dsh-model 0.23.3 → 0.25.0

package/README.en.md

@@ -2,7 +2,7 @@
 
 # dsh-model
 
-**📅 Daily check-in credits claimed for you · 🔁 one address that relays every model · 🧩 free and subscription models, your pick**
+**📅 Daily check-in credits claimed for you (Trae, Qoder, WorkBuddy, Doubao) · 🔁 one address that relays every model · 🧩 free and subscription models, your pick**
 
 Install once and all three are taken care of. dsh gets a management page; without dsh, the command line does everything.
 
@@ -27,10 +27,12 @@ English · [中文](README.md)
 |---|---|---|
 | **Trae** | Detected automatically if Trae is installed and signed in; nothing to do | Check-in credits (200 a day in testing) |
 | **Qoder** | Paste a personal access token once (China or international) | That day's check-in credits |
-| **WorkBuddy (China)** | Sign in once | Check-in credits |
+| **WorkBuddy (China)** | Sign in once (several accounts are fine) | Check-in credits |
+| **Doubao** (experimental) | Copy the sign-in cookie from the browser once (personal accounts only) | Daily trial credits |
 
 - **Automatic by default**: done at a random 5–55 minutes after midnight Beijing time; failures retry an hour later; if the computer was off, it catches up within a minute of starting.
 - **You can see it**: one line at the top of the settings page, "Checked in today: …", with a one-click "Check in all" for anything missed, plus a one-time notice in the corner of dsh.
+- **Several accounts**: each product can have more than one. In the check-in card's Details: "+ Add a WorkBuddy account" (approve through a link) and "+ Add another Qoder account"; several Trae installs are checked in once per account automatically.
 - **Check-in only, credits untouched**: they stay on your account for use in each product's own app. Command line: `dsh-model checkin`.
 
 ## 🔁 2. Relay: one address, one key, every model

package/README.md

@@ -2,7 +2,7 @@
 
 # dsh-model
 
-**📅 每天自动签到领积分 · 🔁 一个地址中转所有模型 · 🧩 免费和订阅模型随你接**
+**📅 每天自动签到领积分（Trae、Qoder、WorkBuddy、豆包）· 🔁 一个地址中转所有模型 · 🧩 免费和订阅模型随你接**
 
 装一次，三件事都替你做好。dsh 里有图形管理页，没有 dsh 也能用命令行。
 
@@ -27,10 +27,12 @@
 |---|---|---|
 | **Trae** | 本机装了 Trae 并登录过，自动识别，什么都不用做 | 签到送积分（实测每天 200） |
 | **Qoder** | 粘贴一次个人访问令牌（国内版、国际版都行） | 领当天的签到积分 |
-| **WorkBuddy 国内版** | 登录一次 | 签到送积分 |
+| **WorkBuddy 国内版** | 登录一次（可以加几个账号） | 签到送积分 |
+| **豆包**（实验） | 从浏览器复制一次登录 Cookie（只支持个人账号） | 「天天领额度」送体验额度 |
 
 - **自动签到默认打开**：北京时间零点后随机延后 5–55 分钟签好；失败的一小时后重试；电脑关机错过了，开机一分钟内补签。
 - **结果看得见**：设置页顶部一行「今日已完成签到：…」，没签上的可以「一键签到」；签完在 dsh 右下角提示一次。
+- **多账号**：一家可以签几个账号。在签到卡片的「详情」里「+ 添加 WorkBuddy 账号」（打开链接授权）、「+ 再加一个 Qoder 账号」；本机装了几个 Trae 会自动按账号各签一次。
 - **只签到，不碰积分**：积分留在你的账号里，照常在各家官方软件里用。命令行：`dsh-model checkin`。
 
 ## 🔁 2. 中转：一个地址、一把 key，用上所有模型

package/dist/bridge/login.js

@@ -7,7 +7,7 @@
 //   GET {base}/v2/plugin/login/account?state=…（Bearer）                 → 账号（uid / 企业 / 昵称）
 // 令牌按移植凭据库的"自有副本"格式写进 $DSH_MODEL_HOME/workbuddy/<ownFilename>（0600），bridge 直接用。
 // 网络请求走 curl：它认 -x 代理（Node 的 fetch 不走代理）；国内版域名强制直连。
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { DshModelError } from '../errors.js';
 import { L } from '../i18n.js';
 import { run } from '../util/exec.js';
@@ -110,9 +110,9 @@ export async function workbuddyLogin(variant, home, opts) {
         ...(nickname ? { nickname } : {}),
         source: 'dsh',
     };
-    const dir = bridgeDir(home);
-    await ensureDir(dir, { owner: opts.owner });
-    await atomicWrite(join(dir, variant.ownFilename), JSON.stringify({ version: 1, credential }, null, 2) + '\n', { mode: 0o600, owner: opts.owner });
+    const file = opts.file ?? join(bridgeDir(home), variant.ownFilename);
+    await ensureDir(dirname(file), { owner: opts.owner });
+    await atomicWrite(file, JSON.stringify({ version: 1, credential }, null, 2) + '\n', { mode: 0o600, owner: opts.owner });
     return credential;
 }
 /** 退出登录：删掉 dsh-model 保存的那份（App 的文件不动） */

package/dist/checkin/accounts.js

@@ -0,0 +1,147 @@
+// checkin/accounts.ts — 多账号签到（设计 §14.19）
+//
+// 每个签到项一个 id：第一个账号沿用 workbuddy / qoder / trae，多出来的是 <家>:<账号>（如 workbuddy:12345）。
+// - WorkBuddy：主账号就是来源里登录的那个（bridge 的凭据）；多出来的账号只用来签到，
+//   各存一份 $DSH_MODEL_HOME/workbuddy/checkin/<uid>.json（与 dsh-model 自己登录的格式相同，0600），不接模型。
+// - Qoder：secrets.json 里一组个人访问令牌，各带一个名字（Qoder 的接口不返回账号名）。
+// - Trae：本机装的每个 Trae 都读，按账号（userId）去重，每个账号签一次。
+// - 豆包：secrets.json 里一组 Cookie（用户从浏览器复制），各带一个名字。
+import { readdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { bridgeDir } from '../bridge/runtime.js';
+import { WorkBuddyCredentialStore } from '../bridge/workbuddy/auth.js';
+import { atRestKeyProviderFor } from '../bridge/workbuddy/desktop-credential-protection.js';
+import { WorkBuddyUpstreamClient } from '../bridge/workbuddy/upstream.js';
+import { CN_VARIANT } from '../bridge/workbuddy/variants.js';
+import { loadSecrets, saveSecrets } from '../secrets.js';
+import { readJson } from '../util/fs.js';
+import { randomBytes } from 'node:crypto';
+/** 一个签到项属于哪一家：workbuddy:123 → workbuddy */
+export const checkinKind = (id) => id.split(':')[0];
+// —— WorkBuddy 签到账号 ——
+export const workbuddyAccountsDir = (home) => join(bridgeDir(home), 'checkin');
+/** 多出来的 WorkBuddy 签到账号（不含来源里那个主账号） */
+export async function listWorkbuddyAccounts(home) {
+    const dir = workbuddyAccountsDir(home);
+    let names = [];
+    try {
+        names = (await readdir(dir)).filter((n) => /^[A-Za-z0-9_-]+\.json$/.test(n));
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const n of names.sort()) {
+        const doc = await readJson(join(dir, n));
+        const uid = doc?.credential?.uid || n.replace(/\.json$/, '');
+        out.push({ uid, ...(doc?.credential?.nickname ? { nickname: doc.credential.nickname } : {}), file: join(dir, n) });
+    }
+    return out;
+}
+/** 一个签到账号的凭据库：只用它自己的那份文件，不读桌面 App（否则会读到主账号） */
+export function workbuddyAccountStore(home, file) {
+    const client = new WorkBuddyUpstreamClient();
+    const store = new WorkBuddyCredentialStore({
+        variant: CN_VARIANT,
+        keyProvider: atRestKeyProviderFor(CN_VARIANT),
+        refresh: (credential) => client.refreshToken(credential),
+        ownPath: file,
+        desktopPath: join(workbuddyAccountsDir(home), '.no-desktop-credential'),
+    });
+    return { store, client };
+}
+export async function removeWorkbuddyAccount(home, uid) {
+    const acct = (await listWorkbuddyAccounts(home)).find((a) => a.uid === uid);
+    if (!acct)
+        return false;
+    await rm(acct.file, { force: true });
+    return true;
+}
+/** 名字里显示账号：昵称，没有就 uid 后 4 位 */
+export const accountTag = (nickname, uid) => nickname || `…${uid.slice(-4)}`;
+/** 读全部 Qoder 令牌；旧版只存了一个（secrets.checkin.qoder），读出来当第一个 */
+export async function loadQoders(ctx) {
+    const c = (await loadSecrets(ctx)).checkin;
+    if (c?.qoders?.length)
+        return c.qoders;
+    return c?.qoder?.pat ? [{ id: '1', pat: c.qoder.pat, region: c.qoder.region, ...(c.qoder.savedAt ? { savedAt: c.qoder.savedAt } : {}) }] : [];
+}
+export async function saveQoders(ctx, list) {
+    const secrets = await loadSecrets(ctx);
+    const checkin = { ...secrets.checkin };
+    delete checkin.qoder;
+    if (list.length)
+        checkin.qoders = list;
+    else
+        delete checkin.qoders;
+    secrets.checkin = Object.keys(checkin).length ? checkin : undefined;
+    await saveSecrets(ctx, secrets);
+}
+/** 加一个令牌：同一个令牌再加就是改名字 / 区域；返回它的 id */
+export async function addQoder(ctx, entry) {
+    const list = await loadQoders(ctx);
+    const same = list.find((q) => q.pat === entry.pat);
+    const name = entry.name?.trim().slice(0, 20);
+    if (same) {
+        same.region = entry.region;
+        if (name)
+            same.name = name;
+        await saveQoders(ctx, list);
+        return same.id;
+    }
+    const used = new Set(list.map((q) => q.id));
+    let n = list.length + 1;
+    while (used.has(String(n)))
+        n++;
+    const id = String(n);
+    list.push({ id, pat: entry.pat, region: entry.region, ...(name ? { name } : {}), savedAt: new Date().toISOString() });
+    await saveQoders(ctx, list);
+    return id;
+}
+export async function removeQoder(ctx, id) {
+    const list = await loadQoders(ctx);
+    // 不给 id：删第一个（旧版页面的"删除 Qoder 令牌"）
+    const target = id ?? list[0]?.id;
+    await saveQoders(ctx, list.filter((q) => q.id !== target));
+}
+export async function loadDoubaos(ctx) {
+    return (await loadSecrets(ctx)).checkin?.doubaos ?? [];
+}
+async function saveDoubaos(ctx, list) {
+    const secrets = await loadSecrets(ctx);
+    const checkin = { ...secrets.checkin };
+    if (list.length)
+        checkin.doubaos = list;
+    else
+        delete checkin.doubaos;
+    secrets.checkin = Object.keys(checkin).length ? checkin : undefined;
+    await saveSecrets(ctx, secrets);
+}
+/** 加一个豆包账号；同一个 Cookie 再加 = 改名字。返回 id */
+export async function addDoubao(ctx, entry) {
+    const list = await loadDoubaos(ctx);
+    const name = entry.name?.trim().slice(0, 20);
+    const same = list.find((d) => d.cookie === entry.cookie);
+    if (same) {
+        if (name)
+            same.name = name;
+        await saveDoubaos(ctx, list);
+        return same.id;
+    }
+    const used = new Set(list.map((d) => d.id));
+    let n = list.length + 1;
+    while (used.has(String(n)))
+        n++;
+    const id = String(n);
+    list.push({ id, cookie: entry.cookie, seed: entry.seed ?? randomBytes(16).toString('hex'), ...(name ? { name } : {}), savedAt: new Date().toISOString() });
+    await saveDoubaos(ctx, list);
+    return id;
+}
+export async function removeDoubao(ctx, id) {
+    const list = await loadDoubaos(ctx);
+    const next = list.filter((d) => d.id !== id);
+    if (next.length === list.length)
+        return false;
+    await saveDoubaos(ctx, next);
+    return true;
+}

package/dist/checkin/doubao.js

@@ -0,0 +1,112 @@
+// checkin/doubao.ts — 豆包每日签到（「天天领额度」，每天 +200 体验额度）
+//
+// 协议照 techysy/CreditDaddy 的 src/doubaoClient.js（MIT），对方 2026-10-19/20 抓包实测：
+//   POST https://www.doubao.com/alice/ug/campaign/v3/detail/        任务面板（含今天签没签）
+//   POST https://www.doubao.com/alice/ug/campaign/landing/checkin   领取；服务端幂等，重复领返回 idempotent:true
+// 鉴权只要 doubao.com 的登录 Cookie，没有 a_bogus / msToken 这类签名（dsh-model 也不伪造签名）。
+// 请求带豆包电脑版网页的平台参数（版本号、web 平台等），不带的话接口回"请求非法"。
+// 只支持个人账号：飞书企业账号的任务面板里没有签到任务。
+// Cookie 由用户从浏览器复制一次（存 secrets.json，0600），dsh-model 不读豆包客户端的文件。
+import { createHash } from 'node:crypto';
+const DETAIL_URL = 'https://www.doubao.com/alice/ug/campaign/v3/detail/';
+const CHECKIN_URL = 'https://www.doubao.com/alice/ug/campaign/landing/checkin';
+/** 任务面板所属活动组；签到是其中 task_kind = daily_signin 的任务 */
+const CAMPAIGN_GROUP = 'pc_incentive_task_mvp_v3';
+/** 登录过期 / 未登录的业务码 */
+const LOGIN_INVALID = 710012001;
+const TIMEOUT_MS = 20_000;
+const CLIENT_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) DoubaoDesktop/2.32.6 Chrome/147.0.7727.149 Safari/537.36';
+const COMMON_PARAMS = {
+    version_code: '20800',
+    language: 'zh',
+    device_platform: 'web',
+    doubao_device_platform: 'web',
+    aid: '497858',
+    real_aid: '497858',
+    pkg_type: 'release_version',
+    pc_version: '2.32.6',
+    doubao_pc_version: '5.72.66',
+    samantha_web: '1',
+    web_platform: 'desktop',
+    'use-olympus-account': '1',
+    web_tab_id: '0',
+};
+export class DoubaoAuthError extends Error {
+}
+/** 每个账号一组稳定的网页标识（由这个账号自己的随机种子派生，账号之间不同） */
+export function deviceIdsFor(seed) {
+    const h = createHash('sha256').update(`doubao-dev:${seed}`).digest();
+    return {
+        web_id: '76' + [...h.subarray(0, 8)].map((b) => b % 10).join(''),
+        tea_uuid: [...h.subarray(8, 16)].map((b) => b % 10).join('').padEnd(16, '7'),
+    };
+}
+function apiUrl(base, seed) {
+    return `${base}?${new URLSearchParams({ ...COMMON_PARAMS, ...deviceIdsFor(seed), device_id: '', region: '', sys_region: '' })}`;
+}
+/** 用户粘贴的可能是整行 "Cookie: a=b; c=d"，也可能带换行：规整成 "a=b; c=d" */
+export function normalizeCookie(raw) {
+    return raw.replace(/^\s*cookie\s*:\s*/i, '').replace(/[\r\n]+/g, ' ').replace(/\s*;\s*/g, '; ').replace(/;\s*$/, '').trim();
+}
+async function post(url, cookie, body) {
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: {
+            Cookie: cookie,
+            'Content-Type': 'application/json',
+            Accept: 'application/json, text/plain, */*',
+            Referer: 'https://www.doubao.com/pc/agent-explore',
+            Origin: 'https://www.doubao.com',
+            'User-Agent': CLIENT_UA,
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+    const text = await res.text();
+    try {
+        const json = JSON.parse(text);
+        if (json && typeof json === 'object')
+            return json;
+    }
+    catch {
+        // 非 JSON
+    }
+    throw new Error(`豆包接口返回无法解析（HTTP ${res.status}）`);
+}
+/** 签到状态（detail 接口）。Cookie 不对抛 DoubaoAuthError */
+export async function doubaoStatus(cookie, seed) {
+    const body = await post(apiUrl(DETAIL_URL, seed), cookie, { campaign_group_code: CAMPAIGN_GROUP });
+    const code = Number(body.code);
+    if (code === LOGIN_INVALID)
+        throw new DoubaoAuthError('豆包登录已过期（Cookie 失效）');
+    if (code !== 0)
+        throw new Error(`豆包任务面板返回异常：${String(body.msg ?? body.message ?? '')}（code ${code}）`);
+    const data = (body.data ?? {});
+    const task = Array.isArray(data.tasks) ? data.tasks.find((t) => t?.task_kind === 'daily_signin') : undefined;
+    const c = task?.daily_checkin ?? {};
+    return {
+        checkedIn: task ? c.checked_in_today === true : null,
+        continuousDays: Number(c.continuous_days) || 0,
+        rewardAmount: Number(c.reward?.reward_amount) || 0,
+        totalAmount: Number(data.progress?.total_amount) || 0,
+    };
+}
+/** 签到：先看今天签没签，没签才领 */
+export async function doubaoCheckin(cookie, seed) {
+    const st = await doubaoStatus(cookie, seed);
+    if (st.checkedIn === null)
+        throw new Error('这个豆包账号没有签到任务：只有个人账号能领，飞书企业账号不行（也可能活动暂时下线）');
+    if (st.checkedIn)
+        return { state: 'already' };
+    const body = await post(apiUrl(CHECKIN_URL, seed), cookie, { scene: CAMPAIGN_GROUP });
+    const code = Number(body.code);
+    if (code === LOGIN_INVALID)
+        throw new DoubaoAuthError('豆包登录已过期（Cookie 失效）');
+    if (code !== 0)
+        throw new Error(`豆包签到失败：${String(body.msg ?? body.message ?? '')}（code ${code}）`);
+    const d = (body.data ?? {});
+    if (d.idempotent === true)
+        return { state: 'already' };
+    const credit = Number(d.reward_amount) || st.rewardAmount || undefined;
+    return { state: 'signed', ...(credit ? { credit } : {}) };
+}

package/dist/checkin/index.js

@@ -1,4 +1,4 @@
-// checkin/index.ts — 每日签到（设计 §14.15）：WorkBuddy 国内版、Qoder、Trae；以后加 WPS 灵犀
+// checkin/index.ts — 每日签到（设计 §14.15）：WorkBuddy 国内版、Qoder、Trae、豆包；每家可以有几个账号（§14.19，checkin/accounts.ts）
 //
 // 「今天」按北京时间算：这几家都在北京时间零点换天（VPS 的系统时间是 UTC）。
 // 自动签到默认打开：守护进程每 15 分钟看一眼，过了当天随机的几分钟后签一次；失败的隔一小时再试；错过了下次开机补。
@@ -20,11 +20,16 @@ export function todayResults(file, now = new Date()) {
     return file.date === beijingNow(now).date ? file.results : [];
 }
 /** 失败原因 → 该怎么办 */
-export function checkinAdvice(id, message) {
-    if (/无效|过期|401|403|unauthor|expired/i.test(message)) {
+export function checkinAdvice(itemId, message) {
+    const id = itemId.split(':')[0];
+    if (/无效|过期|401|403|unauthor|expired|not able to authenticate/i.test(message)) {
+        if (id === 'doubao')
+            return L('豆包登录过期：在浏览器里重新登录 doubao.com，到签到卡片里删掉它，再复制 Cookie 添加一次', 'Doubao sign-in expired: sign in at doubao.com again, remove it in the check-in card and add the new cookie');
         if (id === 'trae')
             return L('Trae 登录过期：打开 Trae 重新登录一次', 'Trae sign-in expired: open Trae and sign in again');
-        return id === 'qoder' ? L('Qoder 个人访问令牌失效：在签到卡片里重新填一个', 'The Qoder access token no longer works: enter a new one in the check-in card') : L('WorkBuddy 登录过期：在来源里重新登录 WorkBuddy', 'WorkBuddy sign-in expired: sign in to WorkBuddy again under Sources');
+        if (id === 'qoder')
+            return L('Qoder 个人访问令牌失效：在签到卡片里删掉它再添加一个新的', 'The Qoder access token no longer works: remove it in the check-in card and add a new one');
+        return itemId.includes(':') ? L('这个 WorkBuddy 签到账号的登录过期：在签到卡片里删掉它再添加一次', 'This WorkBuddy check-in account has expired: remove it in the check-in card and add it again') : L('WorkBuddy 登录过期：在来源里重新登录 WorkBuddy', 'WorkBuddy sign-in expired: sign in to WorkBuddy again under Sources');
     }
     if (/timeout|timed out|fetch failed|network|ECONN/i.test(message))
         return L('网络不通：稍后会自动再试', 'Network problem: it will retry automatically');

package/dist/checkin/trae.js

@@ -42,6 +42,17 @@ export function decryptStorageValue(encoded) {
         throw new Error('Trae 登录信息校验不通过');
     return plain.toString('utf8');
 }
+/** JWT 里的账号 id（data.id）；读不出来返回 undefined */
+export function tokenAccountId(token) {
+    try {
+        const p = JSON.parse(Buffer.from(token.split('.')[1] ?? '', 'base64url').toString());
+        const id = p.data?.id ?? p.sub;
+        return id === undefined || id === null || id === '' ? undefined : String(id);
+    }
+    catch {
+        return undefined;
+    }
+}
 /** 各平台的应用数据目录 */
 function appDataRoots(home, platform = process.platform, env = process.env) {
     if (platform === 'darwin')
@@ -50,45 +61,84 @@ function appDataRoots(home, platform = process.platform, env = process.env) {
         return [...new Set([env.APPDATA, join(home, 'AppData', 'Roaming')].filter((v) => Boolean(v)))];
     return [env.XDG_CONFIG_HOME || join(home, '.config')];
 }
-/** 找本机的 Trae 登录：先桌面 App，再 CLI。找不到返回 null（不报错：没装 Trae 就不显示） */
+/**
+ * 找本机的 Trae 登录。可能有好几份（Trae CN、TRAE SOLO CN、CLI…），常有一份早就过期没人用了
+ * （2026-10-29 实测：先读到的 TRAE SOLO CN 已过期 7 天，正在用的 Trae CN 是新的，签到因此失败）。
+ * 所以全读一遍再挑：没过期的优先，其中桌面 App（带设备 id）优先，再按到期最晚。找不到返回 null（没装 Trae 就不显示）。
+ */
 export async function findTraeCredential(home = homedir()) {
+    return (await findTraeCredentials(home))[0] ?? null;
+}
+/** 本机的每个 Trae 账号各一份登录（同一个账号装了几个 Trae 只算一个），第一个是最该用的 */
+export async function findTraeCredentials(home = homedir()) {
+    const found = await readTraeCredentials(home);
+    const groups = new Map();
+    for (const c of found) {
+        const key = c.accountId ?? `?${c.source}`;
+        groups.set(key, [...(groups.get(key) ?? []), c]);
+    }
+    const best = [...groups.values()].map((g) => pickTraeCredential(g)).filter(Boolean);
+    // 账号之间：没过期的在前
+    const first = pickTraeCredential(best);
+    return first ? [first, ...best.filter((c) => c !== first)] : [];
+}
+async function readTraeCredentials(home) {
     // 测试环境不看本机真装了什么（与不发现桌面 App 同一个开关）
     if (process.env.DSH_MODEL_NO_APP_DISCOVERY && home === homedir())
-        return null;
+        return [];
+    const found = [];
     for (const root of appDataRoots(home)) {
         for (const app of APPS) {
             const file = join(root, app, 'User', 'globalStorage', 'storage.json');
-            let storage;
             try {
-                storage = JSON.parse(await readFile(file, 'utf8'));
+                const storage = JSON.parse(await readFile(file, 'utf8'));
+                const raw = storage[AUTH_KEY];
+                if (typeof raw !== 'string' || !raw.trim())
+                    continue;
+                const text = raw.trim().startsWith('{') ? raw : decryptStorageValue(raw);
+                const auth = JSON.parse(text);
+                const token = auth.token || auth.accessToken;
+                if (!token)
+                    continue;
+                const dc = Object.keys(storage).find((k) => k.startsWith(DEVICE_PREFIX));
+                const accountId = auth.userId !== undefined && auth.userId !== null && auth.userId !== '' ? String(auth.userId) : tokenAccountId(token);
+                found.push({ token, deviceId: dc ? dc.slice(DEVICE_PREFIX.length) : String(storage['telemetry.devDeviceId'] ?? ''), source: app, ...(accountId ? { accountId } : {}) });
             }
             catch {
-                continue;
+                // 没装、读不了或解不开：看下一个
             }
-            const raw = storage[AUTH_KEY];
-            if (typeof raw !== 'string' || !raw.trim())
-                continue;
-            const text = raw.trim().startsWith('{') ? raw : decryptStorageValue(raw);
-            const auth = JSON.parse(text);
-            const token = auth.token || auth.accessToken;
-            if (!token)
-                continue;
-            const dc = Object.keys(storage).find((k) => k.startsWith(DEVICE_PREFIX));
-            return { token, deviceId: dc ? dc.slice(DEVICE_PREFIX.length) : String(storage['telemetry.devDeviceId'] ?? ''), source: app };
         }
     }
     for (const dir of ['.trae-cn', '.trae']) {
         try {
             const text = (await readFile(join(home, dir, 'trae-jwt-token'), 'utf8')).trim();
             const token = text.startsWith('{') ? String(JSON.parse(text).token ?? '') : text;
+            const accountId = tokenAccountId(token);
             if (token.split('.').length === 3)
-                return { token, deviceId: '', source: `~/${dir}` };
+                found.push({ token, deviceId: '', source: `~/${dir}`, ...(accountId ? { accountId } : {}) });
         }
         catch {
             // 没有
         }
     }
-    return null;
+    return found;
+}
+/** 几份登录里挑一份：没过期的优先 → 带设备 id 的（桌面 App）优先 → 到期最晚的。导出给测试 */
+export function pickTraeCredential(list, now = Date.now()) {
+    const exp = (t) => {
+        const d = tokenDaysLeft(t, now);
+        return d === null ? Number.POSITIVE_INFINITY : d;
+    };
+    const ranked = [...list].sort((a, b) => {
+        const live = Number(exp(b.token) >= 0) - Number(exp(a.token) >= 0);
+        if (live)
+            return live;
+        const desktop = Number(Boolean(b.deviceId)) - Number(Boolean(a.deviceId));
+        if (desktop)
+            return desktop;
+        return exp(b.token) - exp(a.token);
+    });
+    return ranked[0] ?? null;
 }
 /** 令牌还剩几天（读 JWT 的 exp）；读不出来返回 null */
 export function tokenDaysLeft(token, now = Date.now()) {

package/dist/daemon/core.js

@@ -5,7 +5,7 @@
 // 职责：来源状态与开关、登录会话（引擎 OAuth / WorkBuddy 自有登录 / OpenCode key）、key 管理、用量统计。
 // CLI 与 dsh 插件都只通过 /control/* 调这里，逻辑只有一份。
 import { spawn } from 'node:child_process';
-import { readFile } from 'node:fs/promises';
+import { readFile, rename, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { latestVersion, selfJobLog } from '../commands/self.js';
 import { LOCAL_SERVERS, loadLocalCatalog, refreshLocalCatalog } from '../integrations/local.js';
@@ -18,7 +18,10 @@ import { spawnDetached } from '../util/detach.js';
 import { classify, recentFailures } from './failures.js';
 import { autoDue, beijingNow, checkinAdvice, ensureJitter, loadCheckin, runCheckin, setAuto, todayResults } from '../checkin/index.js';
 import { QODER_REGIONS, exchangePat, qoderCheckin } from '../checkin/qoder.js';
-import { findTraeCredential, traeCheckin } from '../checkin/trae.js';
+import { findTraeCredentials, traeCheckin } from '../checkin/trae.js';
+import { DoubaoAuthError, doubaoCheckin, doubaoStatus, normalizeCookie } from '../checkin/doubao.js';
+import { accountTag, addDoubao, addQoder, listWorkbuddyAccounts, loadDoubaos, loadQoders, removeDoubao, removeQoder, removeWorkbuddyAccount, workbuddyAccountStore, workbuddyAccountsDir } from '../checkin/accounts.js';
+import { CN_VARIANT } from '../bridge/workbuddy/variants.js';
 import { PKG_ROOT, pkgVersion } from '../util/pkg.js';
 import { randomBytes } from 'node:crypto';
 import { currentBinary } from '../engine/install.js';
@@ -34,7 +37,7 @@ import { blockedNotice as workbuddyBlockedNotice, riskNotice as workbuddyRiskNot
 import { DSH_KEY_NAME, addKey, findActive, loadKeys, revokeKey, rotateKey, saveKeys } from '../keys.js';
 import { applyKeyChange, dshCandidates, dshKey, loadAll, saveAll, syncAll } from '../ops.js';
 import { defaultPick, pickedFor } from '../dsh/pick.js';
-import { loadSecrets, saveSecrets } from '../secrets.js';
+import { loadSecrets } from '../secrets.js';
 import { SOURCES, credsFor, findSource, paymentRequired } from '../sources.js';
 import { withLock } from '../state.js';
 import { riskNotice as upstreamRiskNotice } from '../upstreams.js';
@@ -717,35 +720,78 @@ export class Daemon {
     }
     // —— 每日签到 ——
     /** 现在能签到的：WorkBuddy 国内版（已登录）、Qoder（填了个人访问令牌） */
+    /**
+     * 能签到的每个账号（设计 §14.19）：WorkBuddy 主账号 + 多加的签到账号、每个 Qoder 令牌、本机每个 Trae 账号。
+     * 第一个账号的 id 沿用 workbuddy / qoder / trae（旧结果照常认），多出来的是 <家>:<账号>。同一个账号只签一次。
+     */
     async checkers() {
         const out = [];
+        const home = this.ctx.paths.home;
+        const extra = await listWorkbuddyAccounts(home);
+        const seen = new Set();
         for (const rt of this.runtimes) {
             if (rt.variant.id !== 'workbuddy')
                 continue; // 国际版没有签到
             const st = await rt.wbStore.status().catch(() => null);
             if (st?.state !== 'signed-in')
                 continue;
-            out.push({ id: 'workbuddy', label: rt.label, run: async () => rt.wbClient.dailyCheckin(await rt.wbStore.resolve()) });
+            const uid = (await rt.wbStore.resolve().catch(() => null))?.uid;
+            if (uid)
+                seen.add(uid);
+            const tag = extra.length ? `（${accountTag(st.nickname, uid ?? '')}）` : '';
+            out.push({ id: 'workbuddy', label: `${rt.label}${tag}`, run: async () => rt.wbClient.dailyCheckin(await rt.wbStore.resolve()) });
+        }
+        for (const a of extra) {
+            if (seen.has(a.uid))
+                continue;
+            seen.add(a.uid);
+            const { store, client } = workbuddyAccountStore(home, a.file);
+            out.push({ id: `workbuddy:${a.uid}`, label: `WorkBuddy（${accountTag(a.nickname, a.uid)}）`, run: async () => client.dailyCheckin(await store.resolve()) });
         }
-        const q = (await loadSecrets(this.ctx)).checkin?.qoder;
-        if (q?.pat)
-            out.push({ id: 'qoder', label: QODER_REGIONS[q.region].label, run: () => qoderCheckin(q.pat, q.region) });
-        // Trae：本机装了并登录过 Trae 才有（读它自己的登录信息，不需要另外设置；VPS 上一般没有）
-        const trae = await findTraeCredential().catch(() => null);
-        if (trae)
-            out.push({ id: 'trae', label: 'Trae', run: async () => traeCheckin((await findTraeCredential()) ?? trae) });
+        const qoders = await loadQoders(this.ctx);
+        qoders.forEach((q, i) => {
+            // 一个令牌：「Qoder（国内版）」；几个：带上名字（没起名就用编号），如「Qoder（小号 · 国内版）」
+            const region = q.region === 'cn' ? L('国内版', 'China') : '';
+            const tag = q.name || (qoders.length > 1 ? `#${q.id}` : '');
+            const label = tag ? `Qoder（${[tag, region].filter(Boolean).join(' · ')}）` : QODER_REGIONS[q.region].label;
+            out.push({ id: i === 0 ? 'qoder' : `qoder:${q.id}`, label, run: () => qoderCheckin(q.pat, q.region) });
+        });
+        // 豆包：用户粘贴的 Cookie，每个账号一个
+        const doubaos = await loadDoubaos(this.ctx);
+        doubaos.forEach((d, i) => {
+            const tag = d.name || (doubaos.length > 1 ? `#${d.id}` : '');
+            out.push({ id: i === 0 ? 'doubao' : `doubao:${d.id}`, label: tag ? L(`豆包（${tag}）`, `Doubao (${tag})`) : L('豆包', 'Doubao'), run: () => doubaoCheckin(d.cookie, d.seed) });
+        });
+        // Trae：本机装了并登录过 Trae 才有（读它自己的登录信息，不需要另外设置；VPS 上一般没有）。每个账号签一次
+        const traes = await findTraeCredentials().catch(() => []);
+        traes.forEach((t, i) => {
+            const id = i === 0 ? 'trae' : `trae:${t.accountId ?? t.source}`;
+            out.push({
+                id,
+                label: traes.length > 1 ? `Trae（${t.accountId ? `…${t.accountId.slice(-4)}` : t.source}）` : 'Trae',
+                run: async () => traeCheckin((await findTraeCredentials()).find((x) => (x.accountId ?? x.source) === (t.accountId ?? t.source)) ?? t),
+            });
+        });
         return out;
     }
     async checkinStatus() {
         const file = await loadCheckin(this.ctx.paths.home);
         const checkers = await this.checkers();
-        const q = (await loadSecrets(this.ctx)).checkin?.qoder;
+        const qoders = await loadQoders(this.ctx);
+        const extra = await listWorkbuddyAccounts(this.ctx.paths.home);
+        const ids = new Set(checkers.map((c) => c.id));
         return {
             auto: file.auto !== false,
             date: beijingNow().date,
-            results: todayResults(file).map((r) => (r.state === 'failed' ? { ...r, advice: checkinAdvice(r.id, r.message ?? '') } : r)),
+            // 删掉的账号今天的结果不再显示
+            results: todayResults(file).filter((r) => ids.has(r.id)).map((r) => (r.state === 'failed' ? { ...r, advice: checkinAdvice(r.id, r.message ?? '') } : r)),
             available: checkers.map((c) => ({ id: c.id, label: c.label })),
-            qoder: { configured: Boolean(q?.pat), ...(q ? { region: q.region } : {}) },
+            qoder: { configured: qoders.length > 0, ...(qoders[0] ? { region: qoders[0].region } : {}) },
+            accounts: {
+                workbuddy: extra.map((a) => ({ uid: a.uid, label: `WorkBuddy（${accountTag(a.nickname, a.uid)}）` })),
+                qoder: qoders.map((q, i) => ({ id: q.id, label: checkers.find((c) => c.id === (i === 0 ? 'qoder' : `qoder:${q.id}`))?.label ?? q.id, region: q.region })),
+                doubao: (await loadDoubaos(this.ctx)).map((d, i) => ({ id: d.id, label: checkers.find((c) => c.id === (i === 0 ? 'doubao' : `doubao:${d.id}`))?.label ?? d.id })),
+            },
         };
     }
     checkinInflight;
@@ -767,20 +813,80 @@ export class Daemon {
         if (results)
             log_(`daemon: auto check-in ${results.results.map((r) => `${r.id}=${r.state}`).join(' ')}`);
     }
-    async setQoderPat(pat, region) {
+    /** 加一个 Qoder 令牌（同一个令牌再加 = 改名字 / 区域） */
+    async addQoderPat(pat, region, name) {
         if (!pat || /\s/.test(pat) || pat.length < 8)
             throw new DshModelError('invalid_key', L('这看起来不是 Qoder 的个人访问令牌', 'That does not look like a Qoder access token'));
         await exchangePat(pat, region); // 换得到短期 token 才算可用
-        const secrets = await loadSecrets(this.ctx);
-        secrets.checkin = { ...secrets.checkin, qoder: { pat, region, savedAt: new Date().toISOString() } };
-        await saveSecrets(this.ctx, secrets);
+        await addQoder(this.ctx, { pat, region, ...(name ? { name } : {}) });
     }
-    async removeQoderPat() {
-        const secrets = await loadSecrets(this.ctx);
-        if (secrets.checkin?.qoder) {
-            delete secrets.checkin.qoder;
-            await saveSecrets(this.ctx, secrets);
+    async removeQoderPat(id) {
+        await removeQoder(this.ctx, id);
+    }
+    /** 加一个豆包账号：先用这份 Cookie 查一次签到任务，查得到才保存 */
+    async addDoubaoCookie(raw, name) {
+        const cookie = normalizeCookie(raw);
+        if (cookie.length < 20 || !cookie.includes('='))
+            throw new DshModelError('invalid_key', L('这看起来不是豆包的 Cookie：要从浏览器开发者工具里复制整串 Cookie（形如 a=1; b=2; …）', 'That does not look like a Doubao cookie: copy the whole Cookie string from the browser developer tools (like a=1; b=2; …)'));
+        const seed = randomBytes(16).toString('hex');
+        let st;
+        try {
+            st = await doubaoStatus(cookie, seed);
         }
+        catch (error) {
+            if (error instanceof DoubaoAuthError)
+                throw new DshModelError('key_rejected', L('豆包说这份 Cookie 没有登录或已过期：在浏览器里登录 doubao.com 后重新复制', 'Doubao says this cookie is signed out or expired: sign in at doubao.com in the browser and copy it again'));
+            throw new DshModelError('doubao_failed', String(error.message ?? error));
+        }
+        if (st.checkedIn === null)
+            throw new DshModelError('doubao_no_task', L('这个豆包账号没有签到任务：只有个人账号能领每日额度，飞书企业账号不行。请换成个人账号登录后再复制 Cookie', 'This Doubao account has no check-in task: only personal accounts get the daily credits, not Feishu enterprise accounts. Sign in with a personal account and copy the cookie again'));
+        await addDoubao(this.ctx, { cookie, seed, ...(name ? { name } : {}) });
+    }
+    /** 加一个 WorkBuddy 签到账号：打开链接授权（同来源登录一样），存成单独一份，只用来签到 */
+    async startWorkbuddyCheckinLogin() {
+        const all = await loadAll(this.ctx);
+        const home = this.ctx.paths.home;
+        const s = {
+            id: `wbc-${randomBytes(8).toString('hex')}`,
+            source: 'workbuddy-checkin',
+            kind: 'link',
+            status: 'pending',
+            needsPaste: false,
+            startedAt: new Date().toISOString(),
+            expiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
+            abort: new AbortController(),
+        };
+        this.sessions.set(s.id, s);
+        const tmp = join(workbuddyAccountsDir(home), `.pending-${s.id}.json`);
+        let urlReady;
+        const ready = new Promise((r) => (urlReady = r));
+        void workbuddyLogin(CN_VARIANT, home, { proxy: all.config.proxy, owner: this.ctx.owner, signal: s.abort.signal, file: tmp, onUrl: (url) => { s.url = url; urlReady(); } })
+            .then(async (cred) => {
+            const uid = cred.uid || randomBytes(4).toString('hex');
+            const primary = this.runtimes.find((r) => r.variant.id === 'workbuddy');
+            const primaryUid = primary ? (await primary.wbStore.resolve().catch(() => null))?.uid : undefined;
+            if (primaryUid && primaryUid === uid) {
+                await rm(tmp, { force: true });
+                s.status = 'error';
+                s.error = L('这个账号就是来源里登录的 WorkBuddy，已经在签到了。请在浏览器里换另一个账号授权', 'This is the WorkBuddy account already signed in under Sources, so it is checked in already. Authorise a different account');
+                return;
+            }
+            await rename(tmp, join(workbuddyAccountsDir(home), `${uid.replace(/[^A-Za-z0-9_-]/g, '_')}.json`));
+            s.status = 'ok';
+            void this.checkinNow(false).catch(() => { });
+        })
+            .catch(async (error) => {
+            await rm(tmp, { force: true }).catch(() => { });
+            if (s.status === 'pending') {
+                s.status = 'error';
+                s.error = String(error.message ?? error);
+            }
+            urlReady();
+        });
+        await Promise.race([ready, new Promise((r) => setTimeout(r, 30_000))]);
+        if (s.status === 'error')
+            throw new DshModelError('login_failed', s.error ?? 'login failed');
+        return publicSession(s);
     }
     // —— 更新 / 卸载（管理页的按钮）——
     selfJob;
@@ -1104,11 +1210,27 @@ export class Daemon {
                 return ok(await this.checkinStatus());
             }
             if (method === 'POST' && path === '/checkin/qoder') {
-                await this.setQoderPat(String(b.pat ?? '').trim(), b.region === 'intl' ? 'intl' : 'cn');
+                await this.addQoderPat(String(b.pat ?? '').trim(), b.region === 'intl' ? 'intl' : 'cn', typeof b.name === 'string' ? b.name : undefined);
                 return ok(await this.checkinNow(true));
             }
-            if (method === 'DELETE' && path === '/checkin/qoder') {
-                await this.removeQoderPat();
+            if (method === 'DELETE' && (path === '/checkin/qoder' || (seg[0] === 'checkin' && seg[1] === 'qoder' && seg[2]))) {
+                await this.removeQoderPat(seg[2]);
+                return ok(await this.checkinStatus());
+            }
+            if (method === 'POST' && path === '/checkin/workbuddy')
+                return ok({ login: await this.startWorkbuddyCheckinLogin() });
+            if (method === 'POST' && path === '/checkin/doubao') {
+                await this.addDoubaoCookie(String(b.cookie ?? ''), typeof b.name === 'string' ? b.name : undefined);
+                return ok(await this.checkinNow(true));
+            }
+            if (method === 'DELETE' && seg[0] === 'checkin' && seg[1] === 'doubao' && seg[2]) {
+                if (!(await removeDoubao(this.ctx, seg[2])))
+                    throw new DshModelError('no_account', L('没有这个签到账号', 'No such check-in account'));
+                return ok(await this.checkinStatus());
+            }
+            if (method === 'DELETE' && seg[0] === 'checkin' && seg[1] === 'workbuddy' && seg[2]) {
+                if (!(await removeWorkbuddyAccount(this.ctx.paths.home, seg[2])))
+                    throw new DshModelError('no_account', L('没有这个签到账号', 'No such check-in account'));
                 return ok(await this.checkinStatus());
             }
             if (method === 'GET' && path === '/failures') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model",
-  "version": "0.23.3",
+  "version": "0.25.0",
   "description": "Daily check-in credits claimed for you (Trae, Qoder, WorkBuddy China), one OpenAI-compatible address that relays every model, and free or subscription model sources (SiliconFlow, Gemini, Codex, Kimi, Ollama…). For DeepSeek Harness (dsh) and any OpenAI-compatible tool. 每天自动签到领积分 · 一个地址中转所有模型 · 免费和订阅模型随你接。",
   "keywords": [
     "siliconflow",

package/plugin/client.js

@@ -985,37 +985,76 @@ window.__ModuleLoader__.load({
     // —— 每日签到 ——
     const CHECKIN_TEXT = (r) => (r.state === 'signed' ? L(`成功${r.credit ? ` +${r.credit} 积分` : ''}`, `done${r.credit ? ` +${r.credit} credits` : ''}`) : r.state === 'already' ? L('今天已签过', 'already today') : L(`失败：${r.message || ''}`, `failed: ${r.message || ''}`))
 
-    function QoderDialog({ onDone, onClose }) {
+    function QoderDialog({ onDone, onClose, another }) {
       const [pat, setPat] = useState('')
+      const [name, setName] = useState('')
       const [region, setRegion] = useState('cn')
       const [busy, setBusy] = useState(false)
       const [msg, setMsg] = useState('')
       const save = async () => {
         setBusy(true)
         setMsg(L('正在验证这个令牌并签到…', 'Checking the token and checking in…'))
-        try { await api('POST', '/checkin/qoder', { pat: pat.trim(), region }); onDone() } catch (e) { setMsg(e.message); setBusy(false) }
+        try { await api('POST', '/checkin/qoder', { pat: pat.trim(), region, ...(name.trim() ? { name: name.trim() } : {}) }); onDone() } catch (e) { setMsg(e.message); setBusy(false) }
       }
-      return h(Modal, { title: L('添加 Qoder 签到', 'Add Qoder check-in'), onClose },
+      return h(Modal, { title: another ? L('再加一个 Qoder 账号', 'Add another Qoder account') : L('添加 Qoder 签到', 'Add Qoder check-in'), onClose },
         h('p', { style: S.note },
           L('登录 Qoder 网站，在「设置 → API 令牌」（有的版本叫「账号 → 集成」）里点「创建令牌」，复制生成的个人访问令牌（以 pt- 开头，只显示一次），粘贴到这里。只用来每天领签到积分，保存在本机。', 'Sign in on the Qoder website, open Settings → API Tokens (Account → Integrations in some versions), click Create token, then paste the personal access token here (it starts with pt- and is shown only once). It is only used to claim the daily credits, and stays on this machine.'),
           h('a', { href: region === 'cn' ? 'https://qoder.com.cn/account/integrations' : 'https://qoder.com/account/integrations', target: '_blank', rel: 'noopener noreferrer', style: { color: C.accent, marginLeft: 6 } }, region === 'cn' ? L('去 Qoder 国内版创建 ↗', 'Create on Qoder China ↗') : L('去 Qoder 国际版创建 ↗', 'Create on Qoder ↗'))),
         h('div', { style: { ...S.line, marginBottom: 8 } },
           ['cn', 'intl'].map((r) => h('label', { key: r, style: { ...S.meta, display: 'flex', alignItems: 'center', gap: 4, cursor: 'pointer' } },
             h('input', { type: 'radio', name: 'qoder-region', checked: region === r, onChange: () => setRegion(r) }), r === 'cn' ? L('国内版', 'China') : L('国际版', 'International')))),
+        another ? h('div', { style: { ...S.line, marginBottom: 8 } },
+          h('input', { style: { ...S.input, ...S.grow }, maxLength: 20, placeholder: L('给这个账号起个名字，如：小号', 'A name for this account, e.g. Second'), value: name, onChange: (e) => setName(e.target.value), 'aria-label': L('账号名字', 'Account name') })) : null,
         h('div', { style: S.line },
           h('input', { type: 'password', style: { ...S.input, ...S.grow }, placeholder: L('个人访问令牌', 'Personal access token'), value: pat, onChange: (e) => setPat(e.target.value) }),
           h('button', { type: 'button', style: S.btnPrimary, disabled: busy || !pat.trim(), onClick: () => void save() }, L('保存', 'Save'))),
         msg ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null)
     }
 
+    /** 添加豆包签到：从浏览器复制一次登录 Cookie（豆包没有令牌，也不读豆包客户端的文件） */
+    function DoubaoDialog({ onDone, onClose, another }) {
+      const [cookie, setCookie] = useState('')
+      const [name, setName] = useState('')
+      const [busy, setBusy] = useState(false)
+      const [msg, setMsg] = useState('')
+      const save = async () => {
+        setBusy(true)
+        setMsg(L('正在用这份 Cookie 查签到任务并签到…', 'Checking this cookie and checking in…'))
+        try { await api('POST', '/checkin/doubao', { cookie: cookie.trim(), ...(name.trim() ? { name: name.trim() } : {}) }); onDone() } catch (e) { setMsg(e.message); setBusy(false) }
+      }
+      const step = (n, text) => h('div', { style: { ...S.meta, lineHeight: 1.7 } }, `${n}. `, text)
+      return h(Modal, { title: another ? L('再加一个豆包账号', 'Add another Doubao account') : L('添加豆包签到（实验）', 'Add Doubao check-in (experimental)'), onClose },
+        h('p', { style: S.note }, L('豆包「天天领额度」每天送体验额度，只有个人账号能领（飞书企业账号不行）。豆包没有令牌，要从浏览器复制一次登录 Cookie：', 'Doubao gives daily credits to personal accounts (not Feishu enterprise accounts). Doubao has no token, so copy its sign-in cookie from the browser once:')),
+        step(1, h('span', null, L('用电脑浏览器打开 ', 'Open '), h('a', { href: 'https://www.doubao.com/', target: '_blank', rel: 'noopener noreferrer', style: { color: C.accent } }, 'doubao.com ↗'), L(' 并登录', ' in a desktop browser and sign in'))),
+        step(2, L('按 F12 打开开发者工具，切到「网络 / Network」，刷新一下页面', 'Press F12, open the Network tab, and reload the page')),
+        step(3, L('点列表里任意一条 doubao.com 的请求，在「请求标头 / Request Headers」里找到 Cookie 那一行，右键复制它的值', 'Click any doubao.com request, find Cookie under Request Headers, and copy its value')),
+        h('div', { style: { fontSize: 12, color: C.warn, margin: '8px 0' } }, L('Cookie 等于你的登录：只粘在这里（保存在本机），不要发给别人。', 'The cookie is your sign-in: paste it only here (it stays on this machine) and never share it.')),
+        another ? h('div', { style: { ...S.line, marginBottom: 8 } },
+          h('input', { style: { ...S.input, ...S.grow }, maxLength: 20, placeholder: L('给这个账号起个名字，如：小号', 'A name for this account, e.g. Second'), value: name, onChange: (e) => setName(e.target.value), 'aria-label': L('账号名字', 'Account name') })) : null,
+        h('div', { style: S.line },
+          h('input', { type: 'password', style: { ...S.input, ...S.grow }, placeholder: L('粘贴 Cookie', 'Paste the cookie'), value: cookie, onChange: (e) => setCookie(e.target.value), 'aria-label': 'Cookie' }),
+          h('button', { type: 'button', style: S.btnPrimary, disabled: busy || !cookie.trim(), onClick: () => void save() }, L('保存', 'Save'))),
+        msg ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null)
+    }
+
     /** 签到卡片：平时一行"今日已完成签到：…"；没签完的列出来，一键签到；自动签到开关 */
     function CheckinCard() {
       const [st, setSt] = useState(null)
       const [busy, setBusy] = useState(false)
       const [open, setOpen] = useState(false)
       const [qoder, setQoder] = useState(false)
+      const [wbLogin, setWbLogin] = useState(null)
+      const [doubao, setDoubao] = useState(false)
       const [err, setErr] = useState('')
       const refresh = useCallback(() => api('GET', '/checkin').then(setSt, () => {}), [])
+      const addWorkbuddy = async () => {
+        setErr('')
+        try { setWbLogin((await api('POST', '/checkin/workbuddy')).login) } catch (e) { setErr(e.message) }
+      }
+      const removeAccount = async (kind, id, label) => {
+        if (!window.confirm(L(`不再给「${label}」签到？`, `Stop checking in "${label}"?`))) return
+        try { setSt(await api('DELETE', `/checkin/${kind}/${encodeURIComponent(id)}`)) } catch (e) { setErr(e.message) }
+      }
       useEffect(() => { void refresh(); const t = setInterval(refresh, 5 * 60 * 1000); return () => clearInterval(t) }, [refresh])
       if (!st) return null
       const byId = new Map(st.results.map((r) => [r.id, r]))
@@ -1033,8 +1072,10 @@ window.__ModuleLoader__.load({
         // 没有能签到的：只留一个很小的入口
         return h('div', { style: { ...S.section, marginBottom: 16 } },
           h('div', { style: { ...S.meta } }, L('每日签到：登录 WorkBuddy 国内版，或', 'Daily check-in: sign in to WorkBuddy (China), or '),
-            h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setQoder(true) }, L('添加 Qoder', 'Add Qoder'))),
-          qoder ? h(QoderDialog, { onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null)
+            h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setQoder(true) }, L('添加 Qoder', 'Add Qoder')),
+            h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setDoubao(true) }, L('添加豆包', 'Add Doubao'))),
+          qoder ? h(QoderDialog, { onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null,
+          doubao ? h(DoubaoDialog, { onDone: () => { setDoubao(false); void refresh() }, onClose: () => setDoubao(false) }) : null)
       }
       return h('div', { style: S.section },
         h('div', { style: { ...S.card, padding: '10px 14px' } },
@@ -1044,19 +1085,31 @@ window.__ModuleLoader__.load({
               done.length && pending.length ? h('span', { style: { color: C.sub } }, L('；', '; ')) : null,
               pending.length ? h('span', { style: { color: C.text } }, L(`还没签：${pending.map((a) => a.label).join('、')}`, `Not yet: ${pending.map((a) => a.label).join(', ')}`)) : null),
             pending.length ? h('button', { type: 'button', style: S.btnPrimary, disabled: busy, onClick: () => void run() }, busy ? L('签到中…', 'Checking in…') : L('一键签到', 'Check in all')) : null,
-            st.results.length ? h('button', { type: 'button', style: S.btn, onClick: () => setOpen(!open) }, open ? L('收起', 'Hide') : L('详情', 'Details')) : null,
+            // 详情里还有管理账号的按钮，所以没签过也要能打开
+            h('button', { type: 'button', style: S.btn, onClick: () => setOpen(!open) }, open ? L('收起', 'Hide') : L('详情', 'Details')),
             h('label', { style: { ...S.meta, display: 'flex', alignItems: 'center', gap: 4, cursor: 'pointer', whiteSpace: 'nowrap' } },
               h('input', { type: 'checkbox', checked: st.auto, onChange: (e) => void toggleAuto(e.target.checked) }), L('自动签到', 'Auto'))),
           open ? h('div', { style: { marginTop: 8 } },
             st.results.map((r) => h('div', { key: r.id, style: { fontSize: 12, lineHeight: 1.8, color: r.state === 'failed' ? C.err : C.text } },
               `${r.label}：${CHECKIN_TEXT(r)}`, r.advice ? h('span', { style: { color: C.sub, marginLeft: 6 } }, r.advice) : null)),
-            h('div', { style: { ...S.line, marginTop: 6 } },
-              st.qoder.configured
-                ? h('button', { type: 'button', style: S.btn, onClick: () => { if (window.confirm(L('删除 Qoder 的令牌？之后不再给 Qoder 签到。', 'Remove the Qoder token? Qoder will no longer be checked in.'))) void api('DELETE', '/checkin/qoder').then(setSt, (e) => setErr(e.message)) } }, L('删除 Qoder 令牌', 'Remove Qoder token'))
-                : h('button', { type: 'button', style: S.btn, onClick: () => setQoder(true) }, L('添加 Qoder', 'Add Qoder')))) : null,
+            // 多账号：多加的 WorkBuddy 签到账号、每个 Qoder 令牌，都能删；再加一个
+            h('div', { style: { marginTop: 8, borderTop: `1px solid ${C.border}`, paddingTop: 8 } },
+              h('div', { style: { ...S.meta, marginBottom: 4 } }, L('签到账号（同一家可以加几个账号）', 'Check-in accounts (several per product are fine)')),
+              [...((st.accounts && st.accounts.workbuddy) || []).map((a) => ({ kind: 'workbuddy', id: a.uid, label: a.label })), ...((st.accounts && st.accounts.qoder) || []).map((q) => ({ kind: 'qoder', id: q.id, label: q.label })), ...((st.accounts && st.accounts.doubao) || []).map((d) => ({ kind: 'doubao', id: d.id, label: d.label }))].map((a) =>
+                h('div', { key: `${a.kind}:${a.id}`, style: { ...S.line, minHeight: 24, fontSize: 12 } },
+                  h('span', { style: S.grow }, a.label),
+                  h('button', { type: 'button', style: { ...S.btn, padding: '2px 8px' }, onClick: () => void removeAccount(a.kind, a.id, a.label) }, L('删除', 'Remove')))),
+              h('div', { style: { ...S.line, marginTop: 4, flexWrap: 'wrap' } },
+                h('button', { type: 'button', style: S.btn, onClick: () => void addWorkbuddy() }, L('+ 添加 WorkBuddy 账号', '+ Add a WorkBuddy account')),
+                h('button', { type: 'button', style: S.btn, onClick: () => setQoder(true) }, st.qoder.configured ? L('+ 再加一个 Qoder 账号', '+ Add another Qoder account') : L('+ 添加 Qoder', '+ Add Qoder')),
+                h('button', { type: 'button', style: S.btn, onClick: () => setDoubao(true) }, (st.accounts && st.accounts.doubao && st.accounts.doubao.length) ? L('+ 再加一个豆包账号', '+ Add another Doubao account') : L('+ 添加豆包', '+ Add Doubao')))),
+            // Trae 读本机 Trae 的登录：这台没装（比如 VPS）就不会出现，在装了 Trae 的电脑上签就行（每个账号一天一次）
+            !st.available.some((a) => a.id === 'trae') ? h('div', { style: { ...S.meta, marginTop: 6 } }, L('Trae：这台电脑上没装 Trae，所以不签。在装了 Trae 的电脑上会自动签（一个账号一天签一次就够）。', 'Trae: not installed on this machine, so it is skipped. A computer with Trae installed checks it in automatically (once a day per account is enough).')) : null) : null,
           !open && !st.qoder.configured ? h('div', { style: { ...S.meta, marginTop: 4 } }, h('button', { type: 'button', style: { ...S.btn, padding: '2px 8px' }, onClick: () => setQoder(true) }, L('+ 添加 Qoder', '+ Add Qoder'))) : null,
           err ? h('div', { style: { fontSize: 12, color: C.err, marginTop: 6 } }, err) : null),
-        qoder ? h(QoderDialog, { onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null)
+        qoder ? h(QoderDialog, { another: st.qoder.configured, onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null,
+        doubao ? h(DoubaoDialog, { another: Boolean(st.accounts && st.accounts.doubao && st.accounts.doubao.length), onDone: () => { setDoubao(false); setOpen(true); void refresh() }, onClose: () => setDoubao(false) }) : null,
+        wbLogin ? h(LoginDialog, { source: { id: 'workbuddy-checkin', label: L('WorkBuddy 签到账号', 'WorkBuddy check-in account'), login: 'link' }, session: wbLogin, onDone: () => { setWbLogin(null); setOpen(true); setTimeout(() => void refresh(), 3000) }, onClose: () => { setWbLogin(null); void refresh() } }) : null)
     }
 
     /** 签完在 dsh 右下角提示一次（成功或失败），一天一次 */

package/plugin/index.js

@@ -63,8 +63,10 @@ const ALLOWED = [
   ['GET', /^\/self$/],
   ['GET', /^\/failures$/],
   ['GET', /^\/checkin$/],
-  ['POST', /^\/checkin(\/auto|\/qoder)?$/],
-  ['DELETE', /^\/checkin\/qoder$/],
+  ['POST', /^\/checkin(\/auto|\/qoder|\/workbuddy|\/doubao)?$/],
+  ['DELETE', /^\/checkin\/qoder(\/[A-Za-z0-9_-]{1,40})?$/],
+  ['DELETE', /^\/checkin\/workbuddy\/[A-Za-z0-9_-]{1,80}$/],
+  ['DELETE', /^\/checkin\/doubao\/[A-Za-z0-9_-]{1,40}$/],
   ['POST', /^\/models\/test$/],
   ['GET', /^\/combos$/],
   ['POST', /^\/combos$/],