dsh-cmtoken-oauth 1.6.1 → 1.7.0

package/lib/client.js

@@ -61,9 +61,18 @@ window.__ModuleLoader__.load({
 			const [error, setError] = useState(null);
 			const pollTimer = useRef(null);
 			const autoStarted = useRef(false);
+			const [channel, setChannelState] = useState("komect");
+						const switchChannel = async (ch) => {
+							setError(null); setPhase("loading");
+							try {
+								unwrap(await rpc.call(CHANNEL, "set-channel", { channel: ch }));
+								setChannelState(ch);
+								begin();
+							} catch (e) { setPhase("error"); setError(e.message || String(e)); }
+						};
 
 			const refreshStatus = useCallback(async () => {
-				try { setStatus(unwrap(await rpc.call(CHANNEL, "status", {}))); }
+				try { const s = unwrap(await rpc.call(CHANNEL, "status", {})); setStatus(s); if (s && s.channel) setChannelState(s.channel); }
 				catch { setStatus(null); }
 			}, [rpc]);
 
@@ -137,15 +146,18 @@ window.__ModuleLoader__.load({
 			if (phase === "loading") {
 				authCard = react.createElement("div", { className: "co-card" },
 					react.createElement("div", { className: "co-card-title" }, "认证"),
-					react.createElement("p", { className: "co-hint" }, "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
+					react.createElement("p", { className: "co-hint" }, channel === "maas" ? "广东移动 MaaS 旧通道：扫码授权后自动发现模型，令牌自动续期。" : "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
 					react.createElement("div", { className: "co-hint" }, "加载中…"));
 			} else if (phase === "qr" && flow) {
 				authCard = react.createElement("div", { className: "co-card" },
 					react.createElement("div", { className: "co-card-title" }, "认证"),
-					react.createElement("p", { className: "co-hint" }, "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
+					react.createElement("p", { className: "co-hint" }, channel === "maas" ? "广东移动 MaaS 旧通道：扫码授权后自动发现模型，令牌自动续期。" : "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
 					react.createElement("div", { className: "co-qr" },
 						react.createElement("div", { dangerouslySetInnerHTML: { __html: flow.qr_svg } }),
-						react.createElement("div", { className: "co-hint" }, "扫码登录中国移动账号，一次扫码完成认证与用量关联，约 " + Math.round(flow.expires_in || 180) + " 秒内有效")
+						(flow.channel === "maas" && flow.user_code ? react.createElement("div", { className: "co-code" }, flow.user_code) : null),
+						flow.channel === "maas"
+							? react.createElement("div", { className: "co-hint" }, "使用手机扫码并输入用户码完成授权，有效期 " + Math.round((flow.expires_in || 600) / 60) + " 分钟")
+							: react.createElement("div", { className: "co-hint" }, "扫码登录中国移动账号，一次扫码完成认证与用量关联，约 " + Math.round(flow.expires_in || 180) + " 秒内有效")
 					),
 					react.createElement("div", { className: "co-status" },
 						react.createElement("span", { className: "co-dot" }),
@@ -153,36 +165,50 @@ window.__ModuleLoader__.load({
 			} else if (phase === "done") {
 				authCard = react.createElement("div", { className: "co-card" },
 					react.createElement("div", { className: "co-card-title" }, "认证"),
-					react.createElement("p", { className: "co-hint" }, "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
+					react.createElement("p", { className: "co-hint" }, channel === "maas" ? "广东移动 MaaS 旧通道：扫码授权后自动发现模型，令牌自动续期。" : "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
 					react.createElement("div", { className: "co-auth-ok" }, "✅ 已认证" + (models.length ? "，已接入 " + models.length + " 个模型" : "")),
 					react.createElement("div", { className: "co-row" },
-						react.createElement(Button, { variant: "outline", size: "md", onClick: doRefresh }, "刷新模型与用量"),
+						react.createElement(Button, { variant: "outline", size: "md", onClick: doRefresh }, (status && status.activeChannel === "maas" ? "刷新令牌" : "刷新模型与用量")),
 						react.createElement(Button, { variant: "outline", size: "md", onClick: begin }, "重新认证")));
 			} else if (phase === "error") {
 				authCard = react.createElement("div", { className: "co-card" },
 					react.createElement("div", { className: "co-card-title" }, "认证"),
-					react.createElement("p", { className: "co-hint" }, "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
+					react.createElement("p", { className: "co-hint" }, channel === "maas" ? "广东移动 MaaS 旧通道：扫码授权后自动发现模型，令牌自动续期。" : "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
 					react.createElement("div", { className: "co-err" }, "❌ " + (error || "认证失败")),
 					react.createElement("div", { className: "co-row" },
 						react.createElement(Button, { variant: "primary", size: "md", onClick: () => { setPhase("ok"); setError(null); } }, "返回重试")));
 			} else if (authenticated) {
 				authCard = react.createElement("div", { className: "co-card" },
 					react.createElement("div", { className: "co-card-title" }, "认证"),
-					react.createElement("p", { className: "co-hint" }, "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
+					react.createElement("p", { className: "co-hint" }, channel === "maas" ? "广东移动 MaaS 旧通道：扫码授权后自动发现模型，令牌自动续期。" : "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
 					react.createElement("div", { className: "co-auth-ok" },
 						"✅ 已认证",
-						status && status.sessionExpired ? react.createElement("span", { className: "co-hint" }, "（管理会话已过期，重新扫码可刷新模型列表）") : null),
+						status && status.activeChannel === "maas" && status.expiresAt ? react.createElement("span", { className: "co-hint" },
+							status.expired ? "（令牌已过期，请刷新或重新认证）" : "（令牌剩余约 " + Math.max(0, Math.round((status.expiresAt - Date.now()) / 60000)) + " 分钟）") : null,
+						status && status.activeChannel !== "maas" && status.sessionExpired ? react.createElement("span", { className: "co-hint" }, "（管理会话已过期，重新扫码可刷新模型列表）") : null),
 					react.createElement("div", { className: "co-row" },
-						react.createElement(Button, { variant: "outline", size: "md", onClick: doRefresh }, "刷新模型与用量"),
+						react.createElement(Button, { variant: "outline", size: "md", onClick: doRefresh }, (status && status.activeChannel === "maas" ? "刷新令牌" : "刷新模型与用量")),
 						react.createElement(Button, { variant: "outline", size: "md", onClick: begin }, "重新认证")));
 			} else {
 				authCard = react.createElement("div", { className: "co-card" },
 					react.createElement("div", { className: "co-card-title" }, "认证"),
-					react.createElement("p", { className: "co-hint" }, "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
+					react.createElement("p", { className: "co-hint" }, channel === "maas" ? "广东移动 MaaS 旧通道：扫码授权后自动发现模型，令牌自动续期。" : "中国移动算力豆一键认证：扫码即自动创建专属 DSH API key，长期有效，无需刷新令牌。"),
 					react.createElement("div", { className: "co-hint" }, "准备二维码…"));
 			}
 
-			// ---- 卡片：算力豆用量 ----
+			// ---- 通道选择（认证卡上方） ----
+			const channelCard = react.createElement("div", { className: "co-card" },
+				react.createElement("div", { className: "co-card-title" }, "认证通道"),
+				react.createElement("div", { className: "co-row" },
+					react.createElement("select", {
+						className: "co-select",
+						value: channel,
+						onChange: (e) => switchChannel(e.target.value),
+					},
+						react.createElement("option", { value: "komect" }, "中国移动算力豆（推荐）"),
+						react.createElement("option", { value: "maas" }, "广东移动 MaaS（旧通道）")),
+					react.createElement("span", { className: "co-hint" }, "切换后需重新扫码认证")));
+// ---- 卡片：算力豆用量 ----
 			const usageCard = status && status.usageLinked
 				? react.createElement("div", { className: "co-card" },
 					react.createElement("div", { className: "co-card-title" }, "算力豆用量"),

package/lib/index.js

@@ -191,6 +191,233 @@ async function fetchKomectModels(session) {
 // 仅在发现接口失败时兜底使用。
 const DEFAULT_MODEL_SPEC = { contextWindow: 262_144, maxTokens: 65_536 };
 
+// ---------------- 旧通道：广东移动 MaaS（OAuth Device Grant，legacy 可选） ----------------
+const OAUTH_BASE = 'https://agentlink.idaas.cmpassport.com/oauth2-service';
+const CLIENT_ID = '00a60e3140284b408d51a436ecce121d';
+const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+const MAASTIMEOUT = 900_000;
+const legacyPending = new Map();
+
+const scope = () => `profile model.completion identity:device:${os.hostname()}`;
+
+function makePkce() {
+  const verifier = randomBytes(32).toString('base64url');
+  const challenge = createHash('sha256').update(verifier).digest('base64url');
+  const state = randomBytes(16).toString('base64url');
+  return { verifier, challenge, state };
+}
+
+async function requestDeviceCode() {
+  const { verifier, challenge, state } = makePkce();
+  const res = await fetch(`${OAUTH_BASE}/oauth/device/code`, {
+    method: 'POST',
+    signal: AbortSignal.timeout(MAASTIMEOUT),
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      Accept: 'application/json',
+      'x-request-id': randomUUID(),
+    },
+    body: new URLSearchParams({
+      response_type: 'device_code',
+      client_id: CLIENT_ID,
+      scope: scope(),
+      code_challenge: challenge,
+      code_challenge_method: 'S256',
+      state,
+    }),
+  });
+  if (!res.ok) throw new Error(`设备码申请失败: ${await res.text()}`);
+  const json = await res.json();
+  if (!json.device_code || !json.user_code || !json.verification_uri) {
+    throw new Error(json.error_description ?? json.error ?? '设备码响应不完整');
+  }
+  return { ...json, verifier };
+}
+
+/** 单次令牌轮询；成功返回 Token，pending 返回 null，失败抛错。 */
+async function pollOnce(deviceCode, verifier) {
+  let res;
+  try {
+    res = await fetch(`${OAUTH_BASE}/oauth/device/token`, {
+      method: 'POST',
+      signal: AbortSignal.timeout(MAASTIMEOUT),
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+      body: new URLSearchParams({
+        grant_type: DEVICE_GRANT,
+        client_id: CLIENT_ID,
+        device_code: deviceCode,
+        code_verifier: verifier,
+      }),
+    });
+  } catch {
+    return { status: 'pending' }; // 网络抖动 → 当 pending
+  }
+  const json = await res.json().catch(() => undefined);
+  if (res.ok) {
+    if (!json?.access_token || !json.refresh_token || !json.expires_in) {
+      throw new Error('令牌响应不完整');
+    }
+    return {
+      status: 'ok',
+      token: {
+        access: json.access_token,
+        refresh: json.refresh_token,
+        expires: Date.now() + json.expires_in * 1000,
+        resourceUrl: json.resource_url,
+      },
+    };
+  }
+  if (json?.error === 'authorization_pending') return { status: 'pending' };
+  if (json?.error === 'slow_down') return { status: 'slow_down' };
+  throw new Error(json?.error_description ?? json?.error ?? '令牌请求失败');
+}
+
+async function refreshToken(refresh) {
+  const res = await fetch(`${OAUTH_BASE}/oauth/device/token`, {
+    method: 'POST',
+    signal: AbortSignal.timeout(MAASTIMEOUT),
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+    body: new URLSearchParams({
+      grant_type: 'refresh_token',
+      client_id: CLIENT_ID,
+      refresh_token: refresh,
+    }),
+  });
+  const json = await res.json();
+  if (!res.ok || json.error) throw new Error(json?.error_description ?? json?.error ?? '刷新失败');
+  return {
+    access: json.access_token,
+    refresh: json.refresh_token || refresh,
+    expires: Date.now() + json.expires_in * 1000,
+    resourceUrl: json.resource_url,
+  };
+}
+
+// 根据模型名称关键词匹配「输入（上下文）/ 输出（最大生成）」规格（MaaS 旧发现接口无规格字段）。
+const MAAS_MODEL_SPECS = [
+  { match: (n) => n.includes('deepseek') && n.includes('v4') && n.includes('flash'), contextWindow: 524_288, maxTokens: 393_216 },
+  { match: (n) => n.includes('deepseek') && n.includes('v4'), contextWindow: 1_048_576, maxTokens: 393_216 },
+  { match: (n) => n.includes('minimax') && /m3/.test(n), contextWindow: 1_048_576, maxTokens: 131_072 },
+  { match: (n) => n.includes('qwen36') || n.includes('qwen38'), contextWindow: 262_144, maxTokens: 65_536 },
+  { match: (n) => n.includes('qwen'), contextWindow: 1_048_576, maxTokens: 65_536 },
+  { match: (n) => n.includes('glm'), contextWindow: 1_048_576, maxTokens: 131_072 },
+  { match: (n) => n.startsWith('m2') || (n.includes('minimax') && /m2/.test(n)), contextWindow: 204_800, maxTokens: 65_536 },
+  { match: (n) => /hy/.test(n), contextWindow: 262_144, maxTokens: 65_536 },
+];
+
+function maasModelSpecFor(id) {
+  const n = String(id).toLowerCase().replace(/[-_\s.]+/g, '');
+  for (const spec of MAAS_MODEL_SPECS) {
+    if (spec.match(n)) return spec;
+  }
+  return DEFAULT_MODEL_SPEC;
+}
+
+const MAAS_API_BASE = 'https://maas.gd.chinamobile.com:36007/ai/uifm/open/v1';
+
+async function fetchMaasModels(access, discoveryUrl) {
+  const res = await fetch(discoveryUrl || (MAAS_API_BASE + '/models'), {
+    signal: AbortSignal.timeout(15_000),
+    headers: { Accept: 'application/json', Authorization: `Bearer ${access}` },
+  });
+  if (!res.ok) {
+    const text = (await res.text()).slice(0, 200);
+    if (res.status === 403 && /订阅套餐|订阅已过期|余额不足/.test(text)) {
+      throw new Error('订阅错误：' + text);
+    }
+    throw new Error(`模型发现失败 ${res.status}: ${text}`);
+  }
+  const json = await res.json();
+  const list = Array.isArray(json.models) ? json.models : Array.isArray(json.data) ? json.data : [];
+  return list.map((m) => {
+    const spec = maasModelSpecFor(m.id);
+    return {
+      id: m.id,
+      name: m.name ?? m.id,
+      contextWindow: spec.contextWindow,
+      maxTokens: spec.maxTokens,
+    };
+  });
+}
+
+// 旧通道令牌自动刷新：仅在存在 legacy refresh token（CMTOKEN_REFRESH_TOKEN）时生效，
+// 新通道（算力豆）的 lx_sk_ 长期有效、从不写该凭据，因此定时器对新通道天然空转。
+const AUTO_REFRESH_INTERVAL_MS = 60_000;
+const AUTO_REFRESH_THRESHOLD_MS = 60 * 60_000;
+const REFRESH_COOLDOWN_MS = 60_000;
+let lastRefreshAttempt = 0;
+
+async function legacyAutoRefresh(ctx) {
+  const creds = ctx.credentials;
+  if (!creds) return;
+  const refRes = await creds.resolve(credentialRef(REFRESH_ENV)).catch(() => undefined);
+  if (!refRes) return; // 没有 legacy refresh token → 不处理
+
+  const now = Date.now();
+  if (now - lastRefreshAttempt < REFRESH_COOLDOWN_MS) return;
+
+  const expRes = await creds.resolve(credentialRef(EXPIRES_ENV)).catch(() => undefined);
+  const expires = expRes ? Number(expRes.value) : NaN;
+  if (!Number.isFinite(expires) || expires <= 0) return;
+  const remaining = expires - now;
+  if (remaining > AUTO_REFRESH_THRESHOLD_MS) return;
+  if (remaining < -7 * 24 * 3600_000) return;
+
+  try {
+    const token = await refreshToken(refRes.value);
+    await creds.set(credentialRef(API_KEY_ENV), token.access);
+    await creds.set(credentialRef(REFRESH_ENV), token.refresh);
+    await creds.set(credentialRef(EXPIRES_ENV), String(token.expires));
+    lastRefreshAttempt = 0;
+    ctx.logger?.info?.('[cmtoken-oauth] 旧通道令牌已自动刷新，新过期时间: ' + new Date(token.expires).toISOString());
+  } catch (e) {
+    lastRefreshAttempt = Date.now();
+    ctx.logger?.warn?.('[cmtoken-oauth] 旧通道自动刷新失败（冷却 1 分钟）: ' + String(e?.message || e));
+  }
+}
+
+function startLegacyAutoRefresh(ctx) {
+  const timer = setInterval(() => {
+    void legacyAutoRefresh(ctx).catch((e) => ctx.logger?.warn?.('[cmtoken-oauth] 旧通道自动刷新异常: ' + String(e?.message || e)));
+  }, AUTO_REFRESH_INTERVAL_MS);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+
+/** 当前选择的认证通道：komect（中国移动算力豆，默认）| maas（广东移动 MaaS 旧通道）。 */
+async function currentChannel() {
+  const cfg = await readPluginConfig();
+  return cfg.channel === 'maas' ? 'maas' : 'komect';
+}
+
+async function writeLegacyConfigAndCreds(ctx, token, models) {
+  await ctx.credentials.set(credentialRef(API_KEY_ENV), token.access);
+  await ctx.credentials.set(credentialRef(REFRESH_ENV), token.refresh);
+  await ctx.credentials.set(credentialRef(EXPIRES_ENV), String(token.expires));
+  const section = {
+    providers: {
+      cmtoken: {
+        displayName: 'cmtoken (广东移动 MaaS)',
+        apiKeyEnv: API_KEY_ENV,
+        api: 'openai-completions',
+        baseURL: token.resourceUrl || MAAS_API_BASE,
+        models: models.map((m) => ({
+          id: m.id,
+          name: m.name,
+          contextWindow: m.contextWindow,
+          maxTokens: m.maxTokens,
+          input: m.input ?? modelInputModalities(m.id),
+        })),
+      },
+    },
+  };
+  if (ctx.settings) {
+    await ctx.settings.update(settingsNamespace('llm-pi-ai'), section);
+  } else {
+    throw new Error('settings 服务不可用，无法写入 provider 配置');
+  }
+}
+
 // ---------------- 视觉（图片）能力判定与回退优先级 ----------------
 // 视觉模型优先级（值越小越优先，0 表示不支持图片）：
 //   1) Qwen3.8 27B（qwen38-27b 等）—— 最优先
@@ -302,8 +529,37 @@ function registerRpc(ctx) {
       const payload = (rawPayload && typeof rawPayload === 'object') ? rawPayload : {};
 
       switch (endpoint) {
-        // ---- 开始认证：order-center 扫码（一次扫码同时获得用量查询 + 密钥管理） ----
+        // ---- 选择认证通道（komect=中国移动算力豆[默认] | maas=广东移动 MaaS 旧通道） ----
+        case 'set-channel': {
+          const ch = payload.channel === 'maas' ? 'maas' : 'komect';
+          await writePluginConfig({ channel: ch });
+          return { ok: true, value: { channel: ch } };
+        }
+
+        // ---- 开始认证：按通道获取二维码 ----
         case 'begin': {
+          const ch = await currentChannel();
+          if (ch === 'maas') {
+            // 旧通道：OAuth Device Grant 设备码
+            const dc = await requestDeviceCode();
+            const url = dc.verification_uri_complete ?? dc.verification_uri;
+            const id = randomUUID();
+            legacyPending.set(id, { device_code: dc.device_code, verifier: dc.verifier, expires_at: Date.now() + (dc.expires_in ?? 600) * 1000 });
+            return {
+              ok: true,
+              value: {
+                requestId: id,
+                channel: 'maas',
+                qr_svg: qrSvg(url),
+                verification_uri: url,
+                verification_uri_complete: dc.verification_uri_complete,
+                user_code: dc.user_code,
+                interval: dc.interval ?? 5,
+                expires_in: dc.expires_in ?? 600,
+              },
+            };
+          }
+          // 新通道：order-center 扫码（一次扫码同时获得用量查询 + 密钥管理）
           const res = await fetch(`${ORDER_BASE}/sso/qrcode?business=workbuddy`, {
             signal: AbortSignal.timeout(20_000),
             headers: { Accept: 'application/json' },
@@ -319,6 +575,7 @@ function registerRpc(ctx) {
             ok: true,
             value: {
               requestId: id,
+              channel: 'komect',
               qr_svg: qrSvg(dc.qr_code_url),
               interval: Math.max(1, Math.round((dc.poll_interval_ms ?? 1500) / 1000)),
               expires_in: dc.expire ?? Math.round(ORDER_QR_TTL_MS / 1000),
@@ -326,66 +583,14 @@ function registerRpc(ctx) {
           };
         }
 
-        // ---- 轮询扫码状态；成功即：桥接密钥管理会话 → 取/建 DSH 密钥 → 发现模型 → 写配置 ----
+        // ---- 轮询扫码状态；成功即完成该通道的认证 + 配置写入 ----
         case 'poll': {
-          const rid = payload.requestId;
-          const rec = pendingOrder.get(rid);
-          if (!rec) return { ok: false, error: { code: 'bad-request', message: '认证流程已失效，请重新开始', details: {} } };
-          if (Date.now() > rec.expires_at) {
-            pendingOrder.delete(rid);
-            return { ok: false, error: { code: 'timeout', message: '二维码已过期（未在有效期内完成扫码），请重新开始', details: {} } };
-          }
-          const st = await orderPost('/sso/qrcode/status', { uuid: rec.uuid });
-          const state = String(st?.state ?? '');
-          if (state === '0') return { ok: true, value: { status: 'pending' } };
-          if (state === '1') return { ok: true, value: { status: 'pending', scanned: true } };
-          if (state === '-1' || state === '-3') {
-            pendingOrder.delete(rid);
-            return { ok: false, error: { code: 'bad-request', message: '扫码认证失败（' + (st?.state_desc ?? state) + '），请重新扫码', details: {} } };
-          }
-          if (state !== '2' || !st?.order_session) {
-            pendingOrder.delete(rid);
-            return { ok: false, error: { code: 'bad-request', message: '扫码认证未完成，请刷新二维码重试', details: {} } };
-          }
-          // 扫码成功：order_session → 桥接管理会话 → DSH 密钥 → 模型 → 写配置
-          pendingOrder.delete(rid);
-          const orderSession = st.order_session;
-          await ctx.credentials.set(credentialRef(ORDER_SESSION_ENV), orderSession);
-
-          // 用量（失败不阻断主流程）
-          let usage = null;
-          try {
-            usage = await fetchUsageSummary(orderSession);
-          } catch (e) {
-            ctx.logger?.warn?.('[cmtoken-oauth] 算力豆用量获取失败: ' + String(e?.message || e));
-          }
-
-          // 桥接：order_session → api-key/link → sso_token → sso-login → management_session
-          const { session, expires } = await bridgeManagementSession(orderSession);
-          const apiKey = await ensureDshApiKey(session);
-          let models = [];
-          try {
-            models = await fetchKomectModels(session);
-          } catch (e) {
-            // 模型发现失败：密钥照存，配置给最小模型集，报错提示
-            ctx.logger?.warn?.('[cmtoken-oauth] 算力豆模型发现失败: ' + String(e.message || e));
-            models = [{ id: 'deepseekv4-flash-guangdong', name: 'DeepSeek V4 Flash', contextWindow: 512_000, maxTokens: 262_144, input: ['text'] }];
-          }
-          await writeConfigAndCreds(ctx, { apiKey, session, expires }, models);
-          return {
-            ok: true,
-            value: {
-              status: 'ok',
-              models: models.map((m) => ({ ...m, input: m.input ?? modelInputModalities(m.id) })),
-              baseURL: GW_BASE,
-              keyName: DSH_KEY_NAME,
-              usage,
-              maskedPhone: st.phone ?? null,
-            },
-          };
+          const ch = await currentChannel();
+          if (ch === 'maas') return await pollMaaS(payload);
+          return await pollKomect(ctx, payload);
         }
 
-        // ---- 认证状态（含算力豆用量） ----
+        // ---- 认证状态（分通道；含算力豆用量） ----
         case 'status': {
           const creds = ctx.credentials;
           const apiInfo = await creds?.describe(credentialRef(API_KEY_ENV)).catch(() => undefined);
@@ -393,7 +598,28 @@ function registerRpc(ctx) {
           const orderInfo = await creds?.describe(credentialRef(ORDER_SESSION_ENV)).catch(() => undefined);
           const expRaw = await creds?.resolve(credentialRef(EXPIRES_ENV)).catch(() => undefined);
           const expires = expRaw ? Number(expRaw.value) : NaN;
-          // 用量：order_session 有效时实时取，失败标记过期（不阻断状态查询）
+          const cfg = await readPluginConfig();
+          const channel = cfg.channel === 'maas' ? 'maas' : 'komect';
+          const activeChannel = cfg.activeChannel === 'maas' ? 'maas' : (cfg.activeChannel === 'komect' ? 'komect' : channel);
+          const candidates = visionModelCandidates(ctx);
+
+          // 旧通道（当前激活）：返回令牌过期信息
+          if (activeChannel === 'maas') {
+            return {
+              ok: true,
+              value: {
+                configured: !!(apiInfo?.configured),
+                channel,
+                activeChannel,
+                expiresAt: Number.isFinite(expires) && expires > 0 ? expires : null,
+                expired: Number.isFinite(expires) && expires > 0 ? Date.now() > expires : null,
+                visionModels: candidates,
+                visionModel: candidates.some((c) => c.id === cfg.visionModel) ? cfg.visionModel : null,
+              },
+            };
+          }
+
+          // 新通道：用量 + 管理会话信息
           let usage = null;
           let usageExpired = false;
           if (orderInfo?.configured) {
@@ -406,12 +632,12 @@ function registerRpc(ctx) {
               }
             }
           }
-          const candidates = visionModelCandidates(ctx);
-          const cfg = await readPluginConfig();
           return {
             ok: true,
             value: {
               configured: !!(apiInfo?.configured),
+              channel,
+              activeChannel,
               hasSession: !!(sessInfo?.configured),
               usageLinked: !!(orderInfo?.configured),
               usage,
@@ -443,8 +669,20 @@ function registerRpc(ctx) {
           return { ok: true, value: { visionModel: hit.id } };
         }
 
-        // ---- 刷新：order_session 有效则重新桥接 + 重新发现模型 ----
+        // ---- 刷新：按当前激活通道处理 ----
         case 'refresh': {
+          const ch = await (async () => { const c = await readPluginConfig(); return c.activeChannel === 'maas' ? 'maas' : (c.activeChannel === 'komect' ? 'komect' : await currentChannel()); })();
+          if (ch === 'maas') {
+            // 旧通道：刷新令牌
+            const ref = await ctx.credentials?.resolve(credentialRef(REFRESH_ENV));
+            if (!ref) return { ok: false, error: { code: 'bad-request', message: '没有可用的刷新令牌', details: {} } };
+            const token = await refreshToken(ref.value);
+            await ctx.credentials.set(credentialRef(API_KEY_ENV), token.access);
+            await ctx.credentials.set(credentialRef(REFRESH_ENV), token.refresh);
+            await ctx.credentials.set(credentialRef(EXPIRES_ENV), String(token.expires));
+            return { ok: true, value: { expiresAt: token.expires } };
+          }
+          // 新通道：order_session 有效则重新桥接 + 重新发现模型
           const osRes = await ctx.credentials?.resolve(credentialRef(ORDER_SESSION_ENV));
           if (!osRes) return { ok: false, error: { code: 'bad-request', message: '没有可用的扫码会话，请重新扫码认证（API key 本身不受影响）', details: {} } };
           let usage = null;
@@ -475,6 +713,100 @@ function registerRpc(ctx) {
   });
 }
 
+/** 新通道轮询：order-center 扫码 → 桥接 → DSH 密钥 → 模型 → 写配置。 */
+async function pollKomect(ctx, payload) {
+  const rid = payload.requestId;
+  const rec = pendingOrder.get(rid);
+  if (!rec) return { ok: false, error: { code: 'bad-request', message: '认证流程已失效，请重新开始', details: {} } };
+  if (Date.now() > rec.expires_at) {
+    pendingOrder.delete(rid);
+    return { ok: false, error: { code: 'timeout', message: '二维码已过期（未在有效期内完成扫码），请重新开始', details: {} } };
+  }
+  const st = await orderPost('/sso/qrcode/status', { uuid: rec.uuid });
+  const state = String(st?.state ?? '');
+  if (state === '0') return { ok: true, value: { status: 'pending' } };
+  if (state === '1') return { ok: true, value: { status: 'pending', scanned: true } };
+  if (state === '-1' || state === '-3') {
+    pendingOrder.delete(rid);
+    return { ok: false, error: { code: 'bad-request', message: '扫码认证失败（' + (st?.state_desc ?? state) + '），请重新扫码', details: {} } };
+  }
+  if (state !== '2' || !st?.order_session) {
+    pendingOrder.delete(rid);
+    return { ok: false, error: { code: 'bad-request', message: '扫码认证未完成，请刷新二维码重试', details: {} } };
+  }
+  // 扫码成功：order_session → 桥接管理会话 → DSH 密钥 → 模型 → 写配置
+  pendingOrder.delete(rid);
+  const orderSession = st.order_session;
+  await ctx.credentials.set(credentialRef(ORDER_SESSION_ENV), orderSession);
+  await writePluginConfig({ activeChannel: 'komect' });
+
+  // 用量（失败不阻断主流程）
+  let usage = null;
+  try {
+    usage = await fetchUsageSummary(orderSession);
+  } catch (e) {
+    ctx.logger?.warn?.('[cmtoken-oauth] 算力豆用量获取失败: ' + String(e?.message || e));
+  }
+
+  // 桥接：order_session → api-key/link → sso_token → sso-login → management_session
+  const { session, expires } = await bridgeManagementSession(orderSession);
+  const apiKey = await ensureDshApiKey(session);
+  let models = [];
+  try {
+    models = await fetchKomectModels(session);
+  } catch (e) {
+    // 模型发现失败：密钥照存，配置给最小模型集，报错提示
+    ctx.logger?.warn?.('[cmtoken-oauth] 算力豆模型发现失败: ' + String(e.message || e));
+    models = [{ id: 'deepseekv4-flash-guangdong', name: 'DeepSeek V4 Flash', contextWindow: 512_000, maxTokens: 262_144, input: ['text'] }];
+  }
+  await writeConfigAndCreds(ctx, { apiKey, session, expires }, models);
+  return {
+    ok: true,
+    value: {
+      status: 'ok',
+      models: models.map((m) => ({ ...m, input: m.input ?? modelInputModalities(m.id) })),
+      baseURL: GW_BASE,
+      keyName: DSH_KEY_NAME,
+      usage,
+      maskedPhone: st.phone ?? null,
+    },
+  };
+}
+
+/** 旧通道轮询：OAuth Device Grant → 令牌 → 模型发现 → 写配置。 */
+async function pollMaaS(ctx, payload) {
+  const rid = payload.requestId;
+  const rec = legacyPending.get(rid);
+  if (!rec) return { ok: false, error: { code: 'bad-request', message: '认证流程已失效，请重新开始', details: {} } };
+  if (Date.now() > rec.expires_at) {
+    legacyPending.delete(rid);
+    return { ok: false, error: { code: 'timeout', message: '授权超时（未在有效期内完成扫码），请重新开始', details: {} } };
+  }
+  const r = await pollOnce(rec.device_code, rec.verifier);
+  if (r.status === 'pending') return { ok: true, value: { status: 'pending' } };
+  if (r.status === 'slow_down') return { ok: true, value: { status: 'pending', slowDown: true } };
+  legacyPending.delete(rid);
+  const token = r.token;
+  await writePluginConfig({ activeChannel: 'maas' });
+  let models = [];
+  try {
+    models = await fetchMaasModels(token.access, payload.discoveryUrl);
+  } catch (e) {
+    ctx.logger?.warn?.('[cmtoken-oauth] 旧通道模型发现失败: ' + String(e.message || e));
+    models = [{ id: 'deepseekv4-flash', name: 'deepseekv4-flash', contextWindow: 524_288, maxTokens: 65_536, input: ['text'] }];
+  }
+  await writeLegacyConfigAndCreds(ctx, token, models);
+  return {
+    ok: true,
+    value: {
+      status: 'ok',
+      models: models.map((m) => ({ ...m, input: m.input ?? modelInputModalities(m.id) })),
+      baseURL: token.resourceUrl || MAAS_API_BASE,
+      expiresAt: token.expires,
+    },
+  };
+}
+
 async function writeConfigAndCreds(ctx, { apiKey, session, expires }, models) {
   // 1) 凭据（OS keyring / 凭据服务，apiKeyEnv 引用）
   //    API key（lx_sk_）长期有效；session 为管理会话（模型发现用），过期仅需重新扫码
@@ -1152,6 +1484,7 @@ function registerVisionAdapter(ctx) {
 
 export function apply(ctx, cfg = {}) {
   let removeRpc = () => {};
+  let stopTimer = () => {};
   let disposeVisionAdapter = () => {};
   // 在声明了 webServer 的子上下文里注册 RPC 前缀路由（DSH 0.1.5+）。
   const rpcScope = ctx.inject(['webServer'], (scope) => {
@@ -1159,6 +1492,9 @@ export function apply(ctx, cfg = {}) {
   });
   void rpcScope;
   ctx.effect(() => {
+    // 旧通道令牌自动刷新定时器：仅当存在 legacy refresh token 时才有实际动作，
+    // 新通道（算力豆）lx_sk_ 长期有效、从不写该凭据，定时器空转。
+    stopTimer = startLegacyAutoRefresh(ctx);
     registerVisionTool(ctx);
     registerPasteRoute(ctx);
     registerPasteInjection(ctx);
@@ -1167,10 +1503,11 @@ export function apply(ctx, cfg = {}) {
     if (cfg.visionRoute === true) disposeVisionAdapter = registerVisionAdapter(ctx);
     return () => {
       removeRpc();
+      stopTimer();
       disposeVisionAdapter();
     };
   }, 'cmtoken-oauth: host service');
-  ctx.logger?.info?.('[cmtoken-oauth] host 服务已启动（中国移动算力豆 API-key 通道：密钥长期有效，无需定时刷新）');
+  ctx.logger?.info?.('[cmtoken-oauth] host 服务已启动（双通道：中国移动算力豆[默认] / 广东移动 MaaS 旧通道；旧通道自动续期仅在旧凭据存在时生效）');
 }
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cmtoken-oauth",
-  "version": "1.6.1",
+  "version": "1.7.0",
   "description": "DeepSeek Harness 插件：在 DSH 设置页一键完成中国移动算力豆平台（komect）扫码认证——一次扫码自动桥接密钥管理会话、创建专属 DSH API key（lx_sk_，长期有效）、发现模型（上下文/输出/图片支持由平台动态提供）并写入 llm-pi-ai provider 配置，同时展示算力豆用量余额；粘贴识图让纯文本模型直接收图，另有 cmtoken_read_image 工具与可选的 cmtoken-vision 包装路由。零第三方运行时依赖。",
   "type": "module",
   "main": "./lib/index.js",