dsh-llm-adapters 1.2.0 → 1.2.2

package/lib/types/account-store.d.ts

@@ -30,12 +30,12 @@ export interface RaccoonAccountRecord {
     loginAt: number;
 }
 /**
- * One Trae web login.
+ * One Trae login.
  *
- * `accessToken` is the `Cloud-IDE-JWT` the website itself uses. `deviceId` and
- * `machineId` are the fingerprints captured from that web session — this
- * plugin never reads a desktop install — and are replayed on chat, quota and
- * check-in requests.
+ * `accessToken` is the `Cloud-IDE-JWT` Trae's own clients use. `deviceId` and
+ * `machineId` are replayed on chat, quota and check-in requests. A web login
+ * captures them from its browser session; a `client` login copies the desktop
+ * client's own values, which is the only source the check-in route accepts.
  */
 export interface TraeAccountRecord {
     accessToken: string;
@@ -45,6 +45,8 @@ export interface TraeAccountRecord {
     userId?: string;
     name?: string;
     loginAt: number;
+    /** Where the token came from; absent means the plugin's browser login. */
+    source?: 'web' | 'client';
     /** The `Cloud-IDE-JWT` expiry (about 8 hours); absent when the JWT carries none. */
     expiresAt?: number;
     /**
@@ -81,12 +83,19 @@ export interface CodeArtsAccountRecord {
         d: string;
     };
     userName?: string;
+    /**
+     * The `x-ot-session-id` this account chats under: one stable value instead of
+     * one per request, because the gateway counts concurrent sessions by it.
+     *
+     * A record written before the field existed derives the same value from the
+     * refresh token's profile, so an existing sign-in needs no new login.
+     */
+    otSessionId?: string;
     /**
      * Models the account answered `InferHub.4004.200` for.
      *
-     * The verdict is worth persisting: asking with `maas_type: benefit` spends
-     * one of the three chat slots the plan allows per minute, even though the
-     * call cannot succeed.
+     * Worth persisting: the account has no allowance pack for them, so without the
+     * verdict every call would pay for a request that cannot succeed.
      */
     noBenefit?: string[];
     loginAt: number;

package/lib/types/adapter.d.ts

@@ -16,7 +16,7 @@ import { LoomyProvider } from './loomy.ts';
 import { RaccoonProvider } from './raccoon.ts';
 import { TraeProvider } from './trae.ts';
 import type { AuthStatus } from './auth.ts';
-import type { CheckinStatus, ProviderStatus, QuotaSnapshot } from './types.ts';
+import type { CheckinStatus, ClientLoginStatus, ProviderStatus, QuotaSnapshot } from './types.ts';
 import type { ReadImage } from './wire.ts';
 export interface AdapterOptions {
     brand: BrandId;
@@ -33,7 +33,7 @@ export interface AdapterOptions {
  *
  * Declared as an interface rather than a union so a new provider only has to
  * implement the behaviour, not edit the adapter's type list. The optional
- * check-in methods exist only on Trae.
+ * client-login and check-in methods exist only on Trae.
  */
 export interface ProviderClient {
     status(): Promise<AuthStatus>;
@@ -51,6 +51,10 @@ export interface ProviderClient {
     invalidateModels(): void;
     invalidateQuota(): void;
     close(): void;
+    /** Trae only: the local desktop client's current sign-in state. */
+    localClientLogin?(): Promise<ClientLoginStatus>;
+    /** Trae only: copy that state into the plugin's own account store. */
+    importClientLogin?(): Promise<void>;
     checkinStatus?(): Promise<CheckinStatus>;
     claimCheckin?(): Promise<CheckinStatus>;
 }
@@ -85,6 +89,8 @@ export declare abstract class LocalAdapter extends LlmAdapter {
     cancelBrowserLogin(): Promise<void>;
     /** Claim today's reward; providers without one reject it. */
     claimCheckin(): Promise<CheckinStatus>;
+    /** Import a local client login and return the refreshed account reading. */
+    importClientLogin(): Promise<ProviderStatus>;
     invalidateCatalog(): void;
     invalidateUsage(): void;
     /** Login state plus quota, shaped for the settings page. */

package/lib/types/auth.d.ts

@@ -1,10 +1,11 @@
 /**
  * Credential state for every provider.
  *
- * Sign-in happens in the provider's own web page, so credentials exist in
- * exactly one place: the plugin's own account store. No desktop client file is
- * discovered, read, or written, and no token leaves this module in errors or
- * display fields.
+ * Sign-in happens in the provider's own web page. Trae additionally offers an
+ * explicit, read-only import of the local desktop client's login state; nothing
+ * is ever written back to that client. Either way credentials end up in exactly
+ * one place, the plugin's own account store, and no token leaves this module in
+ * errors or display fields.
  *
  * @module dsh-llm-adapters/auth
  */
@@ -26,6 +27,8 @@ export interface AuthStatus {
     possiblyExpired?: boolean;
     account?: LocalAccount;
     error?: string;
+    /** Trae only: where the token came from. */
+    loginSource?: 'web' | 'client';
 }
 export declare class LoomyAuth {
     private readonly store;
@@ -41,6 +44,13 @@ export interface JwtFacts {
     phone?: string;
     ownerType?: string;
     sessionId?: string;
+    /**
+     * The `sub` claim, which is what an account is called on the Raccoon gateway.
+     *
+     * Unlike the token itself it survives a re-sign, so it is the seed a stable
+     * per-account session id is derived from.
+     */
+    subject?: string;
 }
 /** Read non-secret JWT claims; malformed tokens simply yield no facts. */
 export declare function decodeJwtFacts(token: string): JwtFacts;
@@ -58,12 +68,13 @@ export declare class RaccoonAuth {
     logout(): Promise<void>;
 }
 /**
- * Trae's web login, one per region.
+ * Trae's login, one per region.
  *
- * The `Cloud-IDE-JWT` the website issues lives about eight hours, but the
- * website session behind it lives about fourteen days. The cookies captured at
- * sign-in are replayed against `GetUserToken` to renew the short token silently;
- * only when the session itself dies does the user have to sign in again.
+ * A web login stores the `Cloud-IDE-JWT` from the website plus the cookies
+ * behind it, so the short token can be renewed silently until the website
+ * session dies. A client login stores the token the desktop client already
+ * uses; that token has no website session, and the client itself refreshes it.
+ * Only the client source carries the device id the check-in route accepts.
  */
 export declare class TraeAuth {
     private readonly store;
@@ -77,8 +88,10 @@ export declare class TraeAuth {
     /**
      * The bearer token, or an actionable error when there is none.
      *
-     * A token near its expiry is renewed first; `force` means the gateway already
-     * rejected it, so the renewal is attempted even if the clock disagrees.
+     * A web token near its expiry is renewed first; `force` means the gateway
+     * already rejected it, so the renewal is attempted even if the clock
+     * disagrees. A client token is returned until its own expiry and then asks
+     * for a fresh import, because only the client can refresh it.
      */
     accessToken(force?: boolean): Promise<string>;
     /** Renew the eight-hour JWT with the stored website cookies. */

package/lib/types/codearts-oauth.d.ts

@@ -28,6 +28,17 @@ export interface CodeArtsCredential {
     dpopPrivateJwk?: DpopPrivateJwk;
     /** Display only, from the refresh token's profile; never used for signing. */
     userName?: string;
+    /**
+     * The id the gateway counts concurrent sessions against (`x-ot-session-id`).
+     *
+     * Measured on a real account: the three-session cap is keyed by this header,
+     * not by `Chat-Id` / `Session-Id`. A per-request value makes every call a new
+     * session, so the account spends its own budget on its own history and the
+     * fourth call of the minute comes back `TM.00001041`. Derived from the account
+     * identity instead of stored at random: the same value in every process, and
+     * one that survives a token renewal.
+     */
+    otSessionId?: string;
 }
 /** Who the credential belongs to, as the portal encoded it in the token. */
 export interface CodeArtsUserProfile {
@@ -75,6 +86,14 @@ export declare function readJwtExpiry(token: string): number | undefined;
  * request; without it the field stays empty and the page says so.
  */
 export declare function readUserProfile(token: string | undefined): CodeArtsUserProfile | undefined;
+/**
+ * The session id this account should chat under, derived from who the account is.
+ *
+ * 32 lowercase hex, the shape the IDE's own kernel sends. Nothing but stability
+ * matters here — the gateway uses the value as a key, not as an identity — so it
+ * is hashed from the principal id rather than kept in a file.
+ */
+export declare function otSessionIdOf(profile: CodeArtsUserProfile | undefined): string | undefined;
 /** The portal URL the browser opens; the callback is on loopback. */
 export declare function buildAuthorizeUrl(port: number, pkce: PkcePair, ticketId: string): string;
 /** Where the browser lands after a successful or failed exchange. */

package/lib/types/codearts.d.ts

@@ -19,7 +19,6 @@ import type { AccountStore } from './account-store.ts';
 import { CodeArtsAuth } from './auth.ts';
 import type { AuthStatus } from './auth.ts';
 import type { ProviderModel } from './catalog.ts';
-import { CodeArtsSessionWindow } from './codearts-window.ts';
 import type { LoginStatus } from './login-page.ts';
 import type { OpenRouterLookup } from './openrouter.ts';
 import type { CheckinStatus, QuotaPack, QuotaSnapshot } from './types.ts';
@@ -72,8 +71,6 @@ export interface CodeArtsProviderOptions {
     loginTimeoutMs?: number;
     /** Injectable OpenRouter lookup for tests; defaults to the live catalog. */
     openRouter?: OpenRouterLookup;
-    /** Chat budget; defaults to the process-wide window (survives hot reloads). */
-    window?: CodeArtsSessionWindow;
 }
 /** One roster entry before it becomes a model row. */
 export interface CodeArtsModelRow {
@@ -110,7 +107,6 @@ export declare class CodeArtsProvider {
     /** Models that answered `InferHub.4004.200`: no allowance pack to bill. */
     private readonly noBenefit;
     private noBenefitLoaded;
-    private readonly window;
     private readonly openRouter;
     private readonly sessionId;
     /**
@@ -159,7 +155,7 @@ export declare class CodeArtsProvider {
      * so a conversation pays for the description once.
      */
     private relayImages;
-    /** Ask the vision model to describe one image, within the same chat budget. */
+    /** Ask the vision model to describe one image; another turn on the same session. */
     private describeImage;
     stream(options: GenerateOptions, model: string, readImage: ReadImage | undefined, onInvalidate: () => void): AsyncGenerator<StreamChunk>;
     private send;

package/lib/types/config.d.ts

@@ -45,8 +45,6 @@ export interface Config {
     catalogFetchTimeoutSeconds?: number;
     /** Minutes between automatic OpenRouter syncs; 0 disables the schedule. */
     openRouterSyncMinutes?: number;
-    /** Minutes between Raccoon daily-point checks; 0 disables the monitor. */
-    raccoonCheckinMinutes?: number;
 }
 export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     loomyEnabled: z<boolean, boolean, "volatile-defined">;
@@ -82,7 +80,6 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     modelCacheTtlSeconds: z<number, number, "volatile-defined">;
     catalogFetchTimeoutSeconds: z<number, number, "volatile-defined">;
     openRouterSyncMinutes: z<number, number, "volatile-defined">;
-    raccoonCheckinMinutes: z<number, number, "volatile-defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
     loomyEnabled: z<boolean, boolean, "volatile-defined">;
     raccoonEnabled: z<boolean, boolean, "volatile-defined">;
@@ -117,7 +114,6 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     modelCacheTtlSeconds: z<number, number, "volatile-defined">;
     catalogFetchTimeoutSeconds: z<number, number, "volatile-defined">;
     openRouterSyncMinutes: z<number, number, "volatile-defined">;
-    raccoonCheckinMinutes: z<number, number, "volatile-defined">;
 }>>, "plain">;
 export interface ResolvedConfig {
     loomyEnabled: boolean;
@@ -153,7 +149,6 @@ export interface ResolvedConfig {
     modelCacheTtlMs: number;
     catalogFetchTimeoutMs: number;
     openRouterSyncMinutes: number;
-    raccoonCheckinMinutes: number;
 }
 export type ParsedConfig = {
     readonly [K in keyof Config]?: unknown;

package/lib/types/index.d.ts

@@ -59,27 +59,28 @@ export { OpenRouterCatalog, buildOpenRouterIndex, parseOpenRouterModels, readOpe
 export type { OpenRouterIndex, OpenRouterLookup, OpenRouterModel, OpenRouterStatus, OpenRouterSyncResult, } from './openrouter.ts';
 export { LoomyProvider, LOOMY_BASE, LOOMY_VERSION, loomyGatewaySessionValid } from './loomy.ts';
 export { RaccoonProvider, RACCOON_BASE, RACCOON_CLIENT_VERSION, raccoonAccessTokenValid, raccoonRefreshCandidate, } from './raccoon.ts';
-export { TraeProvider, TRAE_CHAT_FUNCTIONS, TRAE_DIRECTORY_FUNCTIONS, mergeTraeModels, normalizeEffort, openTraeStream, parseTraeGlobalUsage, parseTraeRemoteModels, parseTraeUsage, parseTraeWireModels, traeMessages, traeTools, } from './trae.ts';
+export { TraeProvider, TRAE_CHAT_FUNCTIONS, TRAE_CHECKIN_REQ_SOURCE, TRAE_DIRECTORY_FUNCTIONS, mergeTraeModels, normalizeEffort, openTraeStream, parseTraeCheckin, parseTraeGlobalUsage, parseTraeRemoteModels, parseTraeUsage, parseTraeWireModels, traeMessages, traeTools, } from './trae.ts';
 export type { TraeCatalog, TraeModelMeta, TraeProviderOptions, TraeRemoteModel, TraeWireModel, } from './trae.ts';
 export { TRAE_APP_ID, TRAE_REGION_PROFILES, TRAE_SOLO_CHAT_PATH, TRAE_WEB_USER_AGENT } from './trae-endpoints.ts';
 export type { TraeRegionProfile } from './trae-endpoints.ts';
+export { parseTraeClientStorage, readTraeClientLogin, traeClientDataDirs } from './trae-client.ts';
+export type { TraeClientDetection, TraeClientLoginState, TraeClientReadOptions } from './trae-client.ts';
 export { TraeWebLogin, machineIdOf } from './trae-login.ts';
 export type { TraeLoginAccount, TraeWebLoginOptions } from './trae-login.ts';
 export { CodeArtsProvider, CODEARTS_DEFAULT_EFFORT, CODEARTS_EFFORTS, clampMaxTokens, codeartsEfforts, normalizeCodeArtsModelId, parseCodeArtsPackage, parseCodeArtsRoster, pickActiveCredit, priceFactorOfLabel, } from './codearts.ts';
 export type { CodeArtsActivity, CodeArtsModelRow, CodeArtsPackageInfo, CodeArtsProviderOptions, } from './codearts.ts';
 export { CODEARTS_BENEFIT_FALLBACK, CODEARTS_CHAT_URL, CODEARTS_CONTEXT_WINDOWS, CODEARTS_EFFORT_LEVELS, CODEARTS_FALLBACK_CONTEXT_WINDOW, CODEARTS_MAX_OUTPUT_TOKENS, CODEARTS_SNAP_BASE, CODEARTS_VISION_MODELS, codeartsContextWindow, } from './codearts-endpoints.ts';
 export { headersForFetch, signRequestHuawei } from './codearts-sign.ts';
-export { RefreshTokenExpiredError, buildAuthorizeUrl, exchangeAuthorizationCode, exchangeRefreshToken, generateDpopKeyPair, generatePkcePair, readJwtExpiry, signDpopJws, } from './codearts-oauth.ts';
+export { RefreshTokenExpiredError, buildAuthorizeUrl, exchangeAuthorizationCode, exchangeRefreshToken, generateDpopKeyPair, generatePkcePair, otSessionIdOf, readJwtExpiry, signDpopJws, } from './codearts-oauth.ts';
 export type { CodeArtsCredential, DpopKeyPair, DpopPrivateJwk, PkcePair } from './codearts-oauth.ts';
 export { CodeArtsLogin } from './codearts-login.ts';
 export type { CodeArtsLoginAccount, CodeArtsLoginOptions } from './codearts-login.ts';
-export { CODEARTS_SESSION_LIMIT, CODEARTS_SESSION_WINDOW_MS, CodeArtsSessionWindow, sharedSessionWindow, } from './codearts-window.ts';
 export { ProviderHttpError, buildMessages, buildTools, consumeOpenAiStream, openAiStream, sseEvents } from './wire.ts';
 export type { WireMessage } from './wire.ts';
 export { API_PREFIX, buildRows } from './api.ts';
 export { liveConfig, resolveConfig } from './config.ts';
 export type { Config as ConfigShape, LiveConfig, ParsedConfig, ResolvedConfig } from './config.ts';
-export type { CheckinStatus, ProviderStatus, QuotaPack, QuotaSnapshot } from './types.ts';
+export type { CheckinStatus, ClientLoginStatus, ProviderStatus, QuotaPack, QuotaSnapshot } from './types.ts';
 export declare const name = "llm-adapters";
 export declare const inject: string[];
 export declare const Config: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
@@ -116,7 +117,6 @@ export declare const Config: import("@deepseek-ai/schemastery").default<Schemast
     modelCacheTtlSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
     catalogFetchTimeoutSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
     openRouterSyncMinutes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    raccoonCheckinMinutes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
     loomyEnabled: import("@deepseek-ai/schemastery").default<boolean, boolean, "volatile-defined">;
     raccoonEnabled: import("@deepseek-ai/schemastery").default<boolean, boolean, "volatile-defined">;
@@ -151,6 +151,5 @@ export declare const Config: import("@deepseek-ai/schemastery").default<Schemast
     modelCacheTtlSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
     catalogFetchTimeoutSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
     openRouterSyncMinutes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    raccoonCheckinMinutes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
 }>>, "plain">;
 export declare function apply(ctx: Context, config: ParsedConfig): void;

package/lib/types/raccoon.d.ts

@@ -15,6 +15,7 @@ import { ModelCatalog } from './catalog.ts';
 import type { ProviderModel } from './catalog.ts';
 import type { OpenRouterLookup } from './openrouter.ts';
 import type { CheckinStatus, QuotaSnapshot } from './types.ts';
+import { ProviderHttpError } from './wire.ts';
 import type { ReadImage } from './wire.ts';
 export declare const RACCOON_BASE = "https://xiaohuanxiong.com/api/web";
 export declare const RACCOON_CLIENT_VERSION = "v1.0.35";
@@ -30,7 +31,68 @@ export interface RaccoonProviderOptions {
     fetchImpl?: typeof fetch;
     /** Injectable OpenRouter lookup for tests; defaults to the live catalog. */
     openRouter?: OpenRouterLookup;
+    /** Injectable session-id bookkeeping for tests; defaults to the real one. */
+    sessionIds?: RaccoonSessionIds;
 }
+/**
+ * The upstream code for the account's token-throughput wall.
+ *
+ * It reads like a request-rate complaint (`您的模型请求频率超限`) and is not
+ * one: measured on a live account, ten large requests in ten seconds hit it
+ * while fifty small ones did not, and the window refills by throughput rather
+ * than by request count. The gateway sends no `Retry-After` and no
+ * `x-ratelimit-*` header, so nothing here can compute a wait either.
+ */
+export declare const RACCOON_RATE_LIMIT_CODE = "user_model_rate_limited";
+/**
+ * Whether a rejection is the token wall rather than a generic failure.
+ *
+ * Matched on the status, the code and the wording, because the same condition
+ * arrives as an HTTP 429 and as an error frame inside a 200 stream.
+ */
+export declare function isRaccoonRateLimited(status: number | undefined, text: string): boolean;
+/**
+ * The wall, as an error the caller can tell apart from a generic 429.
+ *
+ * A subclass rather than a flag: the in-band path and the HTTP path would
+ * otherwise both be caught by the same handler, and the second pass would wrap
+ * the message the first pass had already rewritten.
+ */
+export declare class RaccoonRateLimitedError extends ProviderHttpError {
+    constructor(message: string);
+}
+/**
+ * One conversation's session id, stable across the turns of that conversation.
+ *
+ * The official client never opens a session per request — measured on its own
+ * logs, 125 calls over 26 minutes all carried one `sess-0-53927d74` — while an
+ * implementation that mints a fresh id per request tells the gateway that one
+ * account opened hundreds of sessions within minutes.
+ *
+ * The id is a pure function of (account, model) rather than a random value, so a
+ * restarted or hot-reloaded process continues the same conversation instead of
+ * presenting a new session, and two models stay two conversations. The principal
+ * itself never leaves the process — only a truncated digest of it does.
+ */
+export declare class RaccoonSessionIds {
+    private readonly principal;
+    /**
+     * @param principal - a value that is stable for one account and identifies it
+     *   without being the token itself (the JWT's `sub`).
+     */
+    constructor(principal: () => Promise<string | undefined>);
+    for(model: string): Promise<string | undefined>;
+}
+/**
+ * `sess-<sequence>-<8 hex>`, the shape the official client sends.
+ *
+ * The sequence is the official client's process-local counter and is pinned to 0
+ * here on purpose: an incrementing value would make one conversation look like a
+ * different session after a restart, which is the one thing this id exists to
+ * prevent. Identity lives in the digest, which is truncated on purpose — the id
+ * must separate accounts without naming them on the wire.
+ */
+export declare function raccoonSessionId(principal: string, model: string): string;
 /** Whether the gateway accepts a token harvested from the browser. */
 export declare function raccoonAccessTokenValid(token: string, fetchImpl?: typeof fetch): Promise<boolean>;
 /**
@@ -43,9 +105,9 @@ export declare class RaccoonProvider {
     readonly catalog: ModelCatalog;
     private quotaCache;
     private quotaInflight;
-    private checkinInflight;
     private loginFlow;
     private readonly openRouter;
+    private readonly sessionIds;
     constructor(options: RaccoonProviderOptions);
     status(): Promise<import("./auth.ts").AuthStatus>;
     signedIn(): Promise<boolean>;
@@ -58,6 +120,14 @@ export declare class RaccoonProvider {
     private login;
     logoutAccount(): Promise<void>;
     private headers;
+    /**
+     * The chat headers, including the session id the gateway counts sessions by.
+     *
+     * Only chat carries it: the catalogue, quota and check-in routes are plain
+     * business calls the official client sends outside any session, so leaving
+     * them alone keeps this change to the one route it was measured on.
+     */
+    private chatHeaders;
     /** Run one JSON call; a rejected token means this login needs a new scan. */
     private authorizedJson;
     private fetchModels;
@@ -76,12 +146,15 @@ export declare class RaccoonProvider {
      * `point_grant_popups` on `setting_info`; the bills list is the durable proof.
      */
     private dailyGrant;
-    checkinStatus(): Promise<CheckinStatus>;
-    claimCheckin(): Promise<CheckinStatus>;
     /**
-     * One automatic check-in pass: report today's grant, or ask the website path
-     * to issue it. Shared so overlapping timers cannot spend two call slots.
+     * Read today's grant. **Read-only on purpose.**
+     *
+     * The gateway has no claim endpoint: points are issued on the day's first
+     * website visit. Replaying that visit (`setting_info`) can trigger the grant
+     * from here, but doing so takes a state-changing action on the account without
+     * the user asking for it in that moment, so the plugin only reports. Claiming
+     * is the website's job, and the card links there.
      */
-    ensureDailyCheckin(): Promise<CheckinStatus>;
+    checkinStatus(): Promise<CheckinStatus>;
     stream(options: GenerateOptions, model: string, readImage: ReadImage | undefined, onUnauthorized?: () => void): AsyncGenerator<StreamChunk>;
 }

package/lib/types/trae-client.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The local Trae desktop client's sign-in state.
+ *
+ * Trae's check-in route insists on the device id its own client registered, so
+ * the website login cannot use it. When the client is installed and already
+ * signed in, the plugin can reuse that state instead:
+ *
+ *  - the `Cloud-IDE-JWT` stored under `iCubeAuthInfo://icube.cloudide`;
+ *  - the 16-digit device id encoded in the `iCubeAuthInfo://icube-dc:<id>` key;
+ *  - `telemetry.machineId`, the value the client sends as `x-machine-id`.
+ *
+ * The stored value uses the client's own AES-CBC envelope: six magic bytes, a
+ * 32-byte key material, then the ciphertext. The AES key and IV are derived
+ * from that key material with SHA-512 and a fixed salt, and the plaintext is a
+ * SHA-512 digest followed by the JSON document. Nothing here writes to the
+ * client, and the token is never returned by the settings API.
+ *
+ * @module dsh-llm-adapters/trae-client
+ */
+import type { TraeRegion } from './brand.ts';
+import type { ClientLoginStatus } from './types.ts';
+/** What the provider stores after importing a client login. */
+export interface TraeClientLoginState {
+    region: TraeRegion;
+    token: string;
+    deviceId: string;
+    machineId: string;
+    userId?: string;
+    name?: string;
+    expiresAt?: number;
+}
+/** The settings-facing half (no token) plus the internal state when usable. */
+export interface TraeClientDetection {
+    status: ClientLoginStatus;
+    state?: TraeClientLoginState;
+}
+export interface TraeClientReadOptions {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+}
+/**
+ * The client's data directory, most specific first.
+ *
+ * `DSH_TRAE_CLIENT_DIR` is a portable/test override; the region-specific
+ * variables let one machine keep separate CN and international installs.
+ */
+export declare function traeClientDataDirs(region: TraeRegion, options?: TraeClientReadOptions): string[];
+/** Parse one `storage.json` document; exported for tests and diagnostics. */
+export declare function parseTraeClientStorage(region: TraeRegion, storage: Record<string, unknown>): TraeClientDetection;
+/** Read the currently selected region's client state from this machine. */
+export declare function readTraeClientLogin(region: TraeRegion, options?: TraeClientReadOptions): TraeClientDetection;

package/lib/types/trae-endpoints.d.ts

@@ -33,6 +33,8 @@ export interface TraeRegionProfile {
      * the dollar allowance instead.
      */
     usageV2: boolean;
+    /** Daily check-in exists only on the mainland deployment. */
+    checkin: boolean;
 }
 export declare const TRAE_REGION_PROFILES: Record<TraeRegion, TraeRegionProfile>;
 /** The app id Trae's own clients send; not account-specific. */

package/lib/types/trae-login.d.ts

@@ -1,15 +1,17 @@
 /**
  * Trae sign-in through the provider's own website.
  *
- * The plugin does not read a desktop install: it opens a dedicated browser
+ * This flow does not read a desktop install: it opens a dedicated browser
  * profile, lets the user sign in on trae.cn / trae.ai, and then takes the
  * session the website itself created. Two things come out of that session:
  *
  *  - the `Cloud-IDE-JWT` token, fetched with the page's own cookies through
  *    `/cloudide/api/v3/common/GetUserToken` — the same call the site makes;
  *  - the device fingerprint (`__msuuid__` from the page, or one generated in
- *    the page), which Trae's check-in route requires and which therefore must
- *    belong to this web session rather than to a machine install.
+ *    the page), stored with the web login.
+ *
+ * The check-in route does not accept this web fingerprint, so check-in is
+ * enabled only for the separate client-login import in `trae-client.ts`.
  *
  * Cookies are captured over the DevTools protocol and kept in the plugin's own
  * account store so the short-lived JWT can be renewed later; the dedicated

package/lib/types/trae.d.ts

@@ -1,8 +1,10 @@
 /**
- * Trae provider: model directory, SOLO chat and quota.
+ * Trae provider: model directory, SOLO chat, quota and client check-in.
  *
  * Trae's website login yields the same `Cloud-IDE-JWT` its own clients use, so
- * the plugin talks to the same gateways they do. Two catalog sources are merged:
+ * the plugin talks to the same gateways they do. A second sign-in method copies
+ * that token from the local desktop client; only that method carries the device
+ * id the daily check-in route accepts. Two catalog sources are merged:
  *
  *  - the Remote directory (`/api/remote/v1/models`) is the model skeleton —
  *    display name, context window, multiplier, reasoning options, multimodal;
@@ -29,7 +31,8 @@ import { ModelCatalog } from './catalog.ts';
 import type { ProviderModel } from './catalog.ts';
 import type { LoginStatus } from './login-page.ts';
 import type { OpenRouterIndex, OpenRouterLookup } from './openrouter.ts';
-import type { QuotaSnapshot } from './types.ts';
+import type { TraeClientDetection } from './trae-client.ts';
+import type { CheckinStatus, ClientLoginStatus, QuotaSnapshot } from './types.ts';
 import type { ReadImage, WireMessage } from './wire.ts';
 /** Chat functions, in the order Trae itself prefers them. */
 export declare const TRAE_CHAT_FUNCTIONS: readonly string[];
@@ -103,6 +106,8 @@ export interface TraeProviderOptions {
     logger?: (message: string) => void;
     /** The shared OpenRouter snapshot; a private one is created when omitted. */
     openRouter?: OpenRouterLookup;
+    /** Overridable in tests; defaults to reading this machine's Trae client. */
+    clientLogin?: () => TraeClientDetection;
 }
 /**
  * The persistent browser profile used for one region.
@@ -154,6 +159,12 @@ export declare function parseTraeUsage(payload: unknown): QuotaSnapshot;
  * dollars and must not be printed as credits.
  */
 export declare function parseTraeGlobalUsage(payload: unknown): QuotaSnapshot;
+/**
+ * The check-in body's `req_source`: 1 is the IDE, 2 is Trae Work. The desktop
+ * client sends 1; the claim route rejects the plugin's former empty body.
+ */
+export declare const TRAE_CHECKIN_REQ_SOURCE = 1;
+export declare function parseTraeCheckin(payload: unknown): CheckinStatus;
 export declare class TraeProvider {
     private readonly options;
     private catalogInstance;
@@ -185,6 +196,7 @@ export declare class TraeProvider {
         possiblyExpired?: boolean;
         account?: import("./auth.ts").LocalAccount;
         error?: string;
+        loginSource?: "web" | "client";
     }>;
     signedIn(): Promise<boolean>;
     models(fresh?: boolean): Promise<readonly ProviderModel[]>;
@@ -199,6 +211,20 @@ export declare class TraeProvider {
     private fetchWire;
     private fetchCatalog;
     quota(fresh?: boolean): Promise<QuotaSnapshot>;
+    /**
+     * The second sign-in method: the desktop client's current state.
+     *
+     * Read-only; the settings page only receives the non-secret status, never
+     * the token.
+     */
+    localClientLogin(): Promise<ClientLoginStatus>;
+    private readClientLogin;
+    /** Import the desktop client's token, device id and machine id. */
+    importClientLogin(): Promise<void>;
+    private checkinContext;
+    checkinStatus(): Promise<CheckinStatus>;
+    /** Claim today's reward. The only state-changing call in this provider. */
+    claimCheckin(): Promise<CheckinStatus>;
     stream(options: GenerateOptions, model: string, readImage: ReadImage | undefined, onInvalidate: () => void): AsyncGenerator<StreamChunk>;
     startBrowserLogin(region?: TraeRegion): Promise<LoginStatus>;
     browserLoginStatus(): LoginStatus;

package/lib/types/types.d.ts

@@ -53,6 +53,22 @@ export interface CheckinStatus {
     /** A page the user can open when the provider has no claimable API. */
     url?: string;
 }
+/**
+ * The local Trae client's state, as shown on the settings page.
+ *
+ * Never carries the token: only whether the client was found, whether a usable
+ * login was read, and the non-secret account fields.
+ */
+export interface ClientLoginStatus {
+    /** A Trae client data directory exists on this machine. */
+    available: boolean;
+    /** The stored login is present, unexpired and usable. */
+    signedIn: boolean;
+    name?: string;
+    userId?: string;
+    expiresAt?: number;
+    error?: string;
+}
 export interface ProviderStatus extends AuthStatus {
     brand: BrandId;
     /** Trae only: the region this reading belongs to. */
@@ -60,7 +76,9 @@ export interface ProviderStatus extends AuthStatus {
     /** Present only after a successful quota read. */
     quota?: QuotaSnapshot;
     quotaError?: string;
-    /** Trae CN only. */
+    /** Trae only: the second sign-in method, when the desktop client exists. */
+    clientLogin?: ClientLoginStatus;
+    /** Trae CN only, and only for a login imported from the client. */
     checkin?: CheckinStatus;
 }
 export type { LocalAccount };

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "dsh-llm-adapters",
   "displayName": "Local LLM Adapters",
-  "description": "DeepSeek Harness adapters for Loomy, SenseTime Raccoon and Trae. Sign in through the provider’s own web page (WeChat QR for Loomy and Raccoon, a dedicated browser window for Trae), then use the account’s models with quota, thinking levels and per-model settings pages.",
-  "version": "1.2.0",
+  "description": "DeepSeek Harness adapters for Loomy, SenseTime Raccoon and Trae. Sign in through the provider’s own web page (WeChat QR for Loomy and Raccoon, a dedicated browser window for Trae), or reuse a signed-in local Trae client for the mainland check-in, then use the account’s models with quota, thinking levels and per-model settings pages.",
+  "version": "1.2.2",
   "type": "module",
   "license": "MIT",
   "author": "k1-h2",
@@ -19,6 +19,7 @@
     "qr-login",
     "wechat-login",
     "web-login",
+    "client-login",
     "openai-compatible",
     "model-provider",
     "trae",