creditdaddy 1.2.0 → 1.3.2

package/src/daemon.js

@@ -18,7 +18,7 @@
  *   POST   /api/accounts/:id/zcode/claim   ZCode 领取活动 {planId, captchaParam?, region?}
  *   GET    /api/zcode/captcha-config       ZCode 领取验证码配置（sceneId / prefix / region）
  *   POST   /api/checkin                全部签到 {provider?, skipIfCheckedToday?}
- *   POST   /api/auth/device/start      发起浏览器登录 {provider: qoder / qoder-cn / workbuddy / workbuddy-intl / zcode-bigmodel / zcode-zai}
+ *   POST   /api/auth/device/start      发起浏览器登录 {provider: qoder / qoder-cn / workbuddy / workbuddy-intl / zcode-bigmodel / zcode-zai / minimax}
  *   POST   /api/auth/device/poll       轮询浏览器登录结果 {sessionId}
  *   GET    /api/local/detect           检测本机 Qoder 客户端 / IDE / CLI
  *   POST   /api/local/scan             读取本机已登录账号（解密客户端凭据 + 扫描旧版 IDE）
@@ -48,7 +48,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { logger, getLogs } from './logger.js';
 import {
-  loadAccounts, loadState, withAccounts, publicAccount, dataDir, loadSettings, saveSettings,
+  loadAccounts, loadState, withAccounts, publicAccount, dataDir, loadSettings, saveSettings, withSettings,
 } from './store.js';
 import { addAccount, importAccounts, refreshContext } from './accounts.js';
 import { productImpl } from './providers.js';
@@ -57,6 +57,9 @@ import { liveToAccount as zcodeLiveAccount, switchTo as zcodeSwitchTo, currentZc
 import { liveToAccount as mirasimLiveAccount, switchTo as mirasimSwitchTo, currentMirasimUid, detectMirasim, terminateMirasim, mirasimRunning } from './mirasimLocal.js';
 import { liveToAccount as catpawLiveAccount, switchTo as catpawSwitchTo, currentCatpawToken, detectCatpaw, terminateCatpaw } from './catpawLocal.js';
 import { liveToAccount as traeLiveAccount, detectTrae, switchTo as traeSwitchTo, snapshotLive as traeSnapshotLive } from './traeLocal.js';
+import { liveToAccount as minimaxLiveAccount, detectMiniMax, currentMiniMaxUid, currentMiniMaxToken, currentMiniMaxRecordKey } from './minimaxLocal.js';
+import * as minimaxGateway from './minimaxGateway.js';
+import * as traeGateway from './traeGateway.js';
 import { fetchClaimPlans, claimPlan, fetchCaptchaConfig, proxyFirst, setProxyFirst, proxyUrl, setProxyUrl, autoClaimEnabled, autoClaimUntil, setAutoClaimEnabled, claimIntervalMin, setClaimIntervalMin, claimWindowMin, setClaimWindowMin } from './zcodeClient.js';
 import { exportAccounts, parseImport, TransferError } from './transfer.js';
 import { syncAccountsTo10r } from './tenrouterAccounts.js';
@@ -69,7 +72,7 @@ import { startDeviceFlow, pollDeviceFlow, LOGIN_KINDS } from './authDevice.js';
 import { detectInstalls, scanLocalTokens, putCandidate, peekCandidate } from './localDetect.js';
 import { PROVIDER_LABEL, APP_VERSION, PROVIDERS, PROJECT_URL } from './constants.js';
 
-const PRODUCT_IDS = ['qoder', 'workbuddy', 'zcode', 'mirasim', 'catpaw', 'trae'];
+const PRODUCT_IDS = ['qoder', 'workbuddy', 'zcode', 'mirasim', 'catpaw', 'trae', 'minimax'];
 
 /** 面板访问密码：面板「设置」写入的 settings.json.panelKey 优先（可设 / 可关）；
  *  未设置（或被面板关闭）时回退环境变量 CREDITDADDY_PASSWORD（fnOS / 命令行部署注入），
@@ -383,6 +386,52 @@ async function handleApi(req, res, url) {
     }
     return json(res, 200, await zcodeGateway.gatewayStatus());
   }
+  // MiniMax 本地网关控制
+  if (p === '/api/minimax-gateway' && method === 'GET') {
+    return json(res, 200, await minimaxGateway.gatewayStatus());
+  }
+  if (p === '/api/minimax-gateway' && method === 'PUT') {
+    const body = await readBody(req).catch(() => ({}));
+    if (body?.enabled !== undefined) await minimaxGateway.setGatewayEnabled(body.enabled === true);
+    if (body?.lan !== undefined || body?.allow !== undefined) {
+      const patch = {};
+      if (body?.lan !== undefined) patch.minimaxGatewayLan = body.lan === true;
+      if (body?.allow !== undefined) {
+        if (!Array.isArray(body.allow)) return json(res, 400, { error: 'allow 需为字符串数组' });
+        const cleaned = [...new Set(body.allow.map((x) => String(x || '').trim()).filter(Boolean))];
+        if (cleaned.some((x) => /[^\w.*:-]/.test(x))) return json(res, 400, { error: '白名单条目只能是 IP / 主机名（支持 192.168.31.* 通配）' });
+        patch.minimaxGatewayAllow = cleaned;
+      }
+      await (await import('./store.js')).saveSettings(patch);
+      const lanNow = patch.minimaxGatewayLan ?? (await (await import('./store.js')).loadSettings()).minimaxGatewayLan === true;
+      const allowText = patch.minimaxGatewayAllow ? patch.minimaxGatewayAllow.join(', ') : '';
+      logger.info('DAEMON', `MiniMax 网关局域网：${lanNow ? '开' : '关（仅本机）'}${allowText ? `，白名单：${allowText}` : ''}（绑定改动重启后生效）`);
+    }
+    return json(res, 200, await minimaxGateway.gatewayStatus());
+  }
+  // Trae 本地网关控制
+  if (p === '/api/trae-gateway' && method === 'GET') {
+    return json(res, 200, await traeGateway.gatewayStatus());
+  }
+  if (p === '/api/trae-gateway' && method === 'PUT') {
+    const body = await readBody(req).catch(() => ({}));
+    if (body?.enabled !== undefined) await traeGateway.setGatewayEnabled(body.enabled === true);
+    if (body?.lan !== undefined || body?.allow !== undefined) {
+      const patch = {};
+      if (body?.lan !== undefined) patch.traeGatewayLan = body.lan === true;
+      if (body?.allow !== undefined) {
+        if (!Array.isArray(body.allow)) return json(res, 400, { error: 'allow 需为字符串数组' });
+        const cleaned = [...new Set(body.allow.map((x) => String(x || '').trim()).filter(Boolean))];
+        if (cleaned.some((x) => /[^\w.*:-]/.test(x))) return json(res, 400, { error: '白名单条目只能是 IP / 主机名（支持 192.168.31.* 通配）' });
+        patch.traeGatewayAllow = cleaned;
+      }
+      await (await import('./store.js')).saveSettings(patch);
+      const lanNow = patch.traeGatewayLan ?? (await (await import('./store.js')).loadSettings()).traeGatewayLan === true;
+      const allowText = patch.traeGatewayAllow ? patch.traeGatewayAllow.join(', ') : '';
+      logger.info('DAEMON', `Trae 网关局域网：${lanNow ? '开' : '关（仅本机）'}${allowText ? `，白名单：${allowText}` : ''}（绑定改动重启后生效）`);
+    }
+    return json(res, 200, await traeGateway.gatewayStatus());
+  }
   if (p === '/api/zcode/net' && method === 'GET') {
     const u = proxyUrl();
     const masked = u ? (() => { try { const x = new URL(u); x.password = x.password ? '*'.repeat(4) : ''; return x.toString(); } catch { return '***'; } })() : null;
@@ -598,8 +647,12 @@ async function handleApi(req, res, url) {
     });
     if (!bound) {
       // 登录窗口可能先于设备码入库关闭：暂存待绑定会话，addAccount 补全 uid 后自动挂上
-      const pending = (await loadSettings()).pendingQoderWebSessions || {};
-      await saveSettings({ pendingQoderWebSessions: { ...pending, [probe.user_id]: { kind, cookie, capturedAt: now } } });
+      await withSettings((settings) => {
+        settings.pendingQoderWebSessions = {
+          ...(settings.pendingQoderWebSessions || {}),
+          [probe.user_id]: { kind, cookie, capturedAt: now },
+        };
+      });
       logger.info('DAEMON', `收到 Qoder 网页会话（uid ${probe.user_id.slice(0, 8)}…），暂无匹配账号，已暂存待绑定`);
     } else {
       logger.info('DAEMON', `已绑定 Qoder 网页会话到 ${bound} 个账号（逐资源包明细可用）`);
@@ -609,7 +662,7 @@ async function handleApi(req, res, url) {
 
   // ── 本机检测 / 凭据扫描 ──
   if (p === '/api/local/detect' && method === 'GET') {
-    return json(res, 200, { apps: detectQoderApps(), workbuddyDir: workbuddyAuthDir(), zcode: detectZcode(), mirasim: detectMirasim(), catpaw: detectCatpaw(), trae: detectTrae(), legacy: detectInstalls() });
+    return json(res, 200, { apps: detectQoderApps(), workbuddyDir: workbuddyAuthDir(), zcode: detectZcode(), mirasim: detectMirasim(), catpaw: detectCatpaw(), trae: detectTrae(), minimax: detectMiniMax(), legacy: detectInstalls() });
   }
   if (p === '/api/local/scan' && method === 'POST') {
     const existing = await loadAccounts();
@@ -669,7 +722,12 @@ async function handleApi(req, res, url) {
       const tr = await traeLiveAccount();
       if (tr) addRecord(tr, { source: 'Trae 当前登录', current: true });
     } catch (e) { errors.push({ file: 'TRAE SOLO CN/User/globalStorage/storage.json', error: e.message }); }
-    // 7) 旧版 VS Code 系 Qoder IDE / CLI：明文 token 扫描（归属需用户选择）
+    // 7) MiniMax 客户端：读取 ~/.minimax 凭据当前登录
+    try {
+      const mm = await minimaxLiveAccount();
+      if (mm) addRecord(mm, { source: 'MiniMax 当前登录', current: true });
+    } catch (e) { errors.push({ file: '~/.minimax/auth/.../auth.json', error: e.message }); }
+    // 8) 旧版 VS Code 系 Qoder IDE / CLI：明文 token 扫描（归属需用户选择）
     const det = detectInstalls();
     const dirs = det.ideDataDirs.filter(d => d.exists).map(d => d.path);
     if (det.cliDir.exists) dirs.push(det.cliDir.path);
@@ -760,9 +818,10 @@ async function handleApi(req, res, url) {
     } catch (e) { return json(res, 500, { error: e.message }); }
   }
 
-  // 日志
+  // 日志（tag 过滤：?tag=MINIMAX-GW / ZCODE-GW 取网关调用日志，与运行日志分开展示）
   if (p === '/api/logs' && method === 'GET') {
-    return json(res, 200, { logs: getLogs(200) });
+    const tag = url.searchParams.get('tag') || null;
+    return json(res, 200, { logs: getLogs(200, tag) });
   }
 
   // 状态
@@ -786,6 +845,17 @@ async function handleApi(req, res, url) {
     }
     // 妙手凭据文件只存 token：当前登录按 token 对齐账号库，避免每轮状态都打网关查 uid
     const cpToken = currentCatpawToken();
+    const mmToken = currentMiniMaxToken();
+    const mmRecKey = currentMiniMaxRecordKey();
+    // 1) token match；2) record-key match (token 轮换时仍稳定);3) uid-cache fallback
+    let mmLiveUid = null;
+    if (mmToken) {
+      mmLiveUid = accounts.find((a) => a.provider === 'minimax' && a.token === mmToken)?.uid;
+    }
+    if (!mmLiveUid && mmRecKey) {
+      mmLiveUid = accounts.find((a) => a.provider === 'minimax' && a.meta?.authRecordKey === mmRecKey)?.uid;
+    }
+    if (!mmLiveUid) mmLiveUid = currentMiniMaxUid();
     const traeDet = detectTrae();
     return json(res, 200, {
       ok: true,
@@ -796,6 +866,12 @@ async function handleApi(req, res, url) {
       dataDir: dataDir(),
       today: dayKey(),
       todayDone: state?.qoderDailyDone || {},
+      todayByProduct: {
+        qoder: dayKey(Date.now(), 'qoder'),
+        workbuddy: dayKey(Date.now(), 'workbuddy'),
+        trae: dayKey(Date.now(), 'trae'),
+        minimax: dayKey(Date.now(), 'minimax'),
+      },
       scheduler: getSchedulerInfo(),
       riskIdentity: riskIdentityAvailable(),
       riskSource: riskIdentitySource(),
@@ -813,6 +889,8 @@ async function handleApi(req, res, url) {
       catpawClient: (() => { const d = detectCatpaw(); return { installed: d.clientInstalled, signedIn: d.signedIn, running: d.running }; })(),
       traeCurrentUid: traeDet.uid,
       traeClient: { installed: traeDet.clientInstalled, signedIn: traeDet.signedIn, running: traeDet.running },
+      minimaxCurrentUid: mmLiveUid,
+      minimaxClient: (() => { const d = detectMiniMax(); return { installed: d.installed, signedIn: d.signedIn, running: d.running }; })(),
       keyRequired: Boolean(PANEL_KEY),
     });
   }
@@ -859,9 +937,37 @@ async function handleApi(req, res, url) {
     return json(res, 200, { added: r.added, updated: r.updated, skipped, source: parsed.source });
   }
 
+  // 重启服务（桌面客户端或 CLI）
+  if (p === '/api/system/restart' && method === 'POST') {
+    json(res, 200, { ok: true, message: '正在重启服务…' });
+    setTimeout(async () => {
+      try {
+        if (restartHandler) {
+          await restartHandler();
+          return;
+        }
+        // Node CLI 环境兜底重启：派生自身并退出当前进程
+        const { spawn } = await import('node:child_process');
+        spawn(process.execPath, process.argv.slice(1), {
+          detached: true,
+          stdio: 'inherit',
+          env: process.env,
+        }).unref();
+        process.exit(0);
+      } catch (err) {
+        logger.error('DAEMON', `自动重启失败: ${err?.message || err}`);
+      }
+    }, 400);
+    return;
+  }
+
   return json(res, 404, { error: '未知接口' });
 }
 
+let restartHandler = null;
+/** 设置外部重启处理器（桌面版 Electron 注入 app.relaunch / app.exit） */
+export function setRestartHandler(fn) { restartHandler = typeof fn === 'function' ? fn : null; }
+
 /** 当前生效的面板访问密码（同进程宿主——桌面壳——调用本机 API 时带上 x-qd-key 头） */
 export function getPanelKey() { return PANEL_KEY; }
 
@@ -879,11 +985,25 @@ export async function startDaemon(port = DEFAULT_PORT, host = '127.0.0.1') {
         return json(res, 403, { error: denied });
       }
       // ZCode 免费额度网关（数据面，先于面板路由；仅本机回路，见 zcodeGateway.js）。
-      // /v1/messages 别名与 zcode-api 端点路径同形——10router 的 zcode-free 供应商
+      // 规范路径带品牌段 /gateway/zcode/v1/messages，与 minimax/trae 网关命名一致，也是
+      // gatewayStatus() 展示的 endpoint。/gateway/v1/messages 与 /v1/messages 为旧别名，
+      // 保留向后兼容：/v1/messages 与 zcode-api 端点同形，10router 的 zcode-free 供应商
       // 只需换 host:port 即可在 CreditDaddy 网关与 zcode-api 之间切换。
-      if (url.pathname === '/gateway/v1/messages' || url.pathname === '/v1/messages') {
+      if (
+        url.pathname === '/gateway/zcode/v1/messages'
+        || url.pathname === '/gateway/v1/messages'
+        || url.pathname === '/v1/messages'
+      ) {
         return await zcodeGateway.handleGateway(req, res);
       }
+      // MiniMax Code 本地 Anthropic 兼容网关
+      if (url.pathname === '/gateway/minimax/v1/messages') {
+        return await minimaxGateway.handleGateway(req, res);
+      }
+      // Trae SOLO 本地 Anthropic 兼容网关
+      if (url.pathname === '/gateway/trae/v1/messages') {
+        return await traeGateway.handleGateway(req, res);
+      }
       if (url.pathname.startsWith('/api/')) {
         return await handleApi(req, res, url);
       }
@@ -902,7 +1022,7 @@ export async function startDaemon(port = DEFAULT_PORT, host = '127.0.0.1') {
     }
   });
 
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
     let attempts = 0;
     const bind = (p) => {
       // 失败重试时必须摘掉上一次的 listening 监听，否则成功后会重复触发
@@ -914,7 +1034,11 @@ export async function startDaemon(port = DEFAULT_PORT, host = '127.0.0.1') {
           server.close();
           setTimeout(() => bind(p + 1), 300);
         } else {
-          logger.error('DAEMON', `监听失败：${err?.message || err}`);
+          // 兜底失败必须 reject：否则这个 promise 永远挂着，调用方的 startScheduler() 不会跑，
+          // 进程既不监听也不退出，只在日志里留一行，看起来像「启动了但没反应」
+          const msg = err?.message || String(err);
+          logger.error('DAEMON', `监听失败：${msg}`);
+          reject(new Error(`无法监听 ${host}:${p}：${msg}`));
         }
       };
       const onListening = () => {

package/src/localDetect.js

@@ -1,147 +1,147 @@
-/**
- * 本机 Qoder 检测 — 安装探测 + 凭据扫描。
- *
- * Qoder IDE 是 VS Code 系（Electron），凭据散落在 userData 目录；
- * 另扫 ~/.qoder（CLI）。扫描纯本地进行，候选 token 只保留在内存，
- * 面板按 candidateId 导入，token 不在日志中输出。
- */
-
-import fs from 'node:fs';
-import fsp from 'node:fs/promises';
-import path from 'node:path';
-import os from 'node:os';
-import crypto from 'node:crypto';
-
-// 候选内存表：candidateId → { token, file?, provider?, user?, refreshToken?, expiresAt?, at }（10 分钟过期）
-const candidates = new Map();
-const CAND_TTL_MS = 10 * 60 * 1000;
-
-const TOKEN_RE = /\b(?:dt|pt)-[A-Za-z0-9_-]{16,}\b/g;
-
-/** 纯函数：提取文本中的 Qoder token（去重）——供测试 */
-export function extractTokens(text) {
-  const found = new Set();
-  let m;
-  TOKEN_RE.lastIndex = 0;
-  while ((m = TOKEN_RE.exec(String(text))) !== null) found.add(m[0]);
-  return [...found];
-}
-
-function mask(token) {
-  return token.slice(0, 5) + '...' + token.slice(-4);
-}
-
-function isWindows() { return process.platform === 'win32'; }
-function isMac() { return process.platform === 'darwin'; }
-
-/** 安装探测：IDE 可执行文件 + CLI */
-export function detectInstalls() {
-  const home = os.homedir();
-  const appdata = process.env.APPDATA || path.join(home, 'AppData', 'Roaming');
-  const localAppData = process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
-  const programFiles = process.env.ProgramFiles || 'C:\\Program Files';
-
-  const idePaths = isMac()
-    ? ['/Applications/Qoder.app']
-    : isWindows()
-      ? [
-          path.join(localAppData, 'Programs', 'Qoder', 'Qoder.exe'),
-          path.join(programFiles, 'Qoder', 'Qoder.exe'),
-        ]
-      : ['/usr/bin/qoder', '/opt/Qoder/qoder', '/usr/share/qoder/qoder'];
-
-  const ideDataDirs = isMac()
-    ? [path.join(home, 'Library', 'Application Support', 'Qoder')]
-    : isWindows()
-      ? [path.join(appdata, 'Qoder')]
-      : [path.join(home, '.config', 'Qoder')];
-
-  const exists = (p) => { try { return fs.existsSync(p); } catch { return false; } };
-
-  return {
-    platform: process.platform,
-    ide: idePaths.map((p) => ({ path: p, exists: exists(p) })),
-    ideDataDirs: ideDataDirs.map((p) => ({ path: p, exists: exists(p) })),
-    cliDir: { path: path.join(home, '.qoder'), exists: exists(path.join(home, '.qoder')) },
-    installed: idePaths.some((p) => exists(p)),
-  };
-}
-
-// 扫描时跳过的目录（缓存/噪音）
-const SKIP_DIRS = new Set([
-  'node_modules', '.git', 'Cache', 'CachedData', 'CacheStorage', 'Code Cache',
-  'GPUCache', 'logs', 'Crashes', 'crashpad', 'blob_storage', 'Service Worker',
-  'History', 'DawnGraphiteCache', 'DawnWebGPUCache', 'SharedDictionary',
-  'index', 'tmp', 'temp', 'workspaceStorage',
-]);
-
-const MAX_FILE_BYTES = 1.5 * 1024 * 1024;
-const MAX_FILES = 4000;
-const MAX_MS = 6000;
-
-/** 扫描目录集合，产出候选 token（含少量上下文以辅助辨认） */
-export async function scanLocalTokens(dirs) {
-  const deadline = Date.now() + MAX_MS;
-  const found = new Map(); // token → { file, count }
-  let scanned = 0;
-
-  async function walk(dir, depth) {
-    if (depth > 5 || scanned >= MAX_FILES || Date.now() > deadline) return;
-    let entries;
-    try { entries = await fsp.readdir(dir, { withFileTypes: true }); } catch { return; }
-    for (const e of entries) {
-      if (scanned >= MAX_FILES || Date.now() > deadline) return;
-      const p = path.join(dir, e.name);
-      if (e.isDirectory()) {
-        if (!SKIP_DIRS.has(e.name) && !e.name.startsWith('.')) await walk(p, depth + 1);
-        continue;
-      }
-      let st;
-      try { st = await fsp.stat(p); } catch { continue; }
-      if (!st.isFile() || st.size === 0 || st.size > MAX_FILE_BYTES) continue;
-      scanned++;
-      let text;
-      try { text = await fsp.readFile(p, 'utf8'); } catch { continue; }
-      for (const token of extractTokens(text)) {
-        const prev = found.get(token);
-        if (prev) prev.count++;
-        else found.set(token, { file: p, count: 1 });
-      }
-    }
-  }
-
-  for (const d of dirs) {
-    try { if (fs.existsSync(d) && fs.statSync(d).isDirectory()) await walk(d, 0); } catch {}
-  }
-
-  const list = [];
-  for (const [token, meta] of found) {
-    const id = putCandidate({ token, file: meta.file });
-    list.push({
-      id,
-      tokenMasked: mask(token),
-      kind: token.startsWith('pt-') ? 'PAT' : 'device',
-      file: meta.file,
-      hits: meta.count,
-    });
-  }
-  list.sort((a, b) => b.hits - a.hits);
-  return { scanned, candidates: list.slice(0, 50) };
-}
-
-/** 放入候选表（带 TTL），返回 candidateId。c 至少含 token，可带 provider / user / refreshToken / expiresAt */
-export function putCandidate(c) {
-  const now = Date.now();
-  for (const [k, v] of candidates) if (v.at < now - CAND_TTL_MS) candidates.delete(k);
-  const id = crypto.createHash('sha256').update(c.token).digest('hex').slice(0, 16);
-  candidates.set(id, { ...c, at: now });
-  return id;
-}
-
-/** 按 candidateId 读取候选（不会消费掉，导入前可反复查询）；过期返回 null */
-export function peekCandidate(id) {
-  const c = candidates.get(id);
-  if (!c) return null;
-  if (c.at < Date.now() - CAND_TTL_MS) { candidates.delete(id); return null; }
-  return c;
-}
+/**
+ * 本机 Qoder 检测 — 安装探测 + 凭据扫描。
+ *
+ * Qoder IDE 是 VS Code 系（Electron），凭据散落在 userData 目录；
+ * 另扫 ~/.qoder（CLI）。扫描纯本地进行，候选 token 只保留在内存，
+ * 面板按 candidateId 导入，token 不在日志中输出。
+ */
+
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import crypto from 'node:crypto';
+
+// 候选内存表：candidateId → { token, file?, provider?, user?, refreshToken?, expiresAt?, at }（10 分钟过期）
+const candidates = new Map();
+const CAND_TTL_MS = 10 * 60 * 1000;
+
+const TOKEN_RE = /\b(?:dt|pt)-[A-Za-z0-9_-]{16,}\b/g;
+
+/** 纯函数：提取文本中的 Qoder token（去重）——供测试 */
+export function extractTokens(text) {
+  const found = new Set();
+  let m;
+  TOKEN_RE.lastIndex = 0;
+  while ((m = TOKEN_RE.exec(String(text))) !== null) found.add(m[0]);
+  return [...found];
+}
+
+function mask(token) {
+  return token.slice(0, 5) + '...' + token.slice(-4);
+}
+
+function isWindows() { return process.platform === 'win32'; }
+function isMac() { return process.platform === 'darwin'; }
+
+/** 安装探测：IDE 可执行文件 + CLI */
+export function detectInstalls() {
+  const home = os.homedir();
+  const appdata = process.env.APPDATA || path.join(home, 'AppData', 'Roaming');
+  const localAppData = process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
+  const programFiles = process.env.ProgramFiles || 'C:\\Program Files';
+
+  const idePaths = isMac()
+    ? ['/Applications/Qoder.app']
+    : isWindows()
+      ? [
+          path.join(localAppData, 'Programs', 'Qoder', 'Qoder.exe'),
+          path.join(programFiles, 'Qoder', 'Qoder.exe'),
+        ]
+      : ['/usr/bin/qoder', '/opt/Qoder/qoder', '/usr/share/qoder/qoder'];
+
+  const ideDataDirs = isMac()
+    ? [path.join(home, 'Library', 'Application Support', 'Qoder')]
+    : isWindows()
+      ? [path.join(appdata, 'Qoder')]
+      : [path.join(home, '.config', 'Qoder')];
+
+  const exists = (p) => { try { return fs.existsSync(p); } catch { return false; } };
+
+  return {
+    platform: process.platform,
+    ide: idePaths.map((p) => ({ path: p, exists: exists(p) })),
+    ideDataDirs: ideDataDirs.map((p) => ({ path: p, exists: exists(p) })),
+    cliDir: { path: path.join(home, '.qoder'), exists: exists(path.join(home, '.qoder')) },
+    installed: idePaths.some((p) => exists(p)),
+  };
+}
+
+// 扫描时跳过的目录（缓存/噪音）
+const SKIP_DIRS = new Set([
+  'node_modules', '.git', 'Cache', 'CachedData', 'CacheStorage', 'Code Cache',
+  'GPUCache', 'logs', 'Crashes', 'crashpad', 'blob_storage', 'Service Worker',
+  'History', 'DawnGraphiteCache', 'DawnWebGPUCache', 'SharedDictionary',
+  'index', 'tmp', 'temp', 'workspaceStorage',
+]);
+
+const MAX_FILE_BYTES = 1.5 * 1024 * 1024;
+const MAX_FILES = 4000;
+const MAX_MS = 6000;
+
+/** 扫描目录集合，产出候选 token（含少量上下文以辅助辨认） */
+export async function scanLocalTokens(dirs) {
+  const deadline = Date.now() + MAX_MS;
+  const found = new Map(); // token → { file, count }
+  let scanned = 0;
+
+  async function walk(dir, depth) {
+    if (depth > 5 || scanned >= MAX_FILES || Date.now() > deadline) return;
+    let entries;
+    try { entries = await fsp.readdir(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (scanned >= MAX_FILES || Date.now() > deadline) return;
+      const p = path.join(dir, e.name);
+      if (e.isDirectory()) {
+        if (!SKIP_DIRS.has(e.name) && !e.name.startsWith('.')) await walk(p, depth + 1);
+        continue;
+      }
+      let st;
+      try { st = await fsp.stat(p); } catch { continue; }
+      if (!st.isFile() || st.size === 0 || st.size > MAX_FILE_BYTES) continue;
+      scanned++;
+      let text;
+      try { text = await fsp.readFile(p, 'utf8'); } catch { continue; }
+      for (const token of extractTokens(text)) {
+        const prev = found.get(token);
+        if (prev) prev.count++;
+        else found.set(token, { file: p, count: 1 });
+      }
+    }
+  }
+
+  for (const d of dirs) {
+    try { if (fs.existsSync(d) && fs.statSync(d).isDirectory()) await walk(d, 0); } catch {}
+  }
+
+  const list = [];
+  for (const [token, meta] of found) {
+    const id = putCandidate({ token, file: meta.file });
+    list.push({
+      id,
+      tokenMasked: mask(token),
+      kind: token.startsWith('pt-') ? 'PAT' : 'device',
+      file: meta.file,
+      hits: meta.count,
+    });
+  }
+  list.sort((a, b) => b.hits - a.hits);
+  return { scanned, candidates: list.slice(0, 50) };
+}
+
+/** 放入候选表（带 TTL），返回 candidateId。c 至少含 token，可带 provider / user / refreshToken / expiresAt */
+export function putCandidate(c) {
+  const now = Date.now();
+  for (const [k, v] of candidates) if (v.at < now - CAND_TTL_MS) candidates.delete(k);
+  const id = crypto.createHash('sha256').update(c.token).digest('hex').slice(0, 16);
+  candidates.set(id, { ...c, at: now });
+  return id;
+}
+
+/** 按 candidateId 读取候选（不会消费掉，导入前可反复查询）；过期返回 null */
+export function peekCandidate(id) {
+  const c = candidates.get(id);
+  if (!c) return null;
+  if (c.at < Date.now() - CAND_TTL_MS) { candidates.delete(id); return null; }
+  return c;
+}