dsh-connect-trae 4.10.0 → 4.14.2

package/lib/index.d.ts

@@ -775,6 +775,12 @@ interface TraeWebPoolAccount {
  * card must render "no free model" rather than silently substituting a paid one.
  */
 interface TraeWebPool {
+  autoCheckinState?: {
+    done: number;
+    deviceBlocked: boolean;
+    failures: number;
+  };
+  autoCheckin?: boolean;
   enabled: boolean;
   /**
    * Whether this panel offers the daily check-in at all.
@@ -865,6 +871,8 @@ interface TraeWebPool {
  * slot must still load, and a missing `enabled` means OFF rather than ON.
  */
 interface TraePoolPreferences {
+  /** 保存后启用国内个人账号池的每日自动签到。 */
+  autoCheckin?: boolean;
   /** Whether this panel bills through the pool at all. Default OFF. */
   enabled?: boolean;
   /**
@@ -4362,6 +4370,15 @@ interface TraePoolTestRow {
   retryAtMs?: number;
 }
 //#endregion
+//#region src/auto-checkin.d.ts
+interface AutoCheckinState {
+  day: string;
+  done: string[];
+  deviceBlocked: boolean;
+  failures: number;
+  retryAt: number;
+}
+//#endregion
 //#region src/web-status.d.ts
 /**
  * Constructor dependencies. Everything panel-specific is addressed by the
@@ -4370,6 +4387,7 @@ interface TraePoolTestRow {
  * user is on.
  */
 interface TraeUsageRouteOptions {
+  autoCheckinProgress?(): Promise<AutoCheckinState | undefined>;
   /** The panel-scoped credential store backing each region's requests. */
   store(panel: TraePanel): TraeCredentialStore;
   /** The panel-scoped usage client (CN work credits / international pay status). */

package/lib/index.js

@@ -1,20 +1,101 @@
+import { copyFile, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
+import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import z from "@deepseek-ai/schemastery";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { ReasoningEffortId, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { existsSync, readFileSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { copyFile, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
-import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
-import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { cpus, homedir, hostname, release, userInfo } from "node:os";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
+//#region src/auto-checkin.ts
+/** 按运行机器的本地日期组织进度；领取资格始终以服务器响应为准。 */
+function checkinDay(now) {
+	const date = new Date(now);
+	return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, "0")}-${String(date.getDate()).padStart(2, "0")}`;
+}
+function foldCheckin(state, rows, now) {
+	const done = new Set(state.done);
+	for (const row of rows) if (row.status === "already" || row.status === "claimed") done.add(row.accountId);
+	const failures = rows.some((row) => row.status === "failed") ? state.failures + 1 : 0;
+	return {
+		day: state.day,
+		done: [...done],
+		deviceBlocked: state.deviceBlocked || rows.some((row) => row.status === "device-already" || row.status === "claimed"),
+		failures,
+		retryAt: now + (rows.some((row) => row.status === "disabled") && failures === 0 ? 18e5 : Math.min(18e5, 3e4 * 2 ** Math.min(failures, 6)))
+	};
+}
+/** 单实例内串行执行。关闭开关或卸载后不再启动新批次。 */
+function createAutoCheckin(deps) {
+	let running = false;
+	let stopped = false;
+	let memory;
+	return {
+		stop() {
+			stopped = true;
+		},
+		async tick() {
+			if (stopped || running || !deps.enabled()) return;
+			running = true;
+			try {
+				const now = deps.now?.() ?? Date.now();
+				const day = checkinDay(now);
+				const stored = memory ?? await deps.read();
+				const state = stored?.day === day ? stored : {
+					day,
+					done: [],
+					deviceBlocked: false,
+					failures: 0,
+					retryAt: 0
+				};
+				memory = state;
+				if (stopped || !deps.enabled() || state.deviceBlocked || now < state.retryAt) return;
+				let rows;
+				try {
+					rows = await deps.run(state.done);
+				} catch {
+					rows = [{
+						accountId: "",
+						accountName: "",
+						status: "failed"
+					}];
+				}
+				memory = foldCheckin(state, rows, deps.now?.() ?? Date.now());
+				await deps.write(memory);
+			} finally {
+				running = false;
+			}
+		}
+	};
+}
+//#endregion
+//#region src/auto-checkin-store.ts
+/** 只保存日期、账号 id 和重试进度，不保存凭据或上游错误正文。 */
+const autoCheckinPath = () => join(resolveDshHome(), ".trae-auto-checkin.cn.json");
+async function readAutoCheckin() {
+	try {
+		const value = JSON.parse(await readFile(autoCheckinPath(), "utf8"));
+		return typeof value.day === "string" && Array.isArray(value.done) && value.done.every((id) => typeof id === "string") && typeof value.deviceBlocked === "boolean" && typeof value.failures === "number" && Number.isFinite(value.failures) && typeof value.retryAt === "number" && Number.isFinite(value.retryAt) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+async function writeAutoCheckin(state) {
+	const path = autoCheckinPath();
+	await withFileLock(path, () => writeFileAtomic(path, `${JSON.stringify(state)}\n`, {
+		mode: 384,
+		dirMode: 448
+	}));
+}
+//#endregion
 //#region src/context-budget.ts
 /**
 * Context-budget arithmetic shared by the HOST (which applies a saved budget to
@@ -8710,13 +8791,56 @@ async function readTransferBody(req) {
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("body must be a JSON object");
 	return parsed;
 }
-/** Loopback browser origins only; other devices are refused until trusted origins exist. */
+/**
+* One hostname spelling: lowercased, IPv6 brackets dropped.
+*
+* `new URL('http://[::1]:3080').hostname` is the string `[::1]`, while a socket's
+* `localAddress` is `::1` — comparing the two without normalising means the
+* bracketed form never matches, which is why the old predicate listed both
+* spellings by hand.
+*/
+function bareHostname(value) {
+	const text = value.trim().toLowerCase();
+	return text.startsWith("[") && text.endsWith("]") ? text.slice(1, -1) : text;
+}
+/**
+* Whether a request's `Origin` may be honoured (ISSUE #78).
+*
+* This used to accept loopback hostnames ONLY, and that was wrong in a way that
+* hid from every non-browser test: a browser always sends `Origin` on a
+* same-origin POST, so `dsh web --host 100.64.0.2` served the page from an
+* address the HOST layer had already accepted (`--trusted-host`) while this
+* predicate called that page's own origin foreign. All six write routes 403'd
+* in the real UI, and `curl` — which sends no `Origin` — stayed green. The
+* plugin's own fetch does not send it either, so nothing on the plugin side
+* noticed.
+*
+* The rule is now "same origin, however this process is addressed": loopback, or
+* a hostname equal to the `Host` header's, or one equal to the socket's own
+* local address. Hostnames only — a reverse proxy that changes the PORT must
+* still be admitted, and the port says nothing about who is asking.
+*
+* The `Host` comparison is what the sibling dsh-connect-workbuddy predicate
+* lacks, and it is here deliberately: a front proxy can rewrite `Host` to a
+* different trusted spelling than the address the browser used, so neither
+* `Host` nor `localAddress` alone covers every arrangement.
+*
+* Exact equality, never `endsWith`/`startsWith`: a suffix test would admit
+* `evil-100.64.0.2`, and a prefix test would admit `100.64.0.20`.
+*/
 function loopbackOrigin(req) {
 	const origin = req.headers.origin;
-	if (origin === void 0) return true;
+	if (origin === void 0 || origin.trim() === "") return true;
 	try {
-		const { hostname } = new URL(origin);
-		return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+		const hostname = bareHostname(new URL(origin).hostname);
+		if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1") return true;
+		const rawHost = req.headers.host;
+		if (typeof rawHost === "string" && rawHost.trim() !== "") {
+			if (hostname === bareHostname(new URL(`http://${rawHost}`).hostname)) return true;
+		}
+		const local = req.socket?.localAddress;
+		if (typeof local === "string" && local.trim() !== "" && hostname === bareHostname(local)) return true;
+		return false;
 	} catch {
 		return false;
 	}
@@ -8993,7 +9117,9 @@ async function traeWebUsage(deps, panel, options = {}) {
 		...poolSection,
 		creditsUnavailable: "enterprise"
 	};
-	const [snapshotResult, checkinResult] = await Promise.allSettled([client.snapshot(), client.checkinStatus()]);
+	const checkinProgress = await deps.autoCheckinProgress?.();
+	const checkinCompleted = checkinProgress?.day === checkinDay(Date.now()) && (checkinProgress.deviceBlocked || checkinProgress.done.includes(account.accountId));
+	const [snapshotResult, checkinResult] = await Promise.allSettled([client.snapshot(), checkinCompleted ? Promise.resolve(void 0) : client.checkinStatus()]);
 	const credits = snapshotResult.status === "fulfilled" ? toCredits(snapshotResult.value) : void 0;
 	const alternatives = credits !== void 0 && credits.workAvailable <= 0 && credits.generalAvailable <= 0 ? await creditAlternatives(deps, panel, accounts) : void 0;
 	return {
@@ -9001,7 +9127,7 @@ async function traeWebUsage(deps, panel, options = {}) {
 		...account,
 		...poolSection,
 		...credits === void 0 ? { creditsError: snapshotResult.status === "rejected" ? safeMessage(snapshotResult.reason) : "unknown" } : { credits },
-		...checkinResult.status === "fulfilled" ? { checkin: toCheckin(checkinResult.value) } : { checkinError: safeMessage(checkinResult.reason) },
+		...checkinResult.status === "fulfilled" ? checkinResult.value === void 0 ? {} : { checkin: toCheckin(checkinResult.value) } : { checkinError: safeMessage(checkinResult.reason) },
 		...alternatives === void 0 ? {} : { alternatives }
 	};
 }
@@ -9191,9 +9317,16 @@ async function traeWebPool(deps, panel, fast = false) {
 		else if (ranked.every((row) => row.excludedBy !== void 0)) noCandidate = new Set(ranked.map((row) => row.excludedBy)).size === 1 ? ranked[0]?.excludedBy ?? "unusable" : "unusable";
 	}
 	const effectiveMemberAccountIds = effectiveMembersOf(rows.filter((row) => row.member).map((row) => row.account.id), new Set(members.map((member) => member.account.id)));
+	const automatic = panel === "cn" && preferences.autoCheckin === true ? await readAutoCheckin() : void 0;
 	const copies = await deps.copiesOf?.(panel).catch(() => void 0);
 	return {
 		enabled: preferences.enabled === true,
+		autoCheckin: preferences.autoCheckin === true,
+		...automatic?.day === checkinDay(Date.now()) ? { autoCheckinState: {
+			done: automatic.done.length,
+			deviceBlocked: automatic.deviceBlocked,
+			failures: automatic.failures
+		} } : {},
 		checkinSupported: pool.checkin !== void 0 && regionOfPanel(panel) === "cn",
 		...deps.deleteAccountOf === void 0 ? {} : { deleteSupported: true },
 		...copies === void 0 ? {} : { copies },
@@ -11148,6 +11281,7 @@ const regionStateConfig = z.object({
 	thinkingEfforts: z.dict(z.string()).default({}).description("每个模型的思考强度（模型 id → 档位）。留空 = 跟随该模型自己的默认档。"),
 	creditPosition: z.union([z.const("composer"), z.const("stats")]).default("composer").description("积分读数显示位置：\"composer\" = 输入框工具栏（默认），\"stats\" = 输入框下方（与「轮次 / 步数 / token」统计同一行）。装了别的插件后读数不显示时改成 stats。"),
 	pool: z.object({
+		autoCheckin: z.boolean().default(false).description("每日自动签到：仅国内个人账号，遵守设备每日奖励限制。"),
 		enabled: z.boolean().default(false).description("账号池：打开后本面板由池中可用账号轮流计费（关闭时按下面的绑定账号）"),
 		targetModelId: z.string().default("").description("账号池测速使用的模型 id（留空 = 自动选择免费模型）"),
 		memberAccountIds: z.array(z.string()).default([]).description("加入本面板账号池的账号 id（显式勾选，默认为空）"),
@@ -12008,7 +12142,7 @@ function apply(ctx, config) {
 	* The bag is built per REQUEST, so it captures the panel and never has to be
 	* told which tab asked.
 	*/
-	const poolDepsOf = (panel) => {
+	const poolDepsOf = (panel, checkinDone = []) => {
 		const bridges = /* @__PURE__ */ new Map();
 		const chatBridgeFor = (accountId) => {
 			const existing = bridges.get(accountId);
@@ -12080,7 +12214,7 @@ function apply(ctx, config) {
 			},
 			catalog: (stored) => poolCatalogOf(stored),
 			checkinSupported: (stored) => regionOfPanel(stored) === "cn",
-			checkin: async (stored) => checkinAllAccounts(await poolTargetsOf(stored), probeDeps()),
+			checkin: async (stored) => checkinAllAccounts((await poolTargetsOf(stored)).filter((target) => !checkinDone.includes(target.accountId)), probeDeps()),
 			checkinState: async (stored) => {
 				const state = cachedCheckinStateOf(stored);
 				const nowMs = Date.now();
@@ -12140,6 +12274,7 @@ function apply(ctx, config) {
 		};
 	};
 	ctx.inject(["webServer"], (webCtx) => registerTraeUsageRoute(webCtx, {
+		autoCheckinProgress: readAutoCheckin,
 		store: (panel) => stacks[panel].store,
 		client: (panel) => stacks[panel].usageClient,
 		displayModels: (panel) => displayModels(current(), panel),
@@ -12410,6 +12545,23 @@ function apply(ctx, config) {
 		applySelection(current());
 		syncTraeDrawImageTool(current());
 	});
+	const automaticCheckin = createAutoCheckin({
+		enabled: () => poolPreferencesOf("cn").autoCheckin === true,
+		read: readAutoCheckin,
+		write: writeAutoCheckin,
+		run: async (done) => await poolDepsOf("cn", done).checkin?.("cn") ?? []
+	});
+	ctx.effect(() => {
+		const tick = () => {
+			automaticCheckin.tick().catch(() => ctx.logger.warn("无法读取或保存 Trae 自动签到进度，请检查本地数据目录的访问权限。"));
+		};
+		const timer = setInterval(tick, 3e4);
+		tick();
+		return () => {
+			clearInterval(timer);
+			automaticCheckin.stop();
+		};
+	});
 	let stopped = false;
 	ctx.effect(() => () => {
 		stopped = true;

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-trae",
   "displayName": "DSH Connect Trae",
   "description": "把本机登录的 Trae 模型接入 DeepSeek Harness：国内版与国际版双供应商并行，提供用量/积分概览与每日签到领取。",
-  "version": "4.10.0",
+  "version": "4.14.2",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",
@@ -35,6 +35,7 @@
     "icons",
     "docs/assets/dsh-connect-trae-usage-card.png",
     "docs/assets/dsh-connect-trae-sidebar-page.png",
+    "docs/assets/dsh-connect-trae-composer-credits.png",
     "scripts/verify-windows.mjs",
     "screenshots.json",
     "cordis.patch.yml",
@@ -51,7 +52,12 @@
     "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.client.json",
     "check": "pnpm run typecheck && pnpm run test && pnpm run build",
     "verify:release": "node scripts/verify-release.mjs",
+    "verify:privacy": "node scripts/verify-privacy.mjs",
+    "prepublishOnly": "node scripts/verify-privacy.mjs",
     "card:shot": "vitest run --config vitest.card.config.ts",
+    "page:shot": "vitest run --config vitest.card.config.ts -t \"page shot\"",
+    "composer:shot": "vitest run --config vitest.card.config.ts -t \"composer shot\"",
+    "section:shot": "vitest run --config vitest.card.config.ts -t \"section shot\"",
     "promo:shot": "vitest run --config vitest.card.config.ts -t \"promo shot\"",
     "panels:shot": "vitest run --config vitest.card.config.ts -t \"panels shot\"",
     "prebuild": "node scripts/warn-live-host.mjs"
@@ -126,6 +132,7 @@
     "react": "^18.3.1",
     "react-dom": "18.3.1",
     "semver": "^7.7.2",
+    "tesseract.js": "^7.0.0",
     "tsdown": "^0.22.2",
     "typescript": "^5.9.3",
     "vitest": "^4.1.8"