dsh-connect-minimaxcode 0.4.2 → 0.5.0

package/lib/index.js

@@ -1,11 +1,12 @@
 import { readFileSync } from "node:fs";
-import { readFile, rename, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { createProvider } from "@earendil-works/pi-ai";
 import { anthropicMessagesApi } from "@earendil-works/pi-ai/api/anthropic-messages.lazy";
 import { LlmAdapter, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { createHash, randomBytes } from "node:crypto";
 //#region src/auth.ts
 /**
 * Reading the MiniMax Code desktop app's own sign-in.
@@ -625,6 +626,8 @@ function createMinimaxCodeAdapter(options) {
 //#region src/status-route.ts
 /** Route this plugin mounts, matching its settings card. */
 const MINIMAX_STATUS_PATH = "/plugins/dsh-connect-minimaxcode/status";
+/** Route the card posts to when it wants something done rather than read. */
+const MINIMAX_ACTION_PATH = "/plugins/dsh-connect-minimaxcode/action";
 const HINTS = {
 	"app-missing": "未找到 MiniMax Code 的登录信息。请先安装并登录 MiniMax Code 桌面 App，然后重启 DSH。",
 	"not-signed-in": "MiniMax Code 尚未登录。请在 MiniMax Code 桌面 App 中登录后重启 DSH。",
@@ -648,7 +651,9 @@ function statusDocument(deps) {
 		models: deps.models,
 		refreshing: deps.refreshing,
 		...deps.credits === void 0 ? {} : { credits: deps.credits },
-		...deps.usage === void 0 ? {} : { usage: deps.usage }
+		...deps.usage === void 0 ? {} : { usage: deps.usage },
+		...deps.signin === void 0 ? {} : { signin: deps.signin },
+		...deps.login === void 0 ? {} : { login: deps.login }
 	};
 	if (auth.state === "expired") return {
 		...base,
@@ -719,7 +724,7 @@ const MEMBERSHIP_PATH = "/matrix/api/v1/commerce/get_membership_info";
 /** Credit ledger endpoint: per-grant amounts and expiry. */
 const CREDIT_DETAILS_PATH = "/minimax-cloud/api/v1/credit/details";
 /** OAuth token endpoint. */
-const TOKEN_PATH = "/oauth2/token";
+const TOKEN_PATH$1 = "/oauth2/token";
 /** Absolute path of the app's credential file for a region. */
 function oauthAuthPath(region, env = process.env) {
 	return join(dataDir(env), "auth", "prod", region, "mcode-public", "auth.json");
@@ -823,7 +828,7 @@ async function refreshOAuthCredential(region, credential, env = process.env, now
 		scope: credential.scopes.join(" "),
 		audience: credential.audience
 	});
-	const response = await fetchImpl(`${MINIMAX_AUTH_HOSTS[region]}${TOKEN_PATH}`, {
+	const response = await fetchImpl(`${MINIMAX_AUTH_HOSTS[region]}${TOKEN_PATH$1}`, {
 		method: "POST",
 		headers: {
 			accept: "application/json",
@@ -920,17 +925,17 @@ function parseCreditSummary(document) {
 	const summary = record.op_credit_summary;
 	if (typeof summary === "object" && summary !== null) {
 		const entry = summary;
-		const total = toNumber(entry.total_remaining_amount);
+		const total = toNumber$1(entry.total_remaining_amount);
 		if (total !== void 0) {
-			const purchased = toNumber(entry.purchased_remaining_amount) ?? 0;
+			const purchased = toNumber$1(entry.purchased_remaining_amount) ?? 0;
 			return {
 				total,
 				purchased,
-				free: toNumber(entry.free_remaining_amount) ?? total - purchased
+				free: toNumber$1(entry.free_remaining_amount) ?? total - purchased
 			};
 		}
 	}
-	const flat = toNumber(record.opcredit_balance) ?? toNumber(record.total_remains_credit);
+	const flat = toNumber$1(record.opcredit_balance) ?? toNumber$1(record.total_remains_credit);
 	return flat === void 0 ? void 0 : {
 		total: flat,
 		purchased: 0,
@@ -938,7 +943,7 @@ function parseCreditSummary(document) {
 	};
 }
 /** Read a numeric field the upstream may send as a string. */
-function toNumber(value) {
+function toNumber$1(value) {
 	if (typeof value === "number" && Number.isFinite(value)) return value;
 	if (typeof value === "string" && value.trim() !== "") {
 		const parsed = Number(value);
@@ -976,17 +981,17 @@ function parseCreditLots(document) {
 	for (const entry of details) {
 		if (typeof entry !== "object" || entry === null) continue;
 		const record = entry;
-		const expireAtMs = toNumber(record.expire_at_ms);
+		const expireAtMs = toNumber$1(record.expire_at_ms);
 		if (expireAtMs === void 0) continue;
-		const granted = toNumber(record.granted_amount) ?? 0;
-		const remaining = toNumber(record.remaining_amount) ?? 0;
+		const granted = toNumber$1(record.granted_amount) ?? 0;
+		const remaining = toNumber$1(record.remaining_amount) ?? 0;
 		lots.push({
 			granted,
 			remaining,
-			consumed: toNumber(record.consumed_amount) ?? Math.max(0, granted - remaining),
-			grantedAtMs: toNumber(record.granted_at_ms) ?? 0,
+			consumed: toNumber$1(record.consumed_amount) ?? Math.max(0, granted - remaining),
+			grantedAtMs: toNumber$1(record.granted_at_ms) ?? 0,
 			expireAtMs,
-			creditType: toNumber(record.credit_type)
+			creditType: toNumber$1(record.credit_type)
 		});
 	}
 	return lots.sort((a, b) => a.expireAtMs - b.expireAtMs);
@@ -1013,7 +1018,7 @@ async function fetchCreditLots(credential, region, fetchImpl = fetch) {
 		const batch = parseCreditLots(document);
 		const before = lots.length;
 		lots.push(...batch);
-		const count = toNumber(document.total_count);
+		const count = toNumber$1(document.total_count);
 		if (count !== void 0) total = count;
 		if (batch.length < pageSize) break;
 		if (lots.length === before) break;
@@ -1132,6 +1137,581 @@ var MinimaxCredits = class {
 	}
 };
 //#endregion
+//#region src/credentials.ts
+/**
+* The plugin's own credential and state.
+*
+* The desktop app signs in with the OAuth 2.0 device authorization grant
+* (RFC 8628): the app asks the authorization server for a device code, opens
+* the account page in the browser, and polls the token endpoint until the
+* person signed in. The plugin can run the same grant itself, which means the
+* plugin works on a machine where the desktop app was never installed, and
+* the only human step is the person signing in to their own account in their
+* own browser.
+*
+* What this module stores is deliberately *not* written into the desktop
+* app's files. The app keeps two files whose `generation` counters must stay
+* in step, and it treats a mismatch as "signed in somewhere else" and demands
+* a new sign-in; the plugin has no business writing there. So the plugin keeps
+* its own copy under the Harness home, next to the files the sibling desktop
+* connectors keep (`~/.dsh/.minimaxcode-auth.json`).
+*
+* @module dsh-connect-minimaxcode/credentials
+*/
+/** The file the plugin's own credential lives in. */
+const PLUGIN_CREDENTIAL_FILENAME = ".minimaxcode-auth.json";
+/** The file the plugin's own settings and session live in. */
+const PLUGIN_STATE_FILENAME = ".minimaxcode-state.json";
+/**
+* The Harness home.
+*
+* The host resolves it the same way: the `DSH_HOME` environment variable when
+* it is set, otherwise `~/.dsh`. The plugin resolves it on its own rather
+* than importing the host's helper, so it also works in a plain command line
+* where the host's packages are not installed.
+*/
+function dshHome(env = process.env) {
+	const override = env.DSH_HOME;
+	return typeof override === "string" && override.length > 0 ? override : join(homedir(), ".dsh");
+}
+/** Where the plugin's credential lives. */
+function pluginCredentialPath(env = process.env) {
+	return join(dshHome(env), PLUGIN_CREDENTIAL_FILENAME);
+}
+/** Where the plugin's state lives. */
+function pluginStatePath(env = process.env) {
+	return join(dshHome(env), PLUGIN_STATE_FILENAME);
+}
+/** Write a document atomically, readable by its owner only. */
+async function writePrivate(path, payload) {
+	await mkdir(dirname(path), { recursive: true });
+	const temporary = `${path}.tmp`;
+	await writeFile(temporary, `${JSON.stringify(payload, null, 2)}\n`, { mode: 384 });
+	await rename(temporary, path);
+}
+/** Read the plugin's own credential. */
+async function readPluginCredential(env = process.env) {
+	let text;
+	try {
+		text = await readFile(pluginCredentialPath(env), "utf8");
+	} catch {
+		return;
+	}
+	let document;
+	try {
+		document = JSON.parse(text);
+	} catch {
+		return;
+	}
+	if (typeof document !== "object" || document === null) return void 0;
+	const record = document;
+	const accessToken = record.accessToken;
+	if (typeof accessToken !== "string" || accessToken.length === 0) return void 0;
+	const expiresAtMs = typeof record.expiresAtMs === "number" ? record.expiresAtMs : void 0;
+	return {
+		schemaVersion: typeof record.schemaVersion === "number" ? record.schemaVersion : 1,
+		clientId: typeof record.clientId === "string" ? record.clientId : MINIMAX_OAUTH_CLIENT_ID,
+		scopes: Array.isArray(record.scopes) ? record.scopes.filter((s) => typeof s === "string") : [...MINIMAX_OAUTH_SCOPES],
+		audience: typeof record.audience === "string" ? record.audience : MINIMAX_OAUTH_AUDIENCE,
+		accessToken,
+		refreshToken: typeof record.refreshToken === "string" ? record.refreshToken : void 0,
+		expiresAtMs,
+		obtainedAtMs: typeof record.obtainedAtMs === "number" ? record.obtainedAtMs : void 0
+	};
+}
+/** Write the plugin's own credential. */
+async function writePluginCredential(credential, env = process.env) {
+	await writePrivate(pluginCredentialPath(env), credential);
+}
+/** Read the plugin's own state. */
+async function readPluginState(env = process.env) {
+	let text;
+	try {
+		text = await readFile(pluginStatePath(env), "utf8");
+	} catch {
+		return {
+			schemaVersion: 1,
+			autoCheckin: false
+		};
+	}
+	let document;
+	try {
+		document = JSON.parse(text);
+	} catch {
+		return {
+			schemaVersion: 1,
+			autoCheckin: false
+		};
+	}
+	if (typeof document !== "object" || document === null) return {
+		schemaVersion: 1,
+		autoCheckin: false
+	};
+	const record = document;
+	const session = record.deviceLogin;
+	const deviceLogin = typeof session === "object" && session !== null ? (() => {
+		const value = session;
+		if (typeof value.deviceCode !== "string" || typeof value.codeVerifier !== "string") return void 0;
+		return {
+			deviceCode: value.deviceCode,
+			codeVerifier: value.codeVerifier,
+			userCode: typeof value.userCode === "string" ? value.userCode : "",
+			verificationUri: typeof value.verificationUri === "string" ? value.verificationUri : "",
+			verificationUriComplete: typeof value.verificationUriComplete === "string" ? value.verificationUriComplete : "",
+			expiresAtMs: typeof value.expiresAtMs === "number" ? value.expiresAtMs : 0
+		};
+	})() : void 0;
+	return {
+		schemaVersion: typeof record.schemaVersion === "number" ? record.schemaVersion : 1,
+		autoCheckin: record.autoCheckin === true,
+		lastClaimDay: typeof record.lastClaimDay === "string" ? record.lastClaimDay : void 0,
+		lastClaimAtMs: typeof record.lastClaimAtMs === "number" ? record.lastClaimAtMs : void 0,
+		lastClaimPoints: typeof record.lastClaimPoints === "number" ? record.lastClaimPoints : void 0,
+		deviceLogin
+	};
+}
+/** Write the plugin's own state. */
+async function writePluginState(state, env = process.env) {
+	await writePrivate(pluginStatePath(env), state);
+}
+/** Whether the credential is close enough to expiry to be worth refreshing. */
+function credentialNeedsRefresh(credential, now = Date.now()) {
+	if (credential.expiresAtMs === void 0) return false;
+	return credential.expiresAtMs - now <= 12e4;
+}
+/** The credential in the shape the account endpoints expect. */
+function toOAuthCredential(credential) {
+	return {
+		token: credential.accessToken,
+		refreshToken: credential.refreshToken,
+		expiresAtMs: credential.expiresAtMs,
+		clientId: credential.clientId,
+		scopes: credential.scopes,
+		audience: credential.audience
+	};
+}
+//#endregion
+//#region src/login.ts
+/**
+* Signing in without the desktop app.
+*
+* The desktop app's only sign-in is the OAuth 2.0 device authorization grant
+* (RFC 8628). The plugin runs the same grant:
+*
+* 1. `POST /oauth2/device/code` asks for a device code. The answer carries a
+*    short `user_code` and the page where the person authorizes it.
+* 2. The person opens that page, signs in to their own MiniMax account, and
+*    approves the request.
+* 3. `POST /oauth2/token` is polled with the device code until the grant
+*    arrives.
+*
+* The plugin never sees a password and never sees a verification code: the
+* one human step happens in the person's own browser, on the account site.
+* PKCE is used, so a device code that leaks cannot be redeemed without the
+* verifier that never left this process.
+*
+* The token this produces is the same `mmoat_` token the desktop app holds.
+* The account endpoints need it, and the model gateway accepts it too — so
+* one sign-in is enough for models, credits and the daily grant.
+*
+* @module dsh-connect-minimaxcode/login
+*/
+/** The endpoint that issues device codes. */
+const DEVICE_CODE_PATH = "/oauth2/device/code";
+/** The endpoint that exchanges a device code for a token. */
+const TOKEN_PATH = "/oauth2/token";
+/** The device authorization grant type. */
+const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+* Make a PKCE verifier and its S256 challenge.
+*
+* The verifier is 43 characters of base64url entropy, which is what RFC 7636
+* asks for, and it never leaves this process.
+*/
+function makePkce() {
+	const verifier = randomBytes(32).toString("base64url");
+	return {
+		verifier,
+		challenge: createHash("sha256").update(verifier).digest("base64url")
+	};
+}
+/**
+* Ask for a device code.
+*
+* @returns The session the person authorizes, or `undefined` when the server
+*   would not issue one.
+*/
+async function startDeviceLogin(region, fetchImpl = fetch, now = Date.now()) {
+	const { verifier, challenge } = makePkce();
+	const response = await fetchImpl(`${MINIMAX_AUTH_HOSTS[region]}${DEVICE_CODE_PATH}`, {
+		method: "POST",
+		headers: {
+			accept: "application/json",
+			"content-type": "application/x-www-form-urlencoded"
+		},
+		body: new URLSearchParams({
+			client_id: MINIMAX_OAUTH_CLIENT_ID,
+			scope: MINIMAX_OAUTH_SCOPES.join(" "),
+			audience: MINIMAX_OAUTH_AUDIENCE,
+			code_challenge: challenge,
+			code_challenge_method: "S256"
+		})
+	});
+	if (!response.ok) throw new Error(`申请设备码失败: HTTP ${response.status}`);
+	const document = await response.json();
+	const deviceCode = document.device_code;
+	const userCode = document.user_code;
+	const verificationUri = document.verification_uri;
+	if (typeof deviceCode !== "string" || deviceCode.length === 0) throw new Error("设备码响应里没有 device_code");
+	const expiresInSec = typeof document.expires_in === "number" ? document.expires_in : 300;
+	const intervalSec = typeof document.interval === "number" ? document.interval : 3;
+	return {
+		deviceCode,
+		codeVerifier: verifier,
+		userCode: typeof userCode === "string" ? userCode : "",
+		verificationUri: typeof verificationUri === "string" ? verificationUri : "",
+		verificationUriComplete: typeof document.verification_uri_complete === "string" ? document.verification_uri_complete : "",
+		expiresAtMs: now + expiresInSec * 1e3,
+		intervalSec
+	};
+}
+/** Read the token document the authorization server answers with. */
+function readToken(document) {
+	if (typeof document !== "object" || document === null) return void 0;
+	const record = document;
+	const accessToken = record.access_token;
+	if (typeof accessToken !== "string" || accessToken.length === 0) return void 0;
+	return {
+		token: accessToken,
+		refreshToken: typeof record.refresh_token === "string" ? record.refresh_token : void 0,
+		expiresInSec: typeof record.expires_in === "number" ? record.expires_in : void 0,
+		scope: typeof record.scope === "string" ? record.scope : void 0
+	};
+}
+/**
+* Poll for the grant.
+*
+* The authorization server answers `400` while the person has not authorized
+* yet, with `authorization_pending` in the body; that is a normal answer, not
+* an error.
+*/
+async function pollDeviceLogin(session, region, fetchImpl = fetch, now = Date.now()) {
+	if (session.expiresAtMs !== 0 && session.expiresAtMs <= now) return {
+		state: "expired",
+		message: "设备码已过期，请重新发起登录"
+	};
+	const response = await fetchImpl(`${MINIMAX_AUTH_HOSTS[region]}${TOKEN_PATH}`, {
+		method: "POST",
+		headers: {
+			accept: "application/json",
+			"content-type": "application/x-www-form-urlencoded"
+		},
+		body: new URLSearchParams({
+			client_id: MINIMAX_OAUTH_CLIENT_ID,
+			grant_type: DEVICE_CODE_GRANT,
+			device_code: session.deviceCode,
+			code_verifier: session.codeVerifier
+		})
+	});
+	const text = await response.text();
+	let document;
+	try {
+		document = JSON.parse(text);
+	} catch {
+		document = void 0;
+	}
+	if (response.ok) {
+		const token = readToken(document);
+		if (token === void 0) return {
+			state: "expired",
+			message: "登录响应里没有访问令牌"
+		};
+		return {
+			state: "signed-in",
+			credential: {
+				schemaVersion: 1,
+				clientId: MINIMAX_OAUTH_CLIENT_ID,
+				scopes: [...MINIMAX_OAUTH_SCOPES],
+				audience: MINIMAX_OAUTH_AUDIENCE,
+				accessToken: token.token,
+				refreshToken: token.refreshToken,
+				expiresAtMs: token.expiresInSec === void 0 ? void 0 : now + token.expiresInSec * 1e3,
+				obtainedAtMs: now
+			}
+		};
+	}
+	const error = typeof document === "object" && document !== null ? document.error : void 0;
+	const description = typeof document === "object" && document !== null ? document.error_description : void 0;
+	const message = typeof description === "string" ? description : void 0;
+	if (error === "authorization_pending") return { state: "pending" };
+	if (error === "slow_down") return { state: "slow-down" };
+	if (error === "expired_token") return {
+		state: "expired",
+		message
+	};
+	if (error === "access_denied") return {
+		state: "denied",
+		message
+	};
+	return {
+		state: "expired",
+		message: message ?? `登录失败: HTTP ${response.status}`
+	};
+}
+/**
+* Exchange the stored refresh token for a fresh access token.
+*
+* The authorization server rotates the refresh token, so the new pair
+* replaces the old one wherever it is kept.
+*/
+async function refreshPluginCredential(credential, region, fetchImpl = fetch, now = Date.now()) {
+	if (credential.refreshToken === void 0) throw new Error("没有可用于续期的 refresh token，请重新登录");
+	const response = await fetchImpl(`${MINIMAX_AUTH_HOSTS[region]}${TOKEN_PATH}`, {
+		method: "POST",
+		headers: {
+			accept: "application/json",
+			"content-type": "application/x-www-form-urlencoded"
+		},
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: credential.refreshToken,
+			client_id: credential.clientId,
+			scope: credential.scopes.join(" "),
+			audience: credential.audience
+		})
+	});
+	if (!response.ok) throw new Error(`续期失败: HTTP ${response.status}`);
+	const token = readToken(await response.json());
+	if (token === void 0) throw new Error("续期响应里没有访问令牌");
+	return {
+		...credential,
+		accessToken: token.token,
+		refreshToken: token.refreshToken ?? credential.refreshToken,
+		expiresAtMs: token.expiresInSec === void 0 ? void 0 : now + token.expiresInSec * 1e3,
+		obtainedAtMs: now
+	};
+}
+//#endregion
+//#region src/signin.ts
+/**
+* The daily check-in that grants the free credits.
+*
+* MiniMax Code hands out a grant of points every day, and the desktop app
+* shows it as a "每日签到" card: a seven-day cycle worth 4000 points, each
+* grant valid for thirty days. The app does **not** claim on its own — the
+* card opens, and a button does the work — so an account that is only used
+* through the model gateway leaves those points unclaimed.
+*
+* The endpoints are the same ones the card calls:
+*
+* - `GET /minimax-cloud/api/v1/signin/status` — the cycle, with today's day
+*   marked
+* - `POST /minimax-cloud/api/v1/signin/claim` — claim today
+*
+* Both need the account's `mmoat_` bearer token, and both need a **time zone
+***: the server answers `invalid timezone_id` when the request carries an
+* offset or nothing at all, and it is that time zone that decides which day
+* "today" is. The client sends an IANA name (`Asia/Shanghai`), so this does
+* too.
+*
+* The claim is the one request here that changes something upstream. It is
+* idempotent per day — claiming again answers "already claimed" and grants
+* nothing — but the caller still guards it, because "cannot double-grant" is
+* a property of the upstream that is verified rather than assumed.
+*
+* @module dsh-connect-minimaxcode/signin
+*/
+/** The claim endpoint. */
+const SIGNIN_CLAIM_PATH = "/minimax-cloud/api/v1/signin/claim";
+/** The cycle endpoint, which reports the panel. */
+const SIGNIN_PANEL_PATH = "/minimax-cloud/api/v1/signin/status";
+/** Per-day status, as the desktop app enumerates it. */
+const SIGNIN_DAY_STATUS = {
+	/** The day has not come yet. */
+	upcoming: 1,
+	/** The day is today and can be claimed. */
+	claimable: 2,
+	/** The day is claimed. */
+	claimed: 3,
+	/** The day does not grant anything. */
+	disabled: 4
+};
+/** How many days a cycle runs. */
+const SIGNIN_CYCLE_DAYS = 7;
+/** The outcome of a claim. */
+const SIGNIN_CLAIM_RESULT = {
+	/** The grant was credited. */
+	credited: 1,
+	/** Today was already claimed; nothing was granted. */
+	alreadyClaimed: 2
+};
+/**
+* The time zone the server should treat the request as coming from.
+*
+* The server wants an IANA name; an offset or a missing value is refused.
+* The system's own name is the right answer, since "today" should be the
+* user's today.
+*/
+function timezoneId() {
+	try {
+		const resolved = Intl.DateTimeFormat().resolvedOptions().timeZone;
+		return typeof resolved === "string" && resolved.length > 0 ? resolved : "UTC";
+	} catch {
+		return "UTC";
+	}
+}
+/** Read a number the upstream may send as a string. */
+function toNumber(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (typeof value === "string" && value.trim() !== "") {
+		const parsed = Number(value);
+		return Number.isFinite(parsed) ? parsed : void 0;
+	}
+}
+/**
+* Unwrap the upstream's envelope.
+*
+* The account APIs answer `200` with a `base_resp` that carries the real
+* status, so the HTTP code alone says nothing.
+*/
+function unwrap(document) {
+	if (typeof document !== "object" || document === null) return {
+		ok: false,
+		message: "签到接口返回了无法解析的响应"
+	};
+	const record = document;
+	const base = record.base_resp;
+	if (typeof base === "object" && base !== null) {
+		const status = toNumber(base.status_code);
+		if (status !== void 0 && status !== 0) {
+			const message = base.status_msg;
+			return {
+				ok: false,
+				message: typeof message === "string" ? message : `签到接口返回状态码 ${status}`
+			};
+		}
+	}
+	return {
+		ok: true,
+		data: record.data
+	};
+}
+/**
+* Read the cycle out of a panel response.
+*
+* The server marks exactly one day as today and at most one day as claimable;
+* a panel that says otherwise is not something to act on, so it is refused
+* rather than half-believed.
+*/
+function parseSigninPanel(document) {
+	const unwrapped = unwrap(document);
+	if (!unwrapped.ok) return void 0;
+	const data = unwrapped.data;
+	if (typeof data !== "object" || data === null) return void 0;
+	const record = data;
+	const scene = toNumber(record.scene);
+	const rawDays = record.days;
+	if (scene === void 0 || !Array.isArray(rawDays)) return void 0;
+	const days = [];
+	let claimable = 0;
+	let today = 0;
+	for (const entry of rawDays) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const day = entry;
+		const dayNo = toNumber(day.day_no);
+		const points = toNumber(day.points);
+		const status = toNumber(day.status);
+		if (dayNo === void 0 || points === void 0 || status === void 0) continue;
+		if (status < 1 || status > 4) continue;
+		const isToday = day.is_today === true;
+		if (status === SIGNIN_DAY_STATUS.claimable) claimable += 1;
+		if (isToday) today += 1;
+		days.push({
+			dayNo,
+			points,
+			bonusPoints: toNumber(day.bonus_points) ?? 0,
+			status,
+			isToday
+		});
+	}
+	if (days.length === 0) return void 0;
+	if (claimable > 1 || today > 1) return void 0;
+	return {
+		scene,
+		days
+	};
+}
+/** Read the result of a claim. */
+function parseSigninClaim(document) {
+	const unwrapped = unwrap(document);
+	if (!unwrapped.ok) return void 0;
+	const data = unwrapped.data;
+	if (typeof data !== "object" || data === null) return void 0;
+	const record = data;
+	const claimId = record.claim_id;
+	const result = toNumber(record.claim_result);
+	const dayNo = toNumber(record.day_no);
+	const points = toNumber(record.points);
+	const expireAtMs = toNumber(record.expire_at_ms);
+	if (typeof claimId !== "string" || claimId.length === 0) return void 0;
+	if (result !== SIGNIN_CLAIM_RESULT.credited && result !== SIGNIN_CLAIM_RESULT.alreadyClaimed) return void 0;
+	if (dayNo === void 0 || dayNo < 1 || dayNo > 7) return void 0;
+	if (points === void 0 || points < 0) return void 0;
+	if (expireAtMs === void 0) return void 0;
+	return {
+		claimId,
+		result,
+		dayNo,
+		points,
+		bonusPoints: toNumber(record.bonus_points) ?? 0,
+		expireAtMs,
+		panel: parseSigninPanel({ data: record.panel })
+	};
+}
+/**
+* Read the cycle.
+*
+* @returns The panel, or `undefined` when the account cannot read it.
+*/
+async function fetchSigninPanel(credential, region, fetchImpl = fetch, timezone = timezoneId()) {
+	const response = await fetchImpl(`${MINIMAX_ACCOUNT_HOSTS[region]}${SIGNIN_PANEL_PATH}?timezone_id=${encodeURIComponent(timezone)}`, { headers: { authorization: `Bearer ${credential.token}` } });
+	if (!response.ok) throw new Error(`签到状态请求失败: HTTP ${response.status}`);
+	return parseSigninPanel(await response.json());
+}
+/**
+* Claim today's grant.
+*
+* This is the only request in the plugin that changes something upstream. It
+* grants the day's points, which expire thirty days later.
+*
+* @returns What the server answered, or `undefined` when it refused.
+*/
+async function claimSignin(credential, region, fetchImpl = fetch, timezone = timezoneId()) {
+	const response = await fetchImpl(`${MINIMAX_ACCOUNT_HOSTS[region]}${SIGNIN_CLAIM_PATH}?timezone_id=${encodeURIComponent(timezone)}`, {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${credential.token}`,
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({})
+	});
+	if (!response.ok) throw new Error(`签到请求失败: HTTP ${response.status}`);
+	return parseSigninClaim(await response.json());
+}
+/** The day's key in the account's own time zone, `YYYY-MM-DD`. */
+function localDay(now = Date.now(), timezone = timezoneId()) {
+	try {
+		return new Intl.DateTimeFormat("en-CA", {
+			timeZone: timezone,
+			year: "numeric",
+			month: "2-digit",
+			day: "2-digit"
+		}).format(new Date(now));
+	} catch {
+		return new Date(now).toISOString().slice(0, 10);
+	}
+}
+//#endregion
 //#region src/usage.ts
 /** An empty usage record. */
 const EMPTY_USAGE = {
@@ -1268,6 +1848,13 @@ const CATALOG_TTL_MS = 3e5;
 */
 const CREDIT_TTL_MS = 3e4;
 /**
+* How often the check-in cycle may be re-read.
+*
+* The cycle changes once a day, so reading it as often as the balance is
+* read would buy nothing but load on the account API.
+*/
+const SIGNIN_TTL_MS = 3e5;
+/**
 * Compose the plugin.
 *
 * The credential is re-read on every request rather than cached at start: the
@@ -1281,20 +1868,106 @@ function apply(ctx) {
 	const credits = new MinimaxCredits();
 	const meter = new UsageMeter();
 	let region = "cn";
-	let credential;
 	let lastCatalogAtMs = 0;
 	let lastCreditAtMs = 0;
+	let lastSigninAtMs = 0;
 	let refreshing = false;
 	let creditState = "unavailable";
-	const readNow = async () => {
+	/** The token the model descriptors carry, refreshed with the credential. */
+	let modelToken;
+	/** The plugin's own settings, read from its own file. */
+	let pluginState = {
+		schemaVersion: 1,
+		autoCheckin: false
+	};
+	/** The cycle as the account last reported it. */
+	let signinPanel;
+	/** What the last claim answered. */
+	let signinClaim;
+	/** Why the cycle or the claim could not be read. */
+	let signinError;
+	/** Where the sign-in came from. */
+	let loginSource;
+	/** Whether a device login is waiting to be authorized. */
+	let loginPending = false;
+	/**
+	* The credential the model gateway is called with.
+	*
+	* The plugin's own sign-in comes first: it is the credential the person
+	* chose, and on a machine where the desktop app was never installed it is
+	* the only one there is. The desktop app's token is the fallback, and the
+	* two are interchangeable as far as the gateway is concerned — it accepts
+	* either bearer.
+	*/
+	const resolveGatewayCredential = async () => {
+		const own = await readPluginCredential();
+		if (own !== void 0) {
+			if (credentialNeedsRefresh(own)) try {
+				const next = await refreshPluginCredential(own, region);
+				await writePluginCredential(next);
+				loginSource = "plugin";
+				modelToken = next.accessToken;
+				return {
+					token: next.accessToken,
+					claims: { exp: Math.floor((next.expiresAtMs ?? Date.now()) / 1e3) }
+				};
+			} catch {}
+			else {
+				loginSource = "plugin";
+				modelToken = own.accessToken;
+				return {
+					token: own.accessToken,
+					claims: { exp: Math.floor((own.expiresAtMs ?? Date.now()) / 1e3) }
+				};
+			}
+		}
 		const state = await readCredential();
 		if (state.state !== "signed-in") {
-			credential = void 0;
+			loginSource = void 0;
+			modelToken = void 0;
+			return;
+		}
+		loginSource = "desktop-app";
+		modelToken = state.credential.token;
+		return state.credential;
+	};
+	/**
+	* The credential the account endpoints are called with.
+	*
+	* The account API needs the `mmoat_` token, not the gateway's JWT, so this
+	* is a second credential: the plugin's own sign-in when there is one, and
+	* otherwise the token the desktop app stored.
+	*/
+	const resolveAccountCredential = async (now = Date.now()) => {
+		const own = await readPluginCredential();
+		if (own !== void 0) {
+			if (credentialNeedsRefresh(own, now)) try {
+				const next = await refreshPluginCredential(own, region, fetch, now);
+				await writePluginCredential(next);
+				return {
+					state: "signed-in",
+					credential: toOAuthCredential(next)
+				};
+			} catch {
+				return {
+					state: "expired",
+					credential: toOAuthCredential(own)
+				};
+			}
+			return {
+				state: "signed-in",
+				credential: toOAuthCredential(own)
+			};
+		}
+		return ensureOAuthCredential(region, process.env, now);
+	};
+	const readNow = async () => {
+		const state = await resolveGatewayCredential();
+		if (state === void 0) {
 			catalog.invalidate();
 			return;
 		}
-		credential = state.credential;
-		return credential;
+		return state;
 	};
 	/** Refresh the catalog at most once per TTL, never blocking a request. */
 	const refreshCatalog = async (current) => {
@@ -1319,7 +1992,7 @@ function apply(ctx) {
 		const now = Date.now();
 		if (now - lastCreditAtMs < CREDIT_TTL_MS) return;
 		lastCreditAtMs = now;
-		const state = await ensureOAuthCredential(region, process.env, now);
+		const state = await resolveAccountCredential(now);
 		if (state.state === "signed-out") {
 			creditState = "signed-out";
 			return;
@@ -1331,6 +2004,65 @@ function apply(ctx) {
 		await credits.refresh(state.credential, region, fetch, now);
 		creditState = credits.snapshot === void 0 ? "unavailable" : "ok";
 	};
+	/**
+	* Read the check-in cycle, and claim the day's grant when asked to.
+	*
+	* The claim is the one request here that changes something upstream. It is
+	* made at most once a day, only when the person turned it on, and only when
+	* the server itself says the day can be claimed — so a day that is already
+	* claimed never produces a request, and a claim that already happened
+	* upstream is answered with "already claimed" and grants nothing.
+	*/
+	const refreshSignin = async () => {
+		const now = Date.now();
+		if (now - lastSigninAtMs < SIGNIN_TTL_MS && signinPanel !== void 0) return;
+		lastSigninAtMs = now;
+		const state = await resolveAccountCredential();
+		if (state.state !== "signed-in") {
+			signinPanel = void 0;
+			return;
+		}
+		let panel;
+		try {
+			panel = await fetchSigninPanel(state.credential, region, fetch);
+			signinPanel = panel;
+			signinError = void 0;
+		} catch (error) {
+			signinError = error instanceof Error ? error.message : String(error);
+			return;
+		}
+		if (!pluginState.autoCheckin || panel === void 0) return;
+		const today = panel.days.find((day) => day.isToday);
+		if (today === void 0 || today.status !== SIGNIN_DAY_STATUS.claimable) return;
+		if (pluginState.lastClaimDay === localDay()) return;
+		await performClaim(state.credential);
+	};
+	/** Claim today's grant and remember that it happened. */
+	const performClaim = async (credential) => {
+		try {
+			const claim = await claimSignin(credential, region, fetch);
+			if (claim === void 0) {
+				signinError = "签到接口没有返回可识别的结果";
+				return;
+			}
+			signinClaim = claim;
+			signinError = void 0;
+			if (claim.panel !== void 0) signinPanel = claim.panel;
+			pluginState = {
+				...pluginState,
+				lastClaimDay: localDay(),
+				lastClaimAtMs: Date.now(),
+				lastClaimPoints: claim.points
+			};
+			await writePluginState(pluginState);
+			lastCreditAtMs = 0;
+			refreshCredits();
+			return claim;
+		} catch (error) {
+			signinError = error instanceof Error ? error.message : String(error);
+			return;
+		}
+	};
 	/** The credit balance as the card and the browser half read it. */
 	const buildCreditStatus = () => {
 		const snapshot = credits.snapshot;
@@ -1373,11 +2105,60 @@ function apply(ctx) {
 			requests: meter.records.length
 		};
 	};
+	/** The check-in cycle, as the card reads it. */
+	const buildSigninStatus = () => {
+		if (signinPanel === void 0 && signinError === void 0) return void 0;
+		const panel = signinPanel;
+		const today = panel?.days.find((day) => day.isToday);
+		return {
+			state: panel === void 0 ? "unavailable" : "ok",
+			...today === void 0 ? {} : { today: {
+				dayNo: today.dayNo,
+				points: today.points,
+				status: today.status,
+				claimable: today.status === SIGNIN_DAY_STATUS.claimable,
+				claimed: today.status === SIGNIN_DAY_STATUS.claimed
+			} },
+			...panel === void 0 ? {} : {
+				days: panel.days.map((day) => ({
+					dayNo: day.dayNo,
+					points: day.points,
+					status: day.status,
+					isToday: day.isToday
+				})),
+				cyclePoints: panel.days.reduce((sum, day) => sum + day.points, 0)
+			},
+			autoCheckin: pluginState.autoCheckin,
+			...pluginState.lastClaimDay === void 0 ? {} : { lastClaimDay: pluginState.lastClaimDay },
+			...pluginState.lastClaimAtMs === void 0 ? {} : { lastClaimAtMs: pluginState.lastClaimAtMs },
+			...pluginState.lastClaimPoints === void 0 ? {} : { lastClaimPoints: pluginState.lastClaimPoints },
+			...signinClaim === void 0 ? {} : {
+				lastClaimResult: signinClaim.result,
+				lastClaimPoints: signinClaim.points
+			},
+			...signinError === void 0 ? {} : { error: signinError }
+		};
+	};
+	/** How the plugin is signed in, as the card reads it. */
+	const buildLoginStatus = () => {
+		const session = pluginState.deviceLogin;
+		const pending = loginPending && session !== void 0;
+		return {
+			state: pending ? "pending" : loginSource === void 0 ? "signed-out" : "signed-in",
+			...loginSource === void 0 ? {} : { source: loginSource },
+			...pending && session !== void 0 ? {
+				userCode: session.userCode,
+				verificationUri: session.verificationUri,
+				verificationUriComplete: session.verificationUriComplete,
+				expiresAtMs: session.expiresAtMs
+			} : {}
+		};
+	};
 	const { adapter, invalidate } = createMinimaxCodeAdapter({
 		catalog,
 		region: () => region,
 		resolveApiKey: async () => (await readNow())?.token,
-		bearerToken: () => bearerToken(),
+		bearerToken: () => modelToken,
 		onUsage: (model, usage) => {
 			meter.record(model, usage);
 			refreshCredits();
@@ -1396,6 +2177,7 @@ function apply(ctx) {
 			reason: state.reason
 		};
 		await refreshCredits();
+		await refreshSignin();
 		return statusDocument({
 			auth,
 			region,
@@ -1408,7 +2190,9 @@ function apply(ctx) {
 			})),
 			refreshing,
 			credits: buildCreditStatus(),
-			usage: buildUsageStatus()
+			usage: buildUsageStatus(),
+			signin: buildSigninStatus(),
+			login: buildLoginStatus()
 		});
 	};
 	(async () => {
@@ -1419,6 +2203,121 @@ function apply(ctx) {
 			invalidate();
 		}
 	})();
+	/**
+	* The actions the card can ask for.
+	*
+	* Every one of them is a request the person made by clicking something, so
+	* they are all safe to repeat: a claim that was already made upstream
+	* answers "already claimed", and a sign-in that is already waiting answers
+	* with the same device code.
+	*/
+	const runAction = async (action, body) => {
+		switch (action) {
+			case "claim": {
+				const state = await resolveAccountCredential();
+				if (state.state !== "signed-in") return {
+					ok: false,
+					state: state.state,
+					error: "尚未登录"
+				};
+				const claim = await performClaim(state.credential);
+				return claim === void 0 ? {
+					ok: false,
+					error: signinError ?? "签到失败"
+				} : {
+					ok: true,
+					claim,
+					panel: signinPanel
+				};
+			}
+			case "login-start": {
+				const session = await startDeviceLogin(region);
+				if (session === void 0) return {
+					ok: false,
+					error: "没有拿到设备码"
+				};
+				pluginState = {
+					...pluginState,
+					deviceLogin: session
+				};
+				await writePluginState(pluginState);
+				loginPending = true;
+				return {
+					ok: true,
+					userCode: session.userCode,
+					verificationUri: session.verificationUri,
+					verificationUriComplete: session.verificationUriComplete,
+					expiresAtMs: session.expiresAtMs
+				};
+			}
+			case "login-poll": {
+				const session = pluginState.deviceLogin;
+				if (session === void 0) return {
+					ok: false,
+					state: "signed-out",
+					error: "没有待完成的登录"
+				};
+				const result = await pollDeviceLogin(session, region);
+				if (result.state === "signed-in") {
+					await writePluginCredential(result.credential);
+					pluginState = {
+						...pluginState,
+						deviceLogin: void 0
+					};
+					await writePluginState(pluginState);
+					loginPending = false;
+					loginSource = "plugin";
+					modelToken = result.credential.accessToken;
+					catalog.invalidate();
+					lastCatalogAtMs = 0;
+					lastCreditAtMs = 0;
+					readNow();
+					return {
+						ok: true,
+						state: "signed-in"
+					};
+				}
+				if (result.state === "expired" || result.state === "denied") {
+					pluginState = {
+						...pluginState,
+						deviceLogin: void 0
+					};
+					await writePluginState(pluginState);
+					loginPending = false;
+					return {
+						ok: false,
+						state: result.state,
+						error: result.message
+					};
+				}
+				return {
+					ok: true,
+					state: result.state
+				};
+			}
+			case "settings": {
+				const autoCheckin = body.autoCheckin;
+				if (typeof autoCheckin !== "boolean") return {
+					ok: false,
+					error: "autoCheckin 必须是布尔值"
+				};
+				pluginState = {
+					...pluginState,
+					autoCheckin
+				};
+				await writePluginState(pluginState);
+				if (autoCheckin) refreshSignin();
+				return {
+					ok: true,
+					autoCheckin
+				};
+			}
+			default: return {
+				ok: false,
+				error: `未知操作: ${action}`
+			};
+		}
+	};
 	ctx.inject(["webServer"], (webCtx) => {
 		webCtx.effect(() => webCtx.webServer.register({
 			kind: "exact",
@@ -1438,7 +2337,50 @@ function apply(ctx) {
 				}
 			}
 		}));
+		webCtx.effect(() => webCtx.webServer.register({
+			kind: "exact",
+			path: MINIMAX_ACTION_PATH,
+			handler: async (req, res) => {
+				if (!isLoopback(req.headers.host)) {
+					res.writeHead(403, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({ error: "loopback only" }));
+					return;
+				}
+				if (req.method !== "POST") {
+					res.writeHead(405, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({ error: "POST only" }));
+					return;
+				}
+				let action = "";
+				let body = {};
+				try {
+					action = new URL(req.url ?? "/", "http://127.0.0.1").searchParams.get("action") ?? "";
+					const text = await readRequestBody(req);
+					if (text.length > 0) {
+						const parsed = JSON.parse(text);
+						if (typeof parsed === "object" && parsed !== null) body = parsed;
+					}
+				} catch {}
+				try {
+					const result = await runAction(action, body);
+					res.writeHead(200, { "Content-Type": "application/json" });
+					res.end(JSON.stringify(result));
+				} catch (error) {
+					res.writeHead(500, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({ error: error instanceof Error ? error.message : String(error) }));
+				}
+			}
+		}));
 	});
 }
+/** Read a request body, up to a size that no card needs to exceed. */
+async function readRequestBody(req) {
+	let text = "";
+	for await (const chunk of req) {
+		text += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+		if (text.length > 65536) break;
+	}
+	return text;
+}
 //#endregion
-export { EMPTY_USAGE, FALLBACK_MODELS, MEMBERSHIP_PATH, MINIMAXCODE_PROVIDER_ID, MINIMAX_AUTH_FILENAME, MINIMAX_DATA_DIR, MINIMAX_GATEWAYS, MINIMAX_OAUTH_CLIENT_ID, MINIMAX_REGIONS, MINIMAX_STATUS_PATH, MINIMAX_STREAM_IDLE_TIMEOUT_MS, MODEL_PRICES, MinimaxCatalog, MinimaxCredits, UsageMeter, apply, authPath, bearerToken, catalogUrl, chatBaseUrl, createMinimaxCodeAdapter, dataDir, daysRemaining, decodeClaims, ensureOAuthCredential, estimateCny, expiresInMs, expiryLevel, fetchCreditSummary, inject, name, parseAuthDocument, parseCatalog, parseCreditSummary, parseOAuthDocument, priceFor, readCredential, readOAuthCredential, refreshOAuthCredential, statusDocument, writeOAuthCredential };
+export { DEVICE_CODE_GRANT, DEVICE_CODE_PATH, EMPTY_USAGE, FALLBACK_MODELS, MEMBERSHIP_PATH, MINIMAXCODE_PROVIDER_ID, MINIMAX_AUTH_FILENAME, MINIMAX_DATA_DIR, MINIMAX_GATEWAYS, MINIMAX_OAUTH_CLIENT_ID, MINIMAX_REGIONS, MINIMAX_STATUS_PATH, MINIMAX_STREAM_IDLE_TIMEOUT_MS, MODEL_PRICES, MinimaxCatalog, MinimaxCredits, PLUGIN_CREDENTIAL_FILENAME, PLUGIN_STATE_FILENAME, SIGNIN_CLAIM_PATH, SIGNIN_CLAIM_RESULT, SIGNIN_CYCLE_DAYS, SIGNIN_DAY_STATUS, SIGNIN_PANEL_PATH, UsageMeter, apply, authPath, bearerToken, catalogUrl, chatBaseUrl, claimSignin, createMinimaxCodeAdapter, dataDir, daysRemaining, decodeClaims, dshHome, ensureOAuthCredential, estimateCny, expiresInMs, expiryLevel, fetchCreditSummary, fetchSigninPanel, inject, localDay, makePkce, name, parseAuthDocument, parseCatalog, parseCreditSummary, parseOAuthDocument, parseSigninClaim, parseSigninPanel, pluginCredentialPath, pluginStatePath, pollDeviceLogin, priceFor, readCredential, readOAuthCredential, readPluginCredential, readPluginState, refreshOAuthCredential, refreshPluginCredential, startDeviceLogin, statusDocument, timezoneId, writeOAuthCredential, writePluginCredential, writePluginState };