dsh-mcloud 0.0.0-stage → 0.2.0

package/lib/login.js

@@ -0,0 +1,358 @@
+/**
+ * dsh-mcloud — 登录模块
+ *
+ * 用「手机号 + 密码」走 139 邮箱的登录流程，最终换出云盘的 Authorization。
+ *
+ * 三步（社区逆向，参考 OpenList 的 drivers/139）：
+ *   1. POST mail.10086.cn/Login/Login.ashx   账号密码登录 → 拿到 sid
+ *   2. GET  smsrebuild1.mail.10086.cn/setting/s?func=umc:getArtifact&sid=…  → 拿到 dycpwd
+ *   3. POST user-njs.yun.139.com/user/thirdlogin  用 dycpwd 换 authToken（双层 AES）
+ *   → Authorization = base64("pc:账号:authToken")
+ *
+ * 安全约定：
+ *   · 密码只在内存里活到登录结束，本模块不写盘。
+ *   · 是否持久化由调用方（宿主端）决定，这里只负责算。
+ */
+
+import { createHash, randomBytes } from 'node:crypto'
+import { createCipheriv, createDecipheriv } from 'node:crypto'
+
+const MAIL_LOGIN_URL = 'https://mail.10086.cn/Login/Login.ashx'
+const MAIL_ARTIFACT_URL = 'https://smsrebuild1.mail.10086.cn/setting/s'
+const YUN_THIRD_LOGIN_URL = 'https://user-njs.yun.139.com/user/thirdlogin'
+
+const UA_DESKTOP =
+  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Edg/141.0.0.0'
+
+/** 第三层登录用的双层 AES 密钥（社区逆向所得，非用户凭据）
+ *  KEY_HEX_1 → 24 字节 = AES-192-CBC
+ *  KEY_HEX_2 → 16 字节 = AES-128-ECB
+ */
+const KEY_HEX_1 = '73634235495062495331515373756c734e7253306c673d3d'
+const KEY_HEX_2 = '7150714477323633586746674c337538'
+
+const TIMEOUT_MS = 25_000
+
+// ------------------------------------------------------------------ 小工具
+
+function sha1Hex(text) {
+  return createHash('sha1').update(text, 'utf8').digest('hex')
+}
+
+/** 139 邮箱的密码哈希规则：sha1("fetion.com.cn:" + 明文密码) */
+export function hashMailPassword(password) {
+  return sha1Hex(`fetion.com.cn:${String(password)}`)
+}
+
+function md5Hex(text) {
+  return createHash('md5').update(text, 'utf8').digest('hex')
+}
+
+function pkcs7Pad(buf, blockSize) {
+  const pad = blockSize - (buf.length % blockSize)
+  return Buffer.concat([buf, Buffer.alloc(pad, pad)])
+}
+
+function pkcs7Unpad(buf) {
+  if (!buf.length) throw new Error('AES 解密失败：数据为空')
+  const pad = buf[buf.length - 1]
+  if (pad > buf.length) throw new Error('AES 解密失败：填充非法')
+  return buf.subarray(0, buf.length - pad)
+}
+
+function aesCbcEncrypt(plain, key, iv) {
+  // 密钥长度决定算法：16→aes-128, 24→aes-192, 32→aes-256
+  const algo = `aes-${key.length * 8}-cbc`
+  const cipher = createCipheriv(algo, key, iv)
+  return Buffer.concat([cipher.update(pkcs7Pad(plain, 16)), cipher.final()])
+}
+
+function aesCbcDecrypt(cipherText, key, iv) {
+  const algo = `aes-${key.length * 8}-cbc`
+  const d = createDecipheriv(algo, key, iv)
+  return pkcs7Unpad(Buffer.concat([d.update(cipherText), d.final()]))
+}
+
+function aesEcbDecrypt(cipherText, key) {
+  const d = createDecipheriv('aes-128-ecb', key, null)
+  d.setAutoPadding(false)
+  return pkcs7Unpad(Buffer.concat([d.update(cipherText), d.final()]))
+}
+
+/** 递归给 JSON 排序键，再字符串化（第三层登录要求） */
+function sortedJsonStringify(value) {
+  if (value === null || value === undefined) return 'null'
+  if (typeof value === 'string') {
+    try {
+      return sortedJsonStringify(JSON.parse(value))
+    } catch {
+      return JSON.stringify(value)
+    }
+  }
+  if (typeof value !== 'object') return JSON.stringify(value)
+  if (Array.isArray(value)) return `[${value.map(sortedJsonStringify).join(',')}]`
+  const keys = Object.keys(value).sort()
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${sortedJsonStringify(value[k])}`).join(',')}}`
+}
+
+function xmlField(xml, tag) {
+  const m = new RegExp(`<${tag}>\\s*([\\s\\S]*?)\\s*</${tag}>`, 'i').exec(xml)
+  return m ? m[1] : ''
+}
+
+/** 从 Set-Cookie 头里取出某个 cookie 的值 */
+function cookieValue(cookieHeaders, name) {
+  for (const line of cookieHeaders) {
+    const first = String(line).split(';')[0]
+    const eq = first.indexOf('=')
+    if (eq < 0) continue
+    if (first.slice(0, eq).trim() === name) return first.slice(eq + 1)
+  }
+  return ''
+}
+
+function allCookies(cookieHeaders) {
+  const pairs = []
+  for (const line of cookieHeaders) {
+    const first = String(line).split(';')[0]
+    if (first.includes('=')) pairs.push(first.trim())
+  }
+  return pairs.join('; ')
+}
+
+// ------------------------------------------------------------------ 第三层：加密请求
+
+/**
+ * 云盘 SSO 的加密请求：请求体 AES-CBC（随机 IV，前置到 base64），
+ * 响应也可能是加密的（base64，前 16 字节是 IV）。
+ */
+async function encryptedPost(url, bodyObject, headers, aesKeyHex) {
+  const key = Buffer.from(aesKeyHex, 'hex')
+  const plain = Buffer.from(sortedJsonStringify(bodyObject), 'utf8')
+  const iv = randomBytes(16)
+  const payload = Buffer.concat([iv, aesCbcEncrypt(plain, key, iv)]).toString('base64')
+
+  const response = await fetch(url, {
+    method: 'POST',
+    headers,
+    body: payload,
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+  })
+  if (!response.ok) {
+    throw new Error(`SSO 请求失败（HTTP ${response.status}）`)
+  }
+  const text = await response.text()
+  if (!text) throw new Error('SSO 返回空响应')
+
+  // 有时服务端直接回明文 JSON
+  if (text.trimStart().startsWith('{')) return JSON.parse(text)
+
+  let decoded
+  try {
+    decoded = Buffer.from(text, 'base64')
+  } catch {
+    throw new Error('SSO 响应不是合法 base64')
+  }
+  if (decoded.length < 16) throw new Error('SSO 响应过短')
+  const respIv = decoded.subarray(0, 16)
+  const respCipher = decoded.subarray(16)
+  const json = aesCbcDecrypt(respCipher, key, respIv).toString('utf8')
+  return JSON.parse(json)
+}
+
+// ------------------------------------------------------------------ 登录三步
+
+/**
+ * 第一步：邮箱账号密码登录，返回 { sid, cookies }
+ * 风控（要求短信验证）会抛特定错误，调用方据此提示用户。
+ */
+async function mailPasswordLogin(account, password) {
+  const cguid = String(Date.now())
+  const hashedPassword = hashMailPassword(password)
+  const encodedAccount = Buffer.from(String(account), 'utf8').toString('base64')
+
+  const body = new URLSearchParams({
+    UserName: String(account),
+    passOld: '',
+    auto: 'on',
+    Password: hashedPassword,
+    webIndexPagePwdLogin: '1',
+    pwdType: '1',
+    clientId: '1003',
+    authType: '2',
+  }).toString()
+
+  const response = await fetch(MAIL_LOGIN_URL, {
+    method: 'POST',
+    redirect: 'manual',
+    headers: {
+      accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+      'accept-language': 'zh-CN,zh;q=0.9',
+      'content-type': 'application/x-www-form-urlencoded',
+      origin: 'https://mail.10086.cn',
+      referer: `https://mail.10086.cn/default.html?&s=1&v=0&u=${encodedAccount}&m=1&ec=S001&resource=indexLogin&clientid=1003&auto=on&cguid=${cguid}&mtime=45`,
+      'user-agent': UA_DESKTOP,
+    },
+    body,
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+  })
+
+  const setCookie = response.headers.getSetCookie ? response.headers.getSetCookie() : []
+  const location = response.headers.get('location') || ''
+  const cookies = allCookies(setCookie)
+
+  // 风控：Location 里带风险码（MW0016 等），需要短信
+  const riskMatch = /[?&]riskcode=([A-Za-z0-9]+)/i.exec(location) || /MW\d{4}/.exec(location)
+  if (riskMatch) {
+    const code = riskMatch[1] || riskMatch[0]
+    const error = new Error('账号登录触发了安全验证，需要在手机或官网完成验证')
+    error.code = 'MAIL_RISK'
+    error.riskCode = code
+    throw error
+  }
+
+  // 错误码判断（实测 139 邮箱的约定）：
+  //   ec=S001 → 登录失败（账号或密码不正确）
+  //   ec=S002 → 同样是凭据问题
+  //   ec=S003 / S004 → 账号被限制或需要额外验证
+  if (/[?&]ec=S00[12]\b/.test(location)) {
+    const error = new Error('账号或密码不正确')
+    error.code = 'BAD_CREDENTIALS'
+    throw error
+  }
+  if (/[?&]ec=S00[34]\b/.test(location)) {
+    const error = new Error('账号被限制或需要额外验证，请先到官网确认账号状态')
+    error.code = 'ACCOUNT_BLOCKED'
+    throw error
+  }
+
+  // 从 Location 的 query 或 cookie 里拿 sid
+  let sid = ''
+  const q = /\bsid=([^&]+)/.exec(location)
+  if (q) sid = decodeURIComponent(q[1])
+  if (!sid) sid = cookieValue(setCookie, 'Os_SSo_Sid') || cookieValue(setCookie, 'sid')
+
+  if (!sid) {
+    const error = new Error('登录未返回会话标识（sid），可能是账号格式不对或触发了风控')
+    error.code = 'NO_SID'
+    throw error
+  }
+  return { sid, cookies }
+}
+
+/** 第二步：用 sid 换 artifact（dycpwd） */
+async function exchangeArtifact(sid, cookies) {
+  const rmkey = (() => {
+    for (const part of String(cookies).split(';')) {
+      const t = part.trim()
+      if (t.startsWith('RMKEY=')) return t
+    }
+    return ''
+  })()
+  if (!rmkey) {
+    const error = new Error('登录会话缺少 RMKEY，无法换取凭据')
+    error.code = 'NO_RMKEY'
+    throw error
+  }
+
+  const url = `${MAIL_ARTIFACT_URL}?func=${encodeURIComponent('umc:getArtifact')}&sid=${encodeURIComponent(sid)}&cguid=${Date.now()}`
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: {
+      cookie: rmkey,
+      'content-type': 'text/xml; charset=utf-8',
+      'accept-encoding': 'gzip',
+      'user-agent': 'okhttp/4.12.0',
+    },
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+  })
+  if (!response.ok) throw new Error(`换取凭据失败（HTTP ${response.status}）`)
+
+  const text = await response.text()
+  let artifact = ''
+  try {
+    artifact = JSON.parse(text)?.var?.artifact || ''
+  } catch {
+    artifact = ''
+  }
+  if (!artifact) {
+    const error = new Error('换取凭据失败：响应里没有 artifact')
+    error.code = 'NO_ARTIFACT'
+    throw error
+  }
+  return artifact
+}
+
+/** 第三步：用 dycpwd 换 authToken，拼出 Authorization */
+async function thirdPartyLogin(dycpwd, account) {
+  const body = {
+    clientkey_decrypt: 'l3TryM&Q+X7@dzwk)qP',
+    clienttype: '886',
+    cpid: '507',
+    dycpwd,
+    extInfo: { ifOpenAccount: '0' },
+    loginMode: '0',
+    msisdn: String(account),
+    pintype: '13',
+    secinfo: sha1Hex(`fetion.com.cn:${dycpwd}`).toUpperCase(),
+    version: '20250901',
+  }
+
+  const headers = {
+    'hcy-cool-flag': '1',
+    'x-huawei-channelSrc': '10246600',
+    'x-sdk-channelSrc': '',
+    'x-MM-Source': '0',
+    'x-UserAgent': 'android|23116PN5BC|android15|1.2.6|||1440x3200|10246600',
+    'x-DeviceInfo': '4|127.0.0.1|5|1.2.6|Xiaomi|23116PN5BC||02-00-00-00-00-00|android 15|1440x3200|android|||',
+    'content-type': 'text/plain;charset=UTF-8',
+    'accept-encoding': 'gzip',
+    'user-agent': 'okhttp/3.12.2',
+  }
+
+  // 第一层：AES-CBC 加密请求，响应解密后 data 是 hex 串
+  const layer1 = await encryptedPost(YUN_THIRD_LOGIN_URL, body, headers, KEY_HEX_1)
+  const hexInner = layer1?.data
+  if (!hexInner || typeof hexInner !== 'string') {
+    const error = new Error('SSO 登录失败：响应里没有 data')
+    error.code = 'SSO_NO_DATA'
+    throw error
+  }
+
+  // 第二层：hex → AES-ECB 解密
+  const key2 = Buffer.from(KEY_HEX_2, 'hex')
+  const finalJson = aesEcbDecrypt(Buffer.from(hexInner, 'hex'), key2).toString('utf8')
+  let parsed
+  try {
+    parsed = JSON.parse(finalJson)
+  } catch {
+    throw new Error('SSO 登录失败：二次解密结果不是 JSON')
+  }
+
+  const authToken = parsed?.authToken
+  const realAccount = parsed?.account || String(account)
+  const userDomainId = parsed?.userDomainId || ''
+  if (!authToken) {
+    const error = new Error('SSO 登录失败：没有拿到 authToken')
+    error.code = 'NO_AUTH_TOKEN'
+    throw error
+  }
+
+  const authorization = Buffer.from(`pc:${realAccount}:${authToken}`, 'utf8').toString('base64')
+  return { authorization, account: realAccount, userDomainId }
+}
+
+/**
+ * 完整登录：手机号 + 密码 → Authorization。
+ * 不写盘、不留密码；密码只在这个函数的作用域里存活。
+ */
+export async function loginWithPassword(account, password) {
+  const cleanAccount = String(account || '').trim()
+  const cleanPassword = String(password || '')
+  if (!cleanAccount) throw new Error('请填写手机号或邮箱')
+  if (!cleanPassword) throw new Error('请填写密码')
+
+  const { sid, cookies } = await mailPasswordLogin(cleanAccount, cleanPassword)
+  const artifact = await exchangeArtifact(sid, cookies)
+  return thirdPartyLogin(artifact, cleanAccount)
+}

package/lib/scan-login.js

@@ -0,0 +1,295 @@
+/**
+ * dsh-mcloud — 浏览器扫码登录（CDP 版）
+ *
+ * 思路：插件自己拉起一个**独立 profile 的 Edge**，开调试端口，打开云盘首页；
+ * 你扫码登录后，云盘会把 `authorization` 写进自己的 cookie（非 HttpOnly），
+ * 插件通过 CDP 读出来 → 存起来 → 关掉浏览器。
+ *
+ * 为什么这么做：
+ *   · 不用你输密码，最安全（密码从头到尾没经过插件）
+ *   · 不用手动 F12 抄令牌
+ *   · 抓到的令牌可以用 `authTokenRefresh.do` 续期，
+ *     所以「扫一次 → 之后自动续期 → 长期免扫」
+ *
+ * 为什么用独立 profile：
+ *   · 不碰你日常用的 Edge（否则要关掉所有窗口才能加调试端口）
+ *   · 不会读到你在别的网站的登录态
+ *   代价：每次扫码要保持登录（但有了续期，正常只扫一次）
+ */
+
+import { spawn } from 'node:child_process'
+import { existsSync, mkdirSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+
+/** 常见 Edge / Chrome 安装位置 */
+const BROWSER_CANDIDATES = [
+  'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe',
+  'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe',
+  'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+  'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
+]
+
+const LOGIN_URL = 'https://yun.139.com/'
+
+/** 扫码等待上限：5 分钟 */
+export const SCAN_TIMEOUT_MS = 5 * 60 * 1000
+
+/**
+ * 找一个**确定空闲**的调试端口。
+ *
+ * 这里必须真去连一下确认：之前踩过坑 —— 固定用 9333，结果上次遗留的浏览器
+ * 还占着那个端口，我们新起的实例没起来，却读到了**旧浏览器的 cookie**，
+ * 看起来「登录成功」，其实是捡了别人（或上一次）的登录态。
+ */
+async function findFreePort(startPort = 9333, tries = 30) {
+  const net = await import('node:net')
+  for (let i = 0; i < tries; i += 1) {
+    const port = startPort + i
+    const free = await new Promise((resolve) => {
+      const srv = net.createServer()
+      srv.once('error', () => resolve(false))
+      srv.once('listening', () => srv.close(() => resolve(true)))
+      try {
+        srv.listen(port, '127.0.0.1')
+      } catch {
+        resolve(false)
+      }
+    })
+    if (free) return port
+  }
+  throw new Error('找不到可用的本地端口，请关闭一些程序后重试')
+}
+
+function findBrowser() {
+  for (const candidate of BROWSER_CANDIDATES) {
+    if (existsSync(candidate)) return candidate
+  }
+  return null
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+/** 极简 CDP 客户端（只用 Runtime.evaluate 和 Network.getAllCookies） */
+async function connectCdp(wsUrl) {
+  const ws = new WebSocket(wsUrl)
+  await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('CDP 连接超时')), 10_000)
+    ws.onopen = () => {
+      clearTimeout(timer)
+      resolve()
+    }
+    ws.onerror = () => {
+      clearTimeout(timer)
+      reject(new Error('CDP 连接失败'))
+    }
+  })
+
+  let seq = 0
+  const pending = new Map()
+  ws.onmessage = (event) => {
+    let msg
+    try {
+      msg = JSON.parse(event.data)
+    } catch {
+      return
+    }
+    if (!msg.id || !pending.has(msg.id)) return
+    const { resolve, reject } = pending.get(msg.id)
+    pending.delete(msg.id)
+    if (msg.error) reject(new Error(msg.error.message || JSON.stringify(msg.error)))
+    else resolve(msg.result)
+  }
+
+  const send = (method, params = {}) =>
+    new Promise((resolve, reject) => {
+      const id = ++seq
+      pending.set(id, { resolve, reject })
+      try {
+        ws.send(JSON.stringify({ id, method, params }))
+      } catch (error) {
+        pending.delete(id)
+        reject(error)
+      }
+    })
+
+  return { ws, send }
+}
+
+/** 等 CDP 端口就绪，返回浏览器版本信息 */
+async function waitForCdp(port, timeoutMs) {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(`http://127.0.0.1:${port}/json/version`, {
+        signal: AbortSignal.timeout(2000),
+      })
+      if (res.ok) return await res.json()
+    } catch {
+      /* 还没起来 */
+    }
+    await sleep(400)
+  }
+  throw new Error('浏览器调试端口没有就绪（可能被安全软件拦了）')
+}
+
+/** 在打开的页面里找云盘标签页 */
+async function findYunTab(port) {
+  try {
+    const list = await fetch(`http://127.0.0.1:${port}/json/list`, { signal: AbortSignal.timeout(5000) })
+      .then((r) => r.json())
+    return (list || []).find((t) => t.type === 'page' && String(t.url).includes('139.com')) || null
+  } catch {
+    return null
+  }
+}
+
+/** 从 cookie 列表里挑出云盘凭据 */
+function pickCredentials(cookies) {
+  const get = (name) => {
+    const hit = (cookies || []).find((c) => c.name === name && String(c.domain || '').includes('139.com'))
+    return hit ? String(hit.value || '') : ''
+  }
+  const rawAuth = get('authorization')
+  const bare = rawAuth.replace(/^Basic\s+/i, '').trim()
+  if (!bare) return null
+  return {
+    authorization: bare,
+    udId: get('ud_id'),
+    authToken: get('auth_token'),
+    skey: get('skey'),
+  }
+}
+
+/**
+ * 拉起浏览器，等用户扫码，然后抓凭据。
+ *
+ * onProgress 会收到 { phase, message } 形式的进度，便于界面显示。
+ * 返回 { authorization, udId, closed:true } 或抛错。
+ */
+export async function scanLogin({ onProgress, signal } = {}) {
+  const browser = findBrowser()
+  if (!browser) {
+    throw new Error('没找到 Edge 或 Chrome，请先安装浏览器，或改用账号密码登录')
+  }
+
+  const report = (phase, message) => {
+    try {
+      onProgress?.({ phase, message })
+    } catch {
+      /* 进度回调不该影响主流程 */
+    }
+  }
+
+  // 每个 profile 独立，避免并发冲突
+  const profileDir = join(tmpdir(), `dsh-mcloud-scan-${Date.now().toString(36)}`)
+  mkdirSync(profileDir, { recursive: true })
+
+  // 动态找一个空闲端口（绝不复用可能被旧进程占着的端口）
+  let port
+  try {
+    port = await findFreePort(9333)
+  } catch (error) {
+    try {
+      rmSync(profileDir, { recursive: true, force: true })
+    } catch {
+      /* ignore */
+    }
+    throw error
+  }
+
+  let child = null
+
+  report('launching', '正在启动浏览器…')
+
+  const cleanup = () => {
+    try {
+      if (child && !child.killed) child.kill()
+    } catch {
+      /* 已经退出 */
+    }
+    // 给浏览器一点时间退出再删 profile，否则文件被占用删不掉
+    setTimeout(() => {
+      try {
+        rmSync(profileDir, { recursive: true, force: true })
+      } catch {
+        /* 删不掉就算了，是个临时目录 */
+      }
+    }, 2000)
+  }
+
+  try {
+    child = spawn(
+      browser,
+      [
+        `--remote-debugging-port=${port}`,
+        `--user-data-dir=${profileDir}`,
+        '--no-first-run',
+        '--no-default-browser-check',
+        '--disable-features=msEdgeIdentityFRE,msEdgeSidebarV2',
+        '--window-size=520,760',
+        LOGIN_URL,
+      ],
+      { detached: false, stdio: 'ignore' },
+    )
+
+    child.on('error', () => {
+      /* 由下面的超时统一报错 */
+    })
+
+    // 等 CDP 起来 —— 并且确认端口后面确实是**我们刚起的这个实例**
+    const version = await waitForCdp(port, 25_000)
+    const browserPath = String(version?.Browser || '')
+    if (!browserPath) throw new Error('浏览器调试端口返回异常')
+    report('waiting', '请在弹出的浏览器里扫码登录（最长等 5 分钟）')
+
+    const deadline = Date.now() + SCAN_TIMEOUT_MS
+    let lastReport = 0
+
+    while (Date.now() < deadline) {
+      if (signal?.aborted) throw new Error('已取消扫码登录')
+      if (child.exitCode !== null && child.exitCode !== undefined) {
+        throw new Error('浏览器被关闭了，扫码登录已取消')
+      }
+
+      const tab = await findYunTab(port)
+      if (tab) {
+        try {
+          const { ws, send } = await connectCdp(tab.webSocketDebuggerUrl)
+          try {
+            await send('Network.enable')
+            const { cookies } = await send('Network.getAllCookies')
+            const picked = pickCredentials(cookies)
+            if (picked) {
+              report('success', '登录成功，正在保存凭据…')
+              ws.close()
+              return { ...picked, closed: true }
+            }
+          } finally {
+            try {
+              ws.close()
+            } catch {
+              /* 已关闭 */
+            }
+          }
+        } catch {
+          /* 页面可能正在跳转，下一轮再试 */
+        }
+      }
+
+      const now = Date.now()
+      if (now - lastReport > 8000) {
+        lastReport = now
+        const left = Math.max(0, Math.round((deadline - now) / 1000))
+        report('waiting', `等待扫码登录…（剩余 ${left} 秒）`)
+      }
+      await sleep(1200)
+    }
+
+    throw new Error('扫码登录超时（5 分钟）。请重新点击「扫码登录」')
+  } finally {
+    cleanup()
+  }
+}