dsh-llm-adapters 1.2.0 → 1.2.1

package/lib/types/account-store.d.ts

@@ -30,12 +30,12 @@ export interface RaccoonAccountRecord {
     loginAt: number;
 }
 /**
- * One Trae web login.
+ * One Trae login.
  *
- * `accessToken` is the `Cloud-IDE-JWT` the website itself uses. `deviceId` and
- * `machineId` are the fingerprints captured from that web session — this
- * plugin never reads a desktop install — and are replayed on chat, quota and
- * check-in requests.
+ * `accessToken` is the `Cloud-IDE-JWT` Trae's own clients use. `deviceId` and
+ * `machineId` are replayed on chat, quota and check-in requests. A web login
+ * captures them from its browser session; a `client` login copies the desktop
+ * client's own values, which is the only source the check-in route accepts.
  */
 export interface TraeAccountRecord {
     accessToken: string;
@@ -45,6 +45,8 @@ export interface TraeAccountRecord {
     userId?: string;
     name?: string;
     loginAt: number;
+    /** Where the token came from; absent means the plugin's browser login. */
+    source?: 'web' | 'client';
     /** The `Cloud-IDE-JWT` expiry (about 8 hours); absent when the JWT carries none. */
     expiresAt?: number;
     /**

package/lib/types/adapter.d.ts

@@ -16,7 +16,7 @@ import { LoomyProvider } from './loomy.ts';
 import { RaccoonProvider } from './raccoon.ts';
 import { TraeProvider } from './trae.ts';
 import type { AuthStatus } from './auth.ts';
-import type { CheckinStatus, ProviderStatus, QuotaSnapshot } from './types.ts';
+import type { CheckinStatus, ClientLoginStatus, ProviderStatus, QuotaSnapshot } from './types.ts';
 import type { ReadImage } from './wire.ts';
 export interface AdapterOptions {
     brand: BrandId;
@@ -33,7 +33,7 @@ export interface AdapterOptions {
  *
  * Declared as an interface rather than a union so a new provider only has to
  * implement the behaviour, not edit the adapter's type list. The optional
- * check-in methods exist only on Trae.
+ * client-login and check-in methods exist only on Trae.
  */
 export interface ProviderClient {
     status(): Promise<AuthStatus>;
@@ -51,6 +51,10 @@ export interface ProviderClient {
     invalidateModels(): void;
     invalidateQuota(): void;
     close(): void;
+    /** Trae only: the local desktop client's current sign-in state. */
+    localClientLogin?(): Promise<ClientLoginStatus>;
+    /** Trae only: copy that state into the plugin's own account store. */
+    importClientLogin?(): Promise<void>;
     checkinStatus?(): Promise<CheckinStatus>;
     claimCheckin?(): Promise<CheckinStatus>;
 }
@@ -85,6 +89,8 @@ export declare abstract class LocalAdapter extends LlmAdapter {
     cancelBrowserLogin(): Promise<void>;
     /** Claim today's reward; providers without one reject it. */
     claimCheckin(): Promise<CheckinStatus>;
+    /** Import a local client login and return the refreshed account reading. */
+    importClientLogin(): Promise<ProviderStatus>;
     invalidateCatalog(): void;
     invalidateUsage(): void;
     /** Login state plus quota, shaped for the settings page. */

package/lib/types/auth.d.ts

@@ -1,10 +1,11 @@
 /**
  * Credential state for every provider.
  *
- * Sign-in happens in the provider's own web page, so credentials exist in
- * exactly one place: the plugin's own account store. No desktop client file is
- * discovered, read, or written, and no token leaves this module in errors or
- * display fields.
+ * Sign-in happens in the provider's own web page. Trae additionally offers an
+ * explicit, read-only import of the local desktop client's login state; nothing
+ * is ever written back to that client. Either way credentials end up in exactly
+ * one place, the plugin's own account store, and no token leaves this module in
+ * errors or display fields.
  *
  * @module dsh-llm-adapters/auth
  */
@@ -26,6 +27,8 @@ export interface AuthStatus {
     possiblyExpired?: boolean;
     account?: LocalAccount;
     error?: string;
+    /** Trae only: where the token came from. */
+    loginSource?: 'web' | 'client';
 }
 export declare class LoomyAuth {
     private readonly store;
@@ -58,12 +61,13 @@ export declare class RaccoonAuth {
     logout(): Promise<void>;
 }
 /**
- * Trae's web login, one per region.
+ * Trae's login, one per region.
  *
- * The `Cloud-IDE-JWT` the website issues lives about eight hours, but the
- * website session behind it lives about fourteen days. The cookies captured at
- * sign-in are replayed against `GetUserToken` to renew the short token silently;
- * only when the session itself dies does the user have to sign in again.
+ * A web login stores the `Cloud-IDE-JWT` from the website plus the cookies
+ * behind it, so the short token can be renewed silently until the website
+ * session dies. A client login stores the token the desktop client already
+ * uses; that token has no website session, and the client itself refreshes it.
+ * Only the client source carries the device id the check-in route accepts.
  */
 export declare class TraeAuth {
     private readonly store;
@@ -77,8 +81,10 @@ export declare class TraeAuth {
     /**
      * The bearer token, or an actionable error when there is none.
      *
-     * A token near its expiry is renewed first; `force` means the gateway already
-     * rejected it, so the renewal is attempted even if the clock disagrees.
+     * A web token near its expiry is renewed first; `force` means the gateway
+     * already rejected it, so the renewal is attempted even if the clock
+     * disagrees. A client token is returned until its own expiry and then asks
+     * for a fresh import, because only the client can refresh it.
      */
     accessToken(force?: boolean): Promise<string>;
     /** Renew the eight-hour JWT with the stored website cookies. */

package/lib/types/index.d.ts

@@ -59,10 +59,12 @@ export { OpenRouterCatalog, buildOpenRouterIndex, parseOpenRouterModels, readOpe
 export type { OpenRouterIndex, OpenRouterLookup, OpenRouterModel, OpenRouterStatus, OpenRouterSyncResult, } from './openrouter.ts';
 export { LoomyProvider, LOOMY_BASE, LOOMY_VERSION, loomyGatewaySessionValid } from './loomy.ts';
 export { RaccoonProvider, RACCOON_BASE, RACCOON_CLIENT_VERSION, raccoonAccessTokenValid, raccoonRefreshCandidate, } from './raccoon.ts';
-export { TraeProvider, TRAE_CHAT_FUNCTIONS, TRAE_DIRECTORY_FUNCTIONS, mergeTraeModels, normalizeEffort, openTraeStream, parseTraeGlobalUsage, parseTraeRemoteModels, parseTraeUsage, parseTraeWireModels, traeMessages, traeTools, } from './trae.ts';
+export { TraeProvider, TRAE_CHAT_FUNCTIONS, TRAE_CHECKIN_REQ_SOURCE, TRAE_DIRECTORY_FUNCTIONS, mergeTraeModels, normalizeEffort, openTraeStream, parseTraeCheckin, parseTraeGlobalUsage, parseTraeRemoteModels, parseTraeUsage, parseTraeWireModels, traeMessages, traeTools, } from './trae.ts';
 export type { TraeCatalog, TraeModelMeta, TraeProviderOptions, TraeRemoteModel, TraeWireModel, } from './trae.ts';
 export { TRAE_APP_ID, TRAE_REGION_PROFILES, TRAE_SOLO_CHAT_PATH, TRAE_WEB_USER_AGENT } from './trae-endpoints.ts';
 export type { TraeRegionProfile } from './trae-endpoints.ts';
+export { parseTraeClientStorage, readTraeClientLogin, traeClientDataDirs } from './trae-client.ts';
+export type { TraeClientDetection, TraeClientLoginState, TraeClientReadOptions } from './trae-client.ts';
 export { TraeWebLogin, machineIdOf } from './trae-login.ts';
 export type { TraeLoginAccount, TraeWebLoginOptions } from './trae-login.ts';
 export { CodeArtsProvider, CODEARTS_DEFAULT_EFFORT, CODEARTS_EFFORTS, clampMaxTokens, codeartsEfforts, normalizeCodeArtsModelId, parseCodeArtsPackage, parseCodeArtsRoster, pickActiveCredit, priceFactorOfLabel, } from './codearts.ts';
@@ -79,7 +81,7 @@ export type { WireMessage } from './wire.ts';
 export { API_PREFIX, buildRows } from './api.ts';
 export { liveConfig, resolveConfig } from './config.ts';
 export type { Config as ConfigShape, LiveConfig, ParsedConfig, ResolvedConfig } from './config.ts';
-export type { CheckinStatus, ProviderStatus, QuotaPack, QuotaSnapshot } from './types.ts';
+export type { CheckinStatus, ClientLoginStatus, ProviderStatus, QuotaPack, QuotaSnapshot } from './types.ts';
 export declare const name = "llm-adapters";
 export declare const inject: string[];
 export declare const Config: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{

package/lib/types/trae-client.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The local Trae desktop client's sign-in state.
+ *
+ * Trae's check-in route insists on the device id its own client registered, so
+ * the website login cannot use it. When the client is installed and already
+ * signed in, the plugin can reuse that state instead:
+ *
+ *  - the `Cloud-IDE-JWT` stored under `iCubeAuthInfo://icube.cloudide`;
+ *  - the 16-digit device id encoded in the `iCubeAuthInfo://icube-dc:<id>` key;
+ *  - `telemetry.machineId`, the value the client sends as `x-machine-id`.
+ *
+ * The stored value uses the client's own AES-CBC envelope: six magic bytes, a
+ * 32-byte key material, then the ciphertext. The AES key and IV are derived
+ * from that key material with SHA-512 and a fixed salt, and the plaintext is a
+ * SHA-512 digest followed by the JSON document. Nothing here writes to the
+ * client, and the token is never returned by the settings API.
+ *
+ * @module dsh-llm-adapters/trae-client
+ */
+import type { TraeRegion } from './brand.ts';
+import type { ClientLoginStatus } from './types.ts';
+/** What the provider stores after importing a client login. */
+export interface TraeClientLoginState {
+    region: TraeRegion;
+    token: string;
+    deviceId: string;
+    machineId: string;
+    userId?: string;
+    name?: string;
+    expiresAt?: number;
+}
+/** The settings-facing half (no token) plus the internal state when usable. */
+export interface TraeClientDetection {
+    status: ClientLoginStatus;
+    state?: TraeClientLoginState;
+}
+export interface TraeClientReadOptions {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+}
+/**
+ * The client's data directory, most specific first.
+ *
+ * `DSH_TRAE_CLIENT_DIR` is a portable/test override; the region-specific
+ * variables let one machine keep separate CN and international installs.
+ */
+export declare function traeClientDataDirs(region: TraeRegion, options?: TraeClientReadOptions): string[];
+/** Parse one `storage.json` document; exported for tests and diagnostics. */
+export declare function parseTraeClientStorage(region: TraeRegion, storage: Record<string, unknown>): TraeClientDetection;
+/** Read the currently selected region's client state from this machine. */
+export declare function readTraeClientLogin(region: TraeRegion, options?: TraeClientReadOptions): TraeClientDetection;

package/lib/types/trae-endpoints.d.ts

@@ -33,6 +33,8 @@ export interface TraeRegionProfile {
      * the dollar allowance instead.
      */
     usageV2: boolean;
+    /** Daily check-in exists only on the mainland deployment. */
+    checkin: boolean;
 }
 export declare const TRAE_REGION_PROFILES: Record<TraeRegion, TraeRegionProfile>;
 /** The app id Trae's own clients send; not account-specific. */

package/lib/types/trae-login.d.ts

@@ -1,15 +1,17 @@
 /**
  * Trae sign-in through the provider's own website.
  *
- * The plugin does not read a desktop install: it opens a dedicated browser
+ * This flow does not read a desktop install: it opens a dedicated browser
  * profile, lets the user sign in on trae.cn / trae.ai, and then takes the
  * session the website itself created. Two things come out of that session:
  *
  *  - the `Cloud-IDE-JWT` token, fetched with the page's own cookies through
  *    `/cloudide/api/v3/common/GetUserToken` — the same call the site makes;
  *  - the device fingerprint (`__msuuid__` from the page, or one generated in
- *    the page), which Trae's check-in route requires and which therefore must
- *    belong to this web session rather than to a machine install.
+ *    the page), stored with the web login.
+ *
+ * The check-in route does not accept this web fingerprint, so check-in is
+ * enabled only for the separate client-login import in `trae-client.ts`.
  *
  * Cookies are captured over the DevTools protocol and kept in the plugin's own
  * account store so the short-lived JWT can be renewed later; the dedicated

package/lib/types/trae.d.ts

@@ -1,8 +1,10 @@
 /**
- * Trae provider: model directory, SOLO chat and quota.
+ * Trae provider: model directory, SOLO chat, quota and client check-in.
  *
  * Trae's website login yields the same `Cloud-IDE-JWT` its own clients use, so
- * the plugin talks to the same gateways they do. Two catalog sources are merged:
+ * the plugin talks to the same gateways they do. A second sign-in method copies
+ * that token from the local desktop client; only that method carries the device
+ * id the daily check-in route accepts. Two catalog sources are merged:
  *
  *  - the Remote directory (`/api/remote/v1/models`) is the model skeleton —
  *    display name, context window, multiplier, reasoning options, multimodal;
@@ -29,7 +31,8 @@ import { ModelCatalog } from './catalog.ts';
 import type { ProviderModel } from './catalog.ts';
 import type { LoginStatus } from './login-page.ts';
 import type { OpenRouterIndex, OpenRouterLookup } from './openrouter.ts';
-import type { QuotaSnapshot } from './types.ts';
+import type { TraeClientDetection } from './trae-client.ts';
+import type { CheckinStatus, ClientLoginStatus, QuotaSnapshot } from './types.ts';
 import type { ReadImage, WireMessage } from './wire.ts';
 /** Chat functions, in the order Trae itself prefers them. */
 export declare const TRAE_CHAT_FUNCTIONS: readonly string[];
@@ -103,6 +106,8 @@ export interface TraeProviderOptions {
     logger?: (message: string) => void;
     /** The shared OpenRouter snapshot; a private one is created when omitted. */
     openRouter?: OpenRouterLookup;
+    /** Overridable in tests; defaults to reading this machine's Trae client. */
+    clientLogin?: () => TraeClientDetection;
 }
 /**
  * The persistent browser profile used for one region.
@@ -154,6 +159,12 @@ export declare function parseTraeUsage(payload: unknown): QuotaSnapshot;
  * dollars and must not be printed as credits.
  */
 export declare function parseTraeGlobalUsage(payload: unknown): QuotaSnapshot;
+/**
+ * The check-in body's `req_source`: 1 is the IDE, 2 is Trae Work. The desktop
+ * client sends 1; the claim route rejects the plugin's former empty body.
+ */
+export declare const TRAE_CHECKIN_REQ_SOURCE = 1;
+export declare function parseTraeCheckin(payload: unknown): CheckinStatus;
 export declare class TraeProvider {
     private readonly options;
     private catalogInstance;
@@ -185,6 +196,7 @@ export declare class TraeProvider {
         possiblyExpired?: boolean;
         account?: import("./auth.ts").LocalAccount;
         error?: string;
+        loginSource?: "web" | "client";
     }>;
     signedIn(): Promise<boolean>;
     models(fresh?: boolean): Promise<readonly ProviderModel[]>;
@@ -199,6 +211,20 @@ export declare class TraeProvider {
     private fetchWire;
     private fetchCatalog;
     quota(fresh?: boolean): Promise<QuotaSnapshot>;
+    /**
+     * The second sign-in method: the desktop client's current state.
+     *
+     * Read-only; the settings page only receives the non-secret status, never
+     * the token.
+     */
+    localClientLogin(): Promise<ClientLoginStatus>;
+    private readClientLogin;
+    /** Import the desktop client's token, device id and machine id. */
+    importClientLogin(): Promise<void>;
+    private checkinContext;
+    checkinStatus(): Promise<CheckinStatus>;
+    /** Claim today's reward. The only state-changing call in this provider. */
+    claimCheckin(): Promise<CheckinStatus>;
     stream(options: GenerateOptions, model: string, readImage: ReadImage | undefined, onInvalidate: () => void): AsyncGenerator<StreamChunk>;
     startBrowserLogin(region?: TraeRegion): Promise<LoginStatus>;
     browserLoginStatus(): LoginStatus;

package/lib/types/types.d.ts

@@ -53,6 +53,22 @@ export interface CheckinStatus {
     /** A page the user can open when the provider has no claimable API. */
     url?: string;
 }
+/**
+ * The local Trae client's state, as shown on the settings page.
+ *
+ * Never carries the token: only whether the client was found, whether a usable
+ * login was read, and the non-secret account fields.
+ */
+export interface ClientLoginStatus {
+    /** A Trae client data directory exists on this machine. */
+    available: boolean;
+    /** The stored login is present, unexpired and usable. */
+    signedIn: boolean;
+    name?: string;
+    userId?: string;
+    expiresAt?: number;
+    error?: string;
+}
 export interface ProviderStatus extends AuthStatus {
     brand: BrandId;
     /** Trae only: the region this reading belongs to. */
@@ -60,7 +76,9 @@ export interface ProviderStatus extends AuthStatus {
     /** Present only after a successful quota read. */
     quota?: QuotaSnapshot;
     quotaError?: string;
-    /** Trae CN only. */
+    /** Trae only: the second sign-in method, when the desktop client exists. */
+    clientLogin?: ClientLoginStatus;
+    /** Trae CN only, and only for a login imported from the client. */
     checkin?: CheckinStatus;
 }
 export type { LocalAccount };

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "dsh-llm-adapters",
   "displayName": "Local LLM Adapters",
-  "description": "DeepSeek Harness adapters for Loomy, SenseTime Raccoon and Trae. Sign in through the provider’s own web page (WeChat QR for Loomy and Raccoon, a dedicated browser window for Trae), then use the account’s models with quota, thinking levels and per-model settings pages.",
-  "version": "1.2.0",
+  "description": "DeepSeek Harness adapters for Loomy, SenseTime Raccoon and Trae. Sign in through the provider’s own web page (WeChat QR for Loomy and Raccoon, a dedicated browser window for Trae), or reuse a signed-in local Trae client for the mainland check-in, then use the account’s models with quota, thinking levels and per-model settings pages.",
+  "version": "1.2.1",
   "type": "module",
   "license": "MIT",
   "author": "k1-h2",
@@ -19,6 +19,7 @@
     "qr-login",
     "wechat-login",
     "web-login",
+    "client-login",
     "openai-compatible",
     "model-provider",
     "trae",

package/src/account-store.ts

@@ -39,12 +39,12 @@ export interface RaccoonAccountRecord {
 }
 
 /**
- * One Trae web login.
+ * One Trae login.
  *
- * `accessToken` is the `Cloud-IDE-JWT` the website itself uses. `deviceId` and
- * `machineId` are the fingerprints captured from that web session — this
- * plugin never reads a desktop install — and are replayed on chat, quota and
- * check-in requests.
+ * `accessToken` is the `Cloud-IDE-JWT` Trae's own clients use. `deviceId` and
+ * `machineId` are replayed on chat, quota and check-in requests. A web login
+ * captures them from its browser session; a `client` login copies the desktop
+ * client's own values, which is the only source the check-in route accepts.
  */
 export interface TraeAccountRecord {
   accessToken: string
@@ -54,6 +54,8 @@ export interface TraeAccountRecord {
   userId?: string
   name?: string
   loginAt: number
+  /** Where the token came from; absent means the plugin's browser login. */
+  source?: 'web' | 'client'
   /** The `Cloud-IDE-JWT` expiry (about 8 hours); absent when the JWT carries none. */
   expiresAt?: number
   /**
@@ -138,9 +140,11 @@ function traeRecord(value: unknown, region: TraeRegion): TraeAccountRecord | und
   const accessToken = text(raw?.accessToken)
   if (raw === undefined || accessToken === undefined) return undefined
   const deviceId = text(raw.deviceId)
+  const source = raw.source === 'web' || raw.source === 'client' ? raw.source : undefined
   return {
     accessToken,
     region,
+    ...source === undefined ? {} : { source },
     deviceId: deviceId ?? `web-${randomBytes(8).toString('hex')}`,
     machineId: text(raw.machineId) ?? `web-${randomBytes(16).toString('hex')}`,
     loginAt: number(raw.loginAt) ?? Date.now(),

package/src/adapter.ts

@@ -22,7 +22,7 @@ import { LoomyProvider } from './loomy.ts'
 import { RaccoonProvider } from './raccoon.ts'
 import { TraeProvider } from './trae.ts'
 import type { AuthStatus } from './auth.ts'
-import type { CheckinStatus, ProviderStatus, QuotaSnapshot } from './types.ts'
+import type { CheckinStatus, ClientLoginStatus, ProviderStatus, QuotaSnapshot } from './types.ts'
 import type { ReadImage } from './wire.ts'
 
 export interface AdapterOptions {
@@ -41,7 +41,7 @@ export interface AdapterOptions {
  *
  * Declared as an interface rather than a union so a new provider only has to
  * implement the behaviour, not edit the adapter's type list. The optional
- * check-in methods exist only on Trae.
+ * client-login and check-in methods exist only on Trae.
  */
 export interface ProviderClient {
   status(): Promise<AuthStatus>
@@ -64,6 +64,10 @@ export interface ProviderClient {
   invalidateModels(): void
   invalidateQuota(): void
   close(): void
+  /** Trae only: the local desktop client's current sign-in state. */
+  localClientLogin?(): Promise<ClientLoginStatus>
+  /** Trae only: copy that state into the plugin's own account store. */
+  importClientLogin?(): Promise<void>
   checkinStatus?(): Promise<CheckinStatus>
   claimCheckin?(): Promise<CheckinStatus>
 }
@@ -154,6 +158,17 @@ export abstract class LocalAdapter extends LlmAdapter {
     return result
   }
 
+  /** Import a local client login and return the refreshed account reading. */
+  async importClientLogin(): Promise<ProviderStatus> {
+    if (this.client.importClientLogin === undefined) {
+      throw new Error('该供应商不支持复用本机客户端登录')
+    }
+    await this.client.importClientLogin()
+    this.invalidateCatalog()
+    this.invalidateUsage()
+    return this.usageInfo(true)
+  }
+
   invalidateCatalog(): void {
     this.client.invalidateModels()
   }
@@ -165,7 +180,20 @@ export abstract class LocalAdapter extends LlmAdapter {
   /** Login state plus quota, shaped for the settings page. */
   async usageInfo(fresh = false): Promise<ProviderStatus> {
     const auth = await this.client.status()
-    const base: ProviderStatus = { brand: this.brand, ...auth }
+    // Detection is part of the reading even while signed out: that is what
+    // offers the second sign-in method. Only Trae implements it.
+    const clientLogin = this.client.localClientLogin === undefined
+      ? undefined
+      : await this.client.localClientLogin().catch(error => ({
+          available: false,
+          signedIn: false,
+          error: error instanceof Error ? error.message : String(error),
+        }))
+    const base: ProviderStatus = {
+      brand: this.brand,
+      ...auth,
+      ...clientLogin === undefined ? {} : { clientLogin },
+    }
     // Trae's check-in state is part of the account reading; the other two
     // providers do not implement it, so this costs them nothing.
     const checkin = this.client.checkinStatus === undefined

package/src/api.ts

@@ -184,8 +184,20 @@ async function handleAccount(req: IncomingMessage, res: ServerResponse, adapters
     return
   }
 
-  // Trae and CodeArts have a daily reward; the other adapters reject the action,
-  // so the page can keep one button that simply reports the refusal.
+  // Trae's second sign-in method: the desktop client must already be logged in.
+  // The response is an ordinary account reading, so it never carries the token.
+  if (action === 'client-login') {
+    try {
+      send(res, 200, await adapter.importClientLogin())
+    } catch (error) {
+      send(res, 400, { error: error instanceof Error ? error.message : String(error) })
+    }
+    return
+  }
+
+  // Trae (client login only) and CodeArts have a daily reward; the other
+  // adapters reject the action, so the page can keep one button that simply
+  // reports the refusal.
   if (action === 'checkin') {
     try {
       send(res, 200, { brand, checkin: await adapter.claimCheckin() })
@@ -195,7 +207,7 @@ async function handleAccount(req: IncomingMessage, res: ServerResponse, adapters
     return
   }
 
-  send(res, 400, { error: 'action 只接受 browser、browser-cancel、checkin 或 logout' })
+  send(res, 400, { error: 'action 只接受 browser、browser-cancel、client-login、checkin 或 logout' })
 }
 
 export async function handleApi(

package/src/auth.ts

@@ -1,10 +1,11 @@
 /**
  * Credential state for every provider.
  *
- * Sign-in happens in the provider's own web page, so credentials exist in
- * exactly one place: the plugin's own account store. No desktop client file is
- * discovered, read, or written, and no token leaves this module in errors or
- * display fields.
+ * Sign-in happens in the provider's own web page. Trae additionally offers an
+ * explicit, read-only import of the local desktop client's login state; nothing
+ * is ever written back to that client. Either way credentials end up in exactly
+ * one place, the plugin's own account store, and no token leaves this module in
+ * errors or display fields.
  *
  * @module dsh-llm-adapters/auth
  */
@@ -34,6 +35,8 @@ export interface AuthStatus {
   possiblyExpired?: boolean
   account?: LocalAccount
   error?: string
+  /** Trae only: where the token came from. */
+  loginSource?: 'web' | 'client'
 }
 
 /** Expiry margin for Raccoon's JWT, so a call does not start on a dead token. */
@@ -261,12 +264,13 @@ function mergeSetCookies(current: string, headers: readonly string[]): string {
 }
 
 /**
- * Trae's web login, one per region.
+ * Trae's login, one per region.
  *
- * The `Cloud-IDE-JWT` the website issues lives about eight hours, but the
- * website session behind it lives about fourteen days. The cookies captured at
- * sign-in are replayed against `GetUserToken` to renew the short token silently;
- * only when the session itself dies does the user have to sign in again.
+ * A web login stores the `Cloud-IDE-JWT` from the website plus the cookies
+ * behind it, so the short token can be renewed silently until the website
+ * session dies. A client login stores the token the desktop client already
+ * uses; that token has no website session, and the client itself refreshes it.
+ * Only the client source carries the device id the check-in route accepts.
  */
 export class TraeAuth {
   private readonly inflight = new Map<TraeRegion, Promise<string>>()
@@ -286,20 +290,41 @@ export class TraeAuth {
     const region = this.region()
     const stored = await this.store.trae(region)
     if (stored === undefined) {
-      return { signedIn: false, error: `${traeLabel(region)}尚未登录。请在设置页点「打开浏览器登录」。` }
+      return {
+        signedIn: false,
+        error: `${traeLabel(region)}尚未登录。可以点「打开浏览器登录」，或复用本机已登录的 Trae 客户端。`,
+      }
     }
+    const source = stored.source ?? 'web'
     const now = Date.now()
     const { token, session } = traeExpiries(stored)
     const tokenExpired = token !== undefined && token <= now + TRAE_EXPIRY_MARGIN_MS
+    const account = traeAccount(stored)
+    if (source === 'client') {
+      // The client owns the refresh loop; when its token dies the user signs in
+      // there again and imports the new state.
+      const signedIn = !tokenExpired
+      return {
+        signedIn,
+        loginSource: 'client',
+        loginAt: stored.loginAt,
+        ...token === undefined ? {} : { expiresAt: token },
+        ...!signedIn ? { possiblyExpired: true } : {},
+        ...Object.keys(account).length === 0 ? {} : { account },
+        ...!signedIn
+          ? { error: `${traeLabel(region)}客户端登录令牌已过期，请先在 Trae 客户端重新登录，再点「复用客户端登录态」。` }
+          : {},
+      }
+    }
     const sessionExpired = session !== undefined && session <= now + TRAE_EXPIRY_MARGIN_MS
     const refreshable = stored.cookies !== undefined && !sessionExpired
     const signedIn = !tokenExpired || refreshable
-    const account = traeAccount(stored)
     // With a renewable session the user cares about the website-session
     // deadline, not the eight-hour JWT the plugin replaces on its own.
     const expiresAt = refreshable ? session ?? token : token
     return {
       signedIn,
+      loginSource: 'web',
       loginAt: stored.loginAt,
       ...expiresAt === undefined ? {} : { expiresAt },
       ...!signedIn ? { possiblyExpired: true } : {},
@@ -315,17 +340,23 @@ export class TraeAuth {
   /**
    * The bearer token, or an actionable error when there is none.
    *
-   * A token near its expiry is renewed first; `force` means the gateway already
-   * rejected it, so the renewal is attempted even if the clock disagrees.
+   * A web token near its expiry is renewed first; `force` means the gateway
+   * already rejected it, so the renewal is attempted even if the clock
+   * disagrees. A client token is returned until its own expiry and then asks
+   * for a fresh import, because only the client can refresh it.
    */
   async accessToken(force = false): Promise<string> {
     const region = this.region()
     const stored = await this.store.trae(region)
     if (stored === undefined) {
-      throw new Error(`${traeLabel(region)}尚未登录。请在设置页点「打开浏览器登录」。`)
+      throw new Error(`${traeLabel(region)}尚未登录。可以点「打开浏览器登录」，或复用本机已登录的 Trae 客户端。`)
     }
     const { token, session } = traeExpiries(stored)
     const expired = token !== undefined && token <= Date.now() + TRAE_EXPIRY_MARGIN_MS
+    if (stored.source === 'client') {
+      if (!force && !expired) return stored.accessToken
+      throw new Error(`${traeLabel(region)}客户端登录令牌已${force ? '失效' : '过期'}，请先在 Trae 客户端重新登录，再点「复用客户端登录态」。`)
+    }
     if (!force && !expired) return stored.accessToken
     if (stored.cookies === undefined) {
       throw new Error(`${traeLabel(region)}登录已${force ? '失效' : '过期'}，请在设置页重新登录。`)
@@ -342,7 +373,7 @@ export class TraeAuth {
     if (existing !== undefined) return existing
     const task = (async () => {
       const stored = await this.store.trae(region)
-      if (stored === undefined || stored.cookies === undefined) {
+      if (stored === undefined || stored.source === 'client' || stored.cookies === undefined) {
         throw new Error(`${traeLabel(region)}登录已失效，请在设置页重新登录。`)
       }
       const profile = TRAE_REGION_PROFILES[region]
@@ -408,7 +439,7 @@ export class TraeAuth {
     const region = this.region()
     const stored = await this.store.trae(region)
     if (stored === undefined) {
-      throw new Error(`${traeLabel(region)}尚未登录。请在设置页点「打开浏览器登录」。`)
+      throw new Error(`${traeLabel(region)}尚未登录。可以点「打开浏览器登录」，或复用本机已登录的 Trae 客户端。`)
     }
     return {
       deviceId: stored.deviceId,