creditdaddy 1.3.0 → 1.4.0

package/src/qoderClient.js

@@ -15,14 +15,31 @@ import {
   buildQoderHeaders, buildExchangeHeaders, FETCH_TIMEOUT_MS, webBase,
 } from './constants.js';
 import { getRiskIdentity, clientVersion, machineOs, machineHostname, machineId } from './qoderApp.js';
+import { fetchJsonRace } from './zcodeClient.js';
 import { logger } from './logger.js';
+import { t } from './i18n.js';
 
 export function apiBase(provider) {
   return provider === 'qoder-cn' ? CN_OPENAPI_BASE : OPENAPI_BASE;
 }
 
+// 所有 openapi / web 请求统一走 fetchJsonRace（连接段限时 + 配置了出口代理时直连/代理双路兜底）——
+// 此前裸 fetch：面板「网络出口 = 代理优先」对 Qoder 所有调用完全无效（审计 M2 漏网）。
+// options.preferProxy：国际版（按 IP 识别地区）由调用方给 true。
 async function req(url, options = {}) {
-  return fetch(url, { ...options, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+  const { preferProxy = false, ...rest } = options;
+  return fetchJsonRace(url, { ...rest, timeoutMs: FETCH_TIMEOUT_MS, preferProxy });
+}
+
+/**
+ * 网页会话链路（探测归属 / 逐资源包用量）专用：国际版接口按 IP 识别地区，国内直连
+ * qoder.com 会被拦——登录窗有系统代理能登录成功，daemon 拿到 Cookie 后直连探测却失败，
+ * Cookie 被当无效丢弃，徽章「缺网页会话」常驻。配置了出口代理时国际版优先走代理
+ * （直连兜底），国内版保持直连不动。
+ */
+async function webReq(provider, url, options = {}) {
+  if (provider === 'qoder-cn') return req(url, options);
+  return fetchJsonRace(url, { ...options, timeoutMs: options.timeoutMs ?? FETCH_TIMEOUT_MS, preferProxy: true });
 }
 
 /** PAT (pt-...) 兑换短期 job token (jt-...)。普通 JSON POST，无需 COSY 签名。 */
@@ -32,6 +49,7 @@ export async function exchangePatToJobToken(pat, isCn = false) {
     method: 'POST',
     headers: buildExchangeHeaders(),
     body: JSON.stringify({ personal_token: pat }),
+    preferProxy: !isCn,
   });
   if (!res.ok) {
     const text = await res.text().catch(() => '');
@@ -63,6 +81,7 @@ export async function fetchUserinfo(account) {
   if (!token) throw new Error('token 不可用');
   const res = await req(`${apiBase(account.provider)}${USERINFO_PATH}`, {
     headers: buildQoderHeaders(token),
+    preferProxy: account.provider === 'qoder',
   });
   if (!res.ok) throw new Error(`userinfo HTTP ${res.status}`);
   return res.json();
@@ -74,6 +93,7 @@ export async function fetchQuotaUsage(account) {
   if (!token) throw new Error('token 不可用');
   const res = await req(`${apiBase(account.provider)}${QUOTA_USAGE_PATH}`, {
     headers: buildQoderHeaders(token),
+    preferProxy: account.provider === 'qoder',
   });
   if (res.status === 401 || res.status === 403) throw new Error(`鉴权失败 (HTTP ${res.status})，token 可能已过期`);
   if (!res.ok) throw new Error(`quota HTTP ${res.status}`);
@@ -91,7 +111,7 @@ function webHeaders(cookie, provider) {
 
 /** 用原始 Cookie 探测网页会话属于哪个 Qoder 用户（登录窗口抓来的 Cookie 按 uid 归到账号上） */
 export async function probeWebSession(provider, cookie) {
-  const res = await req(`${webBase(provider)}${WEB_USAGE_PATH}`, { headers: webHeaders(cookie, provider) });
+  const res = await webReq(provider, `${webBase(provider)}${WEB_USAGE_PATH}`, { headers: webHeaders(cookie, provider) });
   if (!res.ok) return null;
   const data = await res.json().catch(() => null);
   return data?.user_id ? data : null;
@@ -108,7 +128,7 @@ export async function probeWebSession(provider, cookie) {
 export async function fetchUsageDetail(account) {
   const cookie = String(account.meta?.qoderWebSession?.cookie || '').trim();
   if (!cookie) return null;
-  const res = await req(`${webBase(account.provider)}${WEB_USAGE_PATH}`, { headers: webHeaders(cookie, account.provider) });
+  const res = await webReq(account.provider, `${webBase(account.provider)}${WEB_USAGE_PATH}`, { headers: webHeaders(cookie, account.provider) });
   if (res.status === 401 || res.status === 403) {
     const err = new Error(`网页会话已失效 (HTTP ${res.status})`);
     err.auth = true;
@@ -191,7 +211,7 @@ export async function checkinOne(account) {
 
     // 2) 带客户端身份 + 设备风控身份重新拉取（国际版只有这样才会出现每日积分活动）
     const { headers, risk, riskError } = await buildCampaignHeaders(account, token, uid);
-    if (riskError) logger.debug('CHECKIN', `${label}：${riskError}`);
+    if (riskError) logger.debug('CHECKIN', '{label}:{err}', { label, err: riskError });
     const { campaigns, uid: uid2 } = (risk || !first) ? await getCampaigns(apiBase(account.provider), headers) : first;
     uid = uid2 || uid;
 

package/src/qoderUmid.js

@@ -18,6 +18,7 @@ import zlib from 'node:zlib';
 import { execFile } from 'node:child_process';
 import { dataDir } from './store.js';
 import { logger } from './logger.js';
+import { t } from './i18n.js';
 
 const PKG = '@qoder-ai/qodercli';
 const REGISTRIES = ['https://registry.npmmirror.com', 'https://registry.npmjs.org'];
@@ -154,7 +155,7 @@ async function doInstall() {
         throw new Error(`镜像版本（${meta.version}）与 npmjs（${authority.version}）不一致`);
       }
       const expected = authority && authority.version === meta.version ? authority.integrity : integrity;
-      logger.info('UMID', `下载 ${PKG}@${meta.version}（${registry}）`);
+            logger.info('UMID', '下载 {pkg}@{version}({registry})', { pkg: PKG, version: meta.version, registry });
       const tgz = await fetchBuf(tarball);
       if (!checkIntegrity(tgz, expected)) throw new Error('下载内容与 npm integrity 不一致');
       const bundle = tarEntry(zlib.gunzipSync(tgz), BUNDLE_ENTRY);
@@ -173,11 +174,11 @@ async function doInstall() {
         installedAt: new Date().toISOString(),
       };
       fs.writeFileSync(manifestPath(), JSON.stringify(manifest, null, 2), { mode: 0o600 });
-      logger.info('UMID', `设备身份组件已安装：qodercli ${meta.version} / ${process.arch}`);
+            logger.info('UMID', '设备身份组件已安装:qodercli {version} / {arch}', { version: meta.version, arch: process.arch });
       return { ...manifest, path: binPath() };
     } catch (e) {
       errors.push(`${registry}：${e.message}`);
-      logger.warn('UMID', `从 ${registry} 安装失败：${e.message}`);
+            logger.warn('UMID', '从 {registry} 安装失败:{err}', { registry, err: e.message });
     }
   }
   throw new Error('设备身份组件安装失败 —— ' + errors.join('；'));

package/src/refreshGuard.js

@@ -0,0 +1,69 @@
+/**
+ * 凭据刷新公共守卫（所有 provider 的 401-刷新通路共用）。
+ *
+ * refreshToken 是一次性的、刷新即轮换：两路并发各自拿同一条链去刷新，必然一个成功一个
+ * invalid_grant——面板每 2 分钟一轮额度查询和每小时签到轮曾因此互相误伤。两个护栏：
+ *
+ *  1) in-flight 合并：同一账号的并发刷新只跑一次 refreshFn，后到者共享同一份结果；
+ *  2) 失效链熔断：某条 refreshToken 被服务端作废（401 / invalid_grant / 12153），
+ *     在它被换新（重新登录、本机导入、或刷新成功后链自然更新）之前不再自动重试，
+ *     也不会再打出几十上百次无效请求（2026-10-09 实记录 400+ 次）。
+ *
+ * 消 bug 的调用约定：
+ *  - refreshFn 内部可以再写 account（把新 token/refreshToken 落回对象），调用方负责持久化；
+ *  - 认证失效的判定：err.authInvalid === true 或 err.auth === true（cold 有 provider 用两种标记）；
+ *  - deadMessage / deadNotice 均为可被 i18n 直接命中的字符串模板。
+ */
+
+const inFlight = new Map();   // accountKey → Promise（共享给并发的后来者）
+const deadFp = new Map();     // accountKey → 已被服务端作废的 refreshToken
+
+function keyOf(account) {
+  return String(account.id || account.refreshToken || account.token || 'anon');
+}
+
+/** 该账号当前持有的 refreshToken 是否已被记为失效链。凭据换新（链指纹变化）自动放行。 */
+export function refreshFpDead(account) {
+  const fp = account.refreshToken;
+  return typeof fp === 'string' && fp.length > 0 && deadFp.get(keyOf(account)) === fp;
+}
+
+/** 测试专用：清空进程内守卫状态 */
+export function __resetRefreshGuardForTests() {
+  inFlight.clear();
+  deadFp.clear();
+}
+
+/**
+ * @param {object} account 账号（至少含 id / refreshToken；refreshFn 要拿的都是它字段）
+ * @param {(account: object) => Promise<object>} refreshFn 真刷新：成功后返回新凭据
+ * @param {{ log?: (msg: string) => void | string, deadMessage?: string, deadNotice?: string }} [ctx]
+ */
+export function withRefreshDedupe(account, refreshFn, ctx = {}) {
+  const key = keyOf(account);
+  const inflight = inFlight.get(key);
+  if (inflight) return inflight;
+
+  const p = (async () => {
+    if (refreshFpDead(account)) {
+      const err = new Error(ctx.deadMessage || '凭据链已被服务端作废，等待重新登录或重新导入该账号');
+      err.authInvalid = true;
+      err.dead = true;
+      throw err; // 静默快拒：不再打服务端，不重复刷日志（首次失效时已提示）
+    }
+    try {
+      return await refreshFn(account);
+    } catch (err) {
+      if ((err?.authInvalid || err?.auth) && typeof account.refreshToken === 'string' && account.refreshToken.length > 0) {
+        deadFp.set(key, account.refreshToken);
+        if (ctx.deadNotice !== undefined && ctx.log) {
+          try { ctx.log(ctx.deadNotice || '凭据链已失效，将不再自动重试（重新登录或重新导入该账号后自动恢复）'); } catch {}
+        }
+      }
+      throw err;
+    }
+  })().finally(() => inFlight.delete(key));
+
+  inFlight.set(key, p);
+  return p;
+}

package/src/store.js

@@ -85,6 +85,17 @@ async function readJson(file, fallback) {
     return JSON.parse(await fs.readFile(file, 'utf8'));
   } catch (e) {
     if (e.code === 'ENOENT') return fallback;
+    // 主文件损坏/截断（断电半写、杀软抖动）时,写侧维护了一份同目录 .bak——先试它,
+    // 不至于直接让守护起不来；仍失败才抛出原（保留报错方向,不静默重置）。
+    if (e instanceof SyntaxError || e.name === 'SyntaxError') {
+      const bak = file + '.bak';
+      try {
+        const bakText = await fs.readFile(bak, 'utf8');
+        const parsed = JSON.parse(bakText);
+        console.error('readJson: 主文件损坏,已用备份恢复 ' + bak);
+        return parsed;
+      } catch { /* 没有备份或备份同坏——按原错误上抛 */ }
+    }
     throw new Error(`读取 ${file} 失败: ${e.message}`);
   }
 }
@@ -98,7 +109,16 @@ export async function loadAccounts() {
 
 export async function saveAccounts(accounts) {
   await ensureDir();
-  await atomicWrite(ACCOUNTS_FILE(), JSON.stringify(accounts, null, 2));
+  const file = ACCOUNTS_FILE();
+  const bak = file + '.bak';
+  try {
+    // 只有当已有账号文件存在且非空时才建立/更新 .bak 备份
+    const existing = await fs.readFile(file, 'utf8').catch(() => null);
+    if (existing && existing.trim().length > 2) {
+      await atomicWrite(bak, existing);
+    }
+  } catch {}
+  await atomicWrite(file, JSON.stringify(accounts, null, 2));
 }
 
 // 进程内串行队列：所有「读-改-写」都经由 withAccounts，避免并发请求互相覆盖
@@ -200,6 +220,12 @@ export function publicAccount(a) {
     phone: maskPhone(meta.phone),
     domain: meta.domain || null,
     flavor: a.provider === 'zcode' ? zcodeFlavor(meta) : null,
+    // Qoder 网页会话新鲜度（10Router issue #44）：只回时间戳、绝不回 Cookie。
+    // 10Router 的「套餐内 Credits」明细依赖导出的这份会话；面板据此在
+    // 导出/同步缺会话或明显过期的 Qoder 账号时给出提示。
+    qoderWebCapturedAt: String(a.provider).startsWith('qoder')
+      ? (meta.qoderWebSession?.capturedAt || null)
+      : null,
     canSwitch: Boolean(meta.session?.account || meta.credentials || meta.qoderAuth || a.provider === 'catpaw' || a.provider === 'trae'),
     verified: a.verified ?? null,
     createdAt: a.createdAt,

package/src/tenrouter.js

@@ -13,6 +13,7 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { dataDir } from './store.js';
 import { logger } from './logger.js';
+import { t } from './i18n.js';
 import { SOURCES, SOURCE_LABEL, collectSource, selectSince, detectSources } from './usageSync.js';
 
 const FILE = () => path.join(dataDir(), 'tenrouter.json');
@@ -41,17 +42,18 @@ export function loadConfig() {
   } catch { return structuredClone(DEFAULT_CONFIG); }
 }
 
-function saveConfig(c) {
+// 配置落盘走 store.atomicWrite：Windows 上杀软/同步盘瞬时占文件会直接 EPERM，
+// 裸 renameSync 会整路抛到 API 500；atomicWrite 内置占用重试与直写兜底
+async function saveConfig(c) {
   fs.mkdirSync(dataDir(), { recursive: true, mode: 0o700 });
-  const tmp = `${FILE()}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify(c, null, 2), { mode: 0o600 });
-  fs.renameSync(tmp, FILE());
+  const { atomicWrite } = await import('./store.js');
+  await atomicWrite(FILE(), JSON.stringify(c, null, 2));
 }
 
 // 读改写串行，避免面板保存与后台同步互相覆盖
 let chain = Promise.resolve();
 function withConfig(fn) {
-  const run = chain.then(async () => { const c = loadConfig(); const r = await fn(c); saveConfig(c); return r; });
+  const run = chain.then(async () => { const c = loadConfig(); const r = await fn(c); await saveConfig(c); return r; });
   chain = run.catch(() => {});
   return run;
 }
@@ -252,7 +254,12 @@ async function doSync({ dryRun, trigger }) {
       : `同步完成：新增 ${imported} 行，跳过 ${skippedDup} 行重复`;
   if (!dryRun) {
     await withConfig((cc) => { cc.lastSync = { at: new Date().toISOString(), trigger, summary, results }; });
-    (failed.length ? logger.warn : logger.info).call(logger, '10R', summary);
+    // 日志走 key+args（按界面语言实时重渲染）；summary 原文继续供面板展示
+    const logTpl = failed.length
+      ? '同步完成：新增 {imported} 行，跳过 {skipped} 行重复，{failed} 个来源失败（{detail}）'
+      : '同步完成：新增 {imported} 行，跳过 {skipped} 行重复';
+    (failed.length ? logger.warn : logger.info).call(logger, '10R', logTpl,
+      { imported, skipped: skippedDup, failed: failed.length, detail: failed.map((r) => r.label + '：' + r.error).join('；') });
   }
   return { summary, results };
 }
@@ -263,7 +270,7 @@ export function startUsageSyncScheduler() {
   const tick = () => {
     const c = loadConfig();
     if (!isConfigured(c) || !c.sync.enabled) return;
-    runUsageSync({ trigger: 'auto' }).catch((e) => logger.warn('10R', '自动同步失败：' + e.message));
+        runUsageSync({ trigger: 'auto' }).catch((e) => logger.warn('10R', '自动同步失败:{err}', { err: e.message }));
   };
   setTimeout(tick, 60_000).unref?.();   // 启动 1 分钟后先跑一轮
   timer = setInterval(tick, SYNC_INTERVAL_MS);

package/src/tenrouterAccounts.js

@@ -92,6 +92,9 @@ async function syncViaTransfer({ endpoint, cookie, groups }) {
     results.push({
       provider: target, count: list.length, status: (d.failed || 0) ? 'partial' : 'ok',
       imported: d.imported || 0, updated: d.updated || 0, skipped: d.skipped || 0, failed: d.failed || 0,
+      // 10Router issue #44：导入端会探测刚同步过去的网页会话是否仍可用，
+      // 失败清单直接回显到本端摘要（见 syncAccountsTo10r 的 sessionWarns）。
+      webSessions: d.webSessions || null,
     });
   }
   return results;
@@ -103,9 +106,15 @@ async function syncViaProviders({ endpoint, key, groups }) {
   for (const [target, list] of groups) {
     const row = { provider: target, count: list.length, status: 'ok', imported: 0, skipped: 0, failed: 0 };
     for (const a of list) {
-      const r = await trFetch(`${endpoint}/api/providers`, {
-        key, method: 'POST', body: { provider: target, apiKey: a.token, name: connName(a) },
-      });
+      // issue #44：qoder 的 apikey 连接同样按 providerSpecificData 读网页会话
+      // （usage 侧 getQoderUsage 不区分 authType），所以新建连接时把会话一并
+      // 挂上；已存在的同名连接此接口不更新（409），缺失由同步摘要点名提醒。
+      const web = a.meta?.qoderWebSession?.cookie && String(a.provider).startsWith('qoder')
+        ? { creditDaddyWebSession: { cookie: a.meta.qoderWebSession.cookie, capturedAt: a.meta.qoderWebSession.capturedAt || null, userId: a.uid || null } }
+        : null;
+      const body = { provider: target, apiKey: a.token, name: connName(a) };
+      if (web) body.providerSpecificData = { userId: a.uid || null, ...web };
+      const r = await trFetch(`${endpoint}/api/providers`, { key, method: 'POST', body });
       if (r.status === 201 || r.status === 200) row.imported++;
       else if (r.status === 409) row.skipped++;
       else { row.failed++; row.error = r.data?.error || `HTTP ${r.status}`; }
@@ -163,6 +172,25 @@ export async function syncAccountsTo10r({ endpoint, key, adminPassword, accounts
   if (sum('skipped')) parts.push(`已存在 ${sum('skipped')}`);
   if (sum('failed')) parts.push(`失败 ${sum('failed')}`);
   if (unmapped.size) parts.push('跳过 ' + [...unmapped].map(([p, n]) => `${p} ×${n}`).join('、'));
+  // issue #44：Qoder 网页会话决定 10Router 端「套餐内 Credits」能不能显示。
+  // OAuth 通道：10Router 导入时已逐账号探测，失效清单原样带回（deadNames）；
+  // 两条通道都要点名本地就没有会话的账号（apikey 通道 webSessions 恒为
+  // null，条件自动适用；OAuth 通道里已被探测过的组不重复报）。
+  const deadNames = [];
+  for (const r of results) {
+    for (const f of r.webSessions?.failures || []) deadNames.push(f.name);
+  }
+  const sessionless = [];
+  for (const [target, list] of groups) {
+    if (!String(target).startsWith('qoder')) continue;
+    for (const a of list) {
+      if (results.find((r) => r.provider === target)?.webSessions == null && !a.meta?.qoderWebSession?.cookie) {
+        sessionless.push(connName(a));
+      }
+    }
+  }
+  if (sessionless.length) parts.push(`未带网页会话 ${sessionless.length}（${sessionless.join('、')}，在 CreditDaddy 重新浏览器登录 Qoder 后再同步可补齐逐资源包明细）`);
+  if (deadNames.length) parts.push(`网页会话已失效 ${deadNames.length}（${deadNames.join('、')}，重新登录 Qoder 网页后再次同步）`);
   const summary = (channel === 'oauth' ? '账号同步完成（OAuth 通道）：' : '账号同步完成（apikey 通道，token 过期后需重新同步）：')
     + (parts.join('，') || '无变化')
     + (failed.length ? `；${failed.map((r) => r.provider + '：' + (r.error || r.status)).join('；')}` : '');

package/src/traeClient.js

@@ -223,6 +223,11 @@ export async function checkinTrae(account, ctx = {}) {
     return { ...base, status: 'already', message: '今天已签到', uid };
   }
 
+  // 签到应得额度：status 接口里通常预告 credits / extra_credits（如 100 积分），
+  // claim 接口有时只返回 { code: 0, message: "success" } 而不包含 credits 字段，作为 fallback 避免 +0
+  const TRAE_DEFAULT_DAILY_CREDITS = 100;
+  const expectedCredits = Number(findField(r.body, 'credits') ?? findField(r.body, 'extra_credits')) || TRAE_DEFAULT_DAILY_CREDITS;
+
   const c = await post(CLAIM_URL, account);
   if (c.code !== 0) {
     ctx.log?.(`Trae 领取失败：${c.message || `code ${c.code}`}`);
@@ -233,7 +238,7 @@ export async function checkinTrae(account, ctx = {}) {
       uid,
     };
   }
-  const claimed = Number(findField(c.body, 'credits')) || 0;
+  const claimed = Number(findField(c.body, 'credits')) || expectedCredits;
   return { ...base, status: 'checked-in', claimedAmount: claimed, message: claimed ? `签到成功，+${claimed} 积分` : '签到成功', uid };
 }