dsh-connect-trae 3.5.1 → 3.6.1

package/lib/index.js

@@ -829,6 +829,24 @@ const TRAE_ACCOUNT_STATUS_PATH = "/plugins/dsh-connect-trae/account-status";
 * account row.
 */
 const TRAE_CHECKIN_PATH = "/plugins/dsh-connect-trae/checkin";
+/**
+* Plugin-owned account transfer endpoint: batch export and import of a region's
+* stored credentials (issue #37).
+*
+* One route with an `action` query parameter (`export` | `preview` | `import`),
+* mirroring the sibling `dsh-connect-workbuddy` plugin's transfer route so the
+* two cards behave the same way for a user who has both installed. The vault
+* document never leaves the Host: the browser receives parsed answers, and a
+* preview carries display fields only — never token material.
+*/
+const TRAE_TRANSFER_PATH = "/plugins/dsh-connect-trae/transfer";
+/** Read the transfer action off a request URL; unknown/absent means undefined. */
+function transferActionOf(url) {
+	const at = url.indexOf("?");
+	if (at === -1) return void 0;
+	const value = new URLSearchParams(url.slice(at + 1)).get("action");
+	return value === "export" || value === "preview" || value === "import" ? value : void 0;
+}
 /** Query parameter naming the region a card request addresses. */
 const TRAE_REGION_PARAM = "region";
 /** Every region, in card tab order. */
@@ -1581,7 +1599,24 @@ function regionOfCredential(credential) {
 //#region src/auth.ts
 /** Host used for CLI tokens, which carry no host claim of their own. */
 const CLI_DEFAULT_HOST = "https://api.trae.cn";
-const OWN_VERSION = 1;
+/**
+* On-disk format of the plugin-owned per-region file.
+*
+* Version 1 held exactly ONE credential (`{ version, credential }`), which was
+* enough while every account came from a Trae install the plugin can discover
+* itself. Import (issue #37) breaks that assumption: a user can hold several
+* accounts as transferable files, and they have to live somewhere. Version 2
+* keeps the same per-region file but stores `{ version, credentials: [...] }`
+* instead, so the file stays the unit of region isolation (see
+* {@link traeOwnAuthPath}) while holding as many accounts as were imported.
+*
+* Version 1 remains READ (see {@link parseOwn}), so an existing install keeps
+* working and upgrades itself the next time a credential is written; it is
+* never written again.
+*/
+const OWN_VERSION = 2;
+/** The superseded single-credential layout, still read for migration. */
+const OWN_VERSION_SINGLE = 1;
 const TRAE_AUTH_FILENAME = ".trae-auth.json";
 /** Prefix of the plugin-owned per-region credential copies. */
 const TRAE_OWN_PREFIX = ".trae-auth";
@@ -1644,27 +1679,68 @@ function traeAccountId(credential) {
 	const stable = `${credential.edition}\0${credential.userId || credential.accountName || "unknown"}`;
 	return createHash("sha256").update(stable).digest("hex").slice(0, 24);
 }
+/** One stored credential, validated. Returns undefined for a malformed row. */
+function credentialOfStored(stored) {
+	if (typeof stored !== "object" || stored === null || Array.isArray(stored)) return void 0;
+	const record = stored;
+	const edition = record["edition"];
+	if (edition !== "cn" && edition !== "sg" && edition !== "solo" && edition !== "solo-sg") return void 0;
+	return normalizeTraeCredential({
+		token: record["accessToken"],
+		refreshToken: record["refreshToken"],
+		userId: record["userId"],
+		host: record["host"],
+		userRegion: record["userRegion"],
+		account: record["accountName"] === void 0 ? void 0 : { username: record["accountName"] },
+		expiredAt: record["expiresAtMs"],
+		refreshExpiredAt: record["refreshExpiredAtMs"]
+	}, edition, "dsh");
+}
+/**
+* Read the plugin-owned file into its stored credentials.
+*
+* Accepts BOTH layouts: version 2 (`credentials: [...]`, the import-capable
+* shape) and the superseded version 1 (`credential: {...}`). A version-1 file
+* keeps working until the next write upgrades it, so no migration step is
+* needed and an older install's file is never rejected. A malformed row is
+* dropped rather than failing the whole file — one bad imported account must
+* not hide the rest.
+*/
 function parseOwn(text) {
 	try {
 		const document = JSON.parse(text);
-		if (document.version !== OWN_VERSION || typeof document.credential !== "object" || document.credential === null) return void 0;
-		const stored = document.credential;
-		const edition = stored["edition"];
-		if (edition !== "cn" && edition !== "sg" && edition !== "solo" && edition !== "solo-sg") return void 0;
-		return normalizeTraeCredential({
-			token: stored["accessToken"],
-			refreshToken: stored["refreshToken"],
-			userId: stored["userId"],
-			host: stored["host"],
-			userRegion: stored["userRegion"],
-			account: stored["accountName"] === void 0 ? void 0 : { username: stored["accountName"] },
-			expiredAt: stored["expiresAtMs"],
-			refreshExpiredAt: stored["refreshExpiresAtMs"]
-		}, edition, "dsh");
+		if (document.version === OWN_VERSION) {
+			if (!Array.isArray(document.credentials)) return [];
+			return document.credentials.map(credentialOfStored).filter((value) => value !== void 0);
+		}
+		if (document.version === OWN_VERSION_SINGLE) {
+			const single = credentialOfStored(document.credential);
+			return single === void 0 ? [] : [single];
+		}
+		return [];
 	} catch {
-		return;
+		return [];
 	}
 }
+/**
+* Write the plugin-owned file: every credential of the region, in the version-2
+* array layout.
+*
+* One writer for both paths that persist to this file (a refresh, and an
+* import) so the read-modify-write in `refreshNow` and the additive write in
+* {@link TraeCredentialStore.importAccounts} cannot drift apart. Always writes
+* `OWN_VERSION`, which is what upgrades a version-1 file on its first write.
+*/
+async function writeOwn(path, credentials) {
+	const document = {
+		version: OWN_VERSION,
+		credentials: credentials.map((credential) => ({ ...credential }))
+	};
+	await writeFileAtomic(path, `${JSON.stringify(document, null, 2)}\n`, {
+		mode: 384,
+		dirMode: 448
+	});
+}
 var TraeCredentialStore = class {
 	storagePathOverride;
 	edition;
@@ -1791,6 +1867,7 @@ var TraeCredentialStore = class {
 			region: regionOfCredential(live),
 			source: live.source,
 			tokenExpiresAtMs: live.expiresAtMs,
+			...live.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs: live.refreshExpiresAtMs },
 			selected: false
 		};
 	}
@@ -1805,6 +1882,7 @@ var TraeCredentialStore = class {
 			region: regionOfCredential(credential),
 			source: credential.source,
 			tokenExpiresAtMs: credential.expiresAtMs,
+			...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs: credential.refreshExpiresAtMs },
 			selected: selectedExists ? traeAccountId(credential) === this.accountId : credential === defaultSelected
 		}));
 	}
@@ -1832,6 +1910,46 @@ var TraeCredentialStore = class {
 		if (accountId === "") return void 0;
 		return (await this.readAll()).find((credential) => traeAccountId(credential) === accountId);
 	}
+	/**
+	* Store imported credentials (issue #37), replacing any entry with the same
+	* account id and leaving every other entry alone.
+	*
+	* Why an additive write rather than the refresh path: an imported credential
+	* has NO desktop file behind it, so unlike a refresh result it cannot be
+	* rediscovered from the machine. If it were written the way a refresh is —
+	* as the whole document — importing account B would delete account A, and a
+	* later refresh would delete both. `readAll`'s desktop-first preference is
+	* therefore also not enough on its own: these entries survive only because
+	* `readOwns` reads them back and the dedupe keeps the longest-lived copy.
+	*
+	* Returns the account ids actually written, so the caller can report how many
+	* landed without re-reading the store.
+	*/
+	async importAccounts(credentials) {
+		if (credentials.length === 0) return [];
+		const ownPath = this.ownAuthPath();
+		const written = [];
+		await withFileLock(ownPath, async () => {
+			const existing = await readFile(ownPath, "utf8").then(parseOwn, () => []);
+			const byId = /* @__PURE__ */ new Map();
+			for (const item of existing) byId.set(traeAccountId(item), item);
+			for (const credential of credentials) {
+				const stored = {
+					...credential,
+					source: "dsh"
+				};
+				const id = traeAccountId(stored);
+				byId.set(id, stored);
+				written.push(id);
+			}
+			await writeOwn(ownPath, [...byId.values()]);
+		});
+		if (written.length > 0) {
+			this.accountId = written[written.length - 1];
+			this.inflight = void 0;
+		}
+		return written;
+	}
 	async resolve() {
 		const credential = await this.current();
 		if (credential === void 0) throw new Error(`trae: no signed-in account found (${this.candidates().map((item) => item.path).join(" or ")})`);
@@ -1976,8 +2094,7 @@ var TraeCredentialStore = class {
 	async readOwns() {
 		const copies = [];
 		for (const path of this.ownCandidates()) try {
-			const parsed = parseOwn(await readFile(path, "utf8"));
-			if (parsed !== void 0) copies.push(parsed);
+			copies.push(...parseOwn(await readFile(path, "utf8")));
 		} catch {}
 		return copies;
 	}
@@ -1999,13 +2116,11 @@ var TraeCredentialStore = class {
 			};
 			const ownPath = this.ownAuthPath();
 			await withFileLock(ownPath, async () => {
-				await writeFileAtomic(ownPath, `${JSON.stringify({
-					version: OWN_VERSION,
-					credential: refreshed
-				}, null, 2)}\n`, {
-					mode: 384,
-					dirMode: 448
-				});
+				const existing = await readFile(ownPath, "utf8").then(parseOwn, () => []);
+				const refreshedId = traeAccountId(refreshed);
+				const entries = existing.filter((item) => traeAccountId(item) !== refreshedId);
+				entries.push(refreshed);
+				await writeOwn(ownPath, entries);
 			});
 			return refreshed;
 		} catch (error) {
@@ -2926,6 +3041,23 @@ function wireCreditMultiplier(config) {
 	if (typeof data !== "object" || data === null) return void 0;
 	return finitePositive$1(data["rate"]);
 }
+/**
+* Thrown by {@link TraeSoloUpstreamClient.fetchModels} when every requested
+* directory function answered HTTP 200 but with an EMPTY `config_info_list`
+* (no rows at all), so the aggregate roster is empty. This is issue #39's root
+* signal: the upstream has published NO SOLO function config for this account /
+* route. It is a server-side, usually transient gap — the reporter's roster
+* returned empty and later self-resolved with rows per function — NOT a local
+* credential, plugin or account fault, and not something to re-login for. The
+* caller can catch this type to tell "the upstream published no config" apart
+* from "all directory functions errored" (which surfaces as a generic failure).
+*/
+var TraeEmptySoloDirectory = class extends Error {
+	name = "TraeEmptySoloDirectory";
+	constructor() {
+		super("Trae’s server returned NO SOLO function config (an empty directory for every requested function) — an upstream-side gap that usually clears on its own; retry later instead of re-checking credentials or the plugin");
+	}
+};
 var TraeSoloUpstreamClient = class {
 	options;
 	fetchImpl;
@@ -2982,7 +3114,10 @@ var TraeSoloUpstreamClient = class {
 			this.collectModels(list, directoryFunction, byId);
 		}
 		const models = [...byId.values()];
-		if (models.length === 0) throw new Error(`Trae SOLO models response contained no models (${failures.join("; ") || "empty directory"})`);
+		if (models.length === 0) {
+			if (failures.length === 0) throw new TraeEmptySoloDirectory();
+			throw new Error(`Trae SOLO models response contained no models (${failures.join("; ")})`);
+		}
 		return models;
 	}
 	/** Merge one function's config list into the shared catalogue (first wins). */
@@ -3208,9 +3343,20 @@ function decodeTraeEvent(event) {
 *    two different statements, and a user hits the second without touching the
 *    first (issue #33).
 *  - `4023` — the model name is unknown on the route that was asked.
+*  - `2001` — the upstream has not published its function config for the route
+*    that was asked. Evidence is issue #39: on a live CN account every SOLO
+*    function's `get_detail_param` answered HTTP 200 with `config_info_list:
+*    []` (an empty directory), and each chat call failed with
+*    `{"code":2001,"message":"no function config found for appId=...,
+*    function=solo_work_remote"}` (and the variant `[LLMUtilsChat.resolveByUsage]
+*    function is empty, cannot resolve model by usage=`). The roster came back
+*    empty and then self-resolved later with rows per function, so this is a
+*    TRANSIENT server-side gap the user can wait out or retry — never a local
+*    credential, plugin or account fault, and not something to re-login for.
 */
 const TRAE_ERROR_HINTS = {
 	1005: "Trae requires a paid plan for this model; the current account's plan does not cover it",
+	2001: "Trae has not published its function config for this route (an upstream condition, not a local credential or config problem)",
 	4001: "Trae does not serve this model under the SOLO function the request used (config_name rejected)",
 	4008: "Trae reports the account's SOLO quota is exhausted for this request",
 	4011: "Trae throttled the SOLO channel for this account (a rate limit, not the credit balance)",
@@ -4796,6 +4942,268 @@ var TraeUsageClient = class {
 	}
 };
 //#endregion
+//#region src/transfer.ts
+/**
+* Account transfer: the export / import file format shared with sibling
+* credential managers for the same upstream (dsh-connect-workbuddy ships the
+* identical contract so export files interoperate).
+*
+* 参考：通行实现 —— 文件是一个 JSON 数组，每项为一条凭据记录，顶层字段
+*   snake_case（`access_token` / `refresh_token` / `uid` / `nickname` /
+*   `email` / `domain` / `expiresAt`(ms) / `refreshExpiresAt`(ms) /
+*   `auth_raw`），导入按 account id 去重（同 id 覆盖），缺 `access_token`
+*   的记录跳过；预览只回脱敏字段（含 `hasToken` 布尔量），不回明文。解析
+*   函数不依赖文件系统，便于无 UI 环境单测；落库由 Host 侧的 store 完成。
+*
+* 互通 / 单位边界：`expiresAt` 一族按契约是**毫秒**。workbuddy 的 vault 文档
+*   存的是秒，需要在导出/导入边界换算；trae 的 `TraeCredential.expiresAtMs`
+*   （见 auth.ts 的 `timeToMs`）**本身就是毫秒**，所以这里**不做任何
+*   乘除**——刻意与 workbuddy 不同，读者对比两文件时不要误以为换算被漏掉了。
+*   导出时 `auth_raw` 直接携带原始认证文档（桌面 storage 文档或 `{auth,
+*   account}` 双键块），供写入桌面认证文件的工具原样消费。
+*
+* @module dsh-connect-trae/transfer
+*/
+/**
+* Parse transfer-file text: a JSON array, every element an object.
+*
+* The error strings carry the position (1-based item number) because a file
+* from another tool can be big, and "第 N 项" is what lets the user find the
+* broken record in their editor.
+*/
+function parseTransferFile(text) {
+	if (text.trim() === "") throw new Error("transfer file is empty");
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (error) {
+		throw new Error("transfer file is not valid JSON: " + (error instanceof Error ? error.message : String(error)));
+	}
+	if (!Array.isArray(parsed)) throw new Error("transfer file must be a JSON array of account records");
+	for (const [index, item] of parsed.entries()) if (typeof item !== "object" || item === null || Array.isArray(item)) throw new Error("transfer file item " + (index + 1) + " is not an account object");
+	return parsed;
+}
+/** One string field of a record, tolerating the sibling format's odd shapes. */
+function displayString(value) {
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	return "";
+}
+/** Whether a record carries a usable token (a non-empty string). */
+function hasToken(record) {
+	const token = record["access_token"];
+	return typeof token === "string" && token !== "";
+}
+/**
+* The transfer file's desensitized preview: display fields only.
+*
+* Fields come from EXTERNAL files, so a display field may hold an object or an
+* array (a sibling tool can store the desktop app's encrypted-wrapper nickname
+* verbatim); every preview field is normalized to a string or emptied rather
+* than letting a non-renderable value reach the card.
+*/
+function previewTransferFile(text) {
+	const records = parseTransferFile(text);
+	return {
+		accounts: records.map((record, index) => ({
+			index,
+			uid: displayString(record["uid"]),
+			nickname: displayString(record["nickname"]),
+			email: displayString(record["email"]),
+			hasToken: hasToken(record)
+		})),
+		total: records.length
+	};
+}
+/**
+* Positive-match region claim for an IMPORTED record: the record's own
+* `userRegion` claim wins, the host suffix is the fallback, and anything
+* unrecognised (empty, misspelt, or other-region) yields `undefined` — never a
+* default.
+*
+* This is the security-critical difference from `regionOfCredential`, which
+* classifies anything unrecognised as `cn` as a last resort (via the edition
+* label). That fallback is right for upstream-sourced data, whose host/region
+* came out of the real Trae install, but wrong for an import whose values are
+* simply whatever the file's author wrote: a spoofed or misspelt `domain`
+* would otherwise be admitted into the CN vault and cross-bill the CN provider
+* stack with a credential that belongs to no real CN account. So this helper
+* reuses `regionOfUserRegion` / `regionOfHost` — both of which already return
+* `undefined` on unrecognised input — and deliberately does NOT consult the
+* edition fallback.
+*/
+function knownRegionOfCredential(credential) {
+	return regionOfUserRegion(credential.userRegion) ?? regionOfHost(credential.host);
+}
+/**
+* Project one credential into the shared transfer record shape.
+*
+* `expiresAt` / `refreshExpiresAt` are emitted in epoch MILLISECONDS — the
+* transfer contract's unit. Unlike workbuddy — whose vault stored seconds and
+* had to convert here — trae's `expiresAtMs` is already milliseconds, so the
+* value is carried through verbatim (documented above; do not rescale).
+* `auth_raw` carries the original auth document so a tool that writes desktop
+* auth files can consume it verbatim.
+*/
+function traeTransferRecordOf(credential, authRawDocument) {
+	return {
+		access_token: credential.accessToken,
+		...credential.refreshToken !== void 0 && credential.refreshToken !== "" ? { refresh_token: credential.refreshToken } : {},
+		...credential.userId !== "" ? { uid: credential.userId } : {},
+		...credential.accountName !== void 0 ? { nickname: credential.accountName } : {},
+		...credential.host !== "" ? { domain: credential.host } : {},
+		...credential.expiresAtMs > 0 ? { expiresAt: credential.expiresAtMs } : {},
+		...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAt: credential.refreshExpiresAtMs },
+		auth_raw: authRawDocument
+	};
+}
+/** The `userId` claim from a record: the flat `uid`, else recovered from `auth_raw`. */
+function userIdOfRaw(record) {
+	const flat = displayString(record["uid"]);
+	if (flat !== "") return flat;
+	const root = rawRoot(record["auth_raw"]);
+	if (root === void 0) return "";
+	return displayString(root["userId"]) ?? "";
+}
+/** The `accountName` claim: the flat `nickname`, else recovered from `auth_raw`. */
+function accountNameOfRaw(record) {
+	const flat = displayString(record["nickname"]);
+	if (flat !== "") return flat;
+	const root = rawRoot(record["auth_raw"]);
+	if (root === void 0) return void 0;
+	const fromAccount = displayString((typeof root["account"] === "object" && root["account"] !== null ? root["account"] : void 0)?.["username"]);
+	if (fromAccount !== "") return fromAccount;
+	return displayString(root["username"]);
+}
+/** The raw `userRegion` claim string from `auth_raw` (object `{region}` or bare value). */
+function userRegionOfRaw(raw) {
+	const root = rawRoot(raw);
+	if (root === void 0) return void 0;
+	const value = root["userRegion"];
+	const claim = typeof value === "object" && value !== null && !Array.isArray(value) ? value["region"] : value;
+	return typeof claim === "string" && claim.trim() !== "" ? claim.trim() : void 0;
+}
+/**
+* A record's `auth_raw` root, tolerating both the nested `{auth, account}` block
+* this plugin exports and a raw desktop storage document: `account` may be a
+* sub-object (the block shape) or absent (flat document shape).
+*/
+function rawRoot(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return void 0;
+	return raw;
+}
+/**
+* Edition derived from an imported record's `domain` host, positively.
+*
+* The shared transfer format has no edition field (only `domain`), so a
+* re-import must re-derive the routing label from the host. Only the two base
+* editions are ever assigned — a flat `domain` + `uid` cannot distinguish the
+* SOLO variants — so this is inherently lossy for SOLO accounts; that is
+* acceptable because the region gate (see `mergeTransferRecords`) never
+* consults edition, and the account id's edition component only affects whether
+* a re-imported account converges on the same stored id (which it does as long
+* as the host is positively classified).
+*/
+function editionOfDomain(host) {
+	const region = regionOfHost(host);
+	if (region === "ai") return "sg";
+	if (region === "cn") return "cn";
+}
+/**
+* Project one transfer record into a credential, or undefined when the record
+* carries no token (the importer's skip rule).
+*
+* `userId` empty is tolerated at THIS layer because a token-only record still
+* describes a usable credential; the Host's region gate decides whether it is
+* representable, and the store's account id (`edition \0 userId || accountName`)
+* decides whether it is addressable. An unopenable `auth_raw` is ignored — the
+* flat fields are the contract, `auth_raw` is extra fidelity for the write-back
+* path.
+*
+* `edition` is restored positively from the domain host (see `editionOfDomain`),
+* defaulting to `cn` ONLY as a neutral placeholder when the host is not
+* classifiable — this is safe because the region gate never consults edition,
+* and such a record is always `skipped` there before edition could matter.
+*/
+function credentialOfTransferRecord(record) {
+	const accessToken = record["access_token"];
+	if (typeof accessToken !== "string" || accessToken === "") return void 0;
+	const refreshToken = typeof record["refresh_token"] === "string" ? record["refresh_token"] : "";
+	const expiresAtMs = typeof record["expiresAt"] === "number" && Number.isFinite(record["expiresAt"]) && record["expiresAt"] > 0 ? record["expiresAt"] : 0;
+	const refreshExpiresAtMs = typeof record["refreshExpiresAt"] === "number" && Number.isFinite(record["refreshExpiresAt"]) && record["refreshExpiresAt"] > 0 ? record["refreshExpiresAt"] : void 0;
+	const userId = userIdOfRaw(record);
+	const accountName = accountNameOfRaw(record);
+	const host = typeof record["domain"] === "string" ? record["domain"] : "";
+	const edition = editionOfDomain(host) ?? "cn";
+	const userRegion = userRegionOfRaw(record["auth_raw"]);
+	return {
+		accessToken,
+		...refreshToken === "" ? {} : { refreshToken },
+		userId,
+		...accountName === void 0 ? {} : { accountName },
+		host,
+		...userRegion === void 0 ? {} : { userRegion },
+		expiresAtMs,
+		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
+		edition
+	};
+}
+/** Default gate so the merge is secure even when the caller omits the judge. */
+const defaultRegionJudge = knownRegionOfCredential;
+/**
+* Pure merge: fold selected records into a CHANGES map keyed by account id.
+*
+* Mirrors the sibling merger's contract: a record with the same account id
+* OVERWRITES the stored entry (the imported tokens replace what is stored —
+* re-importing a re-login must refresh it; the write layer stores the record
+* atomically, so "overwrite" needs no knowledge of the incumbent), and a
+* record without a token is skipped. The region gate lives HERE rather than in
+* the route so it is testable without a Host.
+*
+* The region gate is a POSITIVE match: a record is kept only when its OWN
+* region claim is positively known to equal the target region. `regionOfCredential`
+* classifies anything unrecognised as `cn`, which is fine for upstream-sourced
+* data but WRONG for an imported file whose host/region are author-controlled —
+* a spoofed or misspelt value would otherwise be admitted into the CN vault.
+* Here the injected `knownRegionOfCredential` (defaulting to the exported
+* positive-match helper, which never consults the edition fallback) returns
+* `undefined` for an empty, unrecognised, or other-region claim, and such a
+* record counts as `skipped` rather than being silently imported cross-region.
+*
+* The caller writes one store file per map entry, so a selection that is
+* already stored rewrites those files with identical content — idempotent,
+* and the steady state of importing the same file twice.
+*/
+function mergeTransferRecords(records, indexes, region, knownRegionOfCredential = defaultRegionJudge) {
+	const changes = /* @__PURE__ */ new Map();
+	let imported = 0;
+	let skipped = 0;
+	for (const index of indexes) {
+		const record = records[index];
+		if (record === void 0) {
+			skipped += 1;
+			continue;
+		}
+		const credential = credentialOfTransferRecord(record);
+		if (credential === void 0) {
+			skipped += 1;
+			continue;
+		}
+		if (knownRegionOfCredential(credential) !== region) {
+			skipped += 1;
+			continue;
+		}
+		const id = traeAccountId(credential);
+		changes.set(id, credential);
+		imported += 1;
+	}
+	return {
+		changes,
+		imported,
+		skipped
+	};
+}
+//#endregion
 //#region src/web-status.ts
 /**
 * The upstream's business code for "该设备今日已参与签到" — this DEVICE already
@@ -4880,6 +5288,35 @@ async function readAccountBody(req) {
 	if (typeof accountId !== "string" || accountId.trim() === "") throw new Error("body must carry an accountId string");
 	return accountId.trim();
 }
+/**
+* Read a transfer-file POST body: the raw file TEXT plus the record indexes the
+* user selected, or (for `export`) the account ids to include.
+*
+* The ceiling is much larger than the other readers' because this body IS a
+* user-chosen file rather than a couple of ids — a credential export from a
+* sibling tool can legitimately be hundreds of kilobytes. It is still bounded so
+* a malformed or hostile request cannot make the Host buffer without limit.
+*/
+async function readTransferBody(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = chunk;
+		size += buffer.byteLength;
+		if (size > 4194304) throw new Error("request body too large");
+		chunks.push(buffer);
+	}
+	const text = Buffer.concat(chunks).toString("utf8").trim();
+	if (text === "") return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new Error("invalid JSON body");
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("body must be a JSON object");
+	return parsed;
+}
 /** Loopback browser origins only; other devices are refused until trusted origins exist. */
 function loopbackOrigin(req) {
 	const origin = req.headers.origin;
@@ -5049,6 +5486,7 @@ async function traeWebUsage(deps, region) {
 		accountId: accounts.find((item) => item.selected)?.id ?? "",
 		accountName: credential.accountName ?? credential.userId,
 		tokenExpiresAtMs: credential.expiresAtMs,
+		...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs: credential.refreshExpiresAtMs },
 		region,
 		enabled,
 		accounts,
@@ -5250,6 +5688,67 @@ function registerTraeUsageRoute(ctx, deps) {
 				}
 			}
 		});
+		/**
+		* Batch credential export / import (issue #37).
+		*
+		* The Host owns every byte of the credential store; the browser only receives
+		* parsed answers. `preview` necessarily returns identifiers the card shows
+		* (uid / nickname / email) plus a `hasToken` boolean — never a token — and
+		* `import` re-parses the file server-side rather than trusting the preview,
+		* so a tampered browser cannot smuggle in a record the preview never showed.
+		*/
+		const disposeTransfer = ctx.webServer.register({
+			kind: "exact",
+			path: TRAE_TRANSFER_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				const region = requestRegion(req, res);
+				if (region === void 0) return;
+				const action = transferActionOf(req.url ?? "");
+				if (action === void 0) return json(res, 400, { error: "unknown transfer action" });
+				try {
+					const body = await readTransferBody(req);
+					if (action === "export") {
+						const wanted = new Set(Array.isArray(body["accountIds"]) ? body["accountIds"].filter((id) => typeof id === "string") : []);
+						const store = deps.store(region);
+						const records = [];
+						for (const account of await store.accounts()) {
+							if (!wanted.has(account.id)) continue;
+							const credential = await store.credentialOf(account.id).catch(() => void 0);
+							if (credential === void 0) continue;
+							records.push(traeTransferRecordOf(credential, {
+								auth: {
+									accessToken: credential.accessToken,
+									...credential.refreshToken === void 0 ? {} : { refreshToken: credential.refreshToken },
+									expiresAt: credential.expiresAtMs > 0 ? Math.floor(credential.expiresAtMs / 1e3) : 0,
+									...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAt: Math.floor(credential.refreshExpiresAtMs / 1e3) },
+									host: credential.host,
+									...credential.userRegion === void 0 ? {} : { userRegion: credential.userRegion }
+								},
+								account: {
+									userId: credential.userId,
+									...credential.accountName === void 0 ? {} : { username: credential.accountName },
+									edition: credential.edition
+								}
+							}));
+						}
+						return json(res, 200, { accounts: records });
+					}
+					const text = typeof body["text"] === "string" ? body["text"] : "";
+					if (action === "preview") return json(res, 200, previewTransferFile(text));
+					const indexes = Array.isArray(body["indexes"]) ? body["indexes"].filter((index) => typeof index === "number" && Number.isInteger(index)) : [];
+					const { changes, imported, skipped } = mergeTransferRecords(parseTransferFile(text), indexes, region);
+					if (changes.size > 0) await deps.store(region).importAccounts([...changes.values()]);
+					json(res, 200, {
+						imported,
+						skipped
+					});
+				} catch (error) {
+					json(res, 400, { error: safeMessage(error) });
+				}
+			}
+		});
 		const disposeRefresh = ctx.webServer.register({
 			kind: "exact",
 			path: TRAE_MODELS_REFRESH_PATH,
@@ -5387,6 +5886,7 @@ function registerTraeUsageRoute(ctx, deps) {
 		return () => {
 			disposeCheckin();
 			disposeRefresh();
+			disposeTransfer();
 			disposeModelsTest();
 			disposeAccounts();
 			disposeAccountCredits();

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-trae",
   "displayName": "DSH Connect Trae",
   "description": "把本机登录的 Trae 模型接入 DeepSeek Harness：国内版与国际版双供应商并行，提供用量/积分概览与每日签到领取。",
-  "version": "3.5.1",
+  "version": "3.6.1",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",