dsh-llm-adapters 1.2.0 → 1.2.2

package/src/raccoon.ts

@@ -9,8 +9,9 @@
  */
 
 import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm'
+import { createHash } from 'node:crypto'
 import type { AccountStore } from './account-store.ts'
-import { RaccoonAuth } from './auth.ts'
+import { RaccoonAuth, decodeJwtFacts } from './auth.ts'
 import { RaccoonQrLogin } from './raccoon-login.ts'
 import type { LoginStatus } from './login-page.ts'
 import {
@@ -47,6 +48,8 @@ export interface RaccoonProviderOptions {
   fetchImpl?: typeof fetch
   /** Injectable OpenRouter lookup for tests; defaults to the live catalog. */
   openRouter?: OpenRouterLookup
+  /** Injectable session-id bookkeeping for tests; defaults to the real one. */
+  sessionIds?: RaccoonSessionIds
 }
 
 function numeric(value: unknown): number | undefined {
@@ -98,6 +101,118 @@ function raccoonHeaders(token: string): Record<string, string> {
   }
 }
 
+/**
+ * The upstream code for the account's token-throughput wall.
+ *
+ * It reads like a request-rate complaint (`您的模型请求频率超限`) and is not
+ * one: measured on a live account, ten large requests in ten seconds hit it
+ * while fifty small ones did not, and the window refills by throughput rather
+ * than by request count. The gateway sends no `Retry-After` and no
+ * `x-ratelimit-*` header, so nothing here can compute a wait either.
+ */
+export const RACCOON_RATE_LIMIT_CODE = 'user_model_rate_limited'
+
+/** Wording the gateway has used alongside that code. */
+const RATE_LIMIT_WORDS = ['user_model_rate_limited', 'rate_limit', '频率超限']
+
+/**
+ * Whether a rejection is the token wall rather than a generic failure.
+ *
+ * Matched on the status, the code and the wording, because the same condition
+ * arrives as an HTTP 429 and as an error frame inside a 200 stream.
+ */
+export function isRaccoonRateLimited(status: number | undefined, text: string): boolean {
+  if (status === 429) return true
+  const lower = text.toLowerCase()
+  return RATE_LIMIT_WORDS.some(word => lower.includes(word.toLowerCase()))
+}
+
+/**
+ * The wall, as an error the caller can tell apart from a generic 429.
+ *
+ * A subclass rather than a flag: the in-band path and the HTTP path would
+ * otherwise both be caught by the same handler, and the second pass would wrap
+ * the message the first pass had already rewritten.
+ */
+export class RaccoonRateLimitedError extends ProviderHttpError {
+  constructor(message: string) {
+    super(message, 429)
+    this.name = 'RaccoonRateLimitedError'
+  }
+}
+
+/**
+ * The message a user sees once the wall is hit.
+ *
+ * The raw text says "retry later" and gives no reason, which is why this reads
+ * as the plugin being broken. The honest answer names the cause and the one
+ * lever the user actually has on this side.
+ */
+function raccoonRateLimited(detail: string): RaccoonRateLimitedError {
+  return new RaccoonRateLimitedError(
+    '小浣熊账号的模型吞吐已达上限（不是每分钟请求数，而是按账号的 token 速率）。'
+    + '一轮对话带的上下文越大越快撞到，撞到后额度按吞吐缓慢回血，上游也没有给恢复时间。'
+    + '稍等一会儿再发；把该模型的上下文窗口调小，同一会话能撑得更久。'
+    + `上游原文：${detail}`,
+  )
+}
+
+/** The `error` object a compatible gateway puts in an SSE frame. */
+function frameFailure(frame: Record<string, unknown>): { code?: string, message?: string } | undefined {
+  const error = frame.error
+  if (error === undefined) return undefined
+  if (typeof error === 'string') return { message: error }
+  if (error === null || typeof error !== 'object') return undefined
+  const record = error as Record<string, unknown>
+  const code = typeof record.code === 'string' ? record.code : undefined
+  const message = typeof record.message === 'string' ? record.message : undefined
+  return {
+    ...code === undefined ? {} : { code },
+    ...message === undefined ? {} : { message },
+  }
+}
+
+/**
+ * One conversation's session id, stable across the turns of that conversation.
+ *
+ * The official client never opens a session per request — measured on its own
+ * logs, 125 calls over 26 minutes all carried one `sess-0-53927d74` — while an
+ * implementation that mints a fresh id per request tells the gateway that one
+ * account opened hundreds of sessions within minutes.
+ *
+ * The id is a pure function of (account, model) rather than a random value, so a
+ * restarted or hot-reloaded process continues the same conversation instead of
+ * presenting a new session, and two models stay two conversations. The principal
+ * itself never leaves the process — only a truncated digest of it does.
+ */
+export class RaccoonSessionIds {
+  /**
+   * @param principal - a value that is stable for one account and identifies it
+   *   without being the token itself (the JWT's `sub`).
+   */
+  constructor(private readonly principal: () => Promise<string | undefined>) {}
+
+  async for(model: string): Promise<string | undefined> {
+    const principal = await this.principal()
+    if (principal === undefined) return undefined
+    return raccoonSessionId(principal, model)
+  }
+}
+
+/**
+ * `sess-<sequence>-<8 hex>`, the shape the official client sends.
+ *
+ * The sequence is the official client's process-local counter and is pinned to 0
+ * here on purpose: an incrementing value would make one conversation look like a
+ * different session after a restart, which is the one thing this id exists to
+ * prevent. Identity lives in the digest, which is truncated on purpose — the id
+ * must separate accounts without naming them on the wire.
+ */
+export function raccoonSessionId(principal: string, model: string): string {
+  const digest = createHash('sha256').update(`${principal}\0${model}`).digest('hex').slice(0, 8)
+  return `sess-0-${digest}`
+}
+
 /** Whether the gateway accepts a token harvested from the browser. */
 export async function raccoonAccessTokenValid(
   token: string,
@@ -156,12 +271,16 @@ export class RaccoonProvider {
   readonly catalog: ModelCatalog
   private quotaCache: { at: number, value: QuotaSnapshot } | undefined
   private quotaInflight: Promise<QuotaSnapshot> | undefined
-  private checkinInflight: Promise<CheckinStatus> | undefined
   private loginFlow: RaccoonQrLogin | undefined
   private readonly openRouter: OpenRouterLookup
+  private readonly sessionIds: RaccoonSessionIds
 
   constructor(private readonly options: RaccoonProviderOptions) {
     this.openRouter = options.openRouter ?? new OpenRouterCatalog(options.fetchImpl ?? fetch)
+    this.sessionIds = options.sessionIds ?? new RaccoonSessionIds(async () => {
+      const stored = await options.store.raccoon()
+      return stored === undefined ? undefined : decodeJwtFacts(stored.accessToken).subject
+    })
     this.catalog = new ModelCatalog(
       () => this.fetchModels(),
       options.ttlMs,
@@ -225,6 +344,19 @@ export class RaccoonProvider {
     return raccoonHeaders(token)
   }
 
+  /**
+   * The chat headers, including the session id the gateway counts sessions by.
+   *
+   * Only chat carries it: the catalogue, quota and check-in routes are plain
+   * business calls the official client sends outside any session, so leaving
+   * them alone keeps this change to the one route it was measured on.
+   */
+  private async chatHeaders(token: string, model: string): Promise<Record<string, string>> {
+    const base = raccoonHeaders(token)
+    const sessionId = await this.sessionIds.for(model).catch(() => undefined)
+    return sessionId === undefined ? base : { ...base, 'x-raccoon-session-id': sessionId }
+  }
+
   /** Run one JSON call; a rejected token means this login needs a new scan. */
   private async authorizedJson<T>(
     path: string,
@@ -371,6 +503,15 @@ export class RaccoonProvider {
     return undefined
   }
 
+  /**
+   * Read today's grant. **Read-only on purpose.**
+   *
+   * The gateway has no claim endpoint: points are issued on the day's first
+   * website visit. Replaying that visit (`setting_info`) can trigger the grant
+   * from here, but doing so takes a state-changing action on the account without
+   * the user asking for it in that moment, so the plugin only reports. Claiming
+   * is the website's job, and the card links there.
+   */
   async checkinStatus(): Promise<CheckinStatus> {
     const grant = await this.dailyGrant()
     if (grant !== undefined) {
@@ -393,53 +534,6 @@ export class RaccoonProvider {
     }
   }
 
-  async claimCheckin(): Promise<CheckinStatus> {
-    // `setting_info` is the call the website makes on load; it is also the one
-    // that carries the point-grant popups. Ask as the web client so the server
-    // treats it as a normal page visit rather than a desktop API call.
-    await this.authorizedJson('/office/v3/setting_info', {}, {
-      'x-client-platform': 'web',
-      'x-client-version': '131.0.0.0',
-    })
-    const grant = await this.dailyGrant()
-    if (grant === undefined) {
-      return {
-        available: true,
-        claimed: false,
-        deviceClaimed: false,
-        message: '每日积分尚未到账；请打开网页签到',
-        url: RACCOON_CHECKIN_URL,
-      }
-    }
-    this.invalidateQuota()
-    return {
-      available: true,
-      claimed: true,
-      deviceClaimed: false,
-      ...grant.points === undefined ? {} : { reward: grant.points },
-      ...grant.grantedAt === undefined ? {} : { grantedAt: grant.grantedAt },
-      message: '每日积分已到账',
-      url: RACCOON_CHECKIN_URL,
-    }
-  }
-
-  /**
-   * One automatic check-in pass: report today's grant, or ask the website path
-   * to issue it. Shared so overlapping timers cannot spend two call slots.
-   */
-  async ensureDailyCheckin(): Promise<CheckinStatus> {
-    if (this.checkinInflight !== undefined) return this.checkinInflight
-    this.checkinInflight = (async () => {
-      const status = await this.checkinStatus()
-      return status.claimed ? status : this.claimCheckin()
-    })()
-    try {
-      return await this.checkinInflight
-    } finally {
-      this.checkinInflight = undefined
-    }
-  }
-
   async *stream(
     options: GenerateOptions,
     model: string,
@@ -465,7 +559,7 @@ export class RaccoonProvider {
     try {
       yield* openAiStream({
         url: `${RACCOON_BASE}/llm/v2/chat/completions`,
-        headers: this.headers(token),
+        headers: await this.chatHeaders(token, model),
         body,
         signal: options.signal,
         fetchImpl: this.options.fetchImpl,
@@ -474,11 +568,30 @@ export class RaccoonProvider {
           this.invalidateQuota()
           onUnauthorized?.()
         },
+        // The same wall arrives inside a 200 stream as an error frame. Without
+        // this hook it would surface as a generic 502 and read as a plugin bug.
+        onFrame: (frame) => {
+          const failure = frameFailure(frame)
+          if (failure === undefined) return
+          const detail = failure.message ?? failure.code ?? '上游返回错误'
+          throw isRaccoonRateLimited(undefined, `${failure.code ?? ''} ${detail}`)
+            ? raccoonRateLimited(detail)
+            : new ProviderHttpError(detail, 502)
+        },
       })
     } catch (error) {
       if (error instanceof ProviderHttpError && (error.status === 401 || error.status === 403)) {
         throw new Error('小浣熊登录已失效，请在设置页点「打开扫码登录」。')
       }
+      // The HTTP path: `openAiStream` throws the status before any frame is read.
+      // The in-band path already rewrote its own error, so it is left alone.
+      // Only the status is trusted here: matching on the wording would re-wrap a
+      // 502 that the in-band hook deliberately classified as a gateway failure.
+      if (error instanceof ProviderHttpError
+        && !(error instanceof RaccoonRateLimitedError)
+        && error.status === 429) {
+        throw raccoonRateLimited(error.message)
+      }
       throw error
     }
   }

package/src/trae-client.ts

@@ -0,0 +1,312 @@
+/**
+ * The local Trae desktop client's sign-in state.
+ *
+ * Trae's check-in route insists on the device id its own client registered, so
+ * the website login cannot use it. When the client is installed and already
+ * signed in, the plugin can reuse that state instead:
+ *
+ *  - the `Cloud-IDE-JWT` stored under `iCubeAuthInfo://icube.cloudide`;
+ *  - the 16-digit device id encoded in the `iCubeAuthInfo://icube-dc:<id>` key;
+ *  - `telemetry.machineId`, the value the client sends as `x-machine-id`.
+ *
+ * The stored value uses the client's own AES-CBC envelope: six magic bytes, a
+ * 32-byte key material, then the ciphertext. The AES key and IV are derived
+ * from that key material with SHA-512 and a fixed salt, and the plaintext is a
+ * SHA-512 digest followed by the JSON document. Nothing here writes to the
+ * client, and the token is never returned by the settings API.
+ *
+ * @module dsh-llm-adapters/trae-client
+ */
+
+import { createDecipheriv, createHash } from 'node:crypto'
+import { existsSync, readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import type { TraeRegion } from './brand.ts'
+import type { ClientLoginStatus } from './types.ts'
+
+/** What the provider stores after importing a client login. */
+export interface TraeClientLoginState {
+  region: TraeRegion
+  token: string
+  deviceId: string
+  machineId: string
+  userId?: string
+  name?: string
+  expiresAt?: number
+}
+
+/** The settings-facing half (no token) plus the internal state when usable. */
+export interface TraeClientDetection {
+  status: ClientLoginStatus
+  state?: TraeClientLoginState
+}
+
+export interface TraeClientReadOptions {
+  platform?: NodeJS.Platform
+  env?: NodeJS.ProcessEnv
+  home?: string
+}
+
+const AUTH_PROVIDER_KEY = 'iCubeAuthInfo://icube.cloudide'
+const DEVICE_KEY_PREFIX = 'iCubeAuthInfo://icube-dc:'
+const MACHINE_KEY = 'telemetry.machineId'
+const SERVICE_MACHINE_KEY = 'storage.serviceMachineId'
+
+const AES_MAGIC = Buffer.from([0x74, 0x63, 0x05, 0x10, 0x00, 0x00])
+const AES_PRIVATE_MAGIC = Buffer.from([0x12, 0x39, 0x20, 0x20, 0x02, 0x03])
+const KEY_OFFSET = 6
+const KEY_LENGTH = 32
+const HASH_LENGTH = 64
+/** Aue ^ Due from the client's byteCrypto module. */
+const AES_SALT = Buffer.from(
+  '4dd4c2e6b83162090e52b3c7a6733ba41cb2462b829ab58a196b39db57177524'
+  + 'f49baf7f08e8d68d26a72e37c1a95a2f1f05a51892aef2949732b62a38aadd58',
+  'hex',
+)
+/** Tue ^ Iue, the AES_PRIVATE variant of the same envelope. */
+const AES_PRIVATE_SALT = Buffer.from(
+  '490cc21292b05d0cc06ccbe91fb92e21b5a7c538811dc85e27a96e28104e1cf6'
+  + '9c7166efab232807390da78a8b91e49c44b49a43feb941a1e46f2656e613e47b',
+  'hex',
+)
+const DEVICE_RE = /^\d{16}$/
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined
+}
+
+function text(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined
+}
+
+/** Accept epoch seconds, epoch milliseconds, or an ISO date. */
+function epochMs(value: unknown): number | undefined {
+  if (typeof value === 'number' && Number.isFinite(value) && value > 0) {
+    return value < 1e12 ? Math.round(value * 1_000) : Math.round(value)
+  }
+  if (typeof value === 'string') {
+    if (/^\d+$/.test(value.trim())) return epochMs(Number(value))
+    const parsed = Date.parse(value)
+    return Number.isFinite(parsed) ? parsed : undefined
+  }
+  return undefined
+}
+
+function jwtExpiry(token: string): number | undefined {
+  const parts = token.split('.')
+  if (parts.length < 2) return undefined
+  try {
+    const base64 = parts[1]!.replace(/-/g, '+').replace(/_/g, '/')
+    const padded = base64 + '='.repeat((4 - base64.length % 4) % 4)
+    const payload: unknown = JSON.parse(Buffer.from(padded, 'base64').toString('utf8'))
+    return epochMs(record(payload)?.exp)
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Open one `iCubeAuthInfo` value.
+ *
+ * The digest check is the client's own integrity check: the first 64 plaintext
+ * bytes are SHA-512 of the document that follows. A malformed or changed
+ * envelope is rejected instead of being parsed as garbage.
+ */
+function decryptAuthValue(value: string): unknown {
+  const bytes = Buffer.from(value, 'base64')
+  if (bytes.length < KEY_OFFSET + KEY_LENGTH + HASH_LENGTH) {
+    throw new Error('数据长度不足')
+  }
+  const magic = bytes.subarray(0, KEY_OFFSET)
+  const salt = magic.equals(AES_MAGIC)
+    ? AES_SALT
+    : magic.equals(AES_PRIVATE_MAGIC) ? AES_PRIVATE_SALT : undefined
+  if (salt === undefined) throw new Error('未知的加密格式')
+  const keyMaterial = bytes.subarray(KEY_OFFSET, KEY_OFFSET + KEY_LENGTH)
+  const mixed = createHash('sha512').update(keyMaterial).digest()
+  const derived = createHash('sha512').update(Buffer.concat([mixed, salt])).digest()
+  const decipher = createDecipheriv(
+    'aes-128-cbc',
+    derived.subarray(0, 16),
+    derived.subarray(16, 32),
+  )
+  const plain = Buffer.concat([
+    decipher.update(bytes.subarray(KEY_OFFSET + KEY_LENGTH)),
+    decipher.final(),
+  ])
+  if (plain.length < HASH_LENGTH) throw new Error('解密结果为空')
+  const body = plain.subarray(HASH_LENGTH)
+  const digest = createHash('sha512').update(body).digest()
+  if (!digest.equals(plain.subarray(0, HASH_LENGTH))) throw new Error('校验失败')
+  return JSON.parse(body.toString('utf8'))
+}
+
+/**
+ * The client's data directory, most specific first.
+ *
+ * `DSH_TRAE_CLIENT_DIR` is a portable/test override; the region-specific
+ * variables let one machine keep separate CN and international installs.
+ */
+export function traeClientDataDirs(
+  region: TraeRegion,
+  options: TraeClientReadOptions = {},
+): string[] {
+  const platform = options.platform ?? process.platform
+  const env = options.env ?? process.env
+  const home = options.home ?? homedir()
+  const name = region === 'cn' ? 'Trae CN' : 'Trae'
+  const out: string[] = []
+  const add = (directory: string | undefined): void => {
+    if (directory !== undefined && directory !== '') out.push(directory)
+  }
+  add(env[region === 'cn' ? 'DSH_TRAE_CN_CLIENT_DIR' : 'DSH_TRAE_GLOBAL_CLIENT_DIR'])
+  add(env['DSH_TRAE_CLIENT_DIR'])
+  if (platform === 'win32') {
+    const appData = env['APPDATA'] ?? join(home, 'AppData', 'Roaming')
+    add(join(appData, name))
+  } else if (platform === 'darwin') {
+    add(join(home, 'Library', 'Application Support', name))
+  } else {
+    const config = env['XDG_CONFIG_HOME'] ?? join(home, '.config')
+    add(join(config, name))
+  }
+  return [...new Set(out)]
+}
+
+function storageFile(userDataDir: string): string {
+  return join(userDataDir, 'User', 'globalStorage', 'storage.json')
+}
+
+function authValueOf(storage: Record<string, unknown>): string | undefined {
+  const direct = text(storage[AUTH_PROVIDER_KEY])
+  if (direct !== undefined) return direct
+  for (const key of Object.keys(storage)) {
+    if (key.startsWith('iCubeAuthInfo://') && key.endsWith('.cloudide')) {
+      const value = text(storage[key])
+      if (value !== undefined) return value
+    }
+  }
+  return undefined
+}
+
+/** The client has one device id per machine; the last valid key is current. */
+function deviceIdOf(storage: Record<string, unknown>): string | undefined {
+  const keys = Object.keys(storage).filter(key => key.startsWith(DEVICE_KEY_PREFIX))
+  for (let index = keys.length - 1; index >= 0; index--) {
+    const value = text(keys[index]!.slice(DEVICE_KEY_PREFIX.length))
+    if (value !== undefined && DEVICE_RE.test(value)) return value
+  }
+  return undefined
+}
+
+function regionMismatch(region: TraeRegion, userInfo: Record<string, unknown>): boolean {
+  const account = record(userInfo.account)
+  const userRegion = record(userInfo.userRegion)
+  const evidence = (text(userRegion?.region) ?? text(account?.storeRegion))?.toUpperCase()
+  if (evidence === undefined) return false
+  return region === 'cn' ? evidence !== 'CN' : evidence === 'CN'
+}
+
+/** Parse one `storage.json` document; exported for tests and diagnostics. */
+export function parseTraeClientStorage(
+  region: TraeRegion,
+  storage: Record<string, unknown>,
+): TraeClientDetection {
+  const encrypted = authValueOf(storage)
+  if (encrypted === undefined) {
+    return {
+      status: {
+        available: true,
+        signedIn: false,
+        error: '本机 Trae 客户端尚未登录。请先在客户端完成登录。',
+      },
+    }
+  }
+  let parsed: unknown
+  try {
+    parsed = decryptAuthValue(encrypted)
+  } catch (error) {
+    return {
+      status: {
+        available: true,
+        signedIn: false,
+        error: `读取本机 Trae 客户端登录态失败：${error instanceof Error ? error.message : String(error)}`,
+      },
+    }
+  }
+  const userInfo = record(parsed)
+  const token = text(userInfo?.token)
+  if (userInfo === undefined || token === undefined) {
+    return {
+      status: {
+        available: true,
+        signedIn: false,
+        error: '本机 Trae 客户端登录态里没有令牌，请先在客户端重新登录。',
+      },
+    }
+  }
+  const account = record(userInfo.account)
+  const name = text(account?.username) ?? text(account?.name)
+  const userId = text(userInfo.userId)
+  const expiresAt = epochMs(userInfo.expiredAt) ?? jwtExpiry(token)
+  const identity = {
+    ...name === undefined ? {} : { name },
+    ...userId === undefined ? {} : { userId },
+    ...expiresAt === undefined ? {} : { expiresAt },
+  }
+  const unavailable = (error: string): TraeClientDetection => ({
+    status: { available: true, signedIn: false, ...identity, error },
+  })
+  if (regionMismatch(region, userInfo)) {
+    return unavailable(region === 'cn'
+      ? '本机 Trae 客户端登录的是国际版账号，请切换到国际版后再复用。'
+      : '本机 Trae 客户端登录的是国内版账号，请切换到国内版后再复用。')
+  }
+  if (expiresAt !== undefined && expiresAt <= Date.now()) {
+    return unavailable('本机 Trae 客户端登录已过期，请先在客户端重新登录。')
+  }
+  const deviceId = deviceIdOf(storage)
+  if (deviceId === undefined) {
+    return unavailable('本机 Trae 客户端登录缺少 16 位设备号，请先在客户端重新登录。')
+  }
+  const machineId = text(storage[MACHINE_KEY]) ?? text(storage[SERVICE_MACHINE_KEY])
+  if (machineId === undefined) {
+    return unavailable('本机 Trae 客户端登录缺少机器码，请先在客户端重新登录。')
+  }
+  return {
+    status: { available: true, signedIn: true, ...identity },
+    state: { region, token, deviceId, machineId, ...identity },
+  }
+}
+
+/** Read the currently selected region's client state from this machine. */
+export function readTraeClientLogin(
+  region: TraeRegion,
+  options: TraeClientReadOptions = {},
+): TraeClientDetection {
+  let available = false
+  let error: string | undefined
+  for (const directory of traeClientDataDirs(region, options)) {
+    const file = storageFile(directory)
+    if (!existsSync(file)) continue
+    available = true
+    try {
+      const raw = readFileSync(file, 'utf8').replace(/^\uFEFF/, '')
+      const storage = record(JSON.parse(raw))
+      if (storage === undefined) throw new Error('storage.json 不是对象')
+      return parseTraeClientStorage(region, storage)
+    } catch (cause) {
+      error = `读取本机 Trae 客户端登录态失败：${cause instanceof Error ? cause.message : String(cause)}`
+    }
+  }
+  return {
+    status: {
+      available,
+      signedIn: false,
+      ...error === undefined ? {} : { error },
+    },
+  }
+}

package/src/trae-endpoints.ts

@@ -35,6 +35,8 @@ export interface TraeRegionProfile {
    * the dollar allowance instead.
    */
   usageV2: boolean
+  /** Daily check-in exists only on the mainland deployment. */
+  checkin: boolean
 }
 
 export const TRAE_REGION_PROFILES: Record<TraeRegion, TraeRegionProfile> = {
@@ -49,6 +51,7 @@ export const TRAE_REGION_PROFILES: Record<TraeRegion, TraeRegionProfile> = {
     timezone: 'Asia/Shanghai',
     language: 'zh-cn',
     usageV2: true,
+    checkin: true,
   },
   global: {
     id: 'global',
@@ -61,6 +64,7 @@ export const TRAE_REGION_PROFILES: Record<TraeRegion, TraeRegionProfile> = {
     timezone: 'Asia/Singapore',
     language: 'en',
     usageV2: false,
+    checkin: false,
   },
 }
 

package/src/trae-login.ts

@@ -1,15 +1,17 @@
 /**
  * Trae sign-in through the provider's own website.
  *
- * The plugin does not read a desktop install: it opens a dedicated browser
+ * This flow does not read a desktop install: it opens a dedicated browser
  * profile, lets the user sign in on trae.cn / trae.ai, and then takes the
  * session the website itself created. Two things come out of that session:
  *
  *  - the `Cloud-IDE-JWT` token, fetched with the page's own cookies through
  *    `/cloudide/api/v3/common/GetUserToken` — the same call the site makes;
  *  - the device fingerprint (`__msuuid__` from the page, or one generated in
- *    the page), which Trae's check-in route requires and which therefore must
- *    belong to this web session rather than to a machine install.
+ *    the page), stored with the web login.
+ *
+ * The check-in route does not accept this web fingerprint, so check-in is
+ * enabled only for the separate client-login import in `trae-client.ts`.
  *
  * Cookies are captured over the DevTools protocol and kept in the plugin's own
  * account store so the short-lived JWT can be renewed later; the dedicated