creditdaddy 1.3.2 → 1.4.0

package/src/qoderClient.js

@@ -15,14 +15,31 @@ import {
   buildQoderHeaders, buildExchangeHeaders, FETCH_TIMEOUT_MS, webBase,
 } from './constants.js';
 import { getRiskIdentity, clientVersion, machineOs, machineHostname, machineId } from './qoderApp.js';
+import { fetchJsonRace } from './zcodeClient.js';
 import { logger } from './logger.js';
+import { t } from './i18n.js';
 
 export function apiBase(provider) {
   return provider === 'qoder-cn' ? CN_OPENAPI_BASE : OPENAPI_BASE;
 }
 
+// 所有 openapi / web 请求统一走 fetchJsonRace（连接段限时 + 配置了出口代理时直连/代理双路兜底）——
+// 此前裸 fetch：面板「网络出口 = 代理优先」对 Qoder 所有调用完全无效（审计 M2 漏网）。
+// options.preferProxy：国际版（按 IP 识别地区）由调用方给 true。
 async function req(url, options = {}) {
-  return fetch(url, { ...options, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+  const { preferProxy = false, ...rest } = options;
+  return fetchJsonRace(url, { ...rest, timeoutMs: FETCH_TIMEOUT_MS, preferProxy });
+}
+
+/**
+ * 网页会话链路（探测归属 / 逐资源包用量）专用：国际版接口按 IP 识别地区，国内直连
+ * qoder.com 会被拦——登录窗有系统代理能登录成功，daemon 拿到 Cookie 后直连探测却失败，
+ * Cookie 被当无效丢弃，徽章「缺网页会话」常驻。配置了出口代理时国际版优先走代理
+ * （直连兜底），国内版保持直连不动。
+ */
+async function webReq(provider, url, options = {}) {
+  if (provider === 'qoder-cn') return req(url, options);
+  return fetchJsonRace(url, { ...options, timeoutMs: options.timeoutMs ?? FETCH_TIMEOUT_MS, preferProxy: true });
 }
 
 /** PAT (pt-...) 兑换短期 job token (jt-...)。普通 JSON POST，无需 COSY 签名。 */
@@ -32,6 +49,7 @@ export async function exchangePatToJobToken(pat, isCn = false) {
     method: 'POST',
     headers: buildExchangeHeaders(),
     body: JSON.stringify({ personal_token: pat }),
+    preferProxy: !isCn,
   });
   if (!res.ok) {
     const text = await res.text().catch(() => '');
@@ -63,6 +81,7 @@ export async function fetchUserinfo(account) {
   if (!token) throw new Error('token 不可用');
   const res = await req(`${apiBase(account.provider)}${USERINFO_PATH}`, {
     headers: buildQoderHeaders(token),
+    preferProxy: account.provider === 'qoder',
   });
   if (!res.ok) throw new Error(`userinfo HTTP ${res.status}`);
   return res.json();
@@ -74,6 +93,7 @@ export async function fetchQuotaUsage(account) {
   if (!token) throw new Error('token 不可用');
   const res = await req(`${apiBase(account.provider)}${QUOTA_USAGE_PATH}`, {
     headers: buildQoderHeaders(token),
+    preferProxy: account.provider === 'qoder',
   });
   if (res.status === 401 || res.status === 403) throw new Error(`鉴权失败 (HTTP ${res.status})，token 可能已过期`);
   if (!res.ok) throw new Error(`quota HTTP ${res.status}`);
@@ -91,7 +111,7 @@ function webHeaders(cookie, provider) {
 
 /** 用原始 Cookie 探测网页会话属于哪个 Qoder 用户（登录窗口抓来的 Cookie 按 uid 归到账号上） */
 export async function probeWebSession(provider, cookie) {
-  const res = await req(`${webBase(provider)}${WEB_USAGE_PATH}`, { headers: webHeaders(cookie, provider) });
+  const res = await webReq(provider, `${webBase(provider)}${WEB_USAGE_PATH}`, { headers: webHeaders(cookie, provider) });
   if (!res.ok) return null;
   const data = await res.json().catch(() => null);
   return data?.user_id ? data : null;
@@ -108,7 +128,7 @@ export async function probeWebSession(provider, cookie) {
 export async function fetchUsageDetail(account) {
   const cookie = String(account.meta?.qoderWebSession?.cookie || '').trim();
   if (!cookie) return null;
-  const res = await req(`${webBase(account.provider)}${WEB_USAGE_PATH}`, { headers: webHeaders(cookie, account.provider) });
+  const res = await webReq(account.provider, `${webBase(account.provider)}${WEB_USAGE_PATH}`, { headers: webHeaders(cookie, account.provider) });
   if (res.status === 401 || res.status === 403) {
     const err = new Error(`网页会话已失效 (HTTP ${res.status})`);
     err.auth = true;
@@ -191,7 +211,7 @@ export async function checkinOne(account) {
 
     // 2) 带客户端身份 + 设备风控身份重新拉取（国际版只有这样才会出现每日积分活动）
     const { headers, risk, riskError } = await buildCampaignHeaders(account, token, uid);
-    if (riskError) logger.debug('CHECKIN', `${label}：${riskError}`);
+    if (riskError) logger.debug('CHECKIN', '{label}:{err}', { label, err: riskError });
     const { campaigns, uid: uid2 } = (risk || !first) ? await getCampaigns(apiBase(account.provider), headers) : first;
     uid = uid2 || uid;
 

package/src/qoderUmid.js

@@ -18,6 +18,7 @@ import zlib from 'node:zlib';
 import { execFile } from 'node:child_process';
 import { dataDir } from './store.js';
 import { logger } from './logger.js';
+import { t } from './i18n.js';
 
 const PKG = '@qoder-ai/qodercli';
 const REGISTRIES = ['https://registry.npmmirror.com', 'https://registry.npmjs.org'];
@@ -154,7 +155,7 @@ async function doInstall() {
         throw new Error(`镜像版本（${meta.version}）与 npmjs（${authority.version}）不一致`);
       }
       const expected = authority && authority.version === meta.version ? authority.integrity : integrity;
-      logger.info('UMID', `下载 ${PKG}@${meta.version}（${registry}）`);
+            logger.info('UMID', '下载 {pkg}@{version}({registry})', { pkg: PKG, version: meta.version, registry });
       const tgz = await fetchBuf(tarball);
       if (!checkIntegrity(tgz, expected)) throw new Error('下载内容与 npm integrity 不一致');
       const bundle = tarEntry(zlib.gunzipSync(tgz), BUNDLE_ENTRY);
@@ -173,11 +174,11 @@ async function doInstall() {
         installedAt: new Date().toISOString(),
       };
       fs.writeFileSync(manifestPath(), JSON.stringify(manifest, null, 2), { mode: 0o600 });
-      logger.info('UMID', `设备身份组件已安装：qodercli ${meta.version} / ${process.arch}`);
+            logger.info('UMID', '设备身份组件已安装:qodercli {version} / {arch}', { version: meta.version, arch: process.arch });
       return { ...manifest, path: binPath() };
     } catch (e) {
       errors.push(`${registry}：${e.message}`);
-      logger.warn('UMID', `从 ${registry} 安装失败：${e.message}`);
+            logger.warn('UMID', '从 {registry} 安装失败:{err}', { registry, err: e.message });
     }
   }
   throw new Error('设备身份组件安装失败 —— ' + errors.join('；'));

package/src/refreshGuard.js

@@ -0,0 +1,69 @@
+/**
+ * 凭据刷新公共守卫（所有 provider 的 401-刷新通路共用）。
+ *
+ * refreshToken 是一次性的、刷新即轮换：两路并发各自拿同一条链去刷新，必然一个成功一个
+ * invalid_grant——面板每 2 分钟一轮额度查询和每小时签到轮曾因此互相误伤。两个护栏：
+ *
+ *  1) in-flight 合并：同一账号的并发刷新只跑一次 refreshFn，后到者共享同一份结果；
+ *  2) 失效链熔断：某条 refreshToken 被服务端作废（401 / invalid_grant / 12153），
+ *     在它被换新（重新登录、本机导入、或刷新成功后链自然更新）之前不再自动重试，
+ *     也不会再打出几十上百次无效请求（2026-10-09 实记录 400+ 次）。
+ *
+ * 消 bug 的调用约定：
+ *  - refreshFn 内部可以再写 account（把新 token/refreshToken 落回对象），调用方负责持久化；
+ *  - 认证失效的判定：err.authInvalid === true 或 err.auth === true（cold 有 provider 用两种标记）；
+ *  - deadMessage / deadNotice 均为可被 i18n 直接命中的字符串模板。
+ */
+
+const inFlight = new Map();   // accountKey → Promise（共享给并发的后来者）
+const deadFp = new Map();     // accountKey → 已被服务端作废的 refreshToken
+
+function keyOf(account) {
+  return String(account.id || account.refreshToken || account.token || 'anon');
+}
+
+/** 该账号当前持有的 refreshToken 是否已被记为失效链。凭据换新（链指纹变化）自动放行。 */
+export function refreshFpDead(account) {
+  const fp = account.refreshToken;
+  return typeof fp === 'string' && fp.length > 0 && deadFp.get(keyOf(account)) === fp;
+}
+
+/** 测试专用：清空进程内守卫状态 */
+export function __resetRefreshGuardForTests() {
+  inFlight.clear();
+  deadFp.clear();
+}
+
+/**
+ * @param {object} account 账号（至少含 id / refreshToken；refreshFn 要拿的都是它字段）
+ * @param {(account: object) => Promise<object>} refreshFn 真刷新：成功后返回新凭据
+ * @param {{ log?: (msg: string) => void | string, deadMessage?: string, deadNotice?: string }} [ctx]
+ */
+export function withRefreshDedupe(account, refreshFn, ctx = {}) {
+  const key = keyOf(account);
+  const inflight = inFlight.get(key);
+  if (inflight) return inflight;
+
+  const p = (async () => {
+    if (refreshFpDead(account)) {
+      const err = new Error(ctx.deadMessage || '凭据链已被服务端作废，等待重新登录或重新导入该账号');
+      err.authInvalid = true;
+      err.dead = true;
+      throw err; // 静默快拒：不再打服务端，不重复刷日志（首次失效时已提示）
+    }
+    try {
+      return await refreshFn(account);
+    } catch (err) {
+      if ((err?.authInvalid || err?.auth) && typeof account.refreshToken === 'string' && account.refreshToken.length > 0) {
+        deadFp.set(key, account.refreshToken);
+        if (ctx.deadNotice !== undefined && ctx.log) {
+          try { ctx.log(ctx.deadNotice || '凭据链已失效，将不再自动重试（重新登录或重新导入该账号后自动恢复）'); } catch {}
+        }
+      }
+      throw err;
+    }
+  })().finally(() => inFlight.delete(key));
+
+  inFlight.set(key, p);
+  return p;
+}

package/src/store.js

@@ -85,6 +85,17 @@ async function readJson(file, fallback) {
     return JSON.parse(await fs.readFile(file, 'utf8'));
   } catch (e) {
     if (e.code === 'ENOENT') return fallback;
+    // 主文件损坏/截断（断电半写、杀软抖动）时,写侧维护了一份同目录 .bak——先试它,
+    // 不至于直接让守护起不来；仍失败才抛出原（保留报错方向,不静默重置）。
+    if (e instanceof SyntaxError || e.name === 'SyntaxError') {
+      const bak = file + '.bak';
+      try {
+        const bakText = await fs.readFile(bak, 'utf8');
+        const parsed = JSON.parse(bakText);
+        console.error('readJson: 主文件损坏,已用备份恢复 ' + bak);
+        return parsed;
+      } catch { /* 没有备份或备份同坏——按原错误上抛 */ }
+    }
     throw new Error(`读取 ${file} 失败: ${e.message}`);
   }
 }

package/src/tenrouter.js

@@ -13,6 +13,7 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { dataDir } from './store.js';
 import { logger } from './logger.js';
+import { t } from './i18n.js';
 import { SOURCES, SOURCE_LABEL, collectSource, selectSince, detectSources } from './usageSync.js';
 
 const FILE = () => path.join(dataDir(), 'tenrouter.json');
@@ -41,17 +42,18 @@ export function loadConfig() {
   } catch { return structuredClone(DEFAULT_CONFIG); }
 }
 
-function saveConfig(c) {
+// 配置落盘走 store.atomicWrite：Windows 上杀软/同步盘瞬时占文件会直接 EPERM，
+// 裸 renameSync 会整路抛到 API 500；atomicWrite 内置占用重试与直写兜底
+async function saveConfig(c) {
   fs.mkdirSync(dataDir(), { recursive: true, mode: 0o700 });
-  const tmp = `${FILE()}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify(c, null, 2), { mode: 0o600 });
-  fs.renameSync(tmp, FILE());
+  const { atomicWrite } = await import('./store.js');
+  await atomicWrite(FILE(), JSON.stringify(c, null, 2));
 }
 
 // 读改写串行，避免面板保存与后台同步互相覆盖
 let chain = Promise.resolve();
 function withConfig(fn) {
-  const run = chain.then(async () => { const c = loadConfig(); const r = await fn(c); saveConfig(c); return r; });
+  const run = chain.then(async () => { const c = loadConfig(); const r = await fn(c); await saveConfig(c); return r; });
   chain = run.catch(() => {});
   return run;
 }
@@ -252,7 +254,12 @@ async function doSync({ dryRun, trigger }) {
       : `同步完成：新增 ${imported} 行，跳过 ${skippedDup} 行重复`;
   if (!dryRun) {
     await withConfig((cc) => { cc.lastSync = { at: new Date().toISOString(), trigger, summary, results }; });
-    (failed.length ? logger.warn : logger.info).call(logger, '10R', summary);
+    // 日志走 key+args（按界面语言实时重渲染）；summary 原文继续供面板展示
+    const logTpl = failed.length
+      ? '同步完成：新增 {imported} 行，跳过 {skipped} 行重复，{failed} 个来源失败（{detail}）'
+      : '同步完成：新增 {imported} 行，跳过 {skipped} 行重复';
+    (failed.length ? logger.warn : logger.info).call(logger, '10R', logTpl,
+      { imported, skipped: skippedDup, failed: failed.length, detail: failed.map((r) => r.label + '：' + r.error).join('；') });
   }
   return { summary, results };
 }
@@ -263,7 +270,7 @@ export function startUsageSyncScheduler() {
   const tick = () => {
     const c = loadConfig();
     if (!isConfigured(c) || !c.sync.enabled) return;
-    runUsageSync({ trigger: 'auto' }).catch((e) => logger.warn('10R', '自动同步失败：' + e.message));
+        runUsageSync({ trigger: 'auto' }).catch((e) => logger.warn('10R', '自动同步失败:{err}', { err: e.message }));
   };
   setTimeout(tick, 60_000).unref?.();   // 启动 1 分钟后先跑一轮
   timer = setInterval(tick, SYNC_INTERVAL_MS);

package/src/traeGateway.js

@@ -17,6 +17,7 @@ import { loadAccounts, loadSettings, saveSettings } from './store.js';
 import { fetchTraeQuota } from './traeClient.js';
 import { gatewayHostSuggestion } from './tenrouter.js';
 import { logger, summarizeAttempts } from './logger.js';
+import { t } from './i18n.js';
 
 const TRAE_SOLO_BASE = 'https://solo.trae.cn/api/remote/v1';
 const ACCOUNT_COOLING_MS = 5 * 60_000;
@@ -44,7 +45,8 @@ export async function setGatewayEnabled(v) {
 
 const cooling = new Map();  // accountId → 冷却截止(ms)
 const dead = new Map();     // accountId → 拉黑时的凭据指纹（指纹变化 = 已重新授权/导入，自动复活）
-const weights = new Map();  // accountId → 上次查到的剩余积分
+const weights = new Map();  // accountId → { w: 剩余积分权重, at: 查询时刻 }
+const WEIGHT_TTL_MS = 10 * 60_000;  // 超过 10 分钟重查额度，让积分变化反映到分流上
 
 export const stats = {
   lastCallAt: null,
@@ -73,7 +75,7 @@ function isDead(account) {
   if (fp === credFingerprint(account)) return true;
   dead.delete(account.id);
   cooling.delete(account.id);
-  logger.info('TRAE-GW', `${account.name || account.uid || account.id} 凭据已更新，解除拉黑`);
+  logger.info('TRAE-GW', '{label} 凭据已更新,解除拉黑', { label: account.name || account.uid || account.id });
   return false;
 }
 
@@ -88,16 +90,17 @@ export function __resetForTests() {
 }
 
 async function accountWeight(a) {
-  if (!weights.has(a.id)) {
-    try {
-      const q = await fetchTraeQuota(a);
-      const remaining = Number(q?.remaining) || 0;
-      weights.set(a.id, Math.max(MIN_WEIGHT, remaining));
-    } catch {
-      weights.set(a.id, MIN_WEIGHT);
-    }
+  const hit = weights.get(a.id);
+  if (hit && Date.now() - hit.at < WEIGHT_TTL_MS) return hit.w;
+  let w = hit?.w ?? MIN_WEIGHT;
+  try {
+    const q = await fetchTraeQuota(a);
+    w = Math.max(MIN_WEIGHT, Number(q?.remaining) || 0);
+  } catch {
+    // 额度查询失败保留上次快照权重（网络抖动不该把主力踢成保底权重）
   }
-  return weights.get(a.id);
+  weights.set(a.id, { w, at: Date.now() });
+  return w;
 }
 
 const swrr = new Map();
@@ -161,7 +164,13 @@ function remoteAllowed(remote, allowList) {
   return (Array.isArray(allowList) ? allowList : []).some((entry) => {
     const e = String(entry || '').trim();
     if (!e) return false;
-    if (e.endsWith('*')) return host.toLowerCase().startsWith(e.slice(0, -1).toLowerCase());
+    if (e.endsWith('*')) {
+      // 通配要求带点段尾：防止 192.168.31.1* 这类把 .100-.199 整段一起放行的怪手。
+      // 要扩整段子网，把写法统一为 192.168.31.*（带尾句点）。
+      const prefix = e.slice(0, -1);
+      if (!prefix.endsWith('.')) return false;
+      return host.toLowerCase().startsWith(prefix.toLowerCase());
+    }
     return host.toLowerCase() === e.toLowerCase();
   });
 }
@@ -362,7 +371,7 @@ export async function handleGateway(req, res) {
               const cur = list.find((a) => a.id === account.id);
               if (cur) cur.token = token;
             });
-            logger.info('TRAE-GW', `${label} 凭据已对齐本地客户端，重试会话创建…`);
+        logger.info('TRAE-GW', '{label} 凭据已对齐本地客户端,重试会话创建...', { label });
             sessionRes = await fetchJsonRace(`${TRAE_SOLO_BASE}/chat_sessions`, {
               method: 'POST',
               headers: makeHeaders(token),
@@ -383,14 +392,14 @@ export async function handleGateway(req, res) {
     if (sessionRes.status === 401) {
       markDead(account);
       attempted.push({ account: label, ok: false, error: 'Token 彻底失效 (401)，拉黑' });
-      logger.info('TRAE-GW', `${label} 凭据失效，拉黑`);
+      logger.info('TRAE-GW', '{label} 凭据失效,拉黑', { label });
       continue;
     }
 
     if (sessionRes.status === 429) {
       markCooling(account.id, ACCOUNT_COOLING_MS);
       attempted.push({ account: label, ok: false, error: '429 限流，冷却 5 分钟' });
-      logger.info('TRAE-GW', `${label} 429 限流，冷却 5 分钟`);
+      logger.info('TRAE-GW', '{label} 429 限流,冷却 5 分钟', { label });
       continue;
     }
 
@@ -415,7 +424,9 @@ export async function handleGateway(req, res) {
     // 获取 events 流
     let eventsRes;
     try {
-      eventsRes = await fetch(`${TRAE_SOLO_BASE}/chat_sessions/${chatSessionId}/events?reply_to_message_id=${encodeURIComponent(messageId)}`, {
+      // 走 fetchJsonRace：连接段 15s 限时 + 统一代理 / 直连兜底与会话请求自洽（此前裸 fetch——
+      // 上游黑洞时一直挂到客户端断开,也整体不走面板配置的出口代理,不是统一的接口设计）
+      eventsRes = await fetchJsonRace(`${TRAE_SOLO_BASE}/chat_sessions/${chatSessionId}/events?reply_to_message_id=${encodeURIComponent(messageId)}`, {
         headers: {
           Authorization: token.startsWith('Cloud-IDE-JWT ') ? token : `Cloud-IDE-JWT ${token.trim()}`,
           Accept: 'text/event-stream',
@@ -423,6 +434,8 @@ export async function handleGateway(req, res) {
           Referer: 'https://solo.trae.cn/',
         },
         signal: clientAbort.signal,
+        timeoutMs: UPSTREAM_TIMEOUT_MS,
+        connectMs: 15_000,
       });
     } catch (e) {
       cleanupSession();
@@ -438,7 +451,7 @@ export async function handleGateway(req, res) {
     }
 
     stats.lastAccount = label;
-    logger.debug('TRAE-GW', `${label} 连接成功，开始流式输出 (${requestedModel})`);
+      logger.debug('TRAE-GW', '{label} 连接成功,开始流式输出 ({model})', { label, model: requestedModel });
 
     // 成功建立流，按 isStream 分发
     if (isStream) {
@@ -482,10 +495,11 @@ export async function handleGateway(req, res) {
       const decoder = new TextDecoder();
       let buffer = '';
 
+      let streamCompleted = false;
       try {
         while (true) {
           const { done, value } = await reader.read();
-          if (done) break;
+          if (done) { streamCompleted = true; break; }
           buffer += decoder.decode(value, { stream: true });
           const lines = buffer.split('\n');
           buffer = lines.pop();
@@ -550,7 +564,7 @@ export async function handleGateway(req, res) {
         }
       } catch (err) {
         // 客户端主动断开（点停止/换一句）属正常收尾，不是故障
-        logger.debug('TRAE-GW', `流式读取中断: ${err.message}`);
+      logger.debug('TRAE-GW', '流式读取中断:{err}', { err: err.message });
       } finally {
         if (thinkingOpen) {
           sendSse('content_block_stop', { type: 'content_block_stop', index: thinkingIndex });
@@ -569,9 +583,13 @@ export async function handleGateway(req, res) {
         if (inputTokens > 0) deltaUsage.input_tokens = inputTokens;
         if (cacheReadTokens > 0) deltaUsage.cache_read_input_tokens = cacheReadTokens;
 
+        // 上游没正常收尾（断流 / EOF / reader 抛错）时,stop_reason 别伪装成 end_turn——
+        // 客户端把截断的字当完整答案就再也看不见了（两个分支都报 interrupted）。
+        const stopReason = streamCompleted ? 'end_turn' : 'interrupted';
+
         sendSse('message_delta', {
           type: 'message_delta',
-          delta: { stop_reason: 'end_turn', stop_sequence: null },
+          delta: { stop_reason: stopReason, stop_sequence: null },
           usage: deltaUsage,
         });
         sendSse('message_stop', { type: 'message_stop' });
@@ -587,11 +605,12 @@ export async function handleGateway(req, res) {
       let fullThinking = '';
       let fullText = '';
       let usageInfo = null;
+      let streamCompleted = false;
 
       try {
         while (true) {
           const { done, value } = await reader.read();
-          if (done) break;
+          if (done) { streamCompleted = true; break; }
           buffer += decoder.decode(value, { stream: true });
           const lines = buffer.split('\n');
           buffer = lines.pop();
@@ -613,7 +632,7 @@ export async function handleGateway(req, res) {
         }
       } catch (err) {
         // 客户端主动断开（点停止/换一句）属正常收尾，不是故障
-        logger.debug('TRAE-GW', `非流式读取中断: ${err.message}`);
+      logger.debug('TRAE-GW', '非流式读取中断:{err}', { err: err.message });
       } finally {
         cleanupSession();
       }
@@ -636,7 +655,7 @@ export async function handleGateway(req, res) {
         role: 'assistant',
         model: requestedModel,
         content,
-        stop_reason: 'end_turn',
+        stop_reason: streamCompleted ? 'end_turn' : 'interrupted',
         stop_sequence: null,
         usage: usageObj,
       }));
@@ -646,7 +665,7 @@ export async function handleGateway(req, res) {
 
   // 全部重试失败
   const failedDetail = summarizeAttempts(attempted);
-  logger.warn('TRAE-GW', `全部 ${attempted.length} 次尝试失败${failedDetail ? '：' + failedDetail : ''}（下一请求自动重试）`);
+  logger.warn('TRAE-GW', '全部 {n} 次尝试失败{detail}(下一请求自动重试)', { n: attempted.length, detail: failedDetail ? ':' + failedDetail : '' });
   res.writeHead(502, { 'Content-Type': 'application/json' });
   res.end(JSON.stringify({
     error: '所有 Trae 账号均调用失败',

package/src/transfer.js

@@ -14,6 +14,7 @@
 
 import crypto from 'node:crypto';
 import { PROVIDERS, productOf } from './constants.js';
+import { inspectToken } from './workbuddyClient.js';
 
 export const TRANSFER_FORMAT = '10router-oauth-secure-v1';
 export const EXPORT_FORMAT = 'creditdaddy-accounts';
@@ -155,9 +156,17 @@ export function parseImport(data, { password } = {}) {
   const accounts = [];
   let skipped = 0;
   for (const item of list) {
-    // 显式标注了其他提供商（如 10router 的 cursor 账号）→ 跳过；未标注才用文件级 provider
-    const provider = item?.provider ? toProvider(item.provider) : fallbackProvider;
-    const token = item?.accessToken || item?.access_token || item?.token || item?.apiKey;
+    // 兼容 workbuddy-switch 导出的明文备份文件（没有 provider 字段，但有 domain / auth_raw / 顶层 access_token）
+    const token = item?.accessToken || item?.access_token || item?.token || item?.apiKey || item?.auth_raw?.accessToken || item?.auth_raw?.auth?.accessToken;
+    let provider = item?.provider ? toProvider(item.provider) : fallbackProvider;
+    let isWbSwitch = false;
+    if (!provider && typeof token === 'string' && token.trim()) {
+      const inspected = inspectToken(token);
+      if (inspected.provider) {
+        provider = inspected.provider;
+        isWbSwitch = true;
+      }
+    }
     if (!provider || typeof token !== 'string' || !token.trim()) { skipped++; continue; }
     const psd = item.providerSpecificData || {};
     const email = typeof item.email === 'string' && item.email.includes('@') && !/^qoder(-cn)?-user-/.test(item.email) ? item.email : null;
@@ -167,15 +176,44 @@ export function parseImport(data, { password } = {}) {
       ? { cookie: psd.creditDaddyWebSession.cookie, capturedAt: psd.creditDaddyWebSession.capturedAt || null } : null;
     const meta = { ...(item.meta && typeof item.meta === 'object' ? item.meta : {}) };
     if (webSession && !meta.qoderWebSession) meta.qoderWebSession = webSession;
+
+    // 对 workbuddy-switch 导出还原 session 结构，使之支持在 CreditDaddy 面板一键切换
+    if (isWbSwitch) {
+      if (source === 'creditdaddy') source = 'wb-switch';
+      if (item.domain && !meta.domain) meta.domain = item.domain;
+      if (item.enterpriseId && !meta.enterpriseId) meta.enterpriseId = item.enterpriseId;
+      if (item.refreshExpiresAt && !meta.refreshExpiresAt) {
+        meta.refreshExpiresAt = Number.isFinite(item.refreshExpiresAt) ? new Date(item.refreshExpiresAt).toISOString() : String(item.refreshExpiresAt);
+      }
+      if (!meta.session) {
+        const accountObj = item.auth_raw?.account || item.profile_raw || {
+          uid: item.uid || null,
+          nickname: item.nickname || item.name || null,
+          phoneNumber: item.phoneNumber || item.phone || null,
+          enterpriseId: item.enterpriseId || null,
+          type: 'personal',
+        };
+        const authObj = item.auth_raw?.auth || (item.auth_raw && item.auth_raw.accessToken ? item.auth_raw : { domain: item.domain });
+        meta.session = {
+          account: accountObj,
+          auth: authObj,
+          accounts: Array.isArray(item.auth_raw?.accounts) ? item.auth_raw.accounts : [],
+          ...(Array.isArray(item.auth_raw?.allAccounts) ? { allAccounts: item.auth_raw.allAccounts } : {}),
+        };
+      }
+    }
+
+    const expiresAt = item.expiresAt ?? (item.expiresIn ? Date.now() + Number(item.expiresIn) * 1000 : null);
+
     accounts.push({
       provider,
       token,
       name: item.name || item.nickname || email || null,
       email,
       uid: item.uid || psd.userId || null,
-      refreshToken: item.refreshToken || item.refresh_token || null,
-      expiresAt: item.expiresAt ?? (item.expiresIn ? Date.now() + Number(item.expiresIn) * 1000 : null),
-      source: source === '10router' ? '10router' : 'import',
+      refreshToken: item.refreshToken || item.refresh_token || item.auth_raw?.refreshToken || item.auth_raw?.auth?.refreshToken || null,
+      expiresAt,
+      source: isWbSwitch ? 'wb-switch' : (source === '10router' ? '10router' : 'import'),
       ...(Object.keys(meta).length ? { meta } : {}),
     });
   }

package/src/workbuddyClient.js

@@ -17,6 +17,8 @@
  */
 
 import { FETCH_TIMEOUT_MS } from './constants.js';
+import { fetchJsonRace } from './zcodeClient.js';
+import { withRefreshDedupe } from './refreshGuard.js';
 
 const USER_AGENT = 'CLI/2.108.1 CodeBuddy/2.108.1';
 const CN_DEFAULT_HOST = 'www.codebuddy.cn';
@@ -79,11 +81,12 @@ function headersFor(account, token) {
 }
 
 async function post(account, path, token) {
-  const res = await fetch(`https://${apiHost(account)}${path}`, {
+  // fetchJsonRace 统一出口：连接段限时 + 配置了出口代理时直连/代理双路兜底
+  const res = await fetchJsonRace(`https://${apiHost(account)}${path}`, {
     method: 'POST',
     headers: headersFor(account, token),
     body: '{}',
-    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    timeoutMs: FETCH_TIMEOUT_MS,
   });
   const text = await res.text();
   let body = null;
@@ -96,7 +99,7 @@ async function post(account, path, token) {
 // 对齐 10router src/sse/services/codebuddyCheckin.js 的 intl 探测（stream 网关的系统提示与 typed blocks 是必需的，否则 11101）。
 const INTL_PROBE_MODEL = 'hy4-preview';
 async function postIntlProbe(account, token) {
-  const res = await fetch(`https://${apiHost(account)}/v2/chat/completions`, {
+  const res = await fetchJsonRace(`https://${apiHost(account)}/v2/chat/completions`, {
     method: 'POST',
     headers: { ...headersFor(account, token), 'Content-Type': 'application/json', Accept: 'text/event-stream' },
     body: JSON.stringify({
@@ -108,7 +111,7 @@ async function postIntlProbe(account, token) {
         { role: 'user', content: [{ type: 'text', text: 'hi' }] },
       ],
     }),
-    signal: AbortSignal.timeout(Math.max(FETCH_TIMEOUT_MS, 25_000)),
+    timeoutMs: Math.max(FETCH_TIMEOUT_MS, 25_000),
   });
   // 2xx = 会话建立成功，把 SSE 流排干（最多几个 token）
   const text = await res.text().catch(() => '');
@@ -151,7 +154,7 @@ export async function refreshWorkbuddyToken(account) {
   let lastError = null;
   for (const host of hosts) {
     try {
-      const res = await fetch(`https://${host}/v2/plugin/auth/token/refresh`, {
+      const res = await fetchJsonRace(`https://${host}/v2/plugin/auth/token/refresh`, {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
@@ -165,7 +168,7 @@ export async function refreshWorkbuddyToken(account) {
           ...(account.meta?.enterpriseId ? { 'X-Enterprise-Id': account.meta.enterpriseId } : {}),
         },
         body: '{}',
-        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        timeoutMs: FETCH_TIMEOUT_MS,
       });
       const j = await res.json().catch(() => ({}));
       const d = j?.data;
@@ -202,7 +205,11 @@ async function withToken(account, fn, onRefresh) {
   let token = account.token;
   let refreshed = false;
   const doRefresh = async () => {
-    const creds = await refreshWorkbuddyToken(account);
+    // 并发互斥 + 失效链熔断：与 minimax 共用 refreshGuard（面板额度查询与签到轮同链抢刷的根堵点）
+    const creds = await withRefreshDedupe(account, refreshWorkbuddyToken, {
+      deadMessage: 'WorkBuddy 凭据链已被服务端作废，等待重新登录',
+      deadNotice: 'WorkBuddy 凭据链已失效，将不再自动重试（重新登录或重新导入该账号后自动恢复）',
+    });
     Object.assign(account, { token: creds.token, refreshToken: creds.refreshToken, expiresAt: creds.expiresAt });
     token = creds.token;
     refreshed = true;