端拿着被轮换掉的旧 token 掉线）。保留 setting.json 其余字段原样。
+ * @returns {boolean} 是否发生了写回
+ */
+export async function writeMirasimAuth(account) {
+  const p = mirasimPaths();
+  const s = readJson(p.setting);
+  if (!s || !s.auth) return false;
+  if (!account?.uid || s.auth.userId !== account.uid) return false;
+  const key = await getMasterKey();
+  const enc = (v) => (key ? encryptWithKey(String(v), key) : String(v));
+  s.auth = {
+    ...s.auth,
+    token: enc(account.token),
+    refreshToken: account.refreshToken ? enc(account.refreshToken) : s.auth.refreshToken,
+    exp: account.expiresAt ? Math.floor(new Date(account.expiresAt).getTime() / 1000) : s.auth.exp,
+  };
+  atomicWriteJson(p.setting, s);
+  return true;
+}
+
+/**
+ * 切换 mirasim 当前登录账号
+ * @param {object} account 目标账号
+ * @param {{ force?: boolean }} opts
+ */
+export async function switchTo(account, { force = false } = {}) {
+  const p = mirasimPaths();
+  const s = readJson(p.setting) || {};
+  const currentUid = s.auth?.userId || null;
+  if (account.uid && currentUid && account.uid === currentUid) {
+    return { switched: false, alreadyActive: true };
+  }
+
+  if (!force && mirasimRunning()) {
+    const err = new Error('Mirasim 客户端正在运行，请先退出后再切换（或强制切换，切换后将自动重新拉起客户端）');
+    err.mirasimRunning = true;
+    throw err;
+  }
+
+  const key = await getMasterKey();
+  let authToWrite = null;
+
+  if (account.meta?.encryptedAuth) {
+    // 优先原样使用抓取到的加密密文
+    authToWrite = account.meta.encryptedAuth;
+  } else if (key) {
+    // 新增或从外部导入的账号：使用当前 master key 加密写回
+    authToWrite = {
+      token: encryptWithKey(account.token, key),
+      refreshToken: account.refreshToken ? encryptWithKey(account.refreshToken, key) : null,
+      userId: account.uid,
+      name: account.name || null,
+      exp: account.expiresAt ? Math.floor(new Date(account.expiresAt).getTime() / 1000) : null,
+    };
+  } else {
+    // 没有 master key 时明文写入（mirasim 支持 unencrypted fallback）
+    authToWrite = {
+      token: account.token,
+      refreshToken: account.refreshToken || null,
+      userId: account.uid,
+      name: account.name || null,
+      exp: account.expiresAt ? Math.floor(new Date(account.expiresAt).getTime() / 1000) : null,
+    };
+  }
+
+  s.auth = authToWrite;
+  atomicWriteJson(p.setting, s);
+  return { switched: true, alreadyActive: false };
+}