dsh-llm-adapters 1.2.0 → 1.2.2

package/lib/index.js

@@ -1,7 +1,7 @@
 import path, { dirname, join } from "node:path";
 import { LlmAdapter, attributionHeaders, offloadedImageText, requestImageHandleText } from "@deepseek-ai/dsh-llm";
 import { existsSync, mkdirSync, mkdtempSync, promises, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { createHash, createHmac, createPrivateKey, generateKeyPairSync, randomBytes, randomUUID, sign } from "node:crypto";
+import { createDecipheriv, createHash, createHmac, createPrivateKey, generateKeyPairSync, randomBytes, randomUUID, sign } from "node:crypto";
 import { homedir, tmpdir } from "node:os";
 import { isVolatile } from "@deepseek-ai/cosmokit";
 import z from "@deepseek-ai/schemastery";
@@ -485,6 +485,14 @@ var LocalAdapter = class extends LlmAdapter {
 		this.invalidateUsage();
 		return result;
 	}
+	/** Import a local client login and return the refreshed account reading. */
+	async importClientLogin() {
+		if (this.client.importClientLogin === void 0) throw new Error("该供应商不支持复用本机客户端登录");
+		await this.client.importClientLogin();
+		this.invalidateCatalog();
+		this.invalidateUsage();
+		return this.usageInfo(true);
+	}
 	invalidateCatalog() {
 		this.client.invalidateModels();
 	}
@@ -494,9 +502,15 @@ var LocalAdapter = class extends LlmAdapter {
 	/** Login state plus quota, shaped for the settings page. */
 	async usageInfo(fresh = false) {
 		const auth = await this.client.status();
+		const clientLogin = this.client.localClientLogin === void 0 ? void 0 : await this.client.localClientLogin().catch((error) => ({
+			available: false,
+			signedIn: false,
+			error: error instanceof Error ? error.message : String(error)
+		}));
 		const base = {
 			brand: this.brand,
-			...auth
+			...auth,
+			...clientLogin === void 0 ? {} : { clientLogin }
 		};
 		const checkin = this.client.checkinStatus === void 0 ? void 0 : await this.client.checkinStatus().catch(() => void 0);
 		const withCheckin = checkin === void 0 ? base : {
@@ -720,45 +734,48 @@ function defaultRoot() {
 	const base = dshHome !== void 0 && dshHome !== "" ? dshHome : path.join(homedir(), ".dsh");
 	return path.join(base, "llm-adapters");
 }
-function record$4(value) {
+function record$5(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function text$4(value) {
+function text$5(value) {
 	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function number(value) {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
 }
 function traeRecord(value, region) {
-	const raw = record$4(value);
-	const accessToken = text$4(raw?.accessToken);
+	const raw = record$5(value);
+	const accessToken = text$5(raw?.accessToken);
 	if (raw === void 0 || accessToken === void 0) return void 0;
+	const deviceId = text$5(raw.deviceId);
+	const source = raw.source === "web" || raw.source === "client" ? raw.source : void 0;
 	return {
 		accessToken,
 		region,
-		deviceId: text$4(raw.deviceId) ?? `web-${randomBytes(8).toString("hex")}`,
-		machineId: text$4(raw.machineId) ?? `web-${randomBytes(16).toString("hex")}`,
+		...source === void 0 ? {} : { source },
+		deviceId: deviceId ?? `web-${randomBytes(8).toString("hex")}`,
+		machineId: text$5(raw.machineId) ?? `web-${randomBytes(16).toString("hex")}`,
 		loginAt: number(raw.loginAt) ?? Date.now(),
-		...text$4(raw.userId) === void 0 ? {} : { userId: text$4(raw.userId) },
-		...text$4(raw.name) === void 0 ? {} : { name: text$4(raw.name) },
+		...text$5(raw.userId) === void 0 ? {} : { userId: text$5(raw.userId) },
+		...text$5(raw.name) === void 0 ? {} : { name: text$5(raw.name) },
 		...number(raw.expiresAt) === void 0 ? {} : { expiresAt: number(raw.expiresAt) },
-		...text$4(raw.cookies) === void 0 ? {} : { cookies: text$4(raw.cookies) },
+		...text$5(raw.cookies) === void 0 ? {} : { cookies: text$5(raw.cookies) },
 		...number(raw.sessionExpiresAt) === void 0 ? {} : { sessionExpiresAt: number(raw.sessionExpiresAt) }
 	};
 }
 function codeartsRecord(value) {
-	const raw = record$4(value);
-	const accessKeyId = text$4(raw?.accessKeyId);
-	const secretAccessKey = text$4(raw?.secretAccessKey);
-	const securityToken = text$4(raw?.securityToken);
+	const raw = record$5(value);
+	const accessKeyId = text$5(raw?.accessKeyId);
+	const secretAccessKey = text$5(raw?.secretAccessKey);
+	const securityToken = text$5(raw?.securityToken);
 	if (raw === void 0 || accessKeyId === void 0 || secretAccessKey === void 0 || securityToken === void 0) return;
-	const jwk = record$4(raw.dpopPrivateJwk);
-	const key = jwk !== void 0 && text$4(jwk.x) !== void 0 && text$4(jwk.y) !== void 0 && text$4(jwk.d) !== void 0 ? {
+	const jwk = record$5(raw.dpopPrivateJwk);
+	const key = jwk !== void 0 && text$5(jwk.x) !== void 0 && text$5(jwk.y) !== void 0 && text$5(jwk.d) !== void 0 ? {
 		kty: "EC",
 		crv: "P-256",
-		x: text$4(jwk.x),
-		y: text$4(jwk.y),
-		d: text$4(jwk.d)
+		x: text$5(jwk.x),
+		y: text$5(jwk.y),
+		d: text$5(jwk.d)
 	} : void 0;
 	const noBenefit = Array.isArray(raw.noBenefit) ? raw.noBenefit.filter((id) => typeof id === "string" && id.trim().length > 0).map((id) => id.trim()) : [];
 	return {
@@ -767,10 +784,11 @@ function codeartsRecord(value) {
 		securityToken,
 		loginAt: number(raw.loginAt) ?? Date.now(),
 		...number(raw.expiresAt) === void 0 ? {} : { expiresAt: number(raw.expiresAt) },
-		...text$4(raw.refreshToken) === void 0 ? {} : { refreshToken: text$4(raw.refreshToken) },
-		...text$4(raw.codeVerifier) === void 0 ? {} : { codeVerifier: text$4(raw.codeVerifier) },
+		...text$5(raw.refreshToken) === void 0 ? {} : { refreshToken: text$5(raw.refreshToken) },
+		...text$5(raw.codeVerifier) === void 0 ? {} : { codeVerifier: text$5(raw.codeVerifier) },
 		...key === void 0 ? {} : { dpopPrivateJwk: key },
-		...text$4(raw.userName) === void 0 ? {} : { userName: text$4(raw.userName) },
+		...text$5(raw.userName) === void 0 ? {} : { userName: text$5(raw.userName) },
+		...text$5(raw.otSessionId) === void 0 ? {} : { otSessionId: text$5(raw.otSessionId) },
 		...noBenefit.length === 0 ? {} : { noBenefit }
 	};
 }
@@ -794,30 +812,30 @@ var AccountStore = class {
 		} catch {
 			return {};
 		}
-		const raw = record$4(parsed);
+		const raw = record$5(parsed);
 		if (raw === void 0) return {};
 		const out = {};
-		const loomy = record$4(raw.loomy);
-		const loomySession = text$4(loomy?.session);
+		const loomy = record$5(raw.loomy);
+		const loomySession = text$5(loomy?.session);
 		if (loomySession !== void 0) out.loomy = {
 			session: loomySession,
-			deviceId: text$4(loomy?.deviceId) ?? `web-${randomBytes(8).toString("hex")}`,
+			deviceId: text$5(loomy?.deviceId) ?? `web-${randomBytes(8).toString("hex")}`,
 			loginAt: number(loomy?.loginAt) ?? Date.now(),
 			expiresAt: number(loomy?.expiresAt) ?? Date.now(),
-			...text$4(loomy?.userId) === void 0 ? {} : { userId: text$4(loomy?.userId) },
-			...text$4(loomy?.phone) === void 0 ? {} : { phone: text$4(loomy?.phone) },
-			...text$4(loomy?.name) === void 0 ? {} : { name: text$4(loomy?.name) }
+			...text$5(loomy?.userId) === void 0 ? {} : { userId: text$5(loomy?.userId) },
+			...text$5(loomy?.phone) === void 0 ? {} : { phone: text$5(loomy?.phone) },
+			...text$5(loomy?.name) === void 0 ? {} : { name: text$5(loomy?.name) }
 		};
-		const raccoon = record$4(raw.raccoon);
-		const access = text$4(raccoon?.accessToken);
+		const raccoon = record$5(raw.raccoon);
+		const access = text$5(raccoon?.accessToken);
 		if (access !== void 0) out.raccoon = {
 			accessToken: access,
 			loginAt: number(raccoon?.loginAt) ?? Date.now(),
-			...text$4(raccoon?.phone) === void 0 ? {} : { phone: text$4(raccoon?.phone) },
-			...text$4(raccoon?.name) === void 0 ? {} : { name: text$4(raccoon?.name) },
-			...text$4(raccoon?.ownerType) === void 0 ? {} : { ownerType: text$4(raccoon?.ownerType) }
+			...text$5(raccoon?.phone) === void 0 ? {} : { phone: text$5(raccoon?.phone) },
+			...text$5(raccoon?.name) === void 0 ? {} : { name: text$5(raccoon?.name) },
+			...text$5(raccoon?.ownerType) === void 0 ? {} : { ownerType: text$5(raccoon?.ownerType) }
 		};
-		const trae = record$4(raw.trae);
+		const trae = record$5(raw.trae);
 		if (trae !== void 0) {
 			const cn = traeRecord(trae.cn, "cn");
 			const global = traeRecord(trae.global, "global");
@@ -1051,6 +1069,14 @@ async function handleAccount(req, res, adapters) {
 		});
 		return;
 	}
+	if (action === "client-login") {
+		try {
+			send(res, 200, await adapter.importClientLogin());
+		} catch (error) {
+			send(res, 400, { error: error instanceof Error ? error.message : String(error) });
+		}
+		return;
+	}
 	if (action === "checkin") {
 		try {
 			send(res, 200, {
@@ -1062,7 +1088,7 @@ async function handleAccount(req, res, adapters) {
 		}
 		return;
 	}
-	send(res, 400, { error: "action 只接受 browser、browser-cancel、checkin 或 logout" });
+	send(res, 400, { error: "action 只接受 browser、browser-cancel、client-login、checkin 或 logout" });
 }
 async function handleApi(req, res, adapters, openRouter) {
 	try {
@@ -1400,6 +1426,18 @@ function readUserProfile(token) {
 		...domainId === void 0 ? {} : { domainId }
 	};
 }
+/**
+* The session id this account should chat under, derived from who the account is.
+*
+* 32 lowercase hex, the shape the IDE's own kernel sends. Nothing but stability
+* matters here — the gateway uses the value as a key, not as an identity — so it
+* is hashed from the principal id rather than kept in a file.
+*/
+function otSessionIdOf(profile) {
+	const seed = profile?.userId ?? profile?.userName;
+	if (seed === void 0) return void 0;
+	return createHash("sha256").update(`codearts-ot-session:${seed}`).digest("hex").slice(0, 32);
+}
 /** The portal URL the browser opens; the callback is on loopback. */
 function buildAuthorizeUrl(port, pkce, ticketId) {
 	return `${CODEARTS_PORTAL_AUTHORIZE}?theme=2&locale=zh-cn&uri_scheme=${CODEARTS_CLIENT_ID}&client_id=${CODEARTS_CLIENT_ID}&port=${port}&code_challenge=${pkce.codeChallenge}&code_challenge_method=SHA-256&ticket_id=${ticketId}&plugin-name=snap_AIIDE&plugin-version=5.2.0`;
@@ -1450,25 +1488,30 @@ async function exchangeRefreshToken(refreshToken, codeVerifier, keyPair, fetcher
 		grant_type: "refresh_token",
 		refresh_token: refreshToken
 	}, keyPair, fetcher), codeVerifier, keyPair);
-	const userName = credential.userName ?? readUserProfile(refreshToken)?.userName;
+	const previous = readUserProfile(refreshToken);
+	const userName = credential.userName ?? previous?.userName;
+	const otSessionId = credential.otSessionId ?? otSessionIdOf(previous);
 	return {
 		...credential,
 		refreshToken: credential.refreshToken ?? refreshToken,
-		...userName === void 0 ? {} : { userName }
+		...userName === void 0 ? {} : { userName },
+		...otSessionId === void 0 ? {} : { otSessionId }
 	};
 }
 function credentialFrom(token, codeVerifier, keyPair) {
 	const credentials = token.credentials ?? {};
 	const expiration = credentials.expiration;
 	const expiresAt = expiration === void 0 ? void 0 : Date.parse(expiration);
-	const userName = readUserProfile(token.refresh_token)?.userName;
+	const profile = readUserProfile(token.refresh_token);
+	const otSessionId = otSessionIdOf(profile);
 	return {
 		accessKeyId: credentials.access_key_id ?? "",
 		secretAccessKey: credentials.secret_access_key ?? "",
 		securityToken: credentials.security_token ?? "",
 		...expiresAt === void 0 || Number.isNaN(expiresAt) ? {} : { expiresAt },
 		...token.refresh_token === void 0 ? {} : { refreshToken: token.refresh_token },
-		...userName === void 0 ? {} : { userName },
+		...profile?.userName === void 0 ? {} : { userName: profile.userName },
+		...otSessionId === void 0 ? {} : { otSessionId },
 		codeVerifier,
 		dpopPrivateJwk: keyPair.privateKeyJwk
 	};
@@ -2080,7 +2123,8 @@ const TRAE_REGION_PROFILES = {
 		payBase: "https://api.trae.cn",
 		timezone: "Asia/Shanghai",
 		language: "zh-cn",
-		usageV2: true
+		usageV2: true,
+		checkin: true
 	},
 	global: {
 		id: "global",
@@ -2092,7 +2136,8 @@ const TRAE_REGION_PROFILES = {
 		payBase: "https://growsg-normal.trae.ai",
 		timezone: "Asia/Singapore",
 		language: "en",
-		usageV2: false
+		usageV2: false,
+		checkin: false
 	}
 };
 /** The app id Trae's own clients send; not account-specific. */
@@ -2197,7 +2242,8 @@ function decodeJwtFacts(token) {
 			...typeof record.name === "string" ? { name: record.name } : {},
 			...typeof record.phone === "string" ? { phone: record.phone } : {},
 			...typeof record.owner_type === "string" ? { ownerType: record.owner_type } : {},
-			...typeof record.sid === "string" ? { sessionId: record.sid } : {}
+			...typeof record.sid === "string" ? { sessionId: record.sid } : {},
+			...typeof record.sub === "string" ? { subject: record.sub } : {}
 		};
 	} catch {
 		return {};
@@ -2298,12 +2344,13 @@ function mergeSetCookies(current, headers) {
 	return [...jar.entries()].map(([name, value]) => `${name}=${value}`).join("; ");
 }
 /**
-* Trae's web login, one per region.
+* Trae's login, one per region.
 *
-* The `Cloud-IDE-JWT` the website issues lives about eight hours, but the
-* website session behind it lives about fourteen days. The cookies captured at
-* sign-in are replayed against `GetUserToken` to renew the short token silently;
-* only when the session itself dies does the user have to sign in again.
+* A web login stores the `Cloud-IDE-JWT` from the website plus the cookies
+* behind it, so the short token can be renewed silently until the website
+* session dies. A client login stores the token the desktop client already
+* uses; that token has no website session, and the client itself refreshes it.
+* Only the client source carries the device id the check-in route accepts.
 */
 var TraeAuth = class {
 	store;
@@ -2324,18 +2371,32 @@ var TraeAuth = class {
 		const stored = await this.store.trae(region);
 		if (stored === void 0) return {
 			signedIn: false,
-			error: `${traeLabel(region)}尚未登录。请在设置页点「打开浏览器登录」。`
+			error: `${traeLabel(region)}尚未登录。可以点「打开浏览器登录」，或复用本机已登录的 Trae 客户端。`
 		};
+		const source = stored.source ?? "web";
 		const now = Date.now();
 		const { token, session } = traeExpiries(stored);
 		const tokenExpired = token !== void 0 && token <= now + TRAE_EXPIRY_MARGIN_MS;
+		const account = traeAccount(stored);
+		if (source === "client") {
+			const signedIn = !tokenExpired;
+			return {
+				signedIn,
+				loginSource: "client",
+				loginAt: stored.loginAt,
+				...token === void 0 ? {} : { expiresAt: token },
+				...!signedIn ? { possiblyExpired: true } : {},
+				...Object.keys(account).length === 0 ? {} : { account },
+				...!signedIn ? { error: `${traeLabel(region)}客户端登录令牌已过期，请先在 Trae 客户端重新登录，再点「复用客户端登录态」。` } : {}
+			};
+		}
 		const sessionExpired = session !== void 0 && session <= now + TRAE_EXPIRY_MARGIN_MS;
 		const refreshable = stored.cookies !== void 0 && !sessionExpired;
 		const signedIn = !tokenExpired || refreshable;
-		const account = traeAccount(stored);
 		const expiresAt = refreshable ? session ?? token : token;
 		return {
 			signedIn,
+			loginSource: "web",
 			loginAt: stored.loginAt,
 			...expiresAt === void 0 ? {} : { expiresAt },
 			...!signedIn ? { possiblyExpired: true } : {},
@@ -2346,15 +2407,21 @@ var TraeAuth = class {
 	/**
 	* The bearer token, or an actionable error when there is none.
 	*
-	* A token near its expiry is renewed first; `force` means the gateway already
-	* rejected it, so the renewal is attempted even if the clock disagrees.
+	* A web token near its expiry is renewed first; `force` means the gateway
+	* already rejected it, so the renewal is attempted even if the clock
+	* disagrees. A client token is returned until its own expiry and then asks
+	* for a fresh import, because only the client can refresh it.
 	*/
 	async accessToken(force = false) {
 		const region = this.region();
 		const stored = await this.store.trae(region);
-		if (stored === void 0) throw new Error(`${traeLabel(region)}尚未登录。请在设置页点「打开浏览器登录」。`);
+		if (stored === void 0) throw new Error(`${traeLabel(region)}尚未登录。可以点「打开浏览器登录」，或复用本机已登录的 Trae 客户端。`);
 		const { token, session } = traeExpiries(stored);
 		const expired = token !== void 0 && token <= Date.now() + TRAE_EXPIRY_MARGIN_MS;
+		if (stored.source === "client") {
+			if (!force && !expired) return stored.accessToken;
+			throw new Error(`${traeLabel(region)}客户端登录令牌已${force ? "失效" : "过期"}，请先在 Trae 客户端重新登录，再点「复用客户端登录态」。`);
+		}
 		if (!force && !expired) return stored.accessToken;
 		if (stored.cookies === void 0) throw new Error(`${traeLabel(region)}登录已${force ? "失效" : "过期"}，请在设置页重新登录。`);
 		if (session !== void 0 && session <= Date.now() + TRAE_EXPIRY_MARGIN_MS) throw new Error(`${traeLabel(region)}网页会话已过期，请重新登录。`);
@@ -2366,7 +2433,7 @@ var TraeAuth = class {
 		if (existing !== void 0) return existing;
 		const task = (async () => {
 			const stored = await this.store.trae(region);
-			if (stored === void 0 || stored.cookies === void 0) throw new Error(`${traeLabel(region)}登录已失效，请在设置页重新登录。`);
+			if (stored === void 0 || stored.source === "client" || stored.cookies === void 0) throw new Error(`${traeLabel(region)}登录已失效，请在设置页重新登录。`);
 			const profile = TRAE_REGION_PROFILES[region];
 			let response;
 			try {
@@ -2425,7 +2492,7 @@ var TraeAuth = class {
 	async identity() {
 		const region = this.region();
 		const stored = await this.store.trae(region);
-		if (stored === void 0) throw new Error(`${traeLabel(region)}尚未登录。请在设置页点「打开浏览器登录」。`);
+		if (stored === void 0) throw new Error(`${traeLabel(region)}尚未登录。可以点「打开浏览器登录」，或复用本机已登录的 Trae 客户端。`);
 		return {
 			deviceId: stored.deviceId,
 			machineId: stored.machineId,
@@ -2509,7 +2576,8 @@ var CodeArtsAuth = class {
 					securityToken: next.securityToken,
 					...next.expiresAt === void 0 ? {} : { expiresAt: next.expiresAt },
 					...next.refreshToken === void 0 ? {} : { refreshToken: next.refreshToken },
-					...next.userName === void 0 ? {} : { userName: next.userName }
+					...next.userName === void 0 ? {} : { userName: next.userName },
+					...next.otSessionId === void 0 ? {} : { otSessionId: next.otSessionId }
 				});
 				this.lastError = void 0;
 				return next;
@@ -2529,6 +2597,7 @@ var CodeArtsAuth = class {
 	}
 };
 function credentialOf(record) {
+	const otSessionId = record.otSessionId ?? otSessionIdOf(readUserProfile(record.refreshToken));
 	return {
 		accessKeyId: record.accessKeyId,
 		secretAccessKey: record.secretAccessKey,
@@ -2536,7 +2605,8 @@ function credentialOf(record) {
 		...record.expiresAt === void 0 ? {} : { expiresAt: record.expiresAt },
 		...record.refreshToken === void 0 ? {} : { refreshToken: record.refreshToken },
 		...record.codeVerifier === void 0 ? {} : { codeVerifier: record.codeVerifier },
-		...record.dpopPrivateJwk === void 0 ? {} : { dpopPrivateJwk: record.dpopPrivateJwk }
+		...record.dpopPrivateJwk === void 0 ? {} : { dpopPrivateJwk: record.dpopPrivateJwk },
+		...otSessionId === void 0 ? {} : { otSessionId }
 	};
 }
 // src/config.ts
@@ -2583,8 +2653,7 @@ const Config$1 = z.object({
 	defaultMaxTokens: z.number().step(1).min(1).default(32e3).description("模型目录未声明输出上限时使用的输出上限。").volatile(),
 	modelCacheTtlSeconds: z.number().step(1).min(10).max(86400).default(120).description("模型列表缓存时长（秒）。调小可更快看到账号侧变化。").volatile(),
 	catalogFetchTimeoutSeconds: z.number().step(1).min(1).max(300).default(20).description("读取模型目录、额度等请求的时限（秒）。").volatile(),
-	openRouterSyncMinutes: z.number().step(1).min(0).max(43200).default(60).description("OpenRouter 模型元数据的自动同步间隔（分钟）。0 表示关闭自动同步；缓存保存在本机，连不上时继续使用上次成功同步的数据。").volatile(),
-	raccoonCheckinMinutes: z.number().step(1).min(0).max(1440).default(30).description("小浣熊每日积分自动监测间隔（分钟）：到点核对积分流水，未到账时按网页方式尝试触发。0 表示关闭自动监测；「打开网页签到」入口始终保留。").volatile()
+	openRouterSyncMinutes: z.number().step(1).min(0).max(43200).default(60).description("OpenRouter 模型元数据的自动同步间隔（分钟）。0 表示关闭自动同步；缓存保存在本机，连不上时继续使用上次成功同步的数据。").volatile()
 });
 function liveConfig(config) {
 	const source = config ?? {};
@@ -2625,8 +2694,7 @@ function liveConfig(config) {
 		defaultMaxTokens: () => positive(field("defaultMaxTokens"), 32e3),
 		modelCacheTtlMs: () => positive(field("modelCacheTtlSeconds"), 120) * 1e3,
 		catalogFetchTimeoutMs: () => positive(field("catalogFetchTimeoutSeconds"), 20) * 1e3,
-		openRouterSyncMinutes: () => nonNegative(field("openRouterSyncMinutes"), 60),
-		raccoonCheckinMinutes: () => nonNegative(field("raccoonCheckinMinutes"), 30)
+		openRouterSyncMinutes: () => nonNegative(field("openRouterSyncMinutes"), 60)
 	};
 }
 function resolveConfig(config) {
@@ -2664,15 +2732,14 @@ function resolveConfig(config) {
 		defaultMaxTokens: live.defaultMaxTokens(),
 		modelCacheTtlMs: live.modelCacheTtlMs(),
 		catalogFetchTimeoutMs: live.catalogFetchTimeoutMs(),
-		openRouterSyncMinutes: live.openRouterSyncMinutes(),
-		raccoonCheckinMinutes: live.raccoonCheckinMinutes()
+		openRouterSyncMinutes: live.openRouterSyncMinutes()
 	};
 }
-function text$3(value) {
+function text$4(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
 function nonEmpty(value, fallback) {
-	const valueText = text$3(value);
+	const valueText = text$4(value);
 	return valueText.length > 0 ? valueText : fallback;
 }
 function positive(value, fallback) {
@@ -3008,117 +3075,6 @@ function headersForFetch(signed) {
 	}
 	return out;
 }
-// src/codearts-window.ts
-/**
-* The trial plan's chat budget.
-*
-* The gateway opens one "session" per chat request and allows **three per
-* rolling minute** for the whole account. The window is shared by every model,
-* it is not keyed by `session-id` (re-sending the same id does not buy a slot),
-* and a request rejected with `InferHub.4004.200` spends a slot just like a
-* successful one. Measured behaviour, three slots then a lockout:
-*
-* ```
-* t+0s   ok ok ok cap cap cap     burst of six
-* t+10s  cap                      …
-* t+51s  cap
-* t+61s  ok ok ok                 the burst ages out of the window
-* ```
-*
-* So a turn cannot be made to "go faster" by retrying: the only way a request
-* stops failing is to spend the budget deliberately — wait for the oldest start
-* to age out instead of firing into a wall. This class owns that bookkeeping and
-* is shared by every provider instance in the process, because a hot reload
-* must not reset the count the gateway still remembers.
-*
-* @module dsh-llm-adapters/codearts-window
-*/
-/** Sessions the trial plan allows inside one window. */
-const CODEARTS_SESSION_LIMIT = 3;
-/** How long a start keeps its slot. Measured: the burst frees at ~60 s. */
-const CODEARTS_SESSION_WINDOW_MS = 6e4;
-/** A little slack so a request never lands a few milliseconds early. */
-const MARGIN_MS = 1500;
-function sleep$2(ms, signal) {
-	return new Promise((resolve, reject) => {
-		if (signal?.aborted === true) {
-			reject(signal.reason instanceof Error ? signal.reason : /* @__PURE__ */ new Error("aborted"));
-			return;
-		}
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(signal?.reason instanceof Error ? signal.reason : /* @__PURE__ */ new Error("aborted"));
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
-}
-var CodeArtsSessionWindow = class {
-	limit;
-	windowMs;
-	now;
-	starts = [];
-	/** Serialises waiters so two callers cannot both take the last slot. */
-	tail = Promise.resolve();
-	constructor(limit = 3, windowMs = CODEARTS_SESSION_WINDOW_MS, now = Date.now) {
-		this.limit = limit;
-		this.windowMs = windowMs;
-		this.now = now;
-	}
-	/** Starts recorded inside the current window. */
-	get size() {
-		this.trim();
-		return this.starts.length;
-	}
-	/** Milliseconds until another start fits; `0` when the window has room. */
-	waitMs() {
-		this.trim();
-		if (this.starts.length < this.limit) return 0;
-		const oldest = this.starts[0] ?? 0;
-		return Math.max(0, this.windowMs - (this.now() - oldest));
-	}
-	/**
-	* Claim a slot, waiting for the window to roll over when it is full.
-	*
-	* The slot is recorded on return, not on completion: the gateway counts the
-	* start, and holds it for a fixed time whether the answer was short or long.
-	*/
-	async open(signal) {
-		const run = this.tail.then(async () => {
-			for (;;) {
-				const wait = this.waitMs();
-				if (wait === 0) {
-					const start = this.now();
-					this.starts.push(start);
-					return { release: () => {
-						const index = this.starts.indexOf(start);
-						if (index >= 0) this.starts.splice(index, 1);
-					} };
-				}
-				await sleep$2(wait + MARGIN_MS, signal);
-			}
-		});
-		this.tail = run.then(() => void 0, () => void 0);
-		return await run;
-	}
-	/** Forget every start (tests, and a fresh login on another account). */
-	reset() {
-		this.starts.length = 0;
-	}
-	trim() {
-		const now = this.now();
-		while (this.starts.length > 0 && now - (this.starts[0] ?? 0) >= this.windowMs) this.starts.shift();
-	}
-};
-let shared;
-/** The process-wide window; a plugin reload reuses it on purpose. */
-function sharedSessionWindow() {
-	shared ??= new CodeArtsSessionWindow();
-	return shared;
-}
 // src/openrouter.ts
 /**
 * Live capability lookup from OpenRouter's public model catalog.
@@ -3499,10 +3455,10 @@ function codeartsEfforts(live) {
 }
 /** Every level a CodeArts model can get: the fallback when the router is silent. */
 const CODEARTS_EFFORTS = codeartsEfforts();
-function record$3(value) {
+function record$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function text$2(value) {
+function text$3(value) {
 	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
 function num$1(value) {
@@ -3521,7 +3477,7 @@ function unwrapEnvelope(payload) {
 	const code = payload.code;
 	if (typeof code !== "number") return payload;
 	if (code !== 0) return void 0;
-	return record$3(payload.data);
+	return record$4(payload.data);
 }
 /** `deepseek-v4-flash-0731` → `deepseek-v4-flash`; chat only knows the latter. */
 function normalizeCodeArtsModelId(id) {
@@ -3537,21 +3493,21 @@ function normalizeCodeArtsModelId(id) {
 * how the upstream behaves when a model has no slots at all.
 */
 function pickActiveCredit(credit, slots, nowMs = Date.now()) {
-	const entries = credit.map((entry) => record$3(entry)).filter((entry) => entry !== void 0);
+	const entries = credit.map((entry) => record$4(entry)).filter((entry) => entry !== void 0);
 	if (entries.length === 0) return void 0;
-	const table = record$3(slots);
+	const table = record$4(slots);
 	if (table === void 0) return entries[0];
 	for (const entry of entries) {
-		const slotId = text$2(entry.time_slot_id);
+		const slotId = text$3(entry.time_slot_id);
 		if (slotId === void 0) continue;
-		const slot = record$3(table[slotId]);
+		const slot = record$4(table[slotId]);
 		if (slot === void 0) continue;
 		if (slotActive(slot, nowMs)) return entry;
 	}
 	return entries[0];
 }
 function slotActive(slot, nowMs) {
-	const schedule = text$2(slot.schedule);
+	const schedule = text$3(slot.schedule);
 	if (schedule === void 0) return false;
 	const parts = schedule.split(/\s+/);
 	if (parts.length < 3) return false;
@@ -3570,18 +3526,18 @@ function parseCodeArtsRoster(items, nowMs = Date.now()) {
 	const seen = /* @__PURE__ */ new Set();
 	const out = [];
 	for (const item of items) {
-		const entry = record$3(item);
+		const entry = record$4(item);
 		if (entry === void 0) continue;
-		const rawId = text$2(entry.model_id);
+		const rawId = text$3(entry.model_id);
 		if (rawId === void 0) continue;
 		const id = normalizeCodeArtsModelId(rawId);
 		const key = id.toLowerCase();
 		if (seen.has(key)) continue;
 		seen.add(key);
-		const rateLabel = text$2(pickActiveCredit(Array.isArray(entry.credit) ? entry.credit : [], entry.time_slots, nowMs)?.ratio_display);
+		const rateLabel = text$3(pickActiveCredit(Array.isArray(entry.credit) ? entry.credit : [], entry.time_slots, nowMs)?.ratio_display);
 		out.push({
 			id,
-			name: text$2(entry.model_name) ?? id,
+			name: text$3(entry.model_name) ?? id,
 			...rateLabel === void 0 ? {} : { rateLabel },
 			...entry.supports_images === true ? { images: true } : {}
 		});
@@ -3644,18 +3600,20 @@ const sleep$1 = (ms, signal) => new Promise((resolve, reject) => {
 	}, ms);
 	signal?.addEventListener("abort", onAbort, { once: true });
 });
-/** Retries for a gateway that is busy for reasons the window cannot predict. */
+/** Retries for a gateway that is busy for reasons the caller cannot predict. */
 const QUEUE_ATTEMPTS = 3;
-/** Minimum pause before retrying a rejected call; the window adds its own. */
+/** Pause before retrying a rejected call. */
 const QUEUE_BACKOFF_MS = 2e4;
 /**
 * The message a user sees once waiting is hopeless.
 *
-* The raw gateway text (`TM.00001041`) reads like a bug; the limit is the
-* trial plan's, and the only fix on this side is to say so.
+* The raw gateway text (`TM.00001041`) reads like a bug. The three concurrent
+* sessions are the trial plan's, and one plugin chatting under a single session
+* id is not meant to reach them: the slots are being held by something else on
+* the same account.
 */
 function queueExhausted() {
-	return new ProviderHttpError("CodeArts 体验版每分钟只允许 3 个会话，当前已被占满。请稍等片刻再发，或关闭其它 CodeArts 会话。", 429);
+	return new ProviderHttpError("CodeArts 这个账号的 3 个并发会话已被占满（通常是码道 IDE 或另一台设备），请稍后再发，或关闭其它 CodeArts 会话。", 429);
 }
 /** Image transcripts live beside accounts.json, so a restart does not re-bill. */
 const IMAGE_CACHE_FILE = "codearts-image-cache.json";
@@ -3688,7 +3646,6 @@ var CodeArtsProvider = class {
 	/** Models that answered `InferHub.4004.200`: no allowance pack to bill. */
 	noBenefit = /* @__PURE__ */ new Set();
 	noBenefitLoaded = false;
-	window;
 	openRouter;
 	sessionId = randomUUID();
 	/**
@@ -3703,7 +3660,6 @@ var CodeArtsProvider = class {
 	imageCacheWrite = Promise.resolve();
 	constructor(options) {
 		this.options = options;
-		this.window = options.window ?? sharedSessionWindow();
 		this.openRouter = options.openRouter ?? new OpenRouterCatalog(options.fetchImpl ?? fetch);
 		this.catalog = new ModelCatalog(() => this.loadModels(), options.ttlMs);
 		this.login = new CodeArtsLogin({
@@ -3712,7 +3668,6 @@ var CodeArtsProvider = class {
 			...options.logger === void 0 ? {} : { logger: options.logger },
 			save: async (account) => {
 				await options.store.saveCodearts(account);
-				this.window.reset();
 				this.noBenefit.clear();
 				this.invalidateModels();
 				this.invalidateQuota();
@@ -3762,8 +3717,8 @@ var CodeArtsProvider = class {
 		const now = Date.now();
 		const gateway = await this.signedGet(credential, CODEARTS_GATEWAY_CONFIG_URL);
 		const builtin = await this.signedGet(credential, `${CODEARTS_SNAP_BASE}${CODEARTS_MODEL_BUILTIN_PATH}`);
-		const gatewayRows = parseCodeArtsRoster(record$3(record$3(gateway)?.result)?.models, now);
-		const builtinRows = parseCodeArtsRoster(record$3(builtin)?.builtinModels, now);
+		const gatewayRows = parseCodeArtsRoster(record$4(record$4(gateway)?.result)?.models, now);
+		const builtinRows = parseCodeArtsRoster(record$4(builtin)?.builtinModels, now);
 		if (gatewayRows.length === 0 && builtinRows.length === 0) throw new Error("CodeArts 没有返回任何模型（签名、凭据或网关异常）");
 		if (gatewayRows.length > 0) this.benefitModels = new Set(gatewayRows.map((row) => row.id));
 		const textOnly = this.options.textOnly();
@@ -3844,7 +3799,7 @@ var CodeArtsProvider = class {
 	}
 	async readQuota() {
 		const credential = await this.credential();
-		const payload = record$3(await this.signedGet(credential, `${CODEARTS_SNAP_BASE}${CODEARTS_PACKAGE_INFO_PATH}`));
+		const payload = record$4(await this.signedGet(credential, `${CODEARTS_SNAP_BASE}${CODEARTS_PACKAGE_INFO_PATH}`));
 		if (payload === void 0) throw new Error("CodeArts 没有返回账户信息");
 		const info = parseCodeArtsPackage(payload);
 		const total = info.credit.amount ?? info.credit.remaining;
@@ -3936,26 +3891,26 @@ var CodeArtsProvider = class {
 				signal: AbortSignal.timeout(this.options.timeoutMs())
 			});
 			if (!response.ok) return void 0;
-			return unwrapEnvelope(record$3(await response.json()));
+			return unwrapEnvelope(record$4(await response.json()));
 		} catch {
 			return;
 		}
 	}
 	async accountInfo(credential) {
-		const payload = record$3(await this.signedGet(credential, `${CODEARTS_SNAP_BASE}${CODEARTS_PACKAGE_INFO_PATH}`));
+		const payload = record$4(await this.signedGet(credential, `${CODEARTS_SNAP_BASE}${CODEARTS_PACKAGE_INFO_PATH}`));
 		return payload === void 0 ? void 0 : parseCodeArtsPackage(payload);
 	}
 	async activities(credential) {
 		const url = `${CODEARTS_SNAP_BASE}${CODEARTS_OPS_DELIVERY_PATH}?channel=IDE`;
-		const items = unwrapEnvelope(record$3(await this.signedGet(credential, url)))?.items;
+		const items = unwrapEnvelope(record$4(await this.signedGet(credential, url)))?.items;
 		if (!Array.isArray(items)) return void 0;
 		return items.map((item) => {
-			const entry = record$3(item) ?? {};
+			const entry = record$4(item) ?? {};
 			return {
 				campaignId: String(entry.campaignId ?? ""),
-				type: text$2(entry.type) ?? "",
+				type: text$3(entry.type) ?? "",
 				claimable: entry.claimable === true || String(entry.claimable).toLowerCase() === "true",
-				status: text$2(entry.status) ?? "",
+				status: text$3(entry.status) ?? "",
 				amount: num$1(entry.benefitAmount) ?? num$1(entry.amount) ?? num$1(entry.creditAmount) ?? 0
 			};
 		});
@@ -3971,7 +3926,7 @@ var CodeArtsProvider = class {
 			const cache = /* @__PURE__ */ new Map();
 			const file = this.imageCacheFile();
 			if (file !== void 0) try {
-				const entries = record$3(record$3(JSON.parse(await promises.readFile(file, "utf8")))?.entries);
+				const entries = record$4(record$4(JSON.parse(await promises.readFile(file, "utf8")))?.entries);
 				for (const [key, value] of Object.entries(entries ?? {})) if (typeof value === "string" && value.length > 0) cache.set(key, value);
 			} catch {}
 			this.imageCache = cache;
@@ -4024,7 +3979,7 @@ var CodeArtsProvider = class {
 			for (let index = 0; index < parts.length; index++) {
 				const part = parts[index];
 				if (part.type !== "image_url") continue;
-				const url = record$3(part.image_url)?.url;
+				const url = record$4(part.image_url)?.url;
 				if (typeof url !== "string" || url.length === 0) continue;
 				const key = sha256Hex(url);
 				let transcript = cache.get(key);
@@ -4041,7 +3996,7 @@ var CodeArtsProvider = class {
 			}
 		}
 	}
-	/** Ask the vision model to describe one image, within the same chat budget. */
+	/** Ask the vision model to describe one image; another turn on the same session. */
 	async describeImage(dataUrl, signal) {
 		const payload = JSON.stringify({
 			model: CODEARTS_VISION_MODEL,
@@ -4062,7 +4017,6 @@ var CodeArtsProvider = class {
 		let authRefreshed = false;
 		let queueAttempts = 0;
 		for (;;) {
-			const slot = await this.window.open(signal);
 			let response;
 			try {
 				response = await this.send(chatId, payload, CODEARTS_VISION_MODEL, false, signal);
@@ -4073,10 +4027,9 @@ var CodeArtsProvider = class {
 					continue;
 				}
 				if (error instanceof CodeArtsRetry && error.kind === "queue") {
-					slot.release();
 					if (queueAttempts < QUEUE_ATTEMPTS) {
 						queueAttempts++;
-						await sleep$1(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), signal);
+						await sleep$1(QUEUE_BACKOFF_MS, signal);
 						continue;
 					}
 					throw queueExhausted();
@@ -4088,19 +4041,18 @@ var CodeArtsProvider = class {
 				for await (const chunk of consumeOpenAiStream(response, {
 					...signal === void 0 ? {} : { signal },
 					onFrame: (frame) => {
-						const code = text$2(frame.error_code);
+						const code = text$3(frame.error_code);
 						if (code === void 0) return;
-						const message = text$2(frame.error_msg) ?? code;
+						const message = text$3(frame.error_msg) ?? code;
 						if (QUEUE_MARKERS.some((marker) => code.includes(marker))) throw new CodeArtsRetry("queue", message);
 						throw new ProviderHttpError(message, 502);
 					}
 				})) if (chunk.type === "text-delta") transcript += chunk.text;
 			} catch (error) {
 				if (error instanceof CodeArtsRetry && error.kind === "queue") {
-					slot.release();
 					if (queueAttempts < QUEUE_ATTEMPTS) {
 						queueAttempts++;
-						await sleep$1(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), signal);
+						await sleep$1(QUEUE_BACKOFF_MS, signal);
 						continue;
 					}
 					throw queueExhausted();
@@ -4139,7 +4091,6 @@ var CodeArtsProvider = class {
 		let benefitDropped = false;
 		let queueAttempts = 0;
 		for (;;) {
-			const slot = await this.window.open(options.signal);
 			let response;
 			try {
 				response = await this.send(chatId, payload, model, benefitDropped, options.signal);
@@ -4162,8 +4113,7 @@ var CodeArtsProvider = class {
 					}
 					if (error.kind === "queue" && queueAttempts < QUEUE_ATTEMPTS) {
 						queueAttempts++;
-						slot.release();
-						await sleep$1(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), options.signal);
+						await sleep$1(QUEUE_BACKOFF_MS, options.signal);
 						continue;
 					}
 					if (error.kind === "queue") throw queueExhausted();
@@ -4175,9 +4125,9 @@ var CodeArtsProvider = class {
 				for await (const chunk of consumeOpenAiStream(response, {
 					...options.signal === void 0 ? {} : { signal: options.signal },
 					onFrame: (frame) => {
-						const code = text$2(frame.error_code);
+						const code = text$3(frame.error_code);
 						if (code === void 0) return;
-						const message = text$2(frame.error_msg) ?? code;
+						const message = text$3(frame.error_msg) ?? code;
 						if (QUEUE_MARKERS.some((marker) => code.includes(marker))) throw new CodeArtsRetry("queue", message);
 						if (code.includes("InferHub.4004.200")) throw new CodeArtsRetry("benefit", message);
 						throw new ProviderHttpError(message, 502);
@@ -4190,8 +4140,7 @@ var CodeArtsProvider = class {
 			} catch (error) {
 				if (!produced && error instanceof CodeArtsRetry && error.kind === "queue" && queueAttempts < QUEUE_ATTEMPTS) {
 					queueAttempts++;
-					slot.release();
-					await sleep$1(Math.max(this.window.waitMs(), QUEUE_BACKOFF_MS), options.signal);
+					await sleep$1(QUEUE_BACKOFF_MS, options.signal);
 					continue;
 				}
 				if (error instanceof CodeArtsRetry && error.kind === "queue") throw queueExhausted();
@@ -4211,13 +4160,17 @@ var CodeArtsProvider = class {
 	async send(chatId, payload, model, benefitDropped, signal) {
 		const credential = await this.credential();
 		const benefit = !benefitDropped && this.isBenefitModel(model);
+		const otSessionId = credential.otSessionId ?? this.sessionId.replace(/-/g, "");
 		const headers = {
 			...headersForFetch(await signRequestHuawei(credential.accessKeyId, credential.secretAccessKey, credential.securityToken, "POST", CODEARTS_CHAT_URL, payload, benefit ? { maas_type: "benefit" } : void 0)),
 			"content-type": "application/json",
 			accept: "text/event-stream",
 			"chat-id": chatId,
 			"session-id": this.sessionId,
-			lang: "en"
+			lang: "en",
+			"x-ot-session-id": otSessionId,
+			"user-session-id": otSessionId,
+			"x-ot-trace-id": randomUUID().replace(/-/g, "")
 		};
 		const timeout = AbortSignal.timeout(Math.max(this.options.timeoutMs(), 6e4));
 		const response = await this.fetcher(CODEARTS_CHAT_URL, {
@@ -4247,7 +4200,6 @@ var CodeArtsProvider = class {
 	}
 	async logoutAccount() {
 		await this.options.auth.logout();
-		this.window.reset();
 		this.invalidateModels();
 		this.invalidateQuota();
 	}
@@ -4275,8 +4227,8 @@ function clampMaxTokens(value) {
 * for them would claim credits expire when they do not.
 */
 function parseCodeArtsPackage(payload) {
-	const pkg = record$3(payload.package) ?? {};
-	const endDate = text$2(payload.end_date);
+	const pkg = record$4(payload.package) ?? {};
+	const endDate = text$3(payload.end_date);
 	const endMs = endDate === void 0 ? void 0 : Date.parse(endDate);
 	const labels = {
 		usageBasicPackageCredit: "基础积分包",
@@ -4286,9 +4238,9 @@ function parseCodeArtsPackage(payload) {
 	const packs = [];
 	let summary;
 	for (const item of Array.isArray(payload.metrics) ? payload.metrics : []) {
-		const metric = record$3(item);
+		const metric = record$4(item);
 		if (metric === void 0) continue;
-		const name = text$2(metric.name) ?? "";
+		const name = text$3(metric.name) ?? "";
 		const amount = num$1(metric.package_credit_amount);
 		const used = num$1(metric.package_credit_used);
 		const remain = num$1(metric.package_credit_remain);
@@ -4321,8 +4273,8 @@ function parseCodeArtsPackage(payload) {
 	});
 	return {
 		isCreditPackage: pkg.is_credit_package === true || String(pkg.is_credit_package).toLowerCase() === "true",
-		packageName: text$2(pkg.package_name_cn) ?? text$2(pkg.package_name_en) ?? "",
-		packageStatus: text$2(pkg.status) ?? "",
+		packageName: text$3(pkg.package_name_cn) ?? text$3(pkg.package_name_en) ?? "",
+		packageStatus: text$3(pkg.status) ?? "",
 		credit: {
 			...credit,
 			packs
@@ -6278,7 +6230,7 @@ function numeric(value) {
 	if (typeof value === "number" && Number.isFinite(value)) return value;
 	if (typeof value === "string" && /^-?\d+(?:\.\d+)?$/.test(value.trim())) return Number(value);
 }
-function record$2(value) {
+function record$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function messageOf(payload) {
@@ -6311,6 +6263,100 @@ function raccoonHeaders(token) {
 		"x-client-version": RACCOON_CLIENT_VERSION
 	};
 }
+/** Wording the gateway has used alongside that code. */
+const RATE_LIMIT_WORDS = [
+	"user_model_rate_limited",
+	"rate_limit",
+	"频率超限"
+];
+/**
+* Whether a rejection is the token wall rather than a generic failure.
+*
+* Matched on the status, the code and the wording, because the same condition
+* arrives as an HTTP 429 and as an error frame inside a 200 stream.
+*/
+function isRaccoonRateLimited(status, text) {
+	if (status === 429) return true;
+	const lower = text.toLowerCase();
+	return RATE_LIMIT_WORDS.some((word) => lower.includes(word.toLowerCase()));
+}
+/**
+* The wall, as an error the caller can tell apart from a generic 429.
+*
+* A subclass rather than a flag: the in-band path and the HTTP path would
+* otherwise both be caught by the same handler, and the second pass would wrap
+* the message the first pass had already rewritten.
+*/
+var RaccoonRateLimitedError = class extends ProviderHttpError {
+	constructor(message) {
+		super(message, 429);
+		this.name = "RaccoonRateLimitedError";
+	}
+};
+/**
+* The message a user sees once the wall is hit.
+*
+* The raw text says "retry later" and gives no reason, which is why this reads
+* as the plugin being broken. The honest answer names the cause and the one
+* lever the user actually has on this side.
+*/
+function raccoonRateLimited(detail) {
+	return new RaccoonRateLimitedError(`小浣熊账号的模型吞吐已达上限（不是每分钟请求数，而是按账号的 token 速率）。一轮对话带的上下文越大越快撞到，撞到后额度按吞吐缓慢回血，上游也没有给恢复时间。稍等一会儿再发；把该模型的上下文窗口调小，同一会话能撑得更久。上游原文：${detail}`);
+}
+/** The `error` object a compatible gateway puts in an SSE frame. */
+function frameFailure(frame) {
+	const error = frame.error;
+	if (error === void 0) return void 0;
+	if (typeof error === "string") return { message: error };
+	if (error === null || typeof error !== "object") return void 0;
+	const record = error;
+	const code = typeof record.code === "string" ? record.code : void 0;
+	const message = typeof record.message === "string" ? record.message : void 0;
+	return {
+		...code === void 0 ? {} : { code },
+		...message === void 0 ? {} : { message }
+	};
+}
+/**
+* One conversation's session id, stable across the turns of that conversation.
+*
+* The official client never opens a session per request — measured on its own
+* logs, 125 calls over 26 minutes all carried one `sess-0-53927d74` — while an
+* implementation that mints a fresh id per request tells the gateway that one
+* account opened hundreds of sessions within minutes.
+*
+* The id is a pure function of (account, model) rather than a random value, so a
+* restarted or hot-reloaded process continues the same conversation instead of
+* presenting a new session, and two models stay two conversations. The principal
+* itself never leaves the process — only a truncated digest of it does.
+*/
+var RaccoonSessionIds = class {
+	principal;
+	/**
+	* @param principal - a value that is stable for one account and identifies it
+	*   without being the token itself (the JWT's `sub`).
+	*/
+	constructor(principal) {
+		this.principal = principal;
+	}
+	async for(model) {
+		const principal = await this.principal();
+		if (principal === void 0) return void 0;
+		return raccoonSessionId(principal, model);
+	}
+};
+/**
+* `sess-<sequence>-<8 hex>`, the shape the official client sends.
+*
+* The sequence is the official client's process-local counter and is pinned to 0
+* here on purpose: an incrementing value would make one conversation look like a
+* different session after a restart, which is the one thing this id exists to
+* prevent. Identity lives in the digest, which is truncated on purpose — the id
+* must separate accounts without naming them on the wire.
+*/
+function raccoonSessionId(principal, model) {
+	return `sess-0-${createHash("sha256").update(`${principal}\0${model}`).digest("hex").slice(0, 8)}`;
+}
 /** Whether the gateway accepts a token harvested from the browser. */
 async function raccoonAccessTokenValid(token, fetchImpl = fetch) {
 	try {
@@ -6332,7 +6378,7 @@ async function raccoonAccessTokenValid(token, fetchImpl = fetch) {
 		return false;
 	}
 }
-function jwtExpiry$1(token) {
+function jwtExpiry$2(token) {
 	const parts = token.split(".");
 	if (parts.length < 2) return void 0;
 	try {
@@ -6354,7 +6400,7 @@ function raccoonRefreshCandidate(tokens, accessToken) {
 	let best;
 	for (const token of tokens) {
 		if (token === accessToken) continue;
-		const expiry = jwtExpiry$1(token);
+		const expiry = jwtExpiry$2(token);
 		if (expiry === void 0) continue;
 		if (best === void 0 || expiry > best.expiry) best = {
 			token,
@@ -6368,12 +6414,16 @@ var RaccoonProvider = class {
 	catalog;
 	quotaCache;
 	quotaInflight;
-	checkinInflight;
 	loginFlow;
 	openRouter;
+	sessionIds;
 	constructor(options) {
 		this.options = options;
 		this.openRouter = options.openRouter ?? new OpenRouterCatalog(options.fetchImpl ?? fetch);
+		this.sessionIds = options.sessionIds ?? new RaccoonSessionIds(async () => {
+			const stored = await options.store.raccoon();
+			return stored === void 0 ? void 0 : decodeJwtFacts(stored.accessToken).subject;
+		});
 		this.catalog = new ModelCatalog(() => this.fetchModels(), options.ttlMs);
 	}
 	async status() {
@@ -6427,6 +6477,21 @@ var RaccoonProvider = class {
 	headers(token) {
 		return raccoonHeaders(token);
 	}
+	/**
+	* The chat headers, including the session id the gateway counts sessions by.
+	*
+	* Only chat carries it: the catalogue, quota and check-in routes are plain
+	* business calls the official client sends outside any session, so leaving
+	* them alone keeps this change to the one route it was measured on.
+	*/
+	async chatHeaders(token, model) {
+		const base = raccoonHeaders(token);
+		const sessionId = await this.sessionIds.for(model).catch(() => void 0);
+		return sessionId === void 0 ? base : {
+			...base,
+			"x-raccoon-session-id": sessionId
+		};
+	}
 	/** Run one JSON call; a rejected token means this login needs a new scan. */
 	async authorizedJson(path, init = {}, extraHeaders = {}) {
 		const token = await this.options.auth.accessToken();
@@ -6517,13 +6582,13 @@ var RaccoonProvider = class {
 	*/
 	async dailyGrant() {
 		const payload = await this.authorizedJson("/points/v2/bills?paging.limit=50&type=all");
-		const root = record$2(payload) ?? {};
+		const root = record$3(payload) ?? {};
 		if (typeof root.code === "number" && root.code !== 0) throw new Error(messageOf(payload) ?? `小浣熊积分流水返回 code=${root.code}`);
-		const data = record$2(root.data) ?? root;
+		const data = record$3(root.data) ?? root;
 		const items = Array.isArray(data.items) ? data.items : [];
 		const today = raccoonDay(Date.now());
 		for (const raw of items) {
-			const item = record$2(raw);
+			const item = record$3(raw);
 			if (item?.biz_type !== "daily_grant") continue;
 			const day = item.grant_at ?? item.created_at;
 			if (typeof day !== "string" && typeof day !== "number") continue;
@@ -6542,6 +6607,15 @@ var RaccoonProvider = class {
 			};
 		}
 	}
+	/**
+	* Read today's grant. **Read-only on purpose.**
+	*
+	* The gateway has no claim endpoint: points are issued on the day's first
+	* website visit. Replaying that visit (`setting_info`) can trigger the grant
+	* from here, but doing so takes a state-changing action on the account without
+	* the user asking for it in that moment, so the plugin only reports. Claiming
+	* is the website's job, and the card links there.
+	*/
 	async checkinStatus() {
 		const grant = await this.dailyGrant();
 		if (grant !== void 0) return {
@@ -6561,46 +6635,6 @@ var RaccoonProvider = class {
 			url: RACCOON_CHECKIN_URL
 		};
 	}
-	async claimCheckin() {
-		await this.authorizedJson("/office/v3/setting_info", {}, {
-			"x-client-platform": "web",
-			"x-client-version": "131.0.0.0"
-		});
-		const grant = await this.dailyGrant();
-		if (grant === void 0) return {
-			available: true,
-			claimed: false,
-			deviceClaimed: false,
-			message: "每日积分尚未到账；请打开网页签到",
-			url: RACCOON_CHECKIN_URL
-		};
-		this.invalidateQuota();
-		return {
-			available: true,
-			claimed: true,
-			deviceClaimed: false,
-			...grant.points === void 0 ? {} : { reward: grant.points },
-			...grant.grantedAt === void 0 ? {} : { grantedAt: grant.grantedAt },
-			message: "每日积分已到账",
-			url: RACCOON_CHECKIN_URL
-		};
-	}
-	/**
-	* One automatic check-in pass: report today's grant, or ask the website path
-	* to issue it. Shared so overlapping timers cannot spend two call slots.
-	*/
-	async ensureDailyCheckin() {
-		if (this.checkinInflight !== void 0) return this.checkinInflight;
-		this.checkinInflight = (async () => {
-			const status = await this.checkinStatus();
-			return status.claimed ? status : this.claimCheckin();
-		})();
-		try {
-			return await this.checkinInflight;
-		} finally {
-			this.checkinInflight = void 0;
-		}
-	}
 	async *stream(options, model, readImage, onUnauthorized) {
 		const token = await this.options.auth.accessToken();
 		const body = buildBody(options, model, await buildMessages(options, readImage), buildTools(options));
@@ -6617,7 +6651,7 @@ var RaccoonProvider = class {
 		try {
 			yield* openAiStream({
 				url: `${RACCOON_BASE}/llm/v2/chat/completions`,
-				headers: this.headers(token),
+				headers: await this.chatHeaders(token, model),
 				body,
 				signal: options.signal,
 				fetchImpl: this.options.fetchImpl,
@@ -6625,27 +6659,268 @@ var RaccoonProvider = class {
 					this.invalidateModels();
 					this.invalidateQuota();
 					onUnauthorized?.();
+				},
+				onFrame: (frame) => {
+					const failure = frameFailure(frame);
+					if (failure === void 0) return;
+					const detail = failure.message ?? failure.code ?? "上游返回错误";
+					throw isRaccoonRateLimited(void 0, `${failure.code ?? ""} ${detail}`) ? raccoonRateLimited(detail) : new ProviderHttpError(detail, 502);
 				}
 			});
 		} catch (error) {
 			if (error instanceof ProviderHttpError && (error.status === 401 || error.status === 403)) throw new Error("小浣熊登录已失效，请在设置页点「打开扫码登录」。");
+			if (error instanceof ProviderHttpError && !(error instanceof RaccoonRateLimitedError) && error.status === 429) throw raccoonRateLimited(error.message);
 			throw error;
 		}
 	}
 };
+// src/trae-client.ts
+/**
+* The local Trae desktop client's sign-in state.
+*
+* Trae's check-in route insists on the device id its own client registered, so
+* the website login cannot use it. When the client is installed and already
+* signed in, the plugin can reuse that state instead:
+*
+*  - the `Cloud-IDE-JWT` stored under `iCubeAuthInfo://icube.cloudide`;
+*  - the 16-digit device id encoded in the `iCubeAuthInfo://icube-dc:<id>` key;
+*  - `telemetry.machineId`, the value the client sends as `x-machine-id`.
+*
+* The stored value uses the client's own AES-CBC envelope: six magic bytes, a
+* 32-byte key material, then the ciphertext. The AES key and IV are derived
+* from that key material with SHA-512 and a fixed salt, and the plaintext is a
+* SHA-512 digest followed by the JSON document. Nothing here writes to the
+* client, and the token is never returned by the settings API.
+*
+* @module dsh-llm-adapters/trae-client
+*/
+const AUTH_PROVIDER_KEY = "iCubeAuthInfo://icube.cloudide";
+const DEVICE_KEY_PREFIX = "iCubeAuthInfo://icube-dc:";
+const MACHINE_KEY = "telemetry.machineId";
+const SERVICE_MACHINE_KEY = "storage.serviceMachineId";
+const AES_MAGIC = Buffer.from([
+	116,
+	99,
+	5,
+	16,
+	0,
+	0
+]);
+const AES_PRIVATE_MAGIC = Buffer.from([
+	18,
+	57,
+	32,
+	32,
+	2,
+	3
+]);
+const KEY_OFFSET = 6;
+const HASH_LENGTH = 64;
+/** Aue ^ Due from the client's byteCrypto module. */
+const AES_SALT = Buffer.from("4dd4c2e6b83162090e52b3c7a6733ba41cb2462b829ab58a196b39db57177524f49baf7f08e8d68d26a72e37c1a95a2f1f05a51892aef2949732b62a38aadd58", "hex");
+/** Tue ^ Iue, the AES_PRIVATE variant of the same envelope. */
+const AES_PRIVATE_SALT = Buffer.from("490cc21292b05d0cc06ccbe91fb92e21b5a7c538811dc85e27a96e28104e1cf69c7166efab232807390da78a8b91e49c44b49a43feb941a1e46f2656e613e47b", "hex");
+const DEVICE_RE = /^\d{16}$/;
+function record$2(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function text$2(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+/** Accept epoch seconds, epoch milliseconds, or an ISO date. */
+function epochMs$2(value) {
+	if (typeof value === "number" && Number.isFinite(value) && value > 0) return value < 0xe8d4a51000 ? Math.round(value * 1e3) : Math.round(value);
+	if (typeof value === "string") {
+		if (/^\d+$/.test(value.trim())) return epochMs$2(Number(value));
+		const parsed = Date.parse(value);
+		return Number.isFinite(parsed) ? parsed : void 0;
+	}
+}
+function jwtExpiry$1(token) {
+	const parts = token.split(".");
+	if (parts.length < 2) return void 0;
+	try {
+		const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+		const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+		return epochMs$2(record$2(JSON.parse(Buffer.from(padded, "base64").toString("utf8")))?.exp);
+	} catch {
+		return;
+	}
+}
+/**
+* Open one `iCubeAuthInfo` value.
+*
+* The digest check is the client's own integrity check: the first 64 plaintext
+* bytes are SHA-512 of the document that follows. A malformed or changed
+* envelope is rejected instead of being parsed as garbage.
+*/
+function decryptAuthValue(value) {
+	const bytes = Buffer.from(value, "base64");
+	if (bytes.length < 102) throw new Error("数据长度不足");
+	const magic = bytes.subarray(0, KEY_OFFSET);
+	const salt = magic.equals(AES_MAGIC) ? AES_SALT : magic.equals(AES_PRIVATE_MAGIC) ? AES_PRIVATE_SALT : void 0;
+	if (salt === void 0) throw new Error("未知的加密格式");
+	const keyMaterial = bytes.subarray(KEY_OFFSET, 38);
+	const mixed = createHash("sha512").update(keyMaterial).digest();
+	const derived = createHash("sha512").update(Buffer.concat([mixed, salt])).digest();
+	const decipher = createDecipheriv("aes-128-cbc", derived.subarray(0, 16), derived.subarray(16, 32));
+	const plain = Buffer.concat([decipher.update(bytes.subarray(38)), decipher.final()]);
+	if (plain.length < HASH_LENGTH) throw new Error("解密结果为空");
+	const body = plain.subarray(HASH_LENGTH);
+	if (!createHash("sha512").update(body).digest().equals(plain.subarray(0, HASH_LENGTH))) throw new Error("校验失败");
+	return JSON.parse(body.toString("utf8"));
+}
+/**
+* The client's data directory, most specific first.
+*
+* `DSH_TRAE_CLIENT_DIR` is a portable/test override; the region-specific
+* variables let one machine keep separate CN and international installs.
+*/
+function traeClientDataDirs(region, options = {}) {
+	const platform = options.platform ?? process.platform;
+	const env = options.env ?? process.env;
+	const home = options.home ?? homedir();
+	const name = region === "cn" ? "Trae CN" : "Trae";
+	const out = [];
+	const add = (directory) => {
+		if (directory !== void 0 && directory !== "") out.push(directory);
+	};
+	add(env[region === "cn" ? "DSH_TRAE_CN_CLIENT_DIR" : "DSH_TRAE_GLOBAL_CLIENT_DIR"]);
+	add(env["DSH_TRAE_CLIENT_DIR"]);
+	if (platform === "win32") {
+		const appData = env["APPDATA"] ?? join(home, "AppData", "Roaming");
+		add(join(appData, name));
+	} else if (platform === "darwin") add(join(home, "Library", "Application Support", name));
+	else {
+		const config = env["XDG_CONFIG_HOME"] ?? join(home, ".config");
+		add(join(config, name));
+	}
+	return [...new Set(out)];
+}
+function storageFile(userDataDir) {
+	return join(userDataDir, "User", "globalStorage", "storage.json");
+}
+function authValueOf(storage) {
+	const direct = text$2(storage[AUTH_PROVIDER_KEY]);
+	if (direct !== void 0) return direct;
+	for (const key of Object.keys(storage)) if (key.startsWith("iCubeAuthInfo://") && key.endsWith(".cloudide")) {
+		const value = text$2(storage[key]);
+		if (value !== void 0) return value;
+	}
+}
+/** The client has one device id per machine; the last valid key is current. */
+function deviceIdOf(storage) {
+	const keys = Object.keys(storage).filter((key) => key.startsWith(DEVICE_KEY_PREFIX));
+	for (let index = keys.length - 1; index >= 0; index--) {
+		const value = text$2(keys[index].slice(25));
+		if (value !== void 0 && DEVICE_RE.test(value)) return value;
+	}
+}
+function regionMismatch(region, userInfo) {
+	const account = record$2(userInfo.account);
+	const evidence = (text$2(record$2(userInfo.userRegion)?.region) ?? text$2(account?.storeRegion))?.toUpperCase();
+	if (evidence === void 0) return false;
+	return region === "cn" ? evidence !== "CN" : evidence === "CN";
+}
+/** Parse one `storage.json` document; exported for tests and diagnostics. */
+function parseTraeClientStorage(region, storage) {
+	const encrypted = authValueOf(storage);
+	if (encrypted === void 0) return { status: {
+		available: true,
+		signedIn: false,
+		error: "本机 Trae 客户端尚未登录。请先在客户端完成登录。"
+	} };
+	let parsed;
+	try {
+		parsed = decryptAuthValue(encrypted);
+	} catch (error) {
+		return { status: {
+			available: true,
+			signedIn: false,
+			error: `读取本机 Trae 客户端登录态失败：${error instanceof Error ? error.message : String(error)}`
+		} };
+	}
+	const userInfo = record$2(parsed);
+	const token = text$2(userInfo?.token);
+	if (userInfo === void 0 || token === void 0) return { status: {
+		available: true,
+		signedIn: false,
+		error: "本机 Trae 客户端登录态里没有令牌，请先在客户端重新登录。"
+	} };
+	const account = record$2(userInfo.account);
+	const name = text$2(account?.username) ?? text$2(account?.name);
+	const userId = text$2(userInfo.userId);
+	const expiresAt = epochMs$2(userInfo.expiredAt) ?? jwtExpiry$1(token);
+	const identity = {
+		...name === void 0 ? {} : { name },
+		...userId === void 0 ? {} : { userId },
+		...expiresAt === void 0 ? {} : { expiresAt }
+	};
+	const unavailable = (error) => ({ status: {
+		available: true,
+		signedIn: false,
+		...identity,
+		error
+	} });
+	if (regionMismatch(region, userInfo)) return unavailable(region === "cn" ? "本机 Trae 客户端登录的是国际版账号，请切换到国际版后再复用。" : "本机 Trae 客户端登录的是国内版账号，请切换到国内版后再复用。");
+	if (expiresAt !== void 0 && expiresAt <= Date.now()) return unavailable("本机 Trae 客户端登录已过期，请先在客户端重新登录。");
+	const deviceId = deviceIdOf(storage);
+	if (deviceId === void 0) return unavailable("本机 Trae 客户端登录缺少 16 位设备号，请先在客户端重新登录。");
+	const machineId = text$2(storage[MACHINE_KEY]) ?? text$2(storage[SERVICE_MACHINE_KEY]);
+	if (machineId === void 0) return unavailable("本机 Trae 客户端登录缺少机器码，请先在客户端重新登录。");
+	return {
+		status: {
+			available: true,
+			signedIn: true,
+			...identity
+		},
+		state: {
+			region,
+			token,
+			deviceId,
+			machineId,
+			...identity
+		}
+	};
+}
+/** Read the currently selected region's client state from this machine. */
+function readTraeClientLogin(region, options = {}) {
+	let available = false;
+	let error;
+	for (const directory of traeClientDataDirs(region, options)) {
+		const file = storageFile(directory);
+		if (!existsSync(file)) continue;
+		available = true;
+		try {
+			const raw = readFileSync(file, "utf8").replace(/^\uFEFF/, "");
+			const storage = record$2(JSON.parse(raw));
+			if (storage === void 0) throw new Error("storage.json 不是对象");
+			return parseTraeClientStorage(region, storage);
+		} catch (cause) {
+			error = `读取本机 Trae 客户端登录态失败：${cause instanceof Error ? cause.message : String(cause)}`;
+		}
+	}
+	return { status: {
+		available,
+		signedIn: false,
+		...error === void 0 ? {} : { error }
+	} };
+}
 // src/trae-login.ts
 /**
 * Trae sign-in through the provider's own website.
 *
-* The plugin does not read a desktop install: it opens a dedicated browser
+* This flow does not read a desktop install: it opens a dedicated browser
 * profile, lets the user sign in on trae.cn / trae.ai, and then takes the
 * session the website itself created. Two things come out of that session:
 *
 *  - the `Cloud-IDE-JWT` token, fetched with the page's own cookies through
 *    `/cloudide/api/v3/common/GetUserToken` — the same call the site makes;
 *  - the device fingerprint (`__msuuid__` from the page, or one generated in
-*    the page), which Trae's check-in route requires and which therefore must
-*    belong to this web session rather than to a machine install.
+*    the page), stored with the web login.
+*
+* The check-in route does not accept this web fingerprint, so check-in is
+* enabled only for the separate client-login import in `trae-client.ts`.
 *
 * Cookies are captured over the DevTools protocol and kept in the plugin's own
 * account store so the short-lived JWT can be renewed later; the dedicated
@@ -7257,10 +7532,12 @@ var TraeWebLogin = class {
 };
 // src/trae.ts
 /**
-* Trae provider: model directory, SOLO chat and quota.
+* Trae provider: model directory, SOLO chat, quota and client check-in.
 *
 * Trae's website login yields the same `Cloud-IDE-JWT` its own clients use, so
-* the plugin talks to the same gateways they do. Two catalog sources are merged:
+* the plugin talks to the same gateways they do. A second sign-in method copies
+* that token from the local desktop client; only that method carries the device
+* id the daily check-in route accepts. Two catalog sources are merged:
 *
 *  - the Remote directory (`/api/remote/v1/models`) is the model skeleton —
 *    display name, context window, multiplier, reasoning options, multimodal;
@@ -7962,6 +8239,22 @@ function parseTraeGlobalUsage(payload) {
 		at: Date.now()
 	};
 }
+/**
+* The check-in body's `req_source`: 1 is the IDE, 2 is Trae Work. The desktop
+* client sends 1; the claim route rejects the plugin's former empty body.
+*/
+const TRAE_CHECKIN_REQ_SOURCE = 1;
+function parseTraeCheckin(payload) {
+	const root = record(payload) ?? {};
+	const reward = num(root.credits) ?? 0;
+	return {
+		available: root.enable !== false,
+		claimed: root.checked_in === true,
+		deviceClaimed: root.did_checked_in === true,
+		...reward === 0 ? {} : { reward },
+		...text(root.message) === void 0 ? {} : { message: text(root.message) }
+	};
+}
 var TraeProvider = class {
 	options;
 	catalogInstance;
@@ -8172,6 +8465,160 @@ var TraeProvider = class {
 		this.quotaInflightRegion = region;
 		return this.quotaInflight;
 	}
+	/**
+	* The second sign-in method: the desktop client's current state.
+	*
+	* Read-only; the settings page only receives the non-secret status, never
+	* the token.
+	*/
+	async localClientLogin() {
+		return this.readClientLogin().status;
+	}
+	readClientLogin() {
+		return (this.options.clientLogin ?? (() => readTraeClientLogin(this.options.region())))();
+	}
+	/** Import the desktop client's token, device id and machine id. */
+	async importClientLogin() {
+		const region = this.ensureRegion();
+		const detection = this.readClientLogin();
+		if (!detection.status.available) throw new Error("本机没有检测到 Trae 客户端。请先安装并登录客户端，或改用网页登录。");
+		const state = detection.state;
+		if (!detection.status.signedIn || state === void 0) throw new Error(detection.status.error ?? "本机 Trae 客户端尚未登录。请先在客户端完成登录。");
+		await this.loginFlow?.cancel();
+		await this.options.store.saveTrae({
+			accessToken: state.token,
+			region,
+			source: "client",
+			deviceId: state.deviceId,
+			machineId: state.machineId,
+			loginAt: Date.now(),
+			...state.userId === void 0 ? {} : { userId: state.userId },
+			...state.name === void 0 ? {} : { name: state.name },
+			...state.expiresAt === void 0 ? {} : { expiresAt: state.expiresAt }
+		});
+		this.invalidateModels();
+		this.invalidateQuota();
+	}
+	async checkinContext() {
+		this.ensureRegion();
+		const profile = this.profile();
+		if (!profile.checkin) return {
+			ok: false,
+			status: {
+				available: false,
+				claimed: false,
+				deviceClaimed: false,
+				message: "Trae 国际版没有签到活动。"
+			}
+		};
+		const auth = await this.options.auth.status();
+		if (!auth.signedIn) return {
+			ok: false,
+			status: {
+				available: false,
+				claimed: false,
+				deviceClaimed: false,
+				message: auth.error ?? "尚未登录，无法签到。"
+			}
+		};
+		if (auth.loginSource !== "client") return {
+			ok: false,
+			status: {
+				available: false,
+				claimed: false,
+				deviceClaimed: false,
+				message: "签到仅在复用本机 Trae 客户端登录时可用；网页登录没有客户端设备号。"
+			}
+		};
+		let token;
+		let identity;
+		try {
+			token = await this.options.auth.accessToken();
+			identity = await this.options.auth.identity();
+		} catch (error) {
+			return {
+				ok: false,
+				status: {
+					available: false,
+					claimed: false,
+					deviceClaimed: false,
+					message: error instanceof Error ? error.message : String(error)
+				}
+			};
+		}
+		if (!/^\d{16}$/.test(identity.deviceId)) return {
+			ok: false,
+			status: {
+				available: false,
+				claimed: false,
+				deviceClaimed: false,
+				message: "本机 Trae 客户端登录缺少 16 位设备号，请先在客户端重新登录后再复用。"
+			}
+		};
+		return {
+			ok: true,
+			profile,
+			token,
+			identity: {
+				deviceId: identity.deviceId,
+				machineId: identity.machineId
+			}
+		};
+	}
+	async checkinStatus() {
+		const context = await this.checkinContext();
+		if (!context.ok) return context.status;
+		const response = await this.fetchImpl(`${context.profile.apiBase}/trae/api/v2/ug/checkin_credits/status`, {
+			method: "POST",
+			headers: {
+				...this.headers(context.token, context.profile),
+				"x-user-region": "CN",
+				"x-device-id": context.identity.deviceId,
+				"x-machine-id": context.identity.machineId
+			},
+			body: JSON.stringify({ req_source: 1 }),
+			signal: AbortSignal.timeout(this.options.timeoutMs())
+		});
+		if (!response.ok) throw new ProviderHttpError(await responseError(response), response.status);
+		return parseTraeCheckin(await response.json());
+	}
+	/** Claim today's reward. The only state-changing call in this provider. */
+	async claimCheckin() {
+		const context = await this.checkinContext();
+		if (!context.ok) throw new Error(context.status.message ?? "当前登录方式不能签到。");
+		const response = await this.fetchImpl(`${context.profile.apiBase}/trae/api/v2/ug/checkin_credits/claim`, {
+			method: "POST",
+			headers: {
+				...this.headers(context.token, context.profile),
+				"x-user-region": "CN",
+				"x-device-id": context.identity.deviceId,
+				"x-machine-id": context.identity.machineId
+			},
+			body: JSON.stringify({ req_source: 1 }),
+			signal: AbortSignal.timeout(this.options.timeoutMs())
+		});
+		if (!response.ok) throw new ProviderHttpError(await responseError(response), response.status);
+		const payload = record(await response.json()) ?? {};
+		const code = typeof payload.code === "number" ? payload.code : 0;
+		if (code === 0) {
+			this.invalidateQuota();
+			const reward = num(payload.credits);
+			return {
+				available: true,
+				claimed: true,
+				deviceClaimed: false,
+				...reward === void 0 || reward === 0 ? {} : { reward },
+				...text(payload.message) === void 0 ? {} : { message: text(payload.message) }
+			};
+		}
+		if (code === 9095) return {
+			available: true,
+			claimed: false,
+			deviceClaimed: true,
+			message: "本机今日已签到"
+		};
+		throw new Error(text(payload.message) ?? `签到失败（code ${code}）`);
+	}
 	async *stream(options, model, readImage, onInvalidate) {
 		this.ensureRegion();
 		const profile = this.profile();
@@ -8229,6 +8676,7 @@ var TraeProvider = class {
 				await this.options.store.saveTrae({
 					accessToken: account.accessToken,
 					region: target,
+					source: "web",
 					deviceId: account.deviceId,
 					machineId: account.machineId,
 					loginAt: Date.now(),
@@ -8428,23 +8876,6 @@ function apply(ctx, config) {
 	syncTimer.unref?.();
 	syncOpenRouter();
 	ctx.effect(() => () => clearInterval(syncTimer), "llm-adapters: openrouter sync");
-	let lastRaccoonCheckin = Date.now();
-	const checkinMonitor = () => {
-		if (!live.raccoonEnabled()) return;
-		const minutes = live.raccoonCheckinMinutes();
-		if (minutes <= 0) return;
-		if (Date.now() - lastRaccoonCheckin < minutes * 6e4) return;
-		lastRaccoonCheckin = Date.now();
-		(async () => {
-			if (!await raccoonProvider.signedIn()) return;
-			await raccoonProvider.ensureDailyCheckin();
-		})().catch((error) => {
-			ctx.logger?.warn(`llm-adapters: 小浣熊签到监测失败：${error instanceof Error ? error.message : String(error)}`);
-		});
-	};
-	const checkinTimer = setInterval(checkinMonitor, 6e4);
-	checkinTimer.unref?.();
-	ctx.effect(() => () => clearInterval(checkinTimer), "llm-adapters: raccoon check-in monitor");
 	ctx.inject(["attachments"], (scope) => {
 		attachments = scope.attachments;
 		scope.effect(() => () => {
@@ -8510,4 +8941,4 @@ function apply(ctx, config) {
 		ctx.logger?.info(`llm-adapters: 设置接口已挂载于 ${API_PREFIX}`);
 	});
 }
-export { API_PREFIX, AccountStore, BRANDS, CODEARTS_BENEFIT_FALLBACK, CODEARTS_BRAND, CODEARTS_CHAT_URL, CODEARTS_CONTEXT_WINDOWS, CODEARTS_DEFAULT_EFFORT, CODEARTS_EFFORTS, CODEARTS_EFFORT_LEVELS, CODEARTS_FALLBACK_CONTEXT_WINDOW, CODEARTS_MAX_OUTPUT_TOKENS, CODEARTS_PROVIDER, CODEARTS_SESSION_LIMIT, CODEARTS_SESSION_WINDOW_MS, CODEARTS_SNAP_BASE, CODEARTS_VISION_MODELS, CodeArtsAdapter, CodeArtsAuth, CodeArtsLogin, CodeArtsProvider, CodeArtsSessionWindow, Config, EMPTY_OPENROUTER_INDEX, LOOMY_ACCOUNT_BASE, LOOMY_BASE, LOOMY_BRAND, LOOMY_PROVIDER, LOOMY_VERSION, LOOMY_WECHAT_APP_ID, LOOMY_WECHAT_REDIRECT_URI, LocalAdapter, LoomyAdapter, LoomyAuth, LoomyProvider, LoomyQrLogin, ModelCatalog, OpenRouterCatalog, ProviderHttpError, RACCOON_BASE, RACCOON_BRAND, RACCOON_CLIENT_VERSION, RACCOON_IAM_BASE, RACCOON_PROVIDER, RACCOON_QR_APP_NAME, RACCOON_QR_ORIGIN, RaccoonAdapter, RaccoonAuth, RaccoonIamError, RaccoonProvider, RaccoonQrLogin, RefreshTokenExpiredError, TRAE_APP_ID, TRAE_BRAND, TRAE_CHAT_FUNCTIONS, TRAE_DIRECTORY_FUNCTIONS, TRAE_PROVIDER, TRAE_REGION_PROFILES, TRAE_SOLO_CHAT_PATH, TRAE_WEB_USER_AGENT, TraeAdapter, TraeAuth, TraeProvider, TraeWebLogin, apply, buildAuthorizeUrl, buildLoomyWechatAuthUrl, buildMessages, buildOpenRouterIndex, buildQrMatrix, buildRows, buildTools, clampMaxTokens, codeartsContextWindow, codeartsEfforts, consumeOpenAiStream, createRaccoonQr, decodeJwtFacts, defaultEffortOf, effortLabel, exchangeAuthorizationCode, exchangeRefreshToken, extractWechatUuid, fetchLoomyWechatUuid, generateDpopKeyPair, generatePkcePair, headersForFetch, inject, isBrandId, liveConfig, loomyGatewaySessionValid, machineIdOf, mergeTraeModels, modelKey, name, normalizeCodeArtsModelId, normalizeEffort, normalizeTraeRegion, openAiStream, openTraeStream, parseCodeArtsPackage, parseCodeArtsRoster, parseLoomyCatalog, parseModelName, parseOpenRouterModels, parseRaccoonCatalog, parseTraeGlobalUsage, parseTraeRemoteModels, parseTraeUsage, parseTraeWireModels, pickActiveCredit, pollRaccoonQr, priceFactorOf, priceFactorOfLabel, raccoonAccessTokenValid, raccoonQrContent, raccoonRefreshCandidate, readJwtExpiry, readOpenRouter, renderQrSvg, resolveCapabilities, resolveConfig, resolveModelId, sharedSessionWindow, signDpopJws, signRequestHuawei, sseEvents, startLoginPage, traeMessages, traeTools };
+export { API_PREFIX, AccountStore, BRANDS, CODEARTS_BENEFIT_FALLBACK, CODEARTS_BRAND, CODEARTS_CHAT_URL, CODEARTS_CONTEXT_WINDOWS, CODEARTS_DEFAULT_EFFORT, CODEARTS_EFFORTS, CODEARTS_EFFORT_LEVELS, CODEARTS_FALLBACK_CONTEXT_WINDOW, CODEARTS_MAX_OUTPUT_TOKENS, CODEARTS_PROVIDER, CODEARTS_SNAP_BASE, CODEARTS_VISION_MODELS, CodeArtsAdapter, CodeArtsAuth, CodeArtsLogin, CodeArtsProvider, Config, EMPTY_OPENROUTER_INDEX, LOOMY_ACCOUNT_BASE, LOOMY_BASE, LOOMY_BRAND, LOOMY_PROVIDER, LOOMY_VERSION, LOOMY_WECHAT_APP_ID, LOOMY_WECHAT_REDIRECT_URI, LocalAdapter, LoomyAdapter, LoomyAuth, LoomyProvider, LoomyQrLogin, ModelCatalog, OpenRouterCatalog, ProviderHttpError, RACCOON_BASE, RACCOON_BRAND, RACCOON_CLIENT_VERSION, RACCOON_IAM_BASE, RACCOON_PROVIDER, RACCOON_QR_APP_NAME, RACCOON_QR_ORIGIN, RaccoonAdapter, RaccoonAuth, RaccoonIamError, RaccoonProvider, RaccoonQrLogin, RefreshTokenExpiredError, TRAE_APP_ID, TRAE_BRAND, TRAE_CHAT_FUNCTIONS, TRAE_CHECKIN_REQ_SOURCE, TRAE_DIRECTORY_FUNCTIONS, TRAE_PROVIDER, TRAE_REGION_PROFILES, TRAE_SOLO_CHAT_PATH, TRAE_WEB_USER_AGENT, TraeAdapter, TraeAuth, TraeProvider, TraeWebLogin, apply, buildAuthorizeUrl, buildLoomyWechatAuthUrl, buildMessages, buildOpenRouterIndex, buildQrMatrix, buildRows, buildTools, clampMaxTokens, codeartsContextWindow, codeartsEfforts, consumeOpenAiStream, createRaccoonQr, decodeJwtFacts, defaultEffortOf, effortLabel, exchangeAuthorizationCode, exchangeRefreshToken, extractWechatUuid, fetchLoomyWechatUuid, generateDpopKeyPair, generatePkcePair, headersForFetch, inject, isBrandId, liveConfig, loomyGatewaySessionValid, machineIdOf, mergeTraeModels, modelKey, name, normalizeCodeArtsModelId, normalizeEffort, normalizeTraeRegion, openAiStream, openTraeStream, otSessionIdOf, parseCodeArtsPackage, parseCodeArtsRoster, parseLoomyCatalog, parseModelName, parseOpenRouterModels, parseRaccoonCatalog, parseTraeCheckin, parseTraeClientStorage, parseTraeGlobalUsage, parseTraeRemoteModels, parseTraeUsage, parseTraeWireModels, pickActiveCredit, pollRaccoonQr, priceFactorOf, priceFactorOfLabel, raccoonAccessTokenValid, raccoonQrContent, raccoonRefreshCandidate, readJwtExpiry, readOpenRouter, readTraeClientLogin, renderQrSvg, resolveCapabilities, resolveConfig, resolveModelId, signDpopJws, signRequestHuawei, sseEvents, startLoginPage, traeClientDataDirs, traeMessages, traeTools };