dsh-cmtoken-oauth 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 cmtoken-oauth contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,51 @@
+# cmtoken 一键认证（DeepSeek Harness 插件）
+
+在 **DeepSeek Harness 设置**里一键认证广东移动 MaaS（cmtoken），自动发现模型并接入 DSH：
+
+- 🔑 **一键认证**：标准 OAuth 2.0 Device Grant (RFC 8628) + PKCE (S256)，扫码即完成
+- 📷 **二维码**：内联 QR 编码器（零依赖）生成 SVG 二维码
+- 🔄 **自动发现模型**：认证后拉取可用模型列表写入 provider 配置
+- 🗝 **安全存储**：token 存 DSH 凭据服务（OS keyring / env），不落盘明文
+- 🔁 **刷新 / 注销**：令牌过期可一键刷新，可随时注销
+
+零第三方运行时依赖（仅 Node 内置模块）。
+
+---
+
+## 安装（分享给别人）
+
+```bash
+# 在 DSH profile 目录（默认 ~/.dsh/profiles/web）执行
+dsh plugin --profile web add github:你的用户名/dsh-cmtoken-oauth
+# 或 npm：
+dsh plugin --profile web add dsh-cmtoken-oauth
+```
+
+`dsh plugin add` 会自动加入 profile 的 `dsh.profile.bundles`，重启 `dsh web` 生效。
+
+## 使用
+
+1. 打开 DSH Web → 设置（左下角齿轮）→ 左侧导航点「**cmtoken 认证**」。
+2. 点「开始一键认证」→ 用手机扫描二维码（或打开链接输入用户码）→ 在中国移动 IDaaS 页确认授权。
+3. 自动完成：发现模型 → 写入 `llm-pi-ai.providers.cmtoken` → 存凭据。
+4. 在 DSH 模型选择器里选用 cmtoken 模型即可。
+
+## 技术说明
+
+- 协议端点（分析自 cmtoken@1.0.7）：
+  - 授权服务器 `https://agentlink.idaas.cmpassport.com/oauth2-service`
+  - 设备码 `POST /oauth/device/code`、令牌 `POST /oauth/device/token`
+  - 模型发现 `GET https://maas.gd.chinamobile.com:36007/ai/uifm/open/v1/models`
+- 凭据引用：`CMTOKEN_API_KEY` / `CMTOKEN_REFRESH_TOKEN` / `CMTOKEN_EXPIRES`
+- 写配置：`llm-pi-ai` 设置 namespace 的 `providers.cmtoken`（merge，不覆盖其他 provider）
+
+## 开发
+
+```bash
+lib/index.js    # host：OAuth 核心（PKCE/设备码/轮询/刷新/模型发现）+ RPC
+lib/client.js   # web：设置页「cmtoken 认证」向导（二维码+轮询+完成）
+lib/qr-core.cjs # 内联 QR 编码器（提取自 qrcode-terminal，输出 SVG）
+```
+
+## License
+MIT

package/cordis.patch.yml

@@ -0,0 +1,5 @@
+# cmtoken 一键认证 — 插件注册（DSH profile 层）
+- insert:
+    - id: cmtoken-oauth
+      name: 'cmtoken-oauth'
+      config: {}

package/lib/client.js

@@ -0,0 +1,201 @@
+window.__ModuleLoader__.load({
+	id: "cmtoken-oauth",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+
+		let react = require("react");
+		let { useState, useEffect, useCallback, useRef } = react;
+		let primitives = require("@deepseek-ai/dsh-client-ui-primitives");
+		let { Button, Pill } = primitives;
+
+		// ==================== 工具 ====================
+		const CHANNEL = "/cmtoken-oauth";
+		function unwrap(r) { if (r && r.ok) return r.value; throw new Error(r && r.error ? r.error.message : "未知错误"); }
+
+		// ==================== 样式 ====================
+		const tagId = "cmtoken-oauth/style.css";
+		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
+			const tag = document.createElement("style");
+			tag.dataset.plugin = "cmtoken-oauth";
+			tag.dataset.pluginCss = tagId;
+			tag.textContent = `
+.dsh-co{display:flex;flex-direction:column;gap:14px;font-size:14px;color:var(--dsw-alias-label-primary);max-width:520px}
+.dsh-co h3{margin:0;font-size:15px}
+.dsh-co p{font-size:13px;color:var(--dsw-alias-label-secondary);line-height:1.7;margin:0}
+.dsh-co .co-qr{display:flex;flex-direction:column;align-items:center;gap:10px;background:var(--dsw-alias-bg-raised);border:1px solid var(--dsw-alias-border-l2);border-radius:14px;padding:18px}
+.dsh-co .co-qr svg{width:200px;height:200px;border-radius:8px}
+.dsh-co .co-qr .co-url{font-size:12.5px;color:var(--dsw-alias-label-tertiary);word-break:break-all;text-align:center}
+.dsh-co .co-qr .co-code{font-size:16px;font-weight:700;letter-spacing:2px;color:var(--dsw-alias-accent,#4d6bfe)}
+.dsh-co .co-status{display:flex;align-items:center;gap:8px;font-size:13px;color:var(--dsw-alias-label-secondary)}
+.dsh-co .co-dot{width:8px;height:8px;border-radius:50%;background:var(--dsw-alias-accent,#4d6bfe);animation:co-blink 1.2s infinite}
+@keyframes co-blink{50%{opacity:.25}}
+.dsh-co .co-ok{color:var(--dsw-alias-state-success,#3ecf8e)}
+.dsh-co .co-err{color:var(--dsw-alias-state-error-primary,#e5484d);font-size:13px}
+.dsh-co .co-models{display:flex;flex-wrap:wrap;gap:6px}
+.dsh-co .co-row{display:flex;align-items:center;gap:8px;flex-wrap:wrap}
+.dsh-co .co-hint{font-size:12px;color:var(--dsw-alias-label-tertiary);line-height:1.6}
+`;
+			document.head.appendChild(tag);
+		}
+
+		// ==================== 认证向导组件 ====================
+		function CmTokenSettings(props) {
+			const { rpc } = props;
+			const [phase, setPhase] = useState("loading"); // loading | idle | qr | done | error
+			const [status, setStatus] = useState(null);
+			const [flow, setFlow] = useState(null); // {requestId, interval}
+			const [models, setModels] = useState([]);
+			const [error, setError] = useState(null);
+			const pollTimer = useRef(null);
+
+			const refreshStatus = useCallback(async () => {
+				try { setStatus(unwrap(await rpc.call(CHANNEL, "status", {}))); }
+				catch { setStatus(null); }
+			}, [rpc]);
+
+			useEffect(() => {
+				refreshStatus().then(() => setPhase((p) => (p === "loading" ? "idle" : p)));
+				return () => { if (pollTimer.current) clearInterval(pollTimer.current); };
+			}, [refreshStatus]);
+
+			const begin = async () => {
+				setError(null);
+				try {
+					const v = unwrap(await rpc.call(CHANNEL, "begin", {}));
+					setFlow(v);
+					setPhase("qr");
+					// 启动轮询
+					if (pollTimer.current) clearInterval(pollTimer.current);
+					pollTimer.current = setInterval(async () => {
+						try {
+							const r = unwrap(await rpc.call(CHANNEL, "poll", { requestId: v.requestId }));
+							if (r.status === "ok") {
+								if (pollTimer.current) clearInterval(pollTimer.current);
+								setModels(r.models || []);
+								setPhase("done");
+								refreshStatus();
+							}
+						} catch (e) {
+							if (pollTimer.current) clearInterval(pollTimer.current);
+							setError(e.message || String(e));
+							setPhase("error");
+						}
+					}, Math.max((v.interval || 2) * 1000, 2000));
+				} catch (e) {
+					setError(e.message || String(e));
+					setPhase("error");
+				}
+			};
+
+			const doRefresh = async () => {
+				setError(null);
+				try { unwrap(await rpc.call(CHANNEL, "refresh", {})); await refreshStatus(); }
+				catch (e) { setError(e.message || String(e)); }
+			};
+
+			const doLogout = async () => {
+				setError(null);
+				try { unwrap(await rpc.call(CHANNEL, "logout", {})); await refreshStatus(); setModels([]); }
+				catch (e) { setError(e.message || String(e)); }
+			};
+
+			// loading
+			if (phase === "loading") {
+				return react.createElement("div", { className: "dsh-co" }, react.createElement("div", { className: "co-hint" }, "加载中…"));
+			}
+
+			// 已认证状态卡片（顶部常显）
+			const statusCard = react.createElement("div", null,
+				react.createElement("h3", null, "CMToken 模型服务"),
+				react.createElement("p", null, "广东移动 MaaS（cmtoken）：通过中国移动 IDaaS 扫码授权后，自动发现模型并接入 DSH 的模型列表。令牌临期或过期后会自动刷新（只要有有效的刷新令牌），无需手动干预。"),
+				status ? react.createElement("div", { className: "co-row", style: { marginTop: 8 } },
+					status.configured ? react.createElement(Pill, { active: true }, "已认证" + (status.expired ? "（已过期）" : "")) : react.createElement(Pill, null, "未认证"),
+					status.expiresAt ? react.createElement("span", { className: "co-hint" }, "剩余约 " + Math.max(0, Math.round((status.expiresAt - Date.now()) / 60000)) + " 分钟（自动刷新）") : null,
+					status.configured && !status.expired ? react.createElement(Button, { variant: "ghost", size: "sm", onClick: doRefresh }, "立即刷新") : null,
+					status.configured ? react.createElement(Button, { variant: "ghost", size: "sm", onClick: doLogout }, "注销") : null
+				) : null
+			);
+
+			// 二维码阶段
+			if (phase === "qr" && flow) {
+				return react.createElement("div", { className: "dsh-co" },
+					statusCard,
+					react.createElement("div", { className: "co-qr" },
+						react.createElement("div", { dangerouslySetInnerHTML: { __html: flow.qr_svg } }),
+						react.createElement("div", { className: "co-code" }, flow.user_code),
+						react.createElement("div", { className: "co-url" }, flow.verification_uri),
+						react.createElement("div", { className: "co-hint" }, "请用手机扫描二维码完成授权（或打开上方链接输入用户码）。有效期 " + Math.round((flow.expires_in || 600) / 60) + " 分钟。")
+					),
+					react.createElement("div", { className: "co-status" },
+						react.createElement("span", { className: "co-dot" }),
+						react.createElement("span", null, "正在等待扫码授权…")
+					),
+					error ? react.createElement("div", { className: "co-err" }, error) : null
+				);
+			}
+
+			// 完成阶段
+			if (phase === "done") {
+				return react.createElement("div", { className: "dsh-co" },
+					statusCard,
+					react.createElement("div", { className: "co-ok" }, "✅ 认证成功！已发现 " + models.length + " 个模型并写入配置。"),
+					models.length ? react.createElement("div", null,
+						react.createElement("div", { className: "co-hint", style: { marginBottom: 6 } }, "可用模型："),
+						react.createElement("div", { className: "co-models" }, models.map((m, i) => react.createElement(Pill, { key: i }, m.name || m.id)))
+					) : null,
+					react.createElement("p", null, "现在可以在 DSH 的模型选择器里选用 cmtoken 模型了。")
+				);
+			}
+
+			// 错误阶段
+			if (phase === "error") {
+				return react.createElement("div", { className: "dsh-co" },
+					statusCard,
+					react.createElement("div", { className: "co-err" }, "❌ " + (error || "认证失败")),
+					react.createElement(Button, { variant: "primary", size: "sm", onClick: () => { setPhase("idle"); setError(null); } }, "返回重试")
+				);
+			}
+
+			// idle：未开始 / 未认证
+			return react.createElement("div", { className: "dsh-co" },
+				statusCard,
+				status && status.configured && !status.expired
+					? react.createElement("div", { className: "co-ok" }, "✅ 已通过 cmtoken 认证，模型可用。需要重新认证或换账号时点下方按钮。")
+					: react.createElement("p", null, "一键认证：点击下方按钮，用手机扫描二维码即可完成广东移动 MaaS 授权（无需手动填写 API Key）。"),
+				react.createElement("div", { className: "co-row" },
+					react.createElement(Button, { variant: "primary", size: "md", onClick: begin }, "开始一键认证"),
+					status && status.hasRefresh && status.expired ? react.createElement(Button, { variant: "outline", size: "md", onClick: doRefresh }, "刷新令牌") : null
+				),
+				error ? react.createElement("div", { className: "co-err" }, error) : null
+			);
+		}
+
+		// ==================== 插件主体 ====================
+		const NS = "cmtoken-oauth";
+		const zh = { "nav": "cmtoken 认证" };
+		const en = { "nav": "cmtoken Auth" };
+		const inject = ["slots", "locale", "connection"];
+
+		function apply(ctx) {
+			ctx.effect(() => ctx.locale.register(NS, { zh, en }), "cmtoken-oauth: dictionaries");
+			const connection = ctx.get("connection");
+			const rpc = connection.rpc;
+			const t = ctx.locale.bind(NS);
+
+			// 注册「设置 → cmtoken 认证」页面
+			ctx.slots.inject("settings.section", () => ctx.slots.register({
+				name: "settings.section",
+				id: "cmtoken",
+				order: 60,
+				label: () => t("nav"),
+				inject: () => ({ rpc }),
+			}, CmTokenSettings));
+		}
+
+		exports.apply = apply;
+		exports.inject = inject;
+		return module.exports;
+	}
+});

package/lib/index.js

@@ -0,0 +1,348 @@
+// ============================================================
+// cmtoken 一键认证 — DeepSeek Harness host 插件
+// OAuth 2.0 Device Authorization Grant (RFC 8628) + PKCE (S256)
+// 对接广东移动 MaaS（cmtoken）：一键认证 → 自动发现模型 →
+// 写入 llm-pi-ai provider 配置 + 凭据（OS keyring / env）。
+// ============================================================
+import { randomBytes, randomUUID, createHash } from 'node:crypto';
+import os from 'node:os';
+import { createRequire } from 'node:module';
+import z from '@deepseek-ai/schemastery';
+import { settingsNamespace } from '@deepseek-ai/dsh-settings';
+import { credentialRef } from '@deepseek-ai/dsh-credentials';
+
+const require2 = createRequire(import.meta.url);
+const { qrSvg } = require2('./qr-core.cjs');
+
+export const name = 'cmtoken-oauth';
+export const inject = ['connection', 'settings', 'credentials'];
+
+export const Config = z.object({});
+
+// ---------------- 协议常量（分析报告第 4 节） ----------------
+const OAUTH_BASE = 'https://agentlink.idaas.cmpassport.com/oauth2-service';
+const CLIENT_ID = '00a60e3140284b408d51a436ecce121d';
+const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEFAULT_API_BASE = 'https://maas.gd.chinamobile.com:36007/ai/uifm/open/v1';
+const DISCOVERY_URL = DEFAULT_API_BASE + '/models';
+const TIMEOUT = 900_000;
+
+const API_KEY_ENV = 'CMTOKEN_API_KEY';
+const REFRESH_ENV = 'CMTOKEN_REFRESH_TOKEN';
+const EXPIRES_ENV = 'CMTOKEN_EXPIRES';
+
+// 单用户 Web 场景：进行中的设备码流程保存在模块级（keyed by requestId）
+const pending = new Map();
+
+const scope = () => `profile model.completion identity:device:${os.hostname()}`;
+
+function makePkce() {
+  const verifier = randomBytes(32).toString('base64url');
+  const challenge = createHash('sha256').update(verifier).digest('base64url');
+  const state = randomBytes(16).toString('base64url');
+  return { verifier, challenge, state };
+}
+
+async function requestDeviceCode() {
+  const { verifier, challenge, state } = makePkce();
+  const res = await fetch(`${OAUTH_BASE}/oauth/device/code`, {
+    method: 'POST',
+    signal: AbortSignal.timeout(TIMEOUT),
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      Accept: 'application/json',
+      'x-request-id': randomUUID(),
+    },
+    body: new URLSearchParams({
+      response_type: 'device_code',
+      client_id: CLIENT_ID,
+      scope: scope(),
+      code_challenge: challenge,
+      code_challenge_method: 'S256',
+      state,
+    }),
+  });
+  if (!res.ok) throw new Error(`设备码申请失败: ${await res.text()}`);
+  const json = await res.json();
+  if (!json.device_code || !json.user_code || !json.verification_uri) {
+    throw new Error(json.error_description ?? json.error ?? '设备码响应不完整');
+  }
+  return { ...json, verifier };
+}
+
+/** 单次令牌轮询；成功返回 Token，pending 返回 null，失败抛错。 */
+async function pollOnce(deviceCode, verifier) {
+  let res;
+  try {
+    res = await fetch(`${OAUTH_BASE}/oauth/device/token`, {
+      method: 'POST',
+      signal: AbortSignal.timeout(TIMEOUT),
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+      body: new URLSearchParams({
+        grant_type: DEVICE_GRANT,
+        client_id: CLIENT_ID,
+        device_code: deviceCode,
+        code_verifier: verifier,
+      }),
+    });
+  } catch {
+    return { status: 'pending' }; // 网络抖动 → 当 pending
+  }
+  const json = await res.json().catch(() => undefined);
+  if (res.ok) {
+    if (!json?.access_token || !json.refresh_token || !json.expires_in) {
+      throw new Error('令牌响应不完整');
+    }
+    return {
+      status: 'ok',
+      token: {
+        access: json.access_token,
+        refresh: json.refresh_token,
+        expires: Date.now() + json.expires_in * 1000,
+        resourceUrl: json.resource_url,
+      },
+    };
+  }
+  if (json?.error === 'authorization_pending') return { status: 'pending' };
+  if (json?.error === 'slow_down') return { status: 'slow_down' };
+  throw new Error(json?.error_description ?? json?.error ?? '令牌请求失败');
+}
+
+async function refreshToken(refresh) {
+  const res = await fetch(`${OAUTH_BASE}/oauth/device/token`, {
+    method: 'POST',
+    signal: AbortSignal.timeout(TIMEOUT),
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+    body: new URLSearchParams({
+      grant_type: 'refresh_token',
+      client_id: CLIENT_ID,
+      refresh_token: refresh,
+    }),
+  });
+  const json = await res.json();
+  if (!res.ok || json.error) throw new Error(json?.error_description ?? json?.error ?? '刷新失败');
+  return {
+    access: json.access_token,
+    refresh: json.refresh_token || refresh,
+    expires: Date.now() + json.expires_in * 1000,
+    resourceUrl: json.resource_url,
+  };
+}
+
+async function fetchModels(access, discoveryUrl) {
+  const res = await fetch(discoveryUrl || DISCOVERY_URL, {
+    signal: AbortSignal.timeout(15_000),
+    headers: { Accept: 'application/json', Authorization: `Bearer ${access}` },
+  });
+  if (!res.ok) {
+    const text = (await res.text()).slice(0, 200);
+    if (res.status === 403 && /订阅套餐|订阅已过期|余额不足/.test(text)) {
+      throw new Error('订阅错误：' + text);
+    }
+    throw new Error(`模型发现失败 ${res.status}: ${text}`);
+  }
+  const json = await res.json();
+  const list = Array.isArray(json.models) ? json.models : Array.isArray(json.data) ? json.data : [];
+  return list.map((m) => ({
+    id: m.id,
+    name: m.name ?? m.id,
+    contextWindow: m.contextWindow ?? 192_000,
+    maxTokens: m.maxTokens ?? 8192,
+  }));
+}
+
+function errorResult(e) {
+  const message = e instanceof Error ? e.message : String(e);
+  return { ok: false, error: { code: 'bad-request', message, details: {} } };
+}
+
+function registerRpc(ctx) {
+  return ctx.connection.rpc.handle('/cmtoken-oauth', async (endpoint, rawPayload, signal) => {
+    try {
+      if (signal?.aborted) throw new Error('请求已取消。');
+      const payload = (rawPayload && typeof rawPayload === 'object') ? rawPayload : {};
+
+      switch (endpoint) {
+        // ---- 开始认证：申请设备码 + 生成二维码 ----
+        case 'begin': {
+          const dc = await requestDeviceCode();
+          const url = dc.verification_uri_complete ?? dc.verification_uri;
+          const id = randomUUID();
+          pending.set(id, { device_code: dc.device_code, verifier: dc.verifier, expires_at: Date.now() + (dc.expires_in ?? 600) * 1000 });
+          return {
+            ok: true,
+            value: {
+              requestId: id,
+              qr_svg: qrSvg(url),
+              verification_uri: url,
+              verification_uri_complete: dc.verification_uri_complete,
+              user_code: dc.user_code,
+              interval: dc.interval ?? 2,
+              expires_in: dc.expires_in ?? 600,
+            },
+          };
+        }
+
+        // ---- 轮询令牌（client 按 interval 调用）；成功即自动发现模型 + 写配置 ----
+        case 'poll': {
+          const rid = payload.requestId;
+          const rec = pending.get(rid);
+          if (!rec) return { ok: false, error: { code: 'bad-request', message: '认证流程已失效，请重新开始', details: {} } };
+          if (Date.now() > rec.expires_at) {
+            pending.delete(rid);
+            return { ok: false, error: { code: 'timeout', message: '授权超时（未在有效期内完成扫码），请重新开始', details: {} } };
+          }
+          const r = await pollOnce(rec.device_code, rec.verifier);
+          if (r.status === 'pending') return { ok: true, value: { status: 'pending' } };
+          if (r.status === 'slow_down') return { ok: true, value: { status: 'slow_down' } };
+          // 成功：发现模型 + 写配置 + 存凭据
+          pending.delete(rid);
+          const token = r.token;
+          let models = [];
+          try {
+            models = await fetchModels(token.access, payload.discoveryUrl);
+          } catch (e) {
+            // 模型发现失败：凭据照存，配置给最小模型集，报错提示
+            ctx.logger?.warn?.('[cmtoken-oauth] 模型发现失败: ' + String(e.message || e));
+            models = [{ id: 'deepseekv4-flash', name: 'deepseekv4-flash', contextWindow: 192000, maxTokens: 8192 }];
+          }
+          await writeConfigAndCreds(ctx, token, models);
+          return { ok: true, value: { status: 'ok', models, baseURL: token.resourceUrl || DEFAULT_API_BASE } };
+        }
+
+        // ---- 认证状态 ----
+        case 'status': {
+          // 先触发一次按需自动刷新：用户一旦查看状态，若 access 已过期/临期
+          // 且有有效 refresh token，立即刷新，避免只靠粗粒度定时器漏刷。
+          await autoRefresh(ctx).catch((e) => ctx.logger?.warn?.('[cmtoken-oauth] 状态查询时自动刷新失败: ' + String(e?.message || e)));
+          const creds = ctx.credentials;
+          const apiInfo = await creds?.describe(credentialRef(API_KEY_ENV)).catch(() => undefined);
+          const refreshInfo = await creds?.describe(credentialRef(REFRESH_ENV)).catch(() => undefined);
+          const expRaw = await creds?.resolve(credentialRef(EXPIRES_ENV)).catch(() => undefined);
+          const expires = expRaw ? Number(expRaw.value) : NaN;
+          return {
+            ok: true,
+            value: {
+              configured: !!(apiInfo?.configured),
+              hasRefresh: !!(refreshInfo?.configured),
+              expiresAt: Number.isFinite(expires) && expires > 0 ? expires : null,
+              expired: Number.isFinite(expires) && expires > 0 ? Date.now() > expires : null,
+            },
+          };
+        }
+
+        // ---- 刷新令牌 ----
+        case 'refresh': {
+          const ref = await ctx.credentials?.resolve(credentialRef(REFRESH_ENV));
+          if (!ref) return { ok: false, error: { code: 'bad-request', message: '没有可用的刷新令牌', details: {} } };
+          const token = await refreshToken(ref.value);
+          await ctx.credentials.set(credentialRef(API_KEY_ENV), token.access);
+          await ctx.credentials.set(credentialRef(REFRESH_ENV), token.refresh);
+          await ctx.credentials.set(credentialRef(EXPIRES_ENV), String(token.expires));
+          return { ok: true, value: { expiresAt: token.expires } };
+        }
+
+        // ---- 注销（清除凭据，保留 provider 配置） ----
+        case 'logout': {
+          await ctx.credentials?.unset(credentialRef(API_KEY_ENV)).catch(() => {});
+          await ctx.credentials?.unset(credentialRef(REFRESH_ENV)).catch(() => {});
+          await ctx.credentials?.unset(credentialRef(EXPIRES_ENV)).catch(() => {});
+          return { ok: true, value: {} };
+        }
+
+        default:
+          throw new Error(`未知端点: ${endpoint}`);
+      }
+    } catch (e) {
+      return errorResult(e);
+    }
+  }, { authority: 'loopback' });
+}
+
+async function writeConfigAndCreds(ctx, token, models) {
+  // 1) 凭据（OS keyring / 凭据服务，apiKeyEnv 引用）
+  await ctx.credentials.set(credentialRef(API_KEY_ENV), token.access);
+  await ctx.credentials.set(credentialRef(REFRESH_ENV), token.refresh);
+  await ctx.credentials.set(credentialRef(EXPIRES_ENV), String(token.expires));
+
+  // 2) llm-pi-ai provider 配置（merge 进现有 providers，保留其他路由）
+  const section = {
+    providers: {
+      cmtoken: {
+        displayName: 'cmtoken',
+        apiKeyEnv: API_KEY_ENV,
+        api: 'openai-completions',
+        baseURL: token.resourceUrl || DEFAULT_API_BASE,
+        models: models.map((m) => ({ id: m.id, name: m.name, contextWindow: m.contextWindow, maxTokens: m.maxTokens })),
+      },
+    },
+  };
+  if (ctx.settings) {
+    await ctx.settings.update(settingsNamespace('llm-pi-ai'), section);
+  } else {
+    throw new Error('settings 服务不可用，无法写入 provider 配置');
+  }
+}
+
+// ---------------- 自动刷新令牌 ----------------
+// 定时器只负责「保底」：每个短周期检查一次；同时 status 查询也会触发按需自动刷新，
+// 因此只要 token 过期且 refresh token 仍有效，就会在过期后迅速被刷新，而不是等 2 小时。
+const AUTO_REFRESH_INTERVAL_MS = 60_000; // 每 1 分钟检查一次（轻量，剩余充足时直接返回）
+const AUTO_REFRESH_THRESHOLD_MS = 60 * 60_000; // 剩余 <1 小时即提前刷新（token 生命周期 ~5 小时，从容轮换）
+const REFRESH_COOLDOWN_MS = 60_000; // 刷新失败后冷却 1 分钟再试
+let lastRefreshAttempt = 0;
+
+/** 检查凭据：若 access 快过期且有 refresh，则自动刷新并更新凭据。 */
+async function autoRefresh(ctx) {
+  const creds = ctx.credentials;
+  if (!creds) return;
+  const refRes = await creds.resolve(credentialRef(REFRESH_ENV)).catch(() => undefined);
+  if (!refRes) return; // 没有 refresh token（未认证或已注销）
+
+  // 失败冷却：上次刷新失败后 REFRESH_COOLDOWN_MS 内不重试，避免无限循环
+  const now = Date.now();
+  if (now - lastRefreshAttempt < REFRESH_COOLDOWN_MS) return;
+
+  const expRes = await creds.resolve(credentialRef(EXPIRES_ENV)).catch(() => undefined);
+  const expires = expRes ? Number(expRes.value) : NaN;
+  if (!Number.isFinite(expires) || expires <= 0) return;
+  const remaining = expires - now;
+  // 剩余还多 → 不用刷；过期超过 7 天 → refresh 大概率已失效，放弃自动刷（需重新认证）
+  if (remaining > AUTO_REFRESH_THRESHOLD_MS) return;
+  if (remaining < -7 * 24 * 3600_000) return;
+
+  try {
+    const token = await refreshToken(refRes.value);
+    await creds.set(credentialRef(API_KEY_ENV), token.access);
+    await creds.set(credentialRef(REFRESH_ENV), token.refresh);
+    await creds.set(credentialRef(EXPIRES_ENV), String(token.expires));
+    lastRefreshAttempt = 0;
+    ctx.logger?.info?.('[cmtoken-oauth] 令牌已自动刷新，新过期时间: ' + new Date(token.expires).toISOString());
+  } catch (e) {
+    lastRefreshAttempt = Date.now();
+    ctx.logger?.warn?.('[cmtoken-oauth] 自动刷新失败（冷却 ' + REFRESH_COOLDOWN_MS / 60000 + ' 分钟）: ' + String(e?.message || e));
+  }
+}
+
+/** 启动自动刷新定时器；返回清理函数。 */
+function startAutoRefresh(ctx) {
+  const timer = setInterval(() => {
+    void autoRefresh(ctx).catch((e) => ctx.logger?.warn?.('[cmtoken-oauth] 自动刷新异常: ' + String(e?.message || e)));
+  }, AUTO_REFRESH_INTERVAL_MS);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+
+export function apply(ctx, cfg = {}) {
+  let removeRpc = () => {};
+  let stopTimer = () => {};
+  ctx.effect(() => {
+    removeRpc = registerRpc(ctx);
+    stopTimer = startAutoRefresh(ctx);
+    return () => {
+      removeRpc();
+      stopTimer();
+    };
+  }, 'cmtoken-oauth: host service');
+  ctx.logger?.info?.('[cmtoken-oauth] host 服务已启动（自动刷新已开启：每 1 分钟检查 + status 查询按需触发，剩余 <1 小时或已过期即刷新）');
+}