dsh-llm-adapters 1.2.0 → 1.2.1

package/src/index.ts

@@ -104,8 +104,8 @@ export {
   RaccoonProvider, RACCOON_BASE, RACCOON_CLIENT_VERSION, raccoonAccessTokenValid, raccoonRefreshCandidate,
 } from './raccoon.ts'
 export {
-  TraeProvider, TRAE_CHAT_FUNCTIONS, TRAE_DIRECTORY_FUNCTIONS, mergeTraeModels,
-  normalizeEffort, openTraeStream, parseTraeGlobalUsage, parseTraeRemoteModels,
+  TraeProvider, TRAE_CHAT_FUNCTIONS, TRAE_CHECKIN_REQ_SOURCE, TRAE_DIRECTORY_FUNCTIONS, mergeTraeModels,
+  normalizeEffort, openTraeStream, parseTraeCheckin, parseTraeGlobalUsage, parseTraeRemoteModels,
   parseTraeUsage, parseTraeWireModels, traeMessages, traeTools,
 } from './trae.ts'
 export type {
@@ -113,6 +113,8 @@ export type {
 } from './trae.ts'
 export { TRAE_APP_ID, TRAE_REGION_PROFILES, TRAE_SOLO_CHAT_PATH, TRAE_WEB_USER_AGENT } from './trae-endpoints.ts'
 export type { TraeRegionProfile } from './trae-endpoints.ts'
+export { parseTraeClientStorage, readTraeClientLogin, traeClientDataDirs } from './trae-client.ts'
+export type { TraeClientDetection, TraeClientLoginState, TraeClientReadOptions } from './trae-client.ts'
 export { TraeWebLogin, machineIdOf } from './trae-login.ts'
 export type { TraeLoginAccount, TraeWebLoginOptions } from './trae-login.ts'
 export {
@@ -143,7 +145,7 @@ export type { WireMessage } from './wire.ts'
 export { API_PREFIX, buildRows } from './api.ts'
 export { liveConfig, resolveConfig } from './config.ts'
 export type { Config as ConfigShape, LiveConfig, ParsedConfig, ResolvedConfig } from './config.ts'
-export type { CheckinStatus, ProviderStatus, QuotaPack, QuotaSnapshot } from './types.ts'
+export type { CheckinStatus, ClientLoginStatus, ProviderStatus, QuotaPack, QuotaSnapshot } from './types.ts'
 
 export const name = 'llm-adapters'
 export const inject = ['llm']

package/src/trae-client.ts

@@ -0,0 +1,312 @@
+/**
+ * The local Trae desktop client's sign-in state.
+ *
+ * Trae's check-in route insists on the device id its own client registered, so
+ * the website login cannot use it. When the client is installed and already
+ * signed in, the plugin can reuse that state instead:
+ *
+ *  - the `Cloud-IDE-JWT` stored under `iCubeAuthInfo://icube.cloudide`;
+ *  - the 16-digit device id encoded in the `iCubeAuthInfo://icube-dc:<id>` key;
+ *  - `telemetry.machineId`, the value the client sends as `x-machine-id`.
+ *
+ * The stored value uses the client's own AES-CBC envelope: six magic bytes, a
+ * 32-byte key material, then the ciphertext. The AES key and IV are derived
+ * from that key material with SHA-512 and a fixed salt, and the plaintext is a
+ * SHA-512 digest followed by the JSON document. Nothing here writes to the
+ * client, and the token is never returned by the settings API.
+ *
+ * @module dsh-llm-adapters/trae-client
+ */
+
+import { createDecipheriv, createHash } from 'node:crypto'
+import { existsSync, readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import type { TraeRegion } from './brand.ts'
+import type { ClientLoginStatus } from './types.ts'
+
+/** What the provider stores after importing a client login. */
+export interface TraeClientLoginState {
+  region: TraeRegion
+  token: string
+  deviceId: string
+  machineId: string
+  userId?: string
+  name?: string
+  expiresAt?: number
+}
+
+/** The settings-facing half (no token) plus the internal state when usable. */
+export interface TraeClientDetection {
+  status: ClientLoginStatus
+  state?: TraeClientLoginState
+}
+
+export interface TraeClientReadOptions {
+  platform?: NodeJS.Platform
+  env?: NodeJS.ProcessEnv
+  home?: string
+}
+
+const AUTH_PROVIDER_KEY = 'iCubeAuthInfo://icube.cloudide'
+const DEVICE_KEY_PREFIX = 'iCubeAuthInfo://icube-dc:'
+const MACHINE_KEY = 'telemetry.machineId'
+const SERVICE_MACHINE_KEY = 'storage.serviceMachineId'
+
+const AES_MAGIC = Buffer.from([0x74, 0x63, 0x05, 0x10, 0x00, 0x00])
+const AES_PRIVATE_MAGIC = Buffer.from([0x12, 0x39, 0x20, 0x20, 0x02, 0x03])
+const KEY_OFFSET = 6
+const KEY_LENGTH = 32
+const HASH_LENGTH = 64
+/** Aue ^ Due from the client's byteCrypto module. */
+const AES_SALT = Buffer.from(
+  '4dd4c2e6b83162090e52b3c7a6733ba41cb2462b829ab58a196b39db57177524'
+  + 'f49baf7f08e8d68d26a72e37c1a95a2f1f05a51892aef2949732b62a38aadd58',
+  'hex',
+)
+/** Tue ^ Iue, the AES_PRIVATE variant of the same envelope. */
+const AES_PRIVATE_SALT = Buffer.from(
+  '490cc21292b05d0cc06ccbe91fb92e21b5a7c538811dc85e27a96e28104e1cf6'
+  + '9c7166efab232807390da78a8b91e49c44b49a43feb941a1e46f2656e613e47b',
+  'hex',
+)
+const DEVICE_RE = /^\d{16}$/
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined
+}
+
+function text(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined
+}
+
+/** Accept epoch seconds, epoch milliseconds, or an ISO date. */
+function epochMs(value: unknown): number | undefined {
+  if (typeof value === 'number' && Number.isFinite(value) && value > 0) {
+    return value < 1e12 ? Math.round(value * 1_000) : Math.round(value)
+  }
+  if (typeof value === 'string') {
+    if (/^\d+$/.test(value.trim())) return epochMs(Number(value))
+    const parsed = Date.parse(value)
+    return Number.isFinite(parsed) ? parsed : undefined
+  }
+  return undefined
+}
+
+function jwtExpiry(token: string): number | undefined {
+  const parts = token.split('.')
+  if (parts.length < 2) return undefined
+  try {
+    const base64 = parts[1]!.replace(/-/g, '+').replace(/_/g, '/')
+    const padded = base64 + '='.repeat((4 - base64.length % 4) % 4)
+    const payload: unknown = JSON.parse(Buffer.from(padded, 'base64').toString('utf8'))
+    return epochMs(record(payload)?.exp)
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Open one `iCubeAuthInfo` value.
+ *
+ * The digest check is the client's own integrity check: the first 64 plaintext
+ * bytes are SHA-512 of the document that follows. A malformed or changed
+ * envelope is rejected instead of being parsed as garbage.
+ */
+function decryptAuthValue(value: string): unknown {
+  const bytes = Buffer.from(value, 'base64')
+  if (bytes.length < KEY_OFFSET + KEY_LENGTH + HASH_LENGTH) {
+    throw new Error('数据长度不足')
+  }
+  const magic = bytes.subarray(0, KEY_OFFSET)
+  const salt = magic.equals(AES_MAGIC)
+    ? AES_SALT
+    : magic.equals(AES_PRIVATE_MAGIC) ? AES_PRIVATE_SALT : undefined
+  if (salt === undefined) throw new Error('未知的加密格式')
+  const keyMaterial = bytes.subarray(KEY_OFFSET, KEY_OFFSET + KEY_LENGTH)
+  const mixed = createHash('sha512').update(keyMaterial).digest()
+  const derived = createHash('sha512').update(Buffer.concat([mixed, salt])).digest()
+  const decipher = createDecipheriv(
+    'aes-128-cbc',
+    derived.subarray(0, 16),
+    derived.subarray(16, 32),
+  )
+  const plain = Buffer.concat([
+    decipher.update(bytes.subarray(KEY_OFFSET + KEY_LENGTH)),
+    decipher.final(),
+  ])
+  if (plain.length < HASH_LENGTH) throw new Error('解密结果为空')
+  const body = plain.subarray(HASH_LENGTH)
+  const digest = createHash('sha512').update(body).digest()
+  if (!digest.equals(plain.subarray(0, HASH_LENGTH))) throw new Error('校验失败')
+  return JSON.parse(body.toString('utf8'))
+}
+
+/**
+ * The client's data directory, most specific first.
+ *
+ * `DSH_TRAE_CLIENT_DIR` is a portable/test override; the region-specific
+ * variables let one machine keep separate CN and international installs.
+ */
+export function traeClientDataDirs(
+  region: TraeRegion,
+  options: TraeClientReadOptions = {},
+): string[] {
+  const platform = options.platform ?? process.platform
+  const env = options.env ?? process.env
+  const home = options.home ?? homedir()
+  const name = region === 'cn' ? 'Trae CN' : 'Trae'
+  const out: string[] = []
+  const add = (directory: string | undefined): void => {
+    if (directory !== undefined && directory !== '') out.push(directory)
+  }
+  add(env[region === 'cn' ? 'DSH_TRAE_CN_CLIENT_DIR' : 'DSH_TRAE_GLOBAL_CLIENT_DIR'])
+  add(env['DSH_TRAE_CLIENT_DIR'])
+  if (platform === 'win32') {
+    const appData = env['APPDATA'] ?? join(home, 'AppData', 'Roaming')
+    add(join(appData, name))
+  } else if (platform === 'darwin') {
+    add(join(home, 'Library', 'Application Support', name))
+  } else {
+    const config = env['XDG_CONFIG_HOME'] ?? join(home, '.config')
+    add(join(config, name))
+  }
+  return [...new Set(out)]
+}
+
+function storageFile(userDataDir: string): string {
+  return join(userDataDir, 'User', 'globalStorage', 'storage.json')
+}
+
+function authValueOf(storage: Record<string, unknown>): string | undefined {
+  const direct = text(storage[AUTH_PROVIDER_KEY])
+  if (direct !== undefined) return direct
+  for (const key of Object.keys(storage)) {
+    if (key.startsWith('iCubeAuthInfo://') && key.endsWith('.cloudide')) {
+      const value = text(storage[key])
+      if (value !== undefined) return value
+    }
+  }
+  return undefined
+}
+
+/** The client has one device id per machine; the last valid key is current. */
+function deviceIdOf(storage: Record<string, unknown>): string | undefined {
+  const keys = Object.keys(storage).filter(key => key.startsWith(DEVICE_KEY_PREFIX))
+  for (let index = keys.length - 1; index >= 0; index--) {
+    const value = text(keys[index]!.slice(DEVICE_KEY_PREFIX.length))
+    if (value !== undefined && DEVICE_RE.test(value)) return value
+  }
+  return undefined
+}
+
+function regionMismatch(region: TraeRegion, userInfo: Record<string, unknown>): boolean {
+  const account = record(userInfo.account)
+  const userRegion = record(userInfo.userRegion)
+  const evidence = (text(userRegion?.region) ?? text(account?.storeRegion))?.toUpperCase()
+  if (evidence === undefined) return false
+  return region === 'cn' ? evidence !== 'CN' : evidence === 'CN'
+}
+
+/** Parse one `storage.json` document; exported for tests and diagnostics. */
+export function parseTraeClientStorage(
+  region: TraeRegion,
+  storage: Record<string, unknown>,
+): TraeClientDetection {
+  const encrypted = authValueOf(storage)
+  if (encrypted === undefined) {
+    return {
+      status: {
+        available: true,
+        signedIn: false,
+        error: '本机 Trae 客户端尚未登录。请先在客户端完成登录。',
+      },
+    }
+  }
+  let parsed: unknown
+  try {
+    parsed = decryptAuthValue(encrypted)
+  } catch (error) {
+    return {
+      status: {
+        available: true,
+        signedIn: false,
+        error: `读取本机 Trae 客户端登录态失败：${error instanceof Error ? error.message : String(error)}`,
+      },
+    }
+  }
+  const userInfo = record(parsed)
+  const token = text(userInfo?.token)
+  if (userInfo === undefined || token === undefined) {
+    return {
+      status: {
+        available: true,
+        signedIn: false,
+        error: '本机 Trae 客户端登录态里没有令牌，请先在客户端重新登录。',
+      },
+    }
+  }
+  const account = record(userInfo.account)
+  const name = text(account?.username) ?? text(account?.name)
+  const userId = text(userInfo.userId)
+  const expiresAt = epochMs(userInfo.expiredAt) ?? jwtExpiry(token)
+  const identity = {
+    ...name === undefined ? {} : { name },
+    ...userId === undefined ? {} : { userId },
+    ...expiresAt === undefined ? {} : { expiresAt },
+  }
+  const unavailable = (error: string): TraeClientDetection => ({
+    status: { available: true, signedIn: false, ...identity, error },
+  })
+  if (regionMismatch(region, userInfo)) {
+    return unavailable(region === 'cn'
+      ? '本机 Trae 客户端登录的是国际版账号，请切换到国际版后再复用。'
+      : '本机 Trae 客户端登录的是国内版账号，请切换到国内版后再复用。')
+  }
+  if (expiresAt !== undefined && expiresAt <= Date.now()) {
+    return unavailable('本机 Trae 客户端登录已过期，请先在客户端重新登录。')
+  }
+  const deviceId = deviceIdOf(storage)
+  if (deviceId === undefined) {
+    return unavailable('本机 Trae 客户端登录缺少 16 位设备号，请先在客户端重新登录。')
+  }
+  const machineId = text(storage[MACHINE_KEY]) ?? text(storage[SERVICE_MACHINE_KEY])
+  if (machineId === undefined) {
+    return unavailable('本机 Trae 客户端登录缺少机器码，请先在客户端重新登录。')
+  }
+  return {
+    status: { available: true, signedIn: true, ...identity },
+    state: { region, token, deviceId, machineId, ...identity },
+  }
+}
+
+/** Read the currently selected region's client state from this machine. */
+export function readTraeClientLogin(
+  region: TraeRegion,
+  options: TraeClientReadOptions = {},
+): TraeClientDetection {
+  let available = false
+  let error: string | undefined
+  for (const directory of traeClientDataDirs(region, options)) {
+    const file = storageFile(directory)
+    if (!existsSync(file)) continue
+    available = true
+    try {
+      const raw = readFileSync(file, 'utf8').replace(/^\uFEFF/, '')
+      const storage = record(JSON.parse(raw))
+      if (storage === undefined) throw new Error('storage.json 不是对象')
+      return parseTraeClientStorage(region, storage)
+    } catch (cause) {
+      error = `读取本机 Trae 客户端登录态失败：${cause instanceof Error ? cause.message : String(cause)}`
+    }
+  }
+  return {
+    status: {
+      available,
+      signedIn: false,
+      ...error === undefined ? {} : { error },
+    },
+  }
+}

package/src/trae-endpoints.ts

@@ -35,6 +35,8 @@ export interface TraeRegionProfile {
    * the dollar allowance instead.
    */
   usageV2: boolean
+  /** Daily check-in exists only on the mainland deployment. */
+  checkin: boolean
 }
 
 export const TRAE_REGION_PROFILES: Record<TraeRegion, TraeRegionProfile> = {
@@ -49,6 +51,7 @@ export const TRAE_REGION_PROFILES: Record<TraeRegion, TraeRegionProfile> = {
     timezone: 'Asia/Shanghai',
     language: 'zh-cn',
     usageV2: true,
+    checkin: true,
   },
   global: {
     id: 'global',
@@ -61,6 +64,7 @@ export const TRAE_REGION_PROFILES: Record<TraeRegion, TraeRegionProfile> = {
     timezone: 'Asia/Singapore',
     language: 'en',
     usageV2: false,
+    checkin: false,
   },
 }
 

package/src/trae-login.ts

@@ -1,15 +1,17 @@
 /**
  * Trae sign-in through the provider's own website.
  *
- * The plugin does not read a desktop install: it opens a dedicated browser
+ * This flow does not read a desktop install: it opens a dedicated browser
  * profile, lets the user sign in on trae.cn / trae.ai, and then takes the
  * session the website itself created. Two things come out of that session:
  *
  *  - the `Cloud-IDE-JWT` token, fetched with the page's own cookies through
  *    `/cloudide/api/v3/common/GetUserToken` — the same call the site makes;
  *  - the device fingerprint (`__msuuid__` from the page, or one generated in
- *    the page), which Trae's check-in route requires and which therefore must
- *    belong to this web session rather than to a machine install.
+ *    the page), stored with the web login.
+ *
+ * The check-in route does not accept this web fingerprint, so check-in is
+ * enabled only for the separate client-login import in `trae-client.ts`.
  *
  * Cookies are captured over the DevTools protocol and kept in the plugin's own
  * account store so the short-lived JWT can be renewed later; the dedicated

package/src/trae.ts

@@ -1,8 +1,10 @@
 /**
- * Trae provider: model directory, SOLO chat and quota.
+ * Trae provider: model directory, SOLO chat, quota and client check-in.
  *
  * Trae's website login yields the same `Cloud-IDE-JWT` its own clients use, so
- * the plugin talks to the same gateways they do. Two catalog sources are merged:
+ * the plugin talks to the same gateways they do. A second sign-in method copies
+ * that token from the local desktop client; only that method carries the device
+ * id the daily check-in route accepts. Two catalog sources are merged:
  *
  *  - the Remote directory (`/api/remote/v1/models`) is the model skeleton —
  *    display name, context window, multiplier, reasoning options, multimodal;
@@ -44,9 +46,11 @@ import {
   TRAE_APP_ID, TRAE_REGION_PROFILES, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_MODELS_PATH, TRAE_VERSION_CODE,
   TRAE_WEB_USER_AGENT,
 } from './trae-endpoints.ts'
+import { readTraeClientLogin } from './trae-client.ts'
+import type { TraeClientDetection } from './trae-client.ts'
 import { TraeWebLogin } from './trae-login.ts'
 import type { TraeLoginAccount } from './trae-login.ts'
-import type { QuotaPack, QuotaSnapshot } from './types.ts'
+import type { CheckinStatus, ClientLoginStatus, QuotaPack, QuotaSnapshot } from './types.ts'
 import { ProviderHttpError, buildMessages } from './wire.ts'
 import type { ReadImage, WireMessage } from './wire.ts'
 
@@ -181,6 +185,8 @@ export interface TraeProviderOptions {
   logger?: (message: string) => void
   /** The shared OpenRouter snapshot; a private one is created when omitted. */
   openRouter?: OpenRouterLookup
+  /** Overridable in tests; defaults to reading this machine's Trae client. */
+  clientLogin?: () => TraeClientDetection
 }
 
 function record(value: unknown): Record<string, unknown> | undefined {
@@ -895,6 +901,26 @@ export function parseTraeGlobalUsage(payload: unknown): QuotaSnapshot {
   }
 }
 
+/**
+ * The check-in body's `req_source`: 1 is the IDE, 2 is Trae Work. The desktop
+ * client sends 1; the claim route rejects the plugin's former empty body.
+ */
+export const TRAE_CHECKIN_REQ_SOURCE = 1
+
+export function parseTraeCheckin(payload: unknown): CheckinStatus {
+  const root = record(payload) ?? {}
+  // `extra_credits` is a campaign bonus the site does not add to the daily
+  // reward; summing it made the card promise 200 when the check-in pays 100.
+  const reward = num(root.credits) ?? 0
+  return {
+    available: root.enable !== false,
+    claimed: root.checked_in === true,
+    deviceClaimed: root.did_checked_in === true,
+    ...reward === 0 ? {} : { reward },
+    ...text(root.message) === undefined ? {} : { message: text(root.message)! },
+  }
+}
+
 export class TraeProvider {
   private catalogInstance: ModelCatalog
   private catalogRegion: TraeRegion
@@ -1142,6 +1168,167 @@ export class TraeProvider {
     return this.quotaInflight
   }
 
+  /**
+   * The second sign-in method: the desktop client's current state.
+   *
+   * Read-only; the settings page only receives the non-secret status, never
+   * the token.
+   */
+  async localClientLogin(): Promise<ClientLoginStatus> {
+    return this.readClientLogin().status
+  }
+
+  private readClientLogin(): TraeClientDetection {
+    return (this.options.clientLogin ?? (() => readTraeClientLogin(this.options.region())))()
+  }
+
+  /** Import the desktop client's token, device id and machine id. */
+  async importClientLogin(): Promise<void> {
+    const region = this.ensureRegion()
+    const detection = this.readClientLogin()
+    if (!detection.status.available) {
+      throw new Error('本机没有检测到 Trae 客户端。请先安装并登录客户端，或改用网页登录。')
+    }
+    const state = detection.state
+    if (!detection.status.signedIn || state === undefined) {
+      throw new Error(detection.status.error ?? '本机 Trae 客户端尚未登录。请先在客户端完成登录。')
+    }
+    // A browser flow that is still running would save its own account after
+    // this import, so cancel it before replacing the record.
+    await this.loginFlow?.cancel()
+    await this.options.store.saveTrae({
+      accessToken: state.token,
+      region,
+      source: 'client',
+      deviceId: state.deviceId,
+      machineId: state.machineId,
+      loginAt: Date.now(),
+      ...state.userId === undefined ? {} : { userId: state.userId },
+      ...state.name === undefined ? {} : { name: state.name },
+      ...state.expiresAt === undefined ? {} : { expiresAt: state.expiresAt },
+    })
+    this.invalidateModels()
+    this.invalidateQuota()
+  }
+
+  private async checkinContext(): Promise<
+    | { ok: true, profile: TraeRegionProfile, token: string, identity: { deviceId: string, machineId: string } }
+    | { ok: false, status: CheckinStatus }
+  > {
+    this.ensureRegion()
+    const profile = this.profile()
+    if (!profile.checkin) {
+      return {
+        ok: false,
+        status: {
+          available: false, claimed: false, deviceClaimed: false,
+          message: 'Trae 国际版没有签到活动。',
+        },
+      }
+    }
+    const auth = await this.options.auth.status()
+    if (!auth.signedIn) {
+      return {
+        ok: false,
+        status: {
+          available: false, claimed: false, deviceClaimed: false,
+          message: auth.error ?? '尚未登录，无法签到。',
+        },
+      }
+    }
+    if (auth.loginSource !== 'client') {
+      return {
+        ok: false,
+        status: {
+          available: false, claimed: false, deviceClaimed: false,
+          message: '签到仅在复用本机 Trae 客户端登录时可用；网页登录没有客户端设备号。',
+        },
+      }
+    }
+    let token: string
+    let identity: { deviceId: string, machineId: string }
+    try {
+      token = await this.options.auth.accessToken()
+      identity = await this.options.auth.identity()
+    } catch (error) {
+      return {
+        ok: false,
+        status: {
+          available: false, claimed: false, deviceClaimed: false,
+          message: error instanceof Error ? error.message : String(error),
+        },
+      }
+    }
+    if (!/^\d{16}$/.test(identity.deviceId)) {
+      return {
+        ok: false,
+        status: {
+          available: false, claimed: false, deviceClaimed: false,
+          message: '本机 Trae 客户端登录缺少 16 位设备号，请先在客户端重新登录后再复用。',
+        },
+      }
+    }
+    return {
+      ok: true,
+      profile,
+      token,
+      identity: { deviceId: identity.deviceId, machineId: identity.machineId },
+    }
+  }
+
+  async checkinStatus(): Promise<CheckinStatus> {
+    const context = await this.checkinContext()
+    if (!context.ok) return context.status
+    const response = await this.fetchImpl(`${context.profile.apiBase}/trae/api/v2/ug/checkin_credits/status`, {
+      method: 'POST',
+      headers: {
+        ...this.headers(context.token, context.profile),
+        'x-user-region': 'CN',
+        'x-device-id': context.identity.deviceId,
+        'x-machine-id': context.identity.machineId,
+      },
+      body: JSON.stringify({ req_source: TRAE_CHECKIN_REQ_SOURCE }),
+      signal: AbortSignal.timeout(this.options.timeoutMs()),
+    })
+    if (!response.ok) throw new ProviderHttpError(await responseError(response), response.status)
+    return parseTraeCheckin(await response.json())
+  }
+
+  /** Claim today's reward. The only state-changing call in this provider. */
+  async claimCheckin(): Promise<CheckinStatus> {
+    const context = await this.checkinContext()
+    if (!context.ok) throw new Error(context.status.message ?? '当前登录方式不能签到。')
+    const response = await this.fetchImpl(`${context.profile.apiBase}/trae/api/v2/ug/checkin_credits/claim`, {
+      method: 'POST',
+      headers: {
+        ...this.headers(context.token, context.profile),
+        'x-user-region': 'CN',
+        'x-device-id': context.identity.deviceId,
+        'x-machine-id': context.identity.machineId,
+      },
+      body: JSON.stringify({ req_source: TRAE_CHECKIN_REQ_SOURCE }),
+      signal: AbortSignal.timeout(this.options.timeoutMs()),
+    })
+    if (!response.ok) throw new ProviderHttpError(await responseError(response), response.status)
+    const payload = record(await response.json()) ?? {}
+    const code = typeof payload.code === 'number' ? payload.code : 0
+    if (code === 0) {
+      this.invalidateQuota()
+      const reward = num(payload.credits)
+      return {
+        available: true,
+        claimed: true,
+        deviceClaimed: false,
+        ...reward === undefined || reward === 0 ? {} : { reward },
+        ...text(payload.message) === undefined ? {} : { message: text(payload.message)! },
+      }
+    }
+    if (code === 9095) {
+      return { available: true, claimed: false, deviceClaimed: true, message: '本机今日已签到' }
+    }
+    throw new Error(text(payload.message) ?? `签到失败（code ${code}）`)
+  }
+
   async *stream(
     options: GenerateOptions,
     model: string,
@@ -1218,6 +1405,7 @@ export class TraeProvider {
         await this.options.store.saveTrae({
           accessToken: account.accessToken,
           region: target,
+          source: 'web',
           deviceId: account.deviceId,
           machineId: account.machineId,
           loginAt: Date.now(),

package/src/types.ts

@@ -58,6 +58,23 @@ export interface CheckinStatus {
   url?: string
 }
 
+/**
+ * The local Trae client's state, as shown on the settings page.
+ *
+ * Never carries the token: only whether the client was found, whether a usable
+ * login was read, and the non-secret account fields.
+ */
+export interface ClientLoginStatus {
+  /** A Trae client data directory exists on this machine. */
+  available: boolean
+  /** The stored login is present, unexpired and usable. */
+  signedIn: boolean
+  name?: string
+  userId?: string
+  expiresAt?: number
+  error?: string
+}
+
 export interface ProviderStatus extends AuthStatus {
   brand: BrandId
   /** Trae only: the region this reading belongs to. */
@@ -65,7 +82,9 @@ export interface ProviderStatus extends AuthStatus {
   /** Present only after a successful quota read. */
   quota?: QuotaSnapshot
   quotaError?: string
-  /** Trae CN only. */
+  /** Trae only: the second sign-in method, when the desktop client exists. */
+  clientLogin?: ClientLoginStatus
+  /** Trae CN only, and only for a login imported from the client. */
   checkin?: CheckinStatus
 }