creditdaddy 1.2.0 → 1.3.2

package/src/winProc.js

@@ -0,0 +1,36 @@
+/**
+ * Windows 进程探测的公共实现。
+ *
+ * `tasklist.exe` 的输出跟随控制台代码页：中文系统上是 GBK，按 latin1/utf8 解码会得到乱码，
+ * 于是「没有运行的任务」那行匹配不上 → 探测函数把「进程不存在」误判成「正在运行」。
+ * （曾经真的踩过：qoderApp 用 latin1，中文 Windows 上 qoderRunning() 恒为 true，
+ *  导致切换永远报「Qoder 正在运行」，强制切换还会空等 11 秒。）
+ * 统一走这里，避免每个产品各写一份、各错一种。
+ */
+
+import { execFileSync } from 'node:child_process';
+
+/** tasklist 的 Buffer 输出 → 字符串（GBK 优先，解码器不可用时退回 utf8） */
+export function decodeTasklist(buf) {
+  try { return new TextDecoder('gbk').decode(buf); } catch { return buf.toString('utf8'); }
+}
+
+/** tasklist 在「无匹配」时输出的那行（各语言版本） */
+const NO_TASKS = /No Tasks|没有运行的任务|没有找到|没有任务/i;
+
+/**
+ * 任一 exe 是否在运行。
+ * @param {string|string[]} exes
+ * @returns {boolean} 查不到（命令不存在 / 超时）一律按「没在运行」处理，不阻塞调用方
+ */
+export function anyProcRunning(exes) {
+  if (process.platform !== 'win32') return false;
+  for (const exe of [].concat(exes)) {
+    try {
+      const out = decodeTasklist(execFileSync('tasklist.exe', ['/FI', `IMAGENAME eq ${exe}`, '/NH'],
+        { windowsHide: true, encoding: 'buffer', timeout: 8000 }));
+      if (!NO_TASKS.test(out)) return true;
+    } catch { /* 查不到就换下一名 */ }
+  }
+  return false;
+}

package/src/workbuddyLocal.js

@@ -1,133 +1,133 @@
-/**
- * 本机 WorkBuddy 客户端凭据 — 读取已登录账号、切换当前账号。
- *
- * WorkBuddy（与 CodeBuddy CLI / 插件共用）把会话存成明文 JSON：
- *   Windows: %LOCALAPPDATA%\CodeBuddyExtension\Data\Public\auth\<认证ID>.info
- *   macOS:   ~/Library/Application Support/CodeBuddyExtension/Data/Public/auth/
- *   Linux:   ~/.local/share/CodeBuddyExtension/Data/Public/auth/
- * 当前会话是 workbuddy-desktop.info（国际版客户端可能用其他认证 ID），带时间戳的同名文件是客户端留下的历史会话。
- * 文件结构：{ account: { uid, nickname, phoneNumber, enterpriseId… }, auth: { accessToken, refreshToken, expiresAt, domain… }, accounts: [...] }
- *
- * 切换账号：原子写入会话文件 + 删除同目录的 "<文件>.logged-out" 登出标记；
- * WorkBuddy 监听该文件，外部改动会被直接应用（客户端日志 "External change applied to session"）。
- */
-
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import { inspectToken } from './workbuddyClient.js';
-
-export function workbuddyAuthDir() {
-  const home = os.homedir();
-  const tail = ['CodeBuddyExtension', 'Data', 'Public', 'auth'];
-  if (process.platform === 'win32') {
-    return path.join(process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local'), ...tail);
-  }
-  if (process.platform === 'darwin') return path.join(home, 'Library', 'Application Support', ...tail);
-  return path.join(process.env.XDG_DATA_HOME || path.join(home, '.local', 'share'), ...tail);
-}
-
-const CURRENT_RE = /^[a-z0-9-]+\.info$/i;           // workbuddy-desktop.info
-const HISTORY_RE = /^[a-z0-9-]+\.\d{4}-.*\.info$/i;  // workbuddy-desktop.<时间戳>.<pid>.<uuid>.info
-
-/** 会话 JSON → 账号记录（供 addAccount），不含网络请求 */
-export function sessionToAccount(session, source) {
-  const token = session?.auth?.accessToken;
-  if (typeof token !== 'string' || !token) return null;
-  const info = inspectToken(token);
-  if (!info.provider) return null;
-  const acc = session.account || {};
-  const auth = session.auth || {};
-  const iso = (ms) => (Number.isFinite(ms) ? new Date(ms).toISOString() : null);
-  // 除 token 外的会话字段原样保留，切换账号时用来还原会话文件
-  const { accessToken: _a, refreshToken: _r, ...authRest } = auth;
-  return {
-    provider: info.provider,
-    token,
-    refreshToken: auth.refreshToken || null,
-    expiresAt: iso(auth.expiresAt) || info.expiresAt,
-    uid: acc.uid || info.uid,
-    name: acc.nickname || acc.name || null,
-    email: acc.email || null,
-    source,
-    meta: {
-      domain: auth.domain || info.host,
-      enterpriseId: acc.enterpriseId || null,
-      phone: acc.phoneNumber || null,
-      refreshExpiresAt: iso(auth.refreshExpiresAt),
-      session: {
-        account: acc, auth: authRest, accounts: Array.isArray(session.accounts) ? session.accounts : [],
-        ...(Array.isArray(session.allAccounts) ? { allAccounts: session.allAccounts } : {}),
-      },
-    },
-  };
-}
-
-/**
- * 读取本机 WorkBuddy 会话：当前会话 + 历史会话（按 uid 去重，保留最新）。
- * @returns {{ dir, accounts: Array<{...账号记录, current: boolean, file, fileTime}>, errors }}
- */
-export function readWorkbuddySessions() {
-  const dir = workbuddyAuthDir();
-  const out = { dir, accounts: [], errors: [] };
-  let names = [];
-  try { names = fs.readdirSync(dir); } catch { return out; }
-  const byUid = new Map();
-  for (const name of names) {
-    if (!CURRENT_RE.test(name) && !HISTORY_RE.test(name)) continue;
-    const file = path.join(dir, name);
-    try {
-      const current = !HISTORY_RE.test(name);
-      if (current && fs.existsSync(`${file}.logged-out`)) continue;   // 已登出
-      const rec = sessionToAccount(JSON.parse(fs.readFileSync(file, 'utf8')), current ? 'WorkBuddy 当前登录' : 'WorkBuddy 历史会话');
-      if (!rec) continue;
-      const fileTime = fs.statSync(file).mtimeMs;
-      const item = { ...rec, current, file, fileTime };
-      const prev = byUid.get(rec.uid);
-      if (!prev || (current && !prev.current) || (current === prev.current && fileTime > prev.fileTime)) byUid.set(rec.uid, item);
-    } catch (e) {
-      out.errors.push({ file, error: e.message });
-    }
-  }
-  out.accounts = [...byUid.values()].sort((a, b) => b.current - a.current || b.fileTime - a.fileTime);
-  return out;
-}
-
-/** 当前 WorkBuddy 客户端登录的 uid（未登录返回 null） */
-export function currentWorkbuddyUid() {
-  return readWorkbuddySessions().accounts.find((a) => a.current)?.uid || null;
-}
-
-/**
- * 把账号写成 WorkBuddy 当前会话（切换账号）。需要账号带有导入时保存的会话信息。
- * @returns {{ file, previousUid }}
- */
-export function writeWorkbuddySession(account) {
-  const s = account.meta?.session;
-  if (!s?.account) throw new Error('该账号缺少 WorkBuddy 会话信息，请从本机重新导入后再切换');
-  const dir = workbuddyAuthDir();
-  fs.mkdirSync(dir, { recursive: true });
-  const file = path.join(dir, 'workbuddy-desktop.info');
-  let previousUid = null;
-  try { previousUid = JSON.parse(fs.readFileSync(file, 'utf8'))?.account?.uid || null; } catch {}
-
-  const ms = (iso) => (iso ? new Date(iso).getTime() : undefined);
-  const session = {
-    account: s.account,
-    auth: {
-      ...s.auth,
-      accessToken: account.token,
-      refreshToken: account.refreshToken || s.auth?.refreshToken,
-      expiresAt: ms(account.expiresAt) ?? s.auth?.expiresAt,
-      lastRefreshTime: Date.now(),
-    },
-    accounts: s.accounts || [],
-    ...(Array.isArray(s.allAccounts) ? { allAccounts: s.allAccounts } : {}),
-  };
-  const tmp = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify(session, null, 2), { mode: 0o600 });
-  fs.renameSync(tmp, file);
-  try { fs.unlinkSync(`${file}.logged-out`); } catch {}
-  return { file, previousUid };
-}
+/**
+ * 本机 WorkBuddy 客户端凭据 — 读取已登录账号、切换当前账号。
+ *
+ * WorkBuddy（与 CodeBuddy CLI / 插件共用）把会话存成明文 JSON：
+ *   Windows: %LOCALAPPDATA%\CodeBuddyExtension\Data\Public\auth\<认证ID>.info
+ *   macOS:   ~/Library/Application Support/CodeBuddyExtension/Data/Public/auth/
+ *   Linux:   ~/.local/share/CodeBuddyExtension/Data/Public/auth/
+ * 当前会话是 workbuddy-desktop.info（国际版客户端可能用其他认证 ID），带时间戳的同名文件是客户端留下的历史会话。
+ * 文件结构：{ account: { uid, nickname, phoneNumber, enterpriseId… }, auth: { accessToken, refreshToken, expiresAt, domain… }, accounts: [...] }
+ *
+ * 切换账号：原子写入会话文件 + 删除同目录的 "<文件>.logged-out" 登出标记；
+ * WorkBuddy 监听该文件，外部改动会被直接应用（客户端日志 "External change applied to session"）。
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { inspectToken } from './workbuddyClient.js';
+
+export function workbuddyAuthDir() {
+  const home = os.homedir();
+  const tail = ['CodeBuddyExtension', 'Data', 'Public', 'auth'];
+  if (process.platform === 'win32') {
+    return path.join(process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local'), ...tail);
+  }
+  if (process.platform === 'darwin') return path.join(home, 'Library', 'Application Support', ...tail);
+  return path.join(process.env.XDG_DATA_HOME || path.join(home, '.local', 'share'), ...tail);
+}
+
+const CURRENT_RE = /^[a-z0-9-]+\.info$/i;           // workbuddy-desktop.info
+const HISTORY_RE = /^[a-z0-9-]+\.\d{4}-.*\.info$/i;  // workbuddy-desktop.<时间戳>.<pid>.<uuid>.info
+
+/** 会话 JSON → 账号记录（供 addAccount），不含网络请求 */
+export function sessionToAccount(session, source) {
+  const token = session?.auth?.accessToken;
+  if (typeof token !== 'string' || !token) return null;
+  const info = inspectToken(token);
+  if (!info.provider) return null;
+  const acc = session.account || {};
+  const auth = session.auth || {};
+  const iso = (ms) => (Number.isFinite(ms) ? new Date(ms).toISOString() : null);
+  // 除 token 外的会话字段原样保留，切换账号时用来还原会话文件
+  const { accessToken: _a, refreshToken: _r, ...authRest } = auth;
+  return {
+    provider: info.provider,
+    token,
+    refreshToken: auth.refreshToken || null,
+    expiresAt: iso(auth.expiresAt) || info.expiresAt,
+    uid: acc.uid || info.uid,
+    name: acc.nickname || acc.name || null,
+    email: acc.email || null,
+    source,
+    meta: {
+      domain: auth.domain || info.host,
+      enterpriseId: acc.enterpriseId || null,
+      phone: acc.phoneNumber || null,
+      refreshExpiresAt: iso(auth.refreshExpiresAt),
+      session: {
+        account: acc, auth: authRest, accounts: Array.isArray(session.accounts) ? session.accounts : [],
+        ...(Array.isArray(session.allAccounts) ? { allAccounts: session.allAccounts } : {}),
+      },
+    },
+  };
+}
+
+/**
+ * 读取本机 WorkBuddy 会话：当前会话 + 历史会话（按 uid 去重，保留最新）。
+ * @returns {{ dir, accounts: Array<{...账号记录, current: boolean, file, fileTime}>, errors }}
+ */
+export function readWorkbuddySessions() {
+  const dir = workbuddyAuthDir();
+  const out = { dir, accounts: [], errors: [] };
+  let names = [];
+  try { names = fs.readdirSync(dir); } catch { return out; }
+  const byUid = new Map();
+  for (const name of names) {
+    if (!CURRENT_RE.test(name) && !HISTORY_RE.test(name)) continue;
+    const file = path.join(dir, name);
+    try {
+      const current = !HISTORY_RE.test(name);
+      if (current && fs.existsSync(`${file}.logged-out`)) continue;   // 已登出
+      const rec = sessionToAccount(JSON.parse(fs.readFileSync(file, 'utf8')), current ? 'WorkBuddy 当前登录' : 'WorkBuddy 历史会话');
+      if (!rec) continue;
+      const fileTime = fs.statSync(file).mtimeMs;
+      const item = { ...rec, current, file, fileTime };
+      const prev = byUid.get(rec.uid);
+      if (!prev || (current && !prev.current) || (current === prev.current && fileTime > prev.fileTime)) byUid.set(rec.uid, item);
+    } catch (e) {
+      out.errors.push({ file, error: e.message });
+    }
+  }
+  out.accounts = [...byUid.values()].sort((a, b) => b.current - a.current || b.fileTime - a.fileTime);
+  return out;
+}
+
+/** 当前 WorkBuddy 客户端登录的 uid（未登录返回 null） */
+export function currentWorkbuddyUid() {
+  return readWorkbuddySessions().accounts.find((a) => a.current)?.uid || null;
+}
+
+/**
+ * 把账号写成 WorkBuddy 当前会话（切换账号）。需要账号带有导入时保存的会话信息。
+ * @returns {{ file, previousUid }}
+ */
+export function writeWorkbuddySession(account) {
+  const s = account.meta?.session;
+  if (!s?.account) throw new Error('该账号缺少 WorkBuddy 会话信息，请从本机重新导入后再切换');
+  const dir = workbuddyAuthDir();
+  fs.mkdirSync(dir, { recursive: true });
+  const file = path.join(dir, 'workbuddy-desktop.info');
+  let previousUid = null;
+  try { previousUid = JSON.parse(fs.readFileSync(file, 'utf8'))?.account?.uid || null; } catch {}
+
+  const ms = (iso) => (iso ? new Date(iso).getTime() : undefined);
+  const session = {
+    account: s.account,
+    auth: {
+      ...s.auth,
+      accessToken: account.token,
+      refreshToken: account.refreshToken || s.auth?.refreshToken,
+      expiresAt: ms(account.expiresAt) ?? s.auth?.expiresAt,
+      lastRefreshTime: Date.now(),
+    },
+    accounts: s.accounts || [],
+    ...(Array.isArray(s.allAccounts) ? { allAccounts: s.allAccounts } : {}),
+  };
+  const tmp = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(session, null, 2), { mode: 0o600 });
+  fs.renameSync(tmp, file);
+  try { fs.unlinkSync(`${file}.logged-out`); } catch {}
+  return { file, previousUid };
+}

package/src/zcodeAuth.js

@@ -1,131 +1,131 @@
-/**
- * ZCode 浏览器登录 — 与 ZCode 客户端的「CLI 轮询登录」同一协议（无需 zcode:// 回调，任何浏览器都能用）：
- *
- *   1. POST https://zcode.z.ai/api/v1/oauth/cli/init   Authorization: Bearer <本地随机 poll token>
- *      {provider: 'bigmodel' | 'zai'} → {flow_id, authorize_url, expires_at, poll_interval_sec}
- *      authorize_url 的回调指向 zcode.z.ai 自己的 /oauth/cli/callback，由服务端完成换 token
- *   2. 用户在浏览器（桌面版为隐私窗口）打开 authorize_url 登录授权
- *   3. GET /api/v1/oauth/cli/poll/{flow_id}（同一 poll token）→ status pending / ready / failed
- *      ready 时带 token（zcode JWT）、user、bigmodel{access_token, refresh_token} 或 zai{access_token}
- *   4. Z.ai 的 access_token 还要换一次业务 token：POST https://api.z.ai/api/auth/z/login {token}
- *
- * 拿到的凭据按客户端 credentials.json 的格式（enc:v1 加密）组装，存进账号 meta，
- * 之后与「本机导入」的账号完全一样：可查额度、可一键切换到 ZCode 客户端。
- */
-
-import crypto from 'node:crypto';
-import * as zc from './zcrypto.js';
-import { zcodePaths } from './zcodeLocal.js';
-import { FETCH_TIMEOUT_MS } from './constants.js';
-
-const API_BASE = 'https://zcode.z.ai';
-const ZAI_BUSINESS_LOGIN_URL = 'https://api.z.ai/api/auth/z/login';
-
-async function fetchJson(url, init = {}) {
-  const res = await fetch(url, { ...init, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
-  const text = await res.text();
-  let body = null;
-  try { body = text ? JSON.parse(text) : null; } catch {}
-  return { res, body };
-}
-
-const str = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);
-
-/** kind: 'zcode-bigmodel'（智谱 BigModel）| 'zcode-zai'（Z.ai 国际） */
-export async function startZcodeLogin(kind) {
-  const provider = kind === 'zcode-zai' ? 'zai' : 'bigmodel';
-  const pollToken = crypto.randomBytes(32).toString('hex');
-  const { res, body } = await fetchJson(API_BASE + '/api/v1/oauth/cli/init', {
-    method: 'POST',
-    headers: { Authorization: 'Bearer ' + pollToken, 'Content-Type': 'application/json', Accept: 'application/json' },
-    body: JSON.stringify({ provider }),
-  });
-  const d = body?.data;
-  if (!res.ok || body?.code !== 0 || !str(d?.flow_id) || !str(d?.authorize_url)) {
-    throw new Error('ZCode 登录初始化失败：' + (body?.msg || 'HTTP ' + res.status));
-  }
-  if (!d.authorize_url.startsWith('https://')) throw new Error('ZCode 登录初始化返回了非 https 授权地址');
-  const expiresInMs = Number.isFinite(d.expires_at) ? d.expires_at * 1000 - Date.now() : 5 * 60e3;
-  return {
-    url: d.authorize_url,
-    expiresInMs: Math.max(60e3, Math.min(expiresInMs, 15 * 60e3)),
-    intervalMs: Math.max(1000, (Number(d.poll_interval_sec) || 2) * 1000),
-    data: { provider, flowId: d.flow_id, pollToken },
-  };
-}
-
-/** 单次轮询：{status:'pending'} | {status:'ok', input}；失败抛错 */
-export async function pollZcodeLogin(data) {
-  const { res, body } = await fetchJson(API_BASE + '/api/v1/oauth/cli/poll/' + encodeURIComponent(data.flowId), {
-    headers: { Authorization: 'Bearer ' + data.pollToken, Accept: 'application/json' },
-  });
-  if (res.status >= 500 || res.status === 408 || res.status === 429) return { status: 'pending' };
-  if (!res.ok || body?.code !== 0) throw new Error('ZCode 授权失败：' + (body?.msg || 'HTTP ' + res.status));
-  const d = body.data || {};
-  if (d.status === 'pending') return { status: 'pending' };
-  if (d.status === 'failed') throw new Error('ZCode 授权失败（用户取消或授权被拒绝）');
-  if (d.status !== 'ready') throw new Error('ZCode 授权返回未知状态：' + d.status);
-
-  const jwt = str(d.token);
-  const user = d.user && typeof d.user === 'object' ? d.user : {};
-  const userId = user.user_id !== undefined && user.user_id !== null ? String(user.user_id) : null;
-  let accessToken = data.provider === 'zai' ? str(d.zai?.access_token) : str(d.bigmodel?.access_token) || str(d.bigmodel?.accessToken);
-  const refreshToken = data.provider === 'bigmodel' ? str(d.bigmodel?.refresh_token) || str(d.bigmodel?.refreshToken) : null;
-  if (!jwt || !accessToken || !userId) throw new Error('ZCode 授权返回缺少 token / 用户信息（上游结构可能变化）');
-  if (data.provider === 'zai') accessToken = await resolveZaiBusinessToken(accessToken);
-
-  return { status: 'ok', input: buildAccountInput({ provider: data.provider, jwt, accessToken, refreshToken, user, userId }) };
-}
-
-/** Z.ai OAuth token → 业务 access token（与客户端 ZaiBusinessTokenResolver 一致） */
-async function resolveZaiBusinessToken(oauthToken) {
-  const { res, body } = await fetchJson(ZAI_BUSINESS_LOGIN_URL, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-    body: JSON.stringify({ token: oauthToken }),
-  });
-  const ok = res.ok && (body?.code === undefined || body.code === 0 || body.code === 200) && body?.success !== false;
-  const t = str(body?.data?.access_token) || str(body?.data?.accessToken);
-  if (!ok || !t) throw new Error('Z.ai 业务 token 交换失败：' + (body?.msg || 'HTTP ' + res.status));
-  return t;
-}
-
-/** 按 ZCode credentials.json 的键名组装并用本机密钥加密（与客户端写出的格式一致） */
-export function buildCredentials({ provider, jwt, accessToken, refreshToken, user, userId }, secret) {
-  const label = str(user.name) || str(user.email) || userId;
-  const userInfo = {
-    id: userId, username: label, displayName: label,
-    ...(str(user.avatar) ? { avatarUrl: user.avatar } : {}),
-    rawProfile: user,
-  };
-  const enc = (v) => zc.encryptWithSecret(v, secret);
-  const creds = {
-    'oauth:active_provider': enc(provider),
-    [`oauth:${provider}:access_token`]: enc(accessToken),
-    [`oauth:${provider}:user_info`]: enc(JSON.stringify(userInfo)),
-    zcodejwttoken: enc(jwt),
-  };
-  if (refreshToken) creds[`oauth:${provider}:refresh_token`] = enc(refreshToken);
-  return creds;
-}
-
-function buildAccountInput(parts) {
-  const secret = zc.defaultSecret(zcodePaths().home);
-  const credentials = buildCredentials(parts, secret);
-  const id = zc.identityWithSecret(credentials, secret);
-  return {
-    provider: 'zcode',
-    token: `zcode-creds:${parts.userId}`,   // 与本机导入同一标记，同一用户自动去重 / 续期
-    uid: parts.userId,
-    name: zc.identityLabel(id),
-    email: str(parts.user.email),
-    source: 'browser',
-    // 不带 config / deviceMid：同一账号再次登录时保留已保存的客户端配置与虚拟设备 ID
-    meta: {
-      credentials,
-      canonicalHash: zc.canonicalHash(credentials),
-      capturedAt: new Date().toISOString(),
-      loginProvider: parts.provider,
-    },
-  };
-}
+/**
+ * ZCode 浏览器登录 — 与 ZCode 客户端的「CLI 轮询登录」同一协议（无需 zcode:// 回调，任何浏览器都能用）：
+ *
+ *   1. POST https://zcode.z.ai/api/v1/oauth/cli/init   Authorization: Bearer <本地随机 poll token>
+ *      {provider: 'bigmodel' | 'zai'} → {flow_id, authorize_url, expires_at, poll_interval_sec}
+ *      authorize_url 的回调指向 zcode.z.ai 自己的 /oauth/cli/callback，由服务端完成换 token
+ *   2. 用户在浏览器（桌面版为隐私窗口）打开 authorize_url 登录授权
+ *   3. GET /api/v1/oauth/cli/poll/{flow_id}（同一 poll token）→ status pending / ready / failed
+ *      ready 时带 token（zcode JWT）、user、bigmodel{access_token, refresh_token} 或 zai{access_token}
+ *   4. Z.ai 的 access_token 还要换一次业务 token：POST https://api.z.ai/api/auth/z/login {token}
+ *
+ * 拿到的凭据按客户端 credentials.json 的格式（enc:v1 加密）组装，存进账号 meta，
+ * 之后与「本机导入」的账号完全一样：可查额度、可一键切换到 ZCode 客户端。
+ */
+
+import crypto from 'node:crypto';
+import * as zc from './zcrypto.js';
+import { zcodePaths } from './zcodeLocal.js';
+import { FETCH_TIMEOUT_MS } from './constants.js';
+
+const API_BASE = 'https://zcode.z.ai';
+const ZAI_BUSINESS_LOGIN_URL = 'https://api.z.ai/api/auth/z/login';
+
+async function fetchJson(url, init = {}) {
+  const res = await fetch(url, { ...init, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+  const text = await res.text();
+  let body = null;
+  try { body = text ? JSON.parse(text) : null; } catch {}
+  return { res, body };
+}
+
+const str = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);
+
+/** kind: 'zcode-bigmodel'（智谱 BigModel）| 'zcode-zai'（Z.ai 国际） */
+export async function startZcodeLogin(kind) {
+  const provider = kind === 'zcode-zai' ? 'zai' : 'bigmodel';
+  const pollToken = crypto.randomBytes(32).toString('hex');
+  const { res, body } = await fetchJson(API_BASE + '/api/v1/oauth/cli/init', {
+    method: 'POST',
+    headers: { Authorization: 'Bearer ' + pollToken, 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({ provider }),
+  });
+  const d = body?.data;
+  if (!res.ok || body?.code !== 0 || !str(d?.flow_id) || !str(d?.authorize_url)) {
+    throw new Error('ZCode 登录初始化失败：' + (body?.msg || 'HTTP ' + res.status));
+  }
+  if (!d.authorize_url.startsWith('https://')) throw new Error('ZCode 登录初始化返回了非 https 授权地址');
+  const expiresInMs = Number.isFinite(d.expires_at) ? d.expires_at * 1000 - Date.now() : 5 * 60e3;
+  return {
+    url: d.authorize_url,
+    expiresInMs: Math.max(60e3, Math.min(expiresInMs, 15 * 60e3)),
+    intervalMs: Math.max(1000, (Number(d.poll_interval_sec) || 2) * 1000),
+    data: { provider, flowId: d.flow_id, pollToken },
+  };
+}
+
+/** 单次轮询：{status:'pending'} | {status:'ok', input}；失败抛错 */
+export async function pollZcodeLogin(data) {
+  const { res, body } = await fetchJson(API_BASE + '/api/v1/oauth/cli/poll/' + encodeURIComponent(data.flowId), {
+    headers: { Authorization: 'Bearer ' + data.pollToken, Accept: 'application/json' },
+  });
+  if (res.status >= 500 || res.status === 408 || res.status === 429) return { status: 'pending' };
+  if (!res.ok || body?.code !== 0) throw new Error('ZCode 授权失败：' + (body?.msg || 'HTTP ' + res.status));
+  const d = body.data || {};
+  if (d.status === 'pending') return { status: 'pending' };
+  if (d.status === 'failed') throw new Error('ZCode 授权失败（用户取消或授权被拒绝）');
+  if (d.status !== 'ready') throw new Error('ZCode 授权返回未知状态：' + d.status);
+
+  const jwt = str(d.token);
+  const user = d.user && typeof d.user === 'object' ? d.user : {};
+  const userId = user.user_id !== undefined && user.user_id !== null ? String(user.user_id) : null;
+  let accessToken = data.provider === 'zai' ? str(d.zai?.access_token) : str(d.bigmodel?.access_token) || str(d.bigmodel?.accessToken);
+  const refreshToken = data.provider === 'bigmodel' ? str(d.bigmodel?.refresh_token) || str(d.bigmodel?.refreshToken) : null;
+  if (!jwt || !accessToken || !userId) throw new Error('ZCode 授权返回缺少 token / 用户信息（上游结构可能变化）');
+  if (data.provider === 'zai') accessToken = await resolveZaiBusinessToken(accessToken);
+
+  return { status: 'ok', input: buildAccountInput({ provider: data.provider, jwt, accessToken, refreshToken, user, userId }) };
+}
+
+/** Z.ai OAuth token → 业务 access token（与客户端 ZaiBusinessTokenResolver 一致） */
+async function resolveZaiBusinessToken(oauthToken) {
+  const { res, body } = await fetchJson(ZAI_BUSINESS_LOGIN_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({ token: oauthToken }),
+  });
+  const ok = res.ok && (body?.code === undefined || body.code === 0 || body.code === 200) && body?.success !== false;
+  const t = str(body?.data?.access_token) || str(body?.data?.accessToken);
+  if (!ok || !t) throw new Error('Z.ai 业务 token 交换失败：' + (body?.msg || 'HTTP ' + res.status));
+  return t;
+}
+
+/** 按 ZCode credentials.json 的键名组装并用本机密钥加密（与客户端写出的格式一致） */
+export function buildCredentials({ provider, jwt, accessToken, refreshToken, user, userId }, secret) {
+  const label = str(user.name) || str(user.email) || userId;
+  const userInfo = {
+    id: userId, username: label, displayName: label,
+    ...(str(user.avatar) ? { avatarUrl: user.avatar } : {}),
+    rawProfile: user,
+  };
+  const enc = (v) => zc.encryptWithSecret(v, secret);
+  const creds = {
+    'oauth:active_provider': enc(provider),
+    [`oauth:${provider}:access_token`]: enc(accessToken),
+    [`oauth:${provider}:user_info`]: enc(JSON.stringify(userInfo)),
+    zcodejwttoken: enc(jwt),
+  };
+  if (refreshToken) creds[`oauth:${provider}:refresh_token`] = enc(refreshToken);
+  return creds;
+}
+
+function buildAccountInput(parts) {
+  const secret = zc.defaultSecret(zcodePaths().home);
+  const credentials = buildCredentials(parts, secret);
+  const id = zc.identityWithSecret(credentials, secret);
+  return {
+    provider: 'zcode',
+    token: `zcode-creds:${parts.userId}`,   // 与本机导入同一标记，同一用户自动去重 / 续期
+    uid: parts.userId,
+    name: zc.identityLabel(id),
+    email: str(parts.user.email),
+    source: 'browser',
+    // 不带 config / deviceMid：同一账号再次登录时保留已保存的客户端配置与虚拟设备 ID
+    meta: {
+      credentials,
+      canonicalHash: zc.canonicalHash(credentials),
+      capturedAt: new Date().toISOString(),
+      loginProvider: parts.provider,
+    },
+  };
+}