dsh-model 0.23.4 → 0.26.0

package/README.en.md

@@ -2,7 +2,7 @@
 
 # dsh-model
 
-**📅 Daily check-in credits claimed for you · 🔁 one address that relays every model · 🧩 free and subscription models, your pick**
+**📅 Daily check-in credits claimed for you (Trae, Qoder, WorkBuddy, Doubao) · 🔁 one address that relays every model · 🧩 free and subscription models, your pick**
 
 Install once and all three are taken care of. dsh gets a management page; without dsh, the command line does everything.
 
@@ -27,10 +27,14 @@ English · [中文](README.md)
 |---|---|---|
 | **Trae** | Detected automatically if Trae is installed and signed in; nothing to do | Check-in credits (200 a day in testing) |
 | **Qoder** | Paste a personal access token once (China or international) | That day's check-in credits |
-| **WorkBuddy (China)** | Sign in once | Check-in credits |
+| **WorkBuddy (China)** | Sign in once (several accounts are fine) | Check-in credits |
+| **Doubao** (experimental) | Copy the sign-in cookie from the browser once (personal accounts only) | Daily trial credits |
 
 - **Automatic by default**: done at a random 5–55 minutes after midnight Beijing time; failures retry an hour later; if the computer was off, it catches up within a minute of starting.
 - **You can see it**: one line at the top of the settings page, "Checked in today: …", with a one-click "Check in all" for anything missed, plus a one-time notice in the corner of dsh.
+- **What else this machine can do**: the card lists the supported products not set up here yet, each with "+ Add".
+- **Move it to an always-on VPS**: "Copy check-in accounts to another machine" gives an encrypted text and a code to import on the VPS page (Qoder and Doubao; sign in to WorkBuddy on the VPS itself, and Trae stays on the computer that has Trae).
+- **Several accounts**: each product can have more than one. In the check-in card's Details: "+ Add a WorkBuddy account" (approve through a link) and "+ Add another Qoder account"; several Trae installs are checked in once per account automatically.
 - **Check-in only, credits untouched**: they stay on your account for use in each product's own app. Command line: `dsh-model checkin`.
 
 ## 🔁 2. Relay: one address, one key, every model
@@ -49,7 +53,7 @@ Your model sources each have their own API and sign-in. dsh-model puts them behi
 | Kind | Sources |
 |---|---|
 | **Free (suggested)** | **SiliconFlow** (reachable from China; some models free after identity verification), **Gemini** (if you can reach Google; the best free models) |
-| Free · limited | Groq, OpenRouter (`:free` models) |
+| Free · limited | **Zhipu GLM** (the Flash models), **iFlytek Spark** (Spark Lite), Baidu Qianfan (ERNIE Speed / Lite), Groq, OpenRouter (`:free` models) |
 | Local | Ollama, LM Studio: appear once started, no sign-in |
 | Subscription | Codex (ChatGPT Plus / Pro), Kimi Code, Grok, Muse, Devin: sign in from the management page |
 | Pay as you go | DeepSeek official, OpenCode Zen, any OpenAI-compatible service |
@@ -110,6 +114,10 @@ If a source is signed in but has no usable plan (say, a Kimi account without Kim
 | Gemini (Google AI Studio), Groq | Free · limited | Paste a free API key; daily / per-minute limits apply |
 | OpenRouter | Free · limited | `:free` models are free (about 50 requests a day) |
 | SiliconFlow | Free · limited | Some small models are free after identity verification |
+| Zhipu GLM | Free · limited | The Flash models (e.g. GLM-4.7-Flash) are free; reachable from China |
+| iFlytek Spark | Free · limited | Spark Lite is free with no token cap, 2 requests per second; use the console's APIPassword as the key |
+| Baidu Qianfan | Free · limited | ERNIE Speed / Lite are free for now (rate limited) |
+| Volcengine Ark (Doubao models), MiniMax, Huawei Cloud ModelArts | Paid | Official APIs, just add a key; Ark and Huawei Cloud have free quotas for new users |
 | DeepSeek official, any OpenAI-compatible service | Paid | Paste an API key (and a URL for other services) |
 | Codex | Paid | ChatGPT Plus / Pro |
 | Kimi | Paid | Kimi Code plan |

package/README.md

@@ -2,7 +2,7 @@
 
 # dsh-model
 
-**📅 每天自动签到领积分 · 🔁 一个地址中转所有模型 · 🧩 免费和订阅模型随你接**
+**📅 每天自动签到领积分（Trae、Qoder、WorkBuddy、豆包）· 🔁 一个地址中转所有模型 · 🧩 免费和订阅模型随你接**
 
 装一次，三件事都替你做好。dsh 里有图形管理页，没有 dsh 也能用命令行。
 
@@ -27,10 +27,14 @@
 |---|---|---|
 | **Trae** | 本机装了 Trae 并登录过，自动识别，什么都不用做 | 签到送积分（实测每天 200） |
 | **Qoder** | 粘贴一次个人访问令牌（国内版、国际版都行） | 领当天的签到积分 |
-| **WorkBuddy 国内版** | 登录一次 | 签到送积分 |
+| **WorkBuddy 国内版** | 登录一次（可以加几个账号） | 签到送积分 |
+| **豆包**（实验） | 从浏览器复制一次登录 Cookie（只支持个人账号） | 「天天领额度」送体验额度 |
 
 - **自动签到默认打开**：北京时间零点后随机延后 5–55 分钟签好；失败的一小时后重试；电脑关机错过了，开机一分钟内补签。
 - **结果看得见**：设置页顶部一行「今日已完成签到：…」，没签上的可以「一键签到」；签完在 dsh 右下角提示一次。
+- **这台还能签哪些**：卡片里列出支持、但这台还没设置的，旁边就是「+ 添加」。
+- **放到 VPS 上签，不会漏**：「复制签到账号到另一台机器」导出一段加密文本和提取码，到 VPS 的页面里「导入」即可（Qoder、豆包；WorkBuddy 在 VPS 上各自登录，Trae 留在装了 Trae 的电脑上签）。
+- **多账号**：一家可以签几个账号。在签到卡片的「详情」里「+ 添加 WorkBuddy 账号」（打开链接授权）、「+ 再加一个 Qoder 账号」；本机装了几个 Trae 会自动按账号各签一次。
 - **只签到，不碰积分**：积分留在你的账号里，照常在各家官方软件里用。命令行：`dsh-model checkin`。
 
 ## 🔁 2. 中转：一个地址、一把 key，用上所有模型
@@ -49,7 +53,7 @@
 | 类型 | 来源 |
 |---|---|
 | **免费（推荐）** | **硅基流动**（国内直连，实名后部分模型免费）、**Gemini**（能上外网，免费模型里质量最好） |
-| 免费 · 额度少 | Groq、OpenRouter（`:free` 模型） |
+| 免费 · 额度少 | **智谱 GLM**（Flash 系列免费）、**讯飞星火**（Spark Lite 免费）、百度千帆（ERNIE Speed / Lite）、Groq、OpenRouter（`:free` 模型） |
 | 本机 | Ollama、LM Studio：启动后自动出现，不用登录 |
 | 订阅 | Codex（ChatGPT Plus / Pro）、Kimi Code、Grok、Muse、Devin：在管理页里登录即可 |
 | 按量付费 | DeepSeek 官方、OpenCode Zen、任意 OpenAI 兼容服务 |
@@ -110,6 +114,10 @@ dsh-model setup
 | Gemini（Google AI Studio）、Groq | 免费·额度少 | 填免费 API key 即可，每天 / 每分钟有上限 |
 | OpenRouter | 免费·额度少 | 名字带 `:free` 的模型免费（每天约 50 次） |
 | 硅基流动 | 免费·额度少 | 实名认证后部分小模型免费 |
+| 智谱 GLM | 免费·额度少 | Flash 系列（如 GLM-4.7-Flash）免费，国内直连 |
+| 讯飞星火 | 免费·额度少 | Spark Lite 免费不限量，每秒 2 次；key 填控制台的 APIPassword |
+| 百度千帆 | 免费·额度少 | ERNIE Speed / Lite 长期免费（限速） |
+| 火山方舟（豆包大模型）、MiniMax 开放平台、华为云 ModelArts | 需付费 | 官方 API，填 key 即可；火山方舟、华为云有新用户免费额度 |
 | DeepSeek 官方、其他 OpenAI 兼容服务 | 需付费 | 填 API key（其他服务还要填地址） |
 | Codex | 需付费 | ChatGPT Plus / Pro |
 | Kimi | 需付费 | Kimi Code 套餐 |

package/dist/bridge/login.js

@@ -7,7 +7,7 @@
 //   GET {base}/v2/plugin/login/account?state=…（Bearer）                 → 账号（uid / 企业 / 昵称）
 // 令牌按移植凭据库的"自有副本"格式写进 $DSH_MODEL_HOME/workbuddy/<ownFilename>（0600），bridge 直接用。
 // 网络请求走 curl：它认 -x 代理（Node 的 fetch 不走代理）；国内版域名强制直连。
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { DshModelError } from '../errors.js';
 import { L } from '../i18n.js';
 import { run } from '../util/exec.js';
@@ -110,9 +110,9 @@ export async function workbuddyLogin(variant, home, opts) {
         ...(nickname ? { nickname } : {}),
         source: 'dsh',
     };
-    const dir = bridgeDir(home);
-    await ensureDir(dir, { owner: opts.owner });
-    await atomicWrite(join(dir, variant.ownFilename), JSON.stringify({ version: 1, credential }, null, 2) + '\n', { mode: 0o600, owner: opts.owner });
+    const file = opts.file ?? join(bridgeDir(home), variant.ownFilename);
+    await ensureDir(dirname(file), { owner: opts.owner });
+    await atomicWrite(file, JSON.stringify({ version: 1, credential }, null, 2) + '\n', { mode: 0o600, owner: opts.owner });
     return credential;
 }
 /** 退出登录：删掉 dsh-model 保存的那份（App 的文件不动） */

package/dist/checkin/accounts.js

@@ -0,0 +1,147 @@
+// checkin/accounts.ts — 多账号签到（设计 §14.19）
+//
+// 每个签到项一个 id：第一个账号沿用 workbuddy / qoder / trae，多出来的是 <家>:<账号>（如 workbuddy:12345）。
+// - WorkBuddy：主账号就是来源里登录的那个（bridge 的凭据）；多出来的账号只用来签到，
+//   各存一份 $DSH_MODEL_HOME/workbuddy/checkin/<uid>.json（与 dsh-model 自己登录的格式相同，0600），不接模型。
+// - Qoder：secrets.json 里一组个人访问令牌，各带一个名字（Qoder 的接口不返回账号名）。
+// - Trae：本机装的每个 Trae 都读，按账号（userId）去重，每个账号签一次。
+// - 豆包：secrets.json 里一组 Cookie（用户从浏览器复制），各带一个名字。
+import { readdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { bridgeDir } from '../bridge/runtime.js';
+import { WorkBuddyCredentialStore } from '../bridge/workbuddy/auth.js';
+import { atRestKeyProviderFor } from '../bridge/workbuddy/desktop-credential-protection.js';
+import { WorkBuddyUpstreamClient } from '../bridge/workbuddy/upstream.js';
+import { CN_VARIANT } from '../bridge/workbuddy/variants.js';
+import { loadSecrets, saveSecrets } from '../secrets.js';
+import { readJson } from '../util/fs.js';
+import { randomBytes } from 'node:crypto';
+/** 一个签到项属于哪一家：workbuddy:123 → workbuddy */
+export const checkinKind = (id) => id.split(':')[0];
+// —— WorkBuddy 签到账号 ——
+export const workbuddyAccountsDir = (home) => join(bridgeDir(home), 'checkin');
+/** 多出来的 WorkBuddy 签到账号（不含来源里那个主账号） */
+export async function listWorkbuddyAccounts(home) {
+    const dir = workbuddyAccountsDir(home);
+    let names = [];
+    try {
+        names = (await readdir(dir)).filter((n) => /^[A-Za-z0-9_-]+\.json$/.test(n));
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const n of names.sort()) {
+        const doc = await readJson(join(dir, n));
+        const uid = doc?.credential?.uid || n.replace(/\.json$/, '');
+        out.push({ uid, ...(doc?.credential?.nickname ? { nickname: doc.credential.nickname } : {}), file: join(dir, n) });
+    }
+    return out;
+}
+/** 一个签到账号的凭据库：只用它自己的那份文件，不读桌面 App（否则会读到主账号） */
+export function workbuddyAccountStore(home, file) {
+    const client = new WorkBuddyUpstreamClient();
+    const store = new WorkBuddyCredentialStore({
+        variant: CN_VARIANT,
+        keyProvider: atRestKeyProviderFor(CN_VARIANT),
+        refresh: (credential) => client.refreshToken(credential),
+        ownPath: file,
+        desktopPath: join(workbuddyAccountsDir(home), '.no-desktop-credential'),
+    });
+    return { store, client };
+}
+export async function removeWorkbuddyAccount(home, uid) {
+    const acct = (await listWorkbuddyAccounts(home)).find((a) => a.uid === uid);
+    if (!acct)
+        return false;
+    await rm(acct.file, { force: true });
+    return true;
+}
+/** 名字里显示账号：昵称，没有就 uid 后 4 位 */
+export const accountTag = (nickname, uid) => nickname || `…${uid.slice(-4)}`;
+/** 读全部 Qoder 令牌；旧版只存了一个（secrets.checkin.qoder），读出来当第一个 */
+export async function loadQoders(ctx) {
+    const c = (await loadSecrets(ctx)).checkin;
+    if (c?.qoders?.length)
+        return c.qoders;
+    return c?.qoder?.pat ? [{ id: '1', pat: c.qoder.pat, region: c.qoder.region, ...(c.qoder.savedAt ? { savedAt: c.qoder.savedAt } : {}) }] : [];
+}
+export async function saveQoders(ctx, list) {
+    const secrets = await loadSecrets(ctx);
+    const checkin = { ...secrets.checkin };
+    delete checkin.qoder;
+    if (list.length)
+        checkin.qoders = list;
+    else
+        delete checkin.qoders;
+    secrets.checkin = Object.keys(checkin).length ? checkin : undefined;
+    await saveSecrets(ctx, secrets);
+}
+/** 加一个令牌：同一个令牌再加就是改名字 / 区域；返回它的 id */
+export async function addQoder(ctx, entry) {
+    const list = await loadQoders(ctx);
+    const same = list.find((q) => q.pat === entry.pat);
+    const name = entry.name?.trim().slice(0, 20);
+    if (same) {
+        same.region = entry.region;
+        if (name)
+            same.name = name;
+        await saveQoders(ctx, list);
+        return same.id;
+    }
+    const used = new Set(list.map((q) => q.id));
+    let n = list.length + 1;
+    while (used.has(String(n)))
+        n++;
+    const id = String(n);
+    list.push({ id, pat: entry.pat, region: entry.region, ...(name ? { name } : {}), savedAt: new Date().toISOString() });
+    await saveQoders(ctx, list);
+    return id;
+}
+export async function removeQoder(ctx, id) {
+    const list = await loadQoders(ctx);
+    // 不给 id：删第一个（旧版页面的"删除 Qoder 令牌"）
+    const target = id ?? list[0]?.id;
+    await saveQoders(ctx, list.filter((q) => q.id !== target));
+}
+export async function loadDoubaos(ctx) {
+    return (await loadSecrets(ctx)).checkin?.doubaos ?? [];
+}
+async function saveDoubaos(ctx, list) {
+    const secrets = await loadSecrets(ctx);
+    const checkin = { ...secrets.checkin };
+    if (list.length)
+        checkin.doubaos = list;
+    else
+        delete checkin.doubaos;
+    secrets.checkin = Object.keys(checkin).length ? checkin : undefined;
+    await saveSecrets(ctx, secrets);
+}
+/** 加一个豆包账号；同一个 Cookie 再加 = 改名字。返回 id */
+export async function addDoubao(ctx, entry) {
+    const list = await loadDoubaos(ctx);
+    const name = entry.name?.trim().slice(0, 20);
+    const same = list.find((d) => d.cookie === entry.cookie);
+    if (same) {
+        if (name)
+            same.name = name;
+        await saveDoubaos(ctx, list);
+        return same.id;
+    }
+    const used = new Set(list.map((d) => d.id));
+    let n = list.length + 1;
+    while (used.has(String(n)))
+        n++;
+    const id = String(n);
+    list.push({ id, cookie: entry.cookie, seed: entry.seed ?? randomBytes(16).toString('hex'), ...(name ? { name } : {}), savedAt: new Date().toISOString() });
+    await saveDoubaos(ctx, list);
+    return id;
+}
+export async function removeDoubao(ctx, id) {
+    const list = await loadDoubaos(ctx);
+    const next = list.filter((d) => d.id !== id);
+    if (next.length === list.length)
+        return false;
+    await saveDoubaos(ctx, next);
+    return true;
+}

package/dist/checkin/doubao.js

@@ -0,0 +1,112 @@
+// checkin/doubao.ts — 豆包每日签到（「天天领额度」，每天 +200 体验额度）
+//
+// 协议照 techysy/CreditDaddy 的 src/doubaoClient.js（MIT），对方 2026-10-19/20 抓包实测：
+//   POST https://www.doubao.com/alice/ug/campaign/v3/detail/        任务面板（含今天签没签）
+//   POST https://www.doubao.com/alice/ug/campaign/landing/checkin   领取；服务端幂等，重复领返回 idempotent:true
+// 鉴权只要 doubao.com 的登录 Cookie，没有 a_bogus / msToken 这类签名（dsh-model 也不伪造签名）。
+// 请求带豆包电脑版网页的平台参数（版本号、web 平台等），不带的话接口回"请求非法"。
+// 只支持个人账号：飞书企业账号的任务面板里没有签到任务。
+// Cookie 由用户从浏览器复制一次（存 secrets.json，0600），dsh-model 不读豆包客户端的文件。
+import { createHash } from 'node:crypto';
+const DETAIL_URL = 'https://www.doubao.com/alice/ug/campaign/v3/detail/';
+const CHECKIN_URL = 'https://www.doubao.com/alice/ug/campaign/landing/checkin';
+/** 任务面板所属活动组；签到是其中 task_kind = daily_signin 的任务 */
+const CAMPAIGN_GROUP = 'pc_incentive_task_mvp_v3';
+/** 登录过期 / 未登录的业务码 */
+const LOGIN_INVALID = 710012001;
+const TIMEOUT_MS = 20_000;
+const CLIENT_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) DoubaoDesktop/2.32.6 Chrome/147.0.7727.149 Safari/537.36';
+const COMMON_PARAMS = {
+    version_code: '20800',
+    language: 'zh',
+    device_platform: 'web',
+    doubao_device_platform: 'web',
+    aid: '497858',
+    real_aid: '497858',
+    pkg_type: 'release_version',
+    pc_version: '2.32.6',
+    doubao_pc_version: '5.72.66',
+    samantha_web: '1',
+    web_platform: 'desktop',
+    'use-olympus-account': '1',
+    web_tab_id: '0',
+};
+export class DoubaoAuthError extends Error {
+}
+/** 每个账号一组稳定的网页标识（由这个账号自己的随机种子派生，账号之间不同） */
+export function deviceIdsFor(seed) {
+    const h = createHash('sha256').update(`doubao-dev:${seed}`).digest();
+    return {
+        web_id: '76' + [...h.subarray(0, 8)].map((b) => b % 10).join(''),
+        tea_uuid: [...h.subarray(8, 16)].map((b) => b % 10).join('').padEnd(16, '7'),
+    };
+}
+function apiUrl(base, seed) {
+    return `${base}?${new URLSearchParams({ ...COMMON_PARAMS, ...deviceIdsFor(seed), device_id: '', region: '', sys_region: '' })}`;
+}
+/** 用户粘贴的可能是整行 "Cookie: a=b; c=d"，也可能带换行：规整成 "a=b; c=d" */
+export function normalizeCookie(raw) {
+    return raw.replace(/^\s*cookie\s*:\s*/i, '').replace(/[\r\n]+/g, ' ').replace(/\s*;\s*/g, '; ').replace(/;\s*$/, '').trim();
+}
+async function post(url, cookie, body) {
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: {
+            Cookie: cookie,
+            'Content-Type': 'application/json',
+            Accept: 'application/json, text/plain, */*',
+            Referer: 'https://www.doubao.com/pc/agent-explore',
+            Origin: 'https://www.doubao.com',
+            'User-Agent': CLIENT_UA,
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+    const text = await res.text();
+    try {
+        const json = JSON.parse(text);
+        if (json && typeof json === 'object')
+            return json;
+    }
+    catch {
+        // 非 JSON
+    }
+    throw new Error(`豆包接口返回无法解析（HTTP ${res.status}）`);
+}
+/** 签到状态（detail 接口）。Cookie 不对抛 DoubaoAuthError */
+export async function doubaoStatus(cookie, seed) {
+    const body = await post(apiUrl(DETAIL_URL, seed), cookie, { campaign_group_code: CAMPAIGN_GROUP });
+    const code = Number(body.code);
+    if (code === LOGIN_INVALID)
+        throw new DoubaoAuthError('豆包登录已过期（Cookie 失效）');
+    if (code !== 0)
+        throw new Error(`豆包任务面板返回异常：${String(body.msg ?? body.message ?? '')}（code ${code}）`);
+    const data = (body.data ?? {});
+    const task = Array.isArray(data.tasks) ? data.tasks.find((t) => t?.task_kind === 'daily_signin') : undefined;
+    const c = task?.daily_checkin ?? {};
+    return {
+        checkedIn: task ? c.checked_in_today === true : null,
+        continuousDays: Number(c.continuous_days) || 0,
+        rewardAmount: Number(c.reward?.reward_amount) || 0,
+        totalAmount: Number(data.progress?.total_amount) || 0,
+    };
+}
+/** 签到：先看今天签没签，没签才领 */
+export async function doubaoCheckin(cookie, seed) {
+    const st = await doubaoStatus(cookie, seed);
+    if (st.checkedIn === null)
+        throw new Error('这个豆包账号没有签到任务：只有个人账号能领，飞书企业账号不行（也可能活动暂时下线）');
+    if (st.checkedIn)
+        return { state: 'already' };
+    const body = await post(apiUrl(CHECKIN_URL, seed), cookie, { scene: CAMPAIGN_GROUP });
+    const code = Number(body.code);
+    if (code === LOGIN_INVALID)
+        throw new DoubaoAuthError('豆包登录已过期（Cookie 失效）');
+    if (code !== 0)
+        throw new Error(`豆包签到失败：${String(body.msg ?? body.message ?? '')}（code ${code}）`);
+    const d = (body.data ?? {});
+    if (d.idempotent === true)
+        return { state: 'already' };
+    const credit = Number(d.reward_amount) || st.rewardAmount || undefined;
+    return { state: 'signed', ...(credit ? { credit } : {}) };
+}

package/dist/checkin/index.js

@@ -1,4 +1,4 @@
-// checkin/index.ts — 每日签到（设计 §14.15）：WorkBuddy 国内版、Qoder、Trae；以后加 WPS 灵犀
+// checkin/index.ts — 每日签到（设计 §14.15）：WorkBuddy 国内版、Qoder、Trae、豆包；每家可以有几个账号（§14.19，checkin/accounts.ts）
 //
 // 「今天」按北京时间算：这几家都在北京时间零点换天（VPS 的系统时间是 UTC）。
 // 自动签到默认打开：守护进程每 15 分钟看一眼，过了当天随机的几分钟后签一次；失败的隔一小时再试；错过了下次开机补。
@@ -20,11 +20,16 @@ export function todayResults(file, now = new Date()) {
     return file.date === beijingNow(now).date ? file.results : [];
 }
 /** 失败原因 → 该怎么办 */
-export function checkinAdvice(id, message) {
-    if (/无效|过期|401|403|unauthor|expired/i.test(message)) {
+export function checkinAdvice(itemId, message) {
+    const id = itemId.split(':')[0];
+    if (/无效|过期|401|403|unauthor|expired|not able to authenticate/i.test(message)) {
+        if (id === 'doubao')
+            return L('豆包登录过期：在浏览器里重新登录 doubao.com，到签到卡片里删掉它，再复制 Cookie 添加一次', 'Doubao sign-in expired: sign in at doubao.com again, remove it in the check-in card and add the new cookie');
         if (id === 'trae')
             return L('Trae 登录过期：打开 Trae 重新登录一次', 'Trae sign-in expired: open Trae and sign in again');
-        return id === 'qoder' ? L('Qoder 个人访问令牌失效：在签到卡片里重新填一个', 'The Qoder access token no longer works: enter a new one in the check-in card') : L('WorkBuddy 登录过期：在来源里重新登录 WorkBuddy', 'WorkBuddy sign-in expired: sign in to WorkBuddy again under Sources');
+        if (id === 'qoder')
+            return L('Qoder 个人访问令牌失效：在签到卡片里删掉它再添加一个新的', 'The Qoder access token no longer works: remove it in the check-in card and add a new one');
+        return itemId.includes(':') ? L('这个 WorkBuddy 签到账号的登录过期：在签到卡片里删掉它再添加一次', 'This WorkBuddy check-in account has expired: remove it in the check-in card and add it again') : L('WorkBuddy 登录过期：在来源里重新登录 WorkBuddy', 'WorkBuddy sign-in expired: sign in to WorkBuddy again under Sources');
     }
     if (/timeout|timed out|fetch failed|network|ECONN/i.test(message))
         return L('网络不通：稍后会自动再试', 'Network problem: it will retry automatically');

package/dist/checkin/trae.js

@@ -42,6 +42,17 @@ export function decryptStorageValue(encoded) {
         throw new Error('Trae 登录信息校验不通过');
     return plain.toString('utf8');
 }
+/** JWT 里的账号 id（data.id）；读不出来返回 undefined */
+export function tokenAccountId(token) {
+    try {
+        const p = JSON.parse(Buffer.from(token.split('.')[1] ?? '', 'base64url').toString());
+        const id = p.data?.id ?? p.sub;
+        return id === undefined || id === null || id === '' ? undefined : String(id);
+    }
+    catch {
+        return undefined;
+    }
+}
 /** 各平台的应用数据目录 */
 function appDataRoots(home, platform = process.platform, env = process.env) {
     if (platform === 'darwin')
@@ -56,9 +67,25 @@ function appDataRoots(home, platform = process.platform, env = process.env) {
  * 所以全读一遍再挑：没过期的优先，其中桌面 App（带设备 id）优先，再按到期最晚。找不到返回 null（没装 Trae 就不显示）。
  */
 export async function findTraeCredential(home = homedir()) {
+    return (await findTraeCredentials(home))[0] ?? null;
+}
+/** 本机的每个 Trae 账号各一份登录（同一个账号装了几个 Trae 只算一个），第一个是最该用的 */
+export async function findTraeCredentials(home = homedir()) {
+    const found = await readTraeCredentials(home);
+    const groups = new Map();
+    for (const c of found) {
+        const key = c.accountId ?? `?${c.source}`;
+        groups.set(key, [...(groups.get(key) ?? []), c]);
+    }
+    const best = [...groups.values()].map((g) => pickTraeCredential(g)).filter(Boolean);
+    // 账号之间：没过期的在前
+    const first = pickTraeCredential(best);
+    return first ? [first, ...best.filter((c) => c !== first)] : [];
+}
+async function readTraeCredentials(home) {
     // 测试环境不看本机真装了什么（与不发现桌面 App 同一个开关）
     if (process.env.DSH_MODEL_NO_APP_DISCOVERY && home === homedir())
-        return null;
+        return [];
     const found = [];
     for (const root of appDataRoots(home)) {
         for (const app of APPS) {
@@ -74,7 +101,8 @@ export async function findTraeCredential(home = homedir()) {
                 if (!token)
                     continue;
                 const dc = Object.keys(storage).find((k) => k.startsWith(DEVICE_PREFIX));
-                found.push({ token, deviceId: dc ? dc.slice(DEVICE_PREFIX.length) : String(storage['telemetry.devDeviceId'] ?? ''), source: app });
+                const accountId = auth.userId !== undefined && auth.userId !== null && auth.userId !== '' ? String(auth.userId) : tokenAccountId(token);
+                found.push({ token, deviceId: dc ? dc.slice(DEVICE_PREFIX.length) : String(storage['telemetry.devDeviceId'] ?? ''), source: app, ...(accountId ? { accountId } : {}) });
             }
             catch {
                 // 没装、读不了或解不开：看下一个
@@ -85,14 +113,15 @@ export async function findTraeCredential(home = homedir()) {
         try {
             const text = (await readFile(join(home, dir, 'trae-jwt-token'), 'utf8')).trim();
             const token = text.startsWith('{') ? String(JSON.parse(text).token ?? '') : text;
+            const accountId = tokenAccountId(token);
             if (token.split('.').length === 3)
-                found.push({ token, deviceId: '', source: `~/${dir}` });
+                found.push({ token, deviceId: '', source: `~/${dir}`, ...(accountId ? { accountId } : {}) });
         }
         catch {
             // 没有
         }
     }
-    return pickTraeCredential(found);
+    return found;
 }
 /** 几份登录里挑一份：没过期的优先 → 带设备 id 的（桌面 App）优先 → 到期最晚的。导出给测试 */
 export function pickTraeCredential(list, now = Date.now()) {

package/dist/checkin/transfer.js

@@ -0,0 +1,65 @@
+// checkin/transfer.ts — 把签到账号复制到另一台机器（设计 §14.20）：比如 Mac 上加好的，搬到不关机的 VPS 上签
+//
+// 只搬能在任何机器上用的：Qoder 令牌、豆包 Cookie。
+//   WorkBuddy 不搬：登录令牌会续期轮换，两台用同一份会互相顶掉，所以每台各自登录。
+//   Trae 不搬：读的是本机 Trae 软件的登录，要在装了 Trae 的电脑上签。
+// 导出 = 一段加密文本 + 一个 8 位提取码（分开显示，光有文本解不开）。AES-256-GCM，密钥由提取码经 scrypt 派生。
+import { createCipheriv, createDecipheriv, randomBytes, randomInt, scryptSync } from 'node:crypto';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { addDoubao, addQoder, loadDoubaos, loadQoders } from './accounts.js';
+const PREFIX = 'dshm-checkin:v1:';
+/** 去掉容易看错的 0/O、1/I/L */
+const ALPHABET = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789';
+const keyFrom = (code, salt) => scryptSync(code.replace(/[\s-]/g, '').toUpperCase(), salt, 32, { N: 1 << 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 });
+export function sealBundle(bundle, code) {
+    const c = code ?? Array.from({ length: 8 }, () => ALPHABET[randomInt(ALPHABET.length)]).join('');
+    const salt = randomBytes(16);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', keyFrom(c, salt), iv);
+    const body = Buffer.concat([cipher.update(JSON.stringify(bundle), 'utf8'), cipher.final()]);
+    const text = PREFIX + Buffer.concat([salt, iv, cipher.getAuthTag(), body]).toString('base64url');
+    return { text, code: `${c.slice(0, 4)}-${c.slice(4)}` };
+}
+export function openBundle(text, code) {
+    const t = text.trim();
+    if (!t.startsWith(PREFIX))
+        throw new DshModelError('bad_transfer', L('这不是 dsh-model 导出的签到账号（应以 dshm-checkin: 开头）', 'This is not a dsh-model check-in export (it should start with dshm-checkin:)'));
+    const raw = Buffer.from(t.slice(PREFIX.length), 'base64url');
+    if (raw.length < 16 + 12 + 16 + 2)
+        throw new DshModelError('bad_transfer', L('导出的文本不完整：复制时可能少了一截', 'The export text is incomplete: part of it may be missing'));
+    const salt = raw.subarray(0, 16);
+    const iv = raw.subarray(16, 28);
+    const tag = raw.subarray(28, 44);
+    try {
+        const d = createDecipheriv('aes-256-gcm', keyFrom(code, salt), iv);
+        d.setAuthTag(tag);
+        const json = Buffer.concat([d.update(raw.subarray(44)), d.final()]).toString('utf8');
+        const b = JSON.parse(json);
+        return { qoders: Array.isArray(b.qoders) ? b.qoders : [], doubaos: Array.isArray(b.doubaos) ? b.doubaos : [] };
+    }
+    catch {
+        throw new DshModelError('bad_transfer_code', L('提取码不对，或者文本被改动过', 'Wrong code, or the text was changed'));
+    }
+}
+/** 导出这台机器上能搬的签到账号 */
+export async function exportCheckin(ctx) {
+    const qoders = await loadQoders(ctx);
+    const doubaos = await loadDoubaos(ctx);
+    if (!qoders.length && !doubaos.length)
+        throw new DshModelError('nothing_to_export', L('这台机器上没有能复制的签到账号（只能复制 Qoder 和豆包；WorkBuddy 请在那台机器上各自登录，Trae 要在装了 Trae 的电脑上签）', 'Nothing to copy from this machine (only Qoder and Doubao can be copied; sign in to WorkBuddy on each machine, and Trae needs a computer with Trae installed)'));
+    const sealed = sealBundle({
+        qoders: qoders.map((q) => ({ pat: q.pat, region: q.region, ...(q.name ? { name: q.name } : {}) })),
+        doubaos: doubaos.map((d) => ({ cookie: d.cookie, seed: d.seed, ...(d.name ? { name: d.name } : {}) })),
+    });
+    return { ...sealed, counts: { qoder: qoders.length, doubao: doubaos.length } };
+}
+/** 导入：已有的同一个令牌 / Cookie 不会重复加 */
+export async function importCheckin(ctx, text, code) {
+    const b = openBundle(text, code);
+    for (const q of b.qoders)
+        await addQoder(ctx, q);
+    for (const d of b.doubaos)
+        await addDoubao(ctx, d);
+    return { qoder: b.qoders.length, doubao: b.doubaos.length };
+}

package/dist/daemon/core.js

@@ -5,7 +5,7 @@
 // 职责：来源状态与开关、登录会话（引擎 OAuth / WorkBuddy 自有登录 / OpenCode key）、key 管理、用量统计。
 // CLI 与 dsh 插件都只通过 /control/* 调这里，逻辑只有一份。
 import { spawn } from 'node:child_process';
-import { readFile } from 'node:fs/promises';
+import { readFile, rename, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { latestVersion, selfJobLog } from '../commands/self.js';
 import { LOCAL_SERVERS, loadLocalCatalog, refreshLocalCatalog } from '../integrations/local.js';
@@ -18,7 +18,11 @@ import { spawnDetached } from '../util/detach.js';
 import { classify, recentFailures } from './failures.js';
 import { autoDue, beijingNow, checkinAdvice, ensureJitter, loadCheckin, runCheckin, setAuto, todayResults } from '../checkin/index.js';
 import { QODER_REGIONS, exchangePat, qoderCheckin } from '../checkin/qoder.js';
-import { findTraeCredential, traeCheckin } from '../checkin/trae.js';
+import { findTraeCredentials, traeCheckin } from '../checkin/trae.js';
+import { DoubaoAuthError, doubaoCheckin, doubaoStatus, normalizeCookie } from '../checkin/doubao.js';
+import { exportCheckin, importCheckin } from '../checkin/transfer.js';
+import { accountTag, addDoubao, checkinKind, addQoder, listWorkbuddyAccounts, loadDoubaos, loadQoders, removeDoubao, removeQoder, removeWorkbuddyAccount, workbuddyAccountStore, workbuddyAccountsDir } from '../checkin/accounts.js';
+import { CN_VARIANT } from '../bridge/workbuddy/variants.js';
 import { PKG_ROOT, pkgVersion } from '../util/pkg.js';
 import { randomBytes } from 'node:crypto';
 import { currentBinary } from '../engine/install.js';
@@ -34,7 +38,7 @@ import { blockedNotice as workbuddyBlockedNotice, riskNotice as workbuddyRiskNot
 import { DSH_KEY_NAME, addKey, findActive, loadKeys, revokeKey, rotateKey, saveKeys } from '../keys.js';
 import { applyKeyChange, dshCandidates, dshKey, loadAll, saveAll, syncAll } from '../ops.js';
 import { defaultPick, pickedFor } from '../dsh/pick.js';
-import { loadSecrets, saveSecrets } from '../secrets.js';
+import { loadSecrets } from '../secrets.js';
 import { SOURCES, credsFor, findSource, paymentRequired } from '../sources.js';
 import { withLock } from '../state.js';
 import { riskNotice as upstreamRiskNotice } from '../upstreams.js';
@@ -717,35 +721,85 @@ export class Daemon {
     }
     // —— 每日签到 ——
     /** 现在能签到的：WorkBuddy 国内版（已登录）、Qoder（填了个人访问令牌） */
+    /**
+     * 能签到的每个账号（设计 §14.19）：WorkBuddy 主账号 + 多加的签到账号、每个 Qoder 令牌、本机每个 Trae 账号。
+     * 第一个账号的 id 沿用 workbuddy / qoder / trae（旧结果照常认），多出来的是 <家>:<账号>。同一个账号只签一次。
+     */
     async checkers() {
         const out = [];
+        const home = this.ctx.paths.home;
+        const extra = await listWorkbuddyAccounts(home);
+        const seen = new Set();
         for (const rt of this.runtimes) {
             if (rt.variant.id !== 'workbuddy')
                 continue; // 国际版没有签到
             const st = await rt.wbStore.status().catch(() => null);
             if (st?.state !== 'signed-in')
                 continue;
-            out.push({ id: 'workbuddy', label: rt.label, run: async () => rt.wbClient.dailyCheckin(await rt.wbStore.resolve()) });
+            const uid = (await rt.wbStore.resolve().catch(() => null))?.uid;
+            if (uid)
+                seen.add(uid);
+            const tag = extra.length ? `（${accountTag(st.nickname, uid ?? '')}）` : '';
+            out.push({ id: 'workbuddy', label: `${rt.label}${tag}`, run: async () => rt.wbClient.dailyCheckin(await rt.wbStore.resolve()) });
+        }
+        for (const a of extra) {
+            if (seen.has(a.uid))
+                continue;
+            seen.add(a.uid);
+            const { store, client } = workbuddyAccountStore(home, a.file);
+            out.push({ id: `workbuddy:${a.uid}`, label: `WorkBuddy（${accountTag(a.nickname, a.uid)}）`, run: async () => client.dailyCheckin(await store.resolve()) });
         }
-        const q = (await loadSecrets(this.ctx)).checkin?.qoder;
-        if (q?.pat)
-            out.push({ id: 'qoder', label: QODER_REGIONS[q.region].label, run: () => qoderCheckin(q.pat, q.region) });
-        // Trae：本机装了并登录过 Trae 才有（读它自己的登录信息，不需要另外设置；VPS 上一般没有）
-        const trae = await findTraeCredential().catch(() => null);
-        if (trae)
-            out.push({ id: 'trae', label: 'Trae', run: async () => traeCheckin((await findTraeCredential()) ?? trae) });
+        const qoders = await loadQoders(this.ctx);
+        qoders.forEach((q, i) => {
+            // 一个令牌：「Qoder（国内版）」；几个：带上名字（没起名就用编号），如「Qoder（小号 · 国内版）」
+            const region = q.region === 'cn' ? L('国内版', 'China') : '';
+            const tag = q.name || (qoders.length > 1 ? `#${q.id}` : '');
+            const label = tag ? `Qoder（${[tag, region].filter(Boolean).join(' · ')}）` : QODER_REGIONS[q.region].label;
+            out.push({ id: i === 0 ? 'qoder' : `qoder:${q.id}`, label, run: () => qoderCheckin(q.pat, q.region) });
+        });
+        // 豆包：用户粘贴的 Cookie，每个账号一个
+        const doubaos = await loadDoubaos(this.ctx);
+        doubaos.forEach((d, i) => {
+            const tag = d.name || (doubaos.length > 1 ? `#${d.id}` : '');
+            out.push({ id: i === 0 ? 'doubao' : `doubao:${d.id}`, label: tag ? L(`豆包（${tag}）`, `Doubao (${tag})`) : L('豆包', 'Doubao'), run: () => doubaoCheckin(d.cookie, d.seed) });
+        });
+        // Trae：本机装了并登录过 Trae 才有（读它自己的登录信息，不需要另外设置；VPS 上一般没有）。每个账号签一次
+        const traes = await findTraeCredentials().catch(() => []);
+        traes.forEach((t, i) => {
+            const id = i === 0 ? 'trae' : `trae:${t.accountId ?? t.source}`;
+            out.push({
+                id,
+                label: traes.length > 1 ? `Trae（${t.accountId ? `…${t.accountId.slice(-4)}` : t.source}）` : 'Trae',
+                run: async () => traeCheckin((await findTraeCredentials()).find((x) => (x.accountId ?? x.source) === (t.accountId ?? t.source)) ?? t),
+            });
+        });
         return out;
     }
     async checkinStatus() {
         const file = await loadCheckin(this.ctx.paths.home);
         const checkers = await this.checkers();
-        const q = (await loadSecrets(this.ctx)).checkin?.qoder;
+        const qoders = await loadQoders(this.ctx);
+        const extra = await listWorkbuddyAccounts(this.ctx.paths.home);
+        const ids = new Set(checkers.map((c) => c.id));
         return {
             auto: file.auto !== false,
             date: beijingNow().date,
-            results: todayResults(file).map((r) => (r.state === 'failed' ? { ...r, advice: checkinAdvice(r.id, r.message ?? '') } : r)),
+            // 删掉的账号今天的结果不再显示
+            results: todayResults(file).filter((r) => ids.has(r.id)).map((r) => (r.state === 'failed' ? { ...r, advice: checkinAdvice(r.id, r.message ?? '') } : r)),
             available: checkers.map((c) => ({ id: c.id, label: c.label })),
-            qoder: { configured: Boolean(q?.pat), ...(q ? { region: q.region } : {}) },
+            qoder: { configured: qoders.length > 0, ...(qoders[0] ? { region: qoders[0].region } : {}) },
+            accounts: {
+                workbuddy: extra.map((a) => ({ uid: a.uid, label: `WorkBuddy（${accountTag(a.nickname, a.uid)}）` })),
+                qoder: qoders.map((q, i) => ({ id: q.id, label: checkers.find((c) => c.id === (i === 0 ? 'qoder' : `qoder:${q.id}`))?.label ?? q.id, region: q.region })),
+                doubao: (await loadDoubaos(this.ctx)).map((d, i) => ({ id: d.id, label: checkers.find((c) => c.id === (i === 0 ? 'doubao' : `doubao:${d.id}`))?.label ?? d.id })),
+            },
+            // 支持、但这台还没设置的（签到卡片里列出来，旁边就是「添加」）
+            missing: [
+                ...(checkers.some((c) => checkinKind(c.id) === 'workbuddy') ? [] : [{ id: 'workbuddy', label: L('WorkBuddy 国内版', 'WorkBuddy (China)'), action: 'workbuddy' }]),
+                ...(checkers.some((c) => checkinKind(c.id) === 'qoder') ? [] : [{ id: 'qoder', label: 'Qoder', action: 'qoder' }]),
+                ...(checkers.some((c) => checkinKind(c.id) === 'doubao') ? [] : [{ id: 'doubao', label: L('豆包', 'Doubao'), action: 'doubao' }]),
+                ...(checkers.some((c) => checkinKind(c.id) === 'trae') ? [] : [{ id: 'trae', label: 'Trae', reason: L('这台没装 Trae：要在装了 Trae 的电脑上签', 'Trae is not installed here: it is checked in on a computer with Trae') }]),
+            ],
         };
     }
     checkinInflight;
@@ -767,20 +821,80 @@ export class Daemon {
         if (results)
             log_(`daemon: auto check-in ${results.results.map((r) => `${r.id}=${r.state}`).join(' ')}`);
     }
-    async setQoderPat(pat, region) {
+    /** 加一个 Qoder 令牌（同一个令牌再加 = 改名字 / 区域） */
+    async addQoderPat(pat, region, name) {
         if (!pat || /\s/.test(pat) || pat.length < 8)
             throw new DshModelError('invalid_key', L('这看起来不是 Qoder 的个人访问令牌', 'That does not look like a Qoder access token'));
         await exchangePat(pat, region); // 换得到短期 token 才算可用
-        const secrets = await loadSecrets(this.ctx);
-        secrets.checkin = { ...secrets.checkin, qoder: { pat, region, savedAt: new Date().toISOString() } };
-        await saveSecrets(this.ctx, secrets);
+        await addQoder(this.ctx, { pat, region, ...(name ? { name } : {}) });
     }
-    async removeQoderPat() {
-        const secrets = await loadSecrets(this.ctx);
-        if (secrets.checkin?.qoder) {
-            delete secrets.checkin.qoder;
-            await saveSecrets(this.ctx, secrets);
+    async removeQoderPat(id) {
+        await removeQoder(this.ctx, id);
+    }
+    /** 加一个豆包账号：先用这份 Cookie 查一次签到任务，查得到才保存 */
+    async addDoubaoCookie(raw, name) {
+        const cookie = normalizeCookie(raw);
+        if (cookie.length < 20 || !cookie.includes('='))
+            throw new DshModelError('invalid_key', L('这看起来不是豆包的 Cookie：要从浏览器开发者工具里复制整串 Cookie（形如 a=1; b=2; …）', 'That does not look like a Doubao cookie: copy the whole Cookie string from the browser developer tools (like a=1; b=2; …)'));
+        const seed = randomBytes(16).toString('hex');
+        let st;
+        try {
+            st = await doubaoStatus(cookie, seed);
         }
+        catch (error) {
+            if (error instanceof DoubaoAuthError)
+                throw new DshModelError('key_rejected', L('豆包说这份 Cookie 没有登录或已过期：在浏览器里登录 doubao.com 后重新复制', 'Doubao says this cookie is signed out or expired: sign in at doubao.com in the browser and copy it again'));
+            throw new DshModelError('doubao_failed', String(error.message ?? error));
+        }
+        if (st.checkedIn === null)
+            throw new DshModelError('doubao_no_task', L('这个豆包账号没有签到任务：只有个人账号能领每日额度，飞书企业账号不行。请换成个人账号登录后再复制 Cookie', 'This Doubao account has no check-in task: only personal accounts get the daily credits, not Feishu enterprise accounts. Sign in with a personal account and copy the cookie again'));
+        await addDoubao(this.ctx, { cookie, seed, ...(name ? { name } : {}) });
+    }
+    /** 加一个 WorkBuddy 签到账号：打开链接授权（同来源登录一样），存成单独一份，只用来签到 */
+    async startWorkbuddyCheckinLogin() {
+        const all = await loadAll(this.ctx);
+        const home = this.ctx.paths.home;
+        const s = {
+            id: `wbc-${randomBytes(8).toString('hex')}`,
+            source: 'workbuddy-checkin',
+            kind: 'link',
+            status: 'pending',
+            needsPaste: false,
+            startedAt: new Date().toISOString(),
+            expiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
+            abort: new AbortController(),
+        };
+        this.sessions.set(s.id, s);
+        const tmp = join(workbuddyAccountsDir(home), `.pending-${s.id}.json`);
+        let urlReady;
+        const ready = new Promise((r) => (urlReady = r));
+        void workbuddyLogin(CN_VARIANT, home, { proxy: all.config.proxy, owner: this.ctx.owner, signal: s.abort.signal, file: tmp, onUrl: (url) => { s.url = url; urlReady(); } })
+            .then(async (cred) => {
+            const uid = cred.uid || randomBytes(4).toString('hex');
+            const primary = this.runtimes.find((r) => r.variant.id === 'workbuddy');
+            const primaryUid = primary ? (await primary.wbStore.resolve().catch(() => null))?.uid : undefined;
+            if (primaryUid && primaryUid === uid) {
+                await rm(tmp, { force: true });
+                s.status = 'error';
+                s.error = L('这个账号就是来源里登录的 WorkBuddy，已经在签到了。请在浏览器里换另一个账号授权', 'This is the WorkBuddy account already signed in under Sources, so it is checked in already. Authorise a different account');
+                return;
+            }
+            await rename(tmp, join(workbuddyAccountsDir(home), `${uid.replace(/[^A-Za-z0-9_-]/g, '_')}.json`));
+            s.status = 'ok';
+            void this.checkinNow(false).catch(() => { });
+        })
+            .catch(async (error) => {
+            await rm(tmp, { force: true }).catch(() => { });
+            if (s.status === 'pending') {
+                s.status = 'error';
+                s.error = String(error.message ?? error);
+            }
+            urlReady();
+        });
+        await Promise.race([ready, new Promise((r) => setTimeout(r, 30_000))]);
+        if (s.status === 'error')
+            throw new DshModelError('login_failed', s.error ?? 'login failed');
+        return publicSession(s);
     }
     // —— 更新 / 卸载（管理页的按钮）——
     selfJob;
@@ -1104,11 +1218,33 @@ export class Daemon {
                 return ok(await this.checkinStatus());
             }
             if (method === 'POST' && path === '/checkin/qoder') {
-                await this.setQoderPat(String(b.pat ?? '').trim(), b.region === 'intl' ? 'intl' : 'cn');
+                await this.addQoderPat(String(b.pat ?? '').trim(), b.region === 'intl' ? 'intl' : 'cn', typeof b.name === 'string' ? b.name : undefined);
+                return ok(await this.checkinNow(true));
+            }
+            if (method === 'DELETE' && (path === '/checkin/qoder' || (seg[0] === 'checkin' && seg[1] === 'qoder' && seg[2]))) {
+                await this.removeQoderPat(seg[2]);
+                return ok(await this.checkinStatus());
+            }
+            if (method === 'POST' && path === '/checkin/workbuddy')
+                return ok({ login: await this.startWorkbuddyCheckinLogin() });
+            if (method === 'POST' && path === '/checkin/export')
+                return ok(await exportCheckin(this.ctx));
+            if (method === 'POST' && path === '/checkin/import') {
+                const n = await importCheckin(this.ctx, String(b.text ?? ''), String(b.code ?? ''));
+                return ok({ imported: n, ...(await this.checkinNow(true)) });
+            }
+            if (method === 'POST' && path === '/checkin/doubao') {
+                await this.addDoubaoCookie(String(b.cookie ?? ''), typeof b.name === 'string' ? b.name : undefined);
                 return ok(await this.checkinNow(true));
             }
-            if (method === 'DELETE' && path === '/checkin/qoder') {
-                await this.removeQoderPat();
+            if (method === 'DELETE' && seg[0] === 'checkin' && seg[1] === 'doubao' && seg[2]) {
+                if (!(await removeDoubao(this.ctx, seg[2])))
+                    throw new DshModelError('no_account', L('没有这个签到账号', 'No such check-in account'));
+                return ok(await this.checkinStatus());
+            }
+            if (method === 'DELETE' && seg[0] === 'checkin' && seg[1] === 'workbuddy' && seg[2]) {
+                if (!(await removeWorkbuddyAccount(this.ctx.paths.home, seg[2])))
+                    throw new DshModelError('no_account', L('没有这个签到账号', 'No such check-in account'));
                 return ok(await this.checkinStatus());
             }
             if (method === 'GET' && path === '/failures') {

package/dist/daemon/usage.js

@@ -13,7 +13,7 @@ import { join } from 'node:path';
 import { beijingTimeToIso } from '../bridge/workbuddy/upstream.js';
 const TIMEOUT_MS = 15_000;
 /** 这几家暂不支持（见设计 §14.6） */
-export const USAGE_UNSUPPORTED = new Set(['antigravity', 'devin', 'meta', 'opencode', 'ollama', 'lmstudio', 'gemini', 'groq', 'openrouter', 'siliconflow', 'deepseek', 'custom']);
+export const USAGE_UNSUPPORTED = new Set(['antigravity', 'devin', 'meta', 'opencode', 'ollama', 'lmstudio', 'gemini', 'groq', 'openrouter', 'siliconflow', 'zhipu', 'spark', 'qianfan', 'ark', 'minimax', 'modelarts', 'deepseek', 'custom']);
 async function getJson(url, headers) {
     const res = await fetch(url, { headers: { Accept: 'application/json', ...headers }, signal: AbortSignal.timeout(TIMEOUT_MS) });
     const text = await res.text();

package/dist/engine/compat.js

@@ -71,7 +71,7 @@ export async function loadCompatUpstreams(ctx) {
             });
         }
     }
-    // 自带 API key 的来源：有 key、有模型、没被关掉就接进来（走出站代理，不 direct）
+    // 自带 API key 的来源：有 key、有模型、没被关掉就接进来（海外的走出站代理，国内平台直连）
     const keyCat = await loadKeyCatalog(ctx.paths.home);
     for (const [id, s] of Object.entries(secrets.apikeys ?? {})) {
         const p = keyProvider(id);
@@ -83,6 +83,8 @@ export async function loadCompatUpstreams(ctx) {
             label: p.label,
             baseUrl: s.base ?? p.base,
             apiKey: s.key,
+            // 国内平台直连，不绕出站代理
+            ...(p.direct ? { direct: true } : {}),
             models: models.map((m) => ({ name: m.id, alias: `${id}/${m.id}`, displayName: `${p.label} · ${m.id}`, dshName: m.free ? `${m.id} · Free` : m.id, ...(m.free ? { rate: 0 } : {}), group: id, groupLabel: p.label })),
         });
     }

package/dist/integrations/apikeys.js

@@ -13,6 +13,13 @@ export const KEY_PROVIDERS = [
     { id: 'groq', label: 'Groq', base: 'https://api.groq.com/openai/v1', keyUrl: 'https://console.groq.com/keys' },
     { id: 'openrouter', label: 'OpenRouter', base: 'https://openrouter.ai/api/v1', keyUrl: 'https://openrouter.ai/keys' },
     { id: 'siliconflow', label: '硅基流动 SiliconFlow', base: 'https://api.siliconflow.cn/v1', keyUrl: 'https://cloud.siliconflow.cn/account/ak', listQuery: 'type=text&sub_type=chat' },
+    // 国内大厂的官方 API（2026-10-29 加）：智谱、讯飞星火有长期免费的模型
+    { id: 'zhipu', label: '智谱 GLM', base: 'https://open.bigmodel.cn/api/paas/v4', keyUrl: 'https://open.bigmodel.cn/usercenter/apikeys', fallbackModels: ['glm-4.7-flash', 'glm-4.6', 'glm-4.5-air'], freeRe: /flash/i, direct: true },
+    { id: 'spark', label: '讯飞星火', base: 'https://spark-api-open.xf-yun.com/v1', keyUrl: 'https://console.xfyun.cn/services/cbm', fallbackModels: ['lite', 'generalv3', 'pro-128k', 'generalv3.5', 'max-32k', '4.0Ultra'], freeRe: /^lite$/i, direct: true },
+    { id: 'qianfan', label: '百度千帆', base: 'https://qianfan.baidubce.com/v2', keyUrl: 'https://console.bce.baidu.com/iam/#/iam/apikey/list', fallbackModels: ['ernie-speed-128k', 'ernie-lite-8k', 'ernie-4.5-turbo-128k', 'deepseek-v3'], freeRe: /^ernie-(speed|lite)/i, direct: true },
+    { id: 'ark', label: '火山方舟（豆包大模型）', base: 'https://ark.cn-beijing.volces.com/api/v3', keyUrl: 'https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey', fallbackModels: ['doubao-seed-1-6-flash-250615', 'doubao-seed-1-6-250615', 'deepseek-v3-1-250821'], direct: true },
+    { id: 'minimax', label: 'MiniMax 开放平台', base: 'https://api.minimaxi.com/v1', keyUrl: 'https://platform.minimaxi.com/user-center/basic-information/interface-key', fallbackModels: ['MiniMax-M2', 'MiniMax-M1', 'MiniMax-Text-01'], direct: true },
+    { id: 'modelarts', label: '华为云 ModelArts', base: 'https://api.modelarts-maas.com/v1', keyUrl: 'https://console.huaweicloud.com/modelarts/?region=cn-southwest-2#/model-studio/authmanage', fallbackModels: ['DeepSeek-V3', 'DeepSeek-R1', 'qwen3-235b-a22b'], direct: true },
     { id: 'deepseek', label: 'DeepSeek 官方', base: 'https://api.deepseek.com/v1', keyUrl: 'https://platform.deepseek.com/api_keys' },
     { id: 'custom', label: '其他 OpenAI 兼容服务', base: '', keyUrl: '' },
 ];
@@ -37,22 +44,60 @@ export function parseModelList(providerId, body) {
         if (!id)
             continue;
         const pricing = m.pricing;
-        const free = id.endsWith(':free') || (pricing ? Number(pricing.prompt) === 0 && Number(pricing.completion) === 0 : false);
+        const free = id.endsWith(':free') || (pricing ? Number(pricing.prompt) === 0 && Number(pricing.completion) === 0 : false) || Boolean(keyProvider(providerId)?.freeRe?.test(id));
         out.push({ id, ...(free ? { free: true } : {}) });
     }
     // OpenRouter 有几百个模型：付费的照样能用，但先把免费的排前面，挑默认时就先挑它们
     return out.sort((a, b) => Number(Boolean(b.free)) - Number(Boolean(a.free)) || a.id.localeCompare(b.id));
 }
 /** 用这把 key 拉模型列表：拉得到就是可用的 key（不花 token） */
-export async function fetchKeyModels(provider, key, base, proxy) {
-    const url = `${base}/models${provider.listQuery ? `?${provider.listQuery}` : ''}`;
-    const r = await run('curl', ['-s', '-m', '25', '-w', '\n%{http_code}', '-K', '-', ...(proxy ? ['-x', proxy] : []), url], {
+/** 带 key 的一次请求（curl：认代理，key 经 stdin 传、不进进程参数） */
+async function keyRequest(provider, key, url, proxy) {
+    const viaProxy = proxy && !provider.direct;
+    const r = await run('curl', ['-s', '-m', '25', '-w', '\n%{http_code}', '-K', '-', ...(viaProxy ? ['-x', proxy] : provider.direct ? ['--noproxy', '*'] : []), url], {
         input: `header = "Authorization: Bearer ${key.replace(/"/g, '')}"\n`,
         timeoutMs: 40_000,
     });
     const lines = r.stdout.trimEnd().split('\n');
-    const status = Number(lines.pop()) || null;
-    const text = lines.join('\n');
+    return { status: Number(lines.pop()) || null, text: lines.join('\n') };
+}
+/** 不支持列模型的平台：发一次 1 个 token 的对话验证 key，返回内置的常用模型 */
+async function verifyByChat(provider, key, base, proxy) {
+    const models = provider.fallbackModels ?? [];
+    const probe = models[0];
+    // curl 的 --data-binary @- 和 -K - 都读 stdin，这里把请求体写进临时文件
+    const { writeFile, rm, mkdtemp } = await import('node:fs/promises');
+    const { tmpdir } = await import('node:os');
+    const dir = await mkdtemp(join(tmpdir(), 'dsh-model-key-'));
+    const file = join(dir, 'body.json');
+    await writeFile(file, JSON.stringify({ model: probe, messages: [{ role: 'user', content: 'ok' }], max_tokens: 1, stream: false }), { mode: 0o600 });
+    try {
+        const viaProxy = proxy && !provider.direct;
+        const r = await run('curl', ['-s', '-m', '40', '-w', '\n%{http_code}', '-K', '-', ...(viaProxy ? ['-x', proxy] : provider.direct ? ['--noproxy', '*'] : []), '-X', 'POST', '--data-binary', `@${file}`, `${base}/chat/completions`], {
+            input: `header = "Authorization: Bearer ${key.replace(/"/g, '')}"\nheader = "Content-Type: application/json"\n`,
+            timeoutMs: 60_000,
+        });
+        const lines = r.stdout.trimEnd().split('\n');
+        const status = Number(lines.pop()) || null;
+        const text = lines.join('\n');
+        if (status === 401 || status === 403 || /invalid.*(api.?key|token)|apikey not found|authenticat|鉴权|令牌/i.test(status === 200 ? '' : text)) {
+            throw new DshModelError('key_rejected', L(`${provider.label} 不认这把 key（HTTP ${status ?? '-'}）`, `${provider.label} rejected the key (HTTP ${status ?? '-'})`), L(`到 ${provider.keyUrl} 重新创建一把`, `Create a new one at ${provider.keyUrl}`));
+        }
+        // 200 = 能用；429 = key 对、只是限流；其余（模型没开通等）key 也是对的，照常保存
+        if (!status)
+            throw new DshModelError('key_check_failed', L(`连不上 ${base}`, `Cannot reach ${base}`));
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+    return parseModelList(provider.id, { data: models.map((id) => ({ id })) });
+}
+export async function fetchKeyModels(provider, key, base, proxy) {
+    const url = `${base}/models${provider.listQuery ? `?${provider.listQuery}` : ''}`;
+    const { status, text } = await keyRequest(provider, key, url, proxy);
+    // 有内置列表的平台：列模型不成功（不支持，或这个接口要额外权限）就改用一次短对话验证 key，由它来判断 key 对不对
+    if (provider.fallbackModels?.length && status !== 200)
+        return verifyByChat(provider, key, base, proxy);
     if (status === 401 || status === 403)
         throw new DshModelError('key_rejected', L(`${provider.label} 不认这把 key（HTTP ${status}）`, `${provider.label} rejected the key (HTTP ${status})`), provider.keyUrl ? L(`到 ${provider.keyUrl} 重新创建一把`, `Create a new one at ${provider.keyUrl}`) : undefined);
     if (status !== 200) {
@@ -63,8 +108,12 @@ export async function fetchKeyModels(provider, key, base, proxy) {
         models = parseModelList(provider.id, JSON.parse(text));
     }
     catch {
+        if (provider.fallbackModels?.length)
+            return verifyByChat(provider, key, base, proxy);
         throw new DshModelError('key_check_failed', L(`${provider.label} 的模型列表看不懂`, `Could not read the ${provider.label} model list`));
     }
+    if (!models.length && provider.fallbackModels?.length)
+        return verifyByChat(provider, key, base, proxy);
     if (!models.length)
         throw new DshModelError('key_no_models', L(`${provider.label} 没有返回任何模型`, `${provider.label} returned no models`));
     return models;

package/dist/sources.js

@@ -20,6 +20,13 @@ export const SOURCES = [
     { id: 'groq', label: 'Groq', kind: 'apikey', login: 'key', subscribeUrl: 'https://console.groq.com/keys', pricing: { tier: 'limited', zh: '免费 key，每个模型每分钟 / 每天有上限', en: 'Free key with per-model per-minute / per-day limits' } },
     { id: 'openrouter', label: 'OpenRouter', kind: 'apikey', login: 'key', subscribeUrl: 'https://openrouter.ai/keys', pricing: { tier: 'limited', zh: '名字带 :free 的模型免费（每天约 50 次，充值 10 美元后约 1000 次）；其余按量付费', en: ':free models are free (about 50/day, about 1,000/day after a $10 top-up); others pay as you go' } },
     { id: 'siliconflow', label: '硅基流动 SiliconFlow', kind: 'apikey', login: 'key', subscribeUrl: 'https://cloud.siliconflow.cn/account/ak', pricing: { tier: 'limited', zh: '实名认证后部分小模型免费（限速）；其余按量付费', en: 'Some small models are free after identity verification (rate limited); others pay as you go' } },
+    // 国内大厂官方 API（2026-10-29 加）：免费档按各家公开说明，以官网为准
+    { id: 'zhipu', label: '智谱 GLM', kind: 'apikey', login: 'key', subscribeUrl: 'https://open.bigmodel.cn/usercenter/apikeys', pricing: { tier: 'limited', zh: 'Flash 系列（如 GLM-4.7-Flash）免费；其余按量付费。国内直连', en: 'The Flash models (e.g. GLM-4.7-Flash) are free; others pay as you go. Reachable from China' } },
+    { id: 'spark', label: '讯飞星火', kind: 'apikey', login: 'key', subscribeUrl: 'https://console.xfyun.cn/services/cbm', pricing: { tier: 'limited', zh: 'Spark Lite 免费不限量，但每秒只能 2 次；key 填控制台里的 APIPassword。国内直连', en: 'Spark Lite is free with no token cap but only 2 requests per second; use the APIPassword from the console. Reachable from China' } },
+    { id: 'qianfan', label: '百度千帆', kind: 'apikey', login: 'key', subscribeUrl: 'https://console.bce.baidu.com/iam/#/iam/apikey/list', pricing: { tier: 'limited', zh: 'ERNIE Speed / Lite 长期免费（限速）；其余按量付费。国内直连', en: 'ERNIE Speed / Lite are free for now (rate limited); others pay as you go. Reachable from China' } },
+    { id: 'ark', label: '火山方舟（豆包大模型）', kind: 'apikey', login: 'key', subscribeUrl: 'https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey', pricing: { tier: 'paid', zh: '按量付费，新用户有限时免费额度；模型要先在控制台开通。国内直连', en: 'Pay as you go with a time-limited free quota for new users; enable models in the console first. Reachable from China' } },
+    { id: 'minimax', label: 'MiniMax 开放平台', kind: 'apikey', login: 'key', subscribeUrl: 'https://platform.minimaxi.com/user-center/basic-information/interface-key', pricing: { tier: 'paid', zh: '按量付费或 Coding Plan 套餐。国内直连', en: 'Pay as you go or a Coding Plan. Reachable from China' } },
+    { id: 'modelarts', label: '华为云 ModelArts', kind: 'apikey', login: 'key', subscribeUrl: 'https://console.huaweicloud.com/modelarts/?region=cn-southwest-2#/model-studio/authmanage', pricing: { tier: 'paid', zh: '按量付费，新用户有免费额度；模型要先在 ModelArts Studio 里开通。国内直连', en: 'Pay as you go with a free quota for new users; enable models in ModelArts Studio first. Reachable from China' } },
     { id: 'deepseek', label: 'DeepSeek 官方', kind: 'apikey', login: 'key', subscribeUrl: 'https://platform.deepseek.com/api_keys', pricing: { tier: 'paid', zh: '按量付费（价格低）', en: 'Pay as you go (low prices)' } },
     { id: 'custom', label: '其他 OpenAI 兼容服务', kind: 'apikey', login: 'key', pricing: { tier: 'paid', zh: '填地址和 key，接入任意 OpenAI 兼容服务', en: 'Enter a URL and a key for any OpenAI-compatible service' } },
     { id: 'opencode', label: 'OpenCode Zen', kind: 'opencode', login: 'key', subscribeUrl: 'https://opencode.ai/zen', pricing: { tier: 'paid', zh: '要先充值拿 key 按量计费；它的免费模型只能在 OpenCode 软件里用', en: 'Top up for a pay-as-you-go key; its free models only work inside the OpenCode app' } },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model",
-  "version": "0.23.4",
+  "version": "0.26.0",
   "description": "Daily check-in credits claimed for you (Trae, Qoder, WorkBuddy China), one OpenAI-compatible address that relays every model, and free or subscription model sources (SiliconFlow, Gemini, Codex, Kimi, Ollama…). For DeepSeek Harness (dsh) and any OpenAI-compatible tool. 每天自动签到领积分 · 一个地址中转所有模型 · 免费和订阅模型随你接。",
   "keywords": [
     "siliconflow",

package/plugin/client.js

@@ -985,37 +985,120 @@ window.__ModuleLoader__.load({
     // —— 每日签到 ——
     const CHECKIN_TEXT = (r) => (r.state === 'signed' ? L(`成功${r.credit ? ` +${r.credit} 积分` : ''}`, `done${r.credit ? ` +${r.credit} credits` : ''}`) : r.state === 'already' ? L('今天已签过', 'already today') : L(`失败：${r.message || ''}`, `failed: ${r.message || ''}`))
 
-    function QoderDialog({ onDone, onClose }) {
+    function QoderDialog({ onDone, onClose, another }) {
       const [pat, setPat] = useState('')
+      const [name, setName] = useState('')
       const [region, setRegion] = useState('cn')
       const [busy, setBusy] = useState(false)
       const [msg, setMsg] = useState('')
       const save = async () => {
         setBusy(true)
         setMsg(L('正在验证这个令牌并签到…', 'Checking the token and checking in…'))
-        try { await api('POST', '/checkin/qoder', { pat: pat.trim(), region }); onDone() } catch (e) { setMsg(e.message); setBusy(false) }
+        try { await api('POST', '/checkin/qoder', { pat: pat.trim(), region, ...(name.trim() ? { name: name.trim() } : {}) }); onDone() } catch (e) { setMsg(e.message); setBusy(false) }
       }
-      return h(Modal, { title: L('添加 Qoder 签到', 'Add Qoder check-in'), onClose },
+      return h(Modal, { title: another ? L('再加一个 Qoder 账号', 'Add another Qoder account') : L('添加 Qoder 签到', 'Add Qoder check-in'), onClose },
         h('p', { style: S.note },
           L('登录 Qoder 网站，在「设置 → API 令牌」（有的版本叫「账号 → 集成」）里点「创建令牌」，复制生成的个人访问令牌（以 pt- 开头，只显示一次），粘贴到这里。只用来每天领签到积分，保存在本机。', 'Sign in on the Qoder website, open Settings → API Tokens (Account → Integrations in some versions), click Create token, then paste the personal access token here (it starts with pt- and is shown only once). It is only used to claim the daily credits, and stays on this machine.'),
           h('a', { href: region === 'cn' ? 'https://qoder.com.cn/account/integrations' : 'https://qoder.com/account/integrations', target: '_blank', rel: 'noopener noreferrer', style: { color: C.accent, marginLeft: 6 } }, region === 'cn' ? L('去 Qoder 国内版创建 ↗', 'Create on Qoder China ↗') : L('去 Qoder 国际版创建 ↗', 'Create on Qoder ↗'))),
         h('div', { style: { ...S.line, marginBottom: 8 } },
           ['cn', 'intl'].map((r) => h('label', { key: r, style: { ...S.meta, display: 'flex', alignItems: 'center', gap: 4, cursor: 'pointer' } },
             h('input', { type: 'radio', name: 'qoder-region', checked: region === r, onChange: () => setRegion(r) }), r === 'cn' ? L('国内版', 'China') : L('国际版', 'International')))),
+        another ? h('div', { style: { ...S.line, marginBottom: 8 } },
+          h('input', { style: { ...S.input, ...S.grow }, maxLength: 20, placeholder: L('给这个账号起个名字，如：小号', 'A name for this account, e.g. Second'), value: name, onChange: (e) => setName(e.target.value), 'aria-label': L('账号名字', 'Account name') })) : null,
         h('div', { style: S.line },
           h('input', { type: 'password', style: { ...S.input, ...S.grow }, placeholder: L('个人访问令牌', 'Personal access token'), value: pat, onChange: (e) => setPat(e.target.value) }),
           h('button', { type: 'button', style: S.btnPrimary, disabled: busy || !pat.trim(), onClick: () => void save() }, L('保存', 'Save'))),
         msg ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null)
     }
 
+    /** 添加豆包签到：从浏览器复制一次登录 Cookie（豆包没有令牌，也不读豆包客户端的文件） */
+    function DoubaoDialog({ onDone, onClose, another }) {
+      const [cookie, setCookie] = useState('')
+      const [name, setName] = useState('')
+      const [busy, setBusy] = useState(false)
+      const [msg, setMsg] = useState('')
+      const save = async () => {
+        setBusy(true)
+        setMsg(L('正在用这份 Cookie 查签到任务并签到…', 'Checking this cookie and checking in…'))
+        try { await api('POST', '/checkin/doubao', { cookie: cookie.trim(), ...(name.trim() ? { name: name.trim() } : {}) }); onDone() } catch (e) { setMsg(e.message); setBusy(false) }
+      }
+      const step = (n, text) => h('div', { style: { ...S.meta, lineHeight: 1.7 } }, `${n}. `, text)
+      return h(Modal, { title: another ? L('再加一个豆包账号', 'Add another Doubao account') : L('添加豆包签到（实验）', 'Add Doubao check-in (experimental)'), onClose },
+        h('p', { style: S.note }, L('豆包「天天领额度」每天送体验额度，只有个人账号能领（飞书企业账号不行）。豆包没有令牌，要从浏览器复制一次登录 Cookie：', 'Doubao gives daily credits to personal accounts (not Feishu enterprise accounts). Doubao has no token, so copy its sign-in cookie from the browser once:')),
+        step(1, h('span', null, L('用电脑浏览器打开 ', 'Open '), h('a', { href: 'https://www.doubao.com/', target: '_blank', rel: 'noopener noreferrer', style: { color: C.accent } }, 'doubao.com ↗'), L(' 并登录', ' in a desktop browser and sign in'))),
+        step(2, L('按 F12 打开开发者工具，切到「网络 / Network」，刷新一下页面', 'Press F12, open the Network tab, and reload the page')),
+        step(3, L('点列表里任意一条 doubao.com 的请求，在「请求标头 / Request Headers」里找到 Cookie 那一行，右键复制它的值', 'Click any doubao.com request, find Cookie under Request Headers, and copy its value')),
+        h('div', { style: { fontSize: 12, color: C.warn, margin: '8px 0' } }, L('Cookie 等于你的登录：只粘在这里（保存在本机），不要发给别人。', 'The cookie is your sign-in: paste it only here (it stays on this machine) and never share it.')),
+        another ? h('div', { style: { ...S.line, marginBottom: 8 } },
+          h('input', { style: { ...S.input, ...S.grow }, maxLength: 20, placeholder: L('给这个账号起个名字，如：小号', 'A name for this account, e.g. Second'), value: name, onChange: (e) => setName(e.target.value), 'aria-label': L('账号名字', 'Account name') })) : null,
+        h('div', { style: S.line },
+          h('input', { type: 'password', style: { ...S.input, ...S.grow }, placeholder: L('粘贴 Cookie', 'Paste the cookie'), value: cookie, onChange: (e) => setCookie(e.target.value), 'aria-label': 'Cookie' }),
+          h('button', { type: 'button', style: S.btnPrimary, disabled: busy || !cookie.trim(), onClick: () => void save() }, L('保存', 'Save'))),
+        msg ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null)
+    }
+
+    /** 把签到账号复制到另一台机器：导出一段加密文本 + 提取码，到那台的页面里导入 */
+    function TransferDialog({ mode, onDone, onClose }) {
+      const [out, setOut] = useState(null)
+      const [text, setText] = useState('')
+      const [code, setCode] = useState('')
+      const [busy, setBusy] = useState(false)
+      const [msg, setMsg] = useState('')
+      useEffect(() => {
+        if (mode !== 'export') return
+        api('POST', '/checkin/export').then(setOut, (e) => setMsg(e.message))
+      }, [mode])
+      const doImport = async () => {
+        setBusy(true)
+        setMsg(L('正在导入并签到…', 'Importing and checking in…'))
+        try {
+          const r = await api('POST', '/checkin/import', { text: text.trim(), code: code.trim() })
+          onDone(r)
+        } catch (e) { setMsg(e.message); setBusy(false) }
+      }
+      if (mode === 'export') {
+        return h(Modal, { title: L('复制签到账号到另一台机器', 'Copy check-in accounts to another machine'), onClose },
+          h('p', { style: S.note }, L('比如搬到不关机的 VPS 上签，就不会漏。会复制 Qoder 令牌和豆包 Cookie；WorkBuddy 请在那台机器上各自登录（复制过去两边会互相顶掉），Trae 要在装了 Trae 的电脑上签。', 'For example move them to an always-on VPS so no day is missed. Qoder tokens and Doubao cookies are copied; sign in to WorkBuddy on that machine itself (a copied sign-in would knock the other out), and Trae needs a computer with Trae.')),
+          out ? h('div', null,
+            h('div', { style: { ...S.meta, marginBottom: 4 } }, L(`1. 复制这段文本（${out.counts.qoder} 个 Qoder、${out.counts.doubao} 个豆包）：`, `1. Copy this text (${out.counts.qoder} Qoder, ${out.counts.doubao} Doubao):`)),
+            h('div', { style: S.line },
+              h('textarea', { readOnly: true, value: out.text, rows: 3, style: { ...S.input, ...S.mono, ...S.grow, resize: 'none' }, 'aria-label': L('导出的文本', 'Exported text') }),
+              h(CopyButton, { get: out.text })),
+            h('div', { style: { ...S.meta, margin: '10px 0 4px' } }, L('2. 记下提取码（光有文本解不开）：', '2. Note the code (the text alone cannot be opened):')),
+            h('div', { style: S.line }, h('span', { style: { ...S.mono, fontSize: 18, letterSpacing: 2 } }, out.code), h(CopyButton, { get: out.code })),
+            h('div', { style: { ...S.meta, marginTop: 10 } }, L('3. 打开那台机器的「设置 → dsh-model」，签到卡片「详情」→「导入签到账号」，把两样都粘进去。', '3. On the other machine open Settings → dsh-model, check-in card Details → "Import check-in accounts", and paste both.')),
+            h('div', { style: { fontSize: 12, color: C.warn, marginTop: 8 } }, L('这段文本加提取码就等于你的登录，只在自己的两台机器之间用。', 'Text plus code amount to your sign-ins: use them only between your own machines.'))) : null,
+          msg ? h('div', { style: { fontSize: 12, color: C.err, marginTop: 8 } }, msg) : null)
+      }
+      return h(Modal, { title: L('导入签到账号', 'Import check-in accounts'), onClose },
+        h('p', { style: S.note }, L('粘贴另一台机器「复制签到账号」给出的文本和提取码。已有的同一个账号不会重复加。', 'Paste the text and code from "Copy check-in accounts" on the other machine. Accounts already here are not added twice.')),
+        h('textarea', { rows: 3, placeholder: 'dshm-checkin:v1:…', value: text, onChange: (e) => setText(e.target.value), style: { ...S.input, ...S.mono, width: '100%', boxSizing: 'border-box', resize: 'none', marginBottom: 8 }, 'aria-label': L('导出的文本', 'Exported text') }),
+        h('div', { style: S.line },
+          h('input', { style: { ...S.input, ...S.mono, width: 160 }, placeholder: L('提取码', 'Code'), value: code, onChange: (e) => setCode(e.target.value), 'aria-label': L('提取码', 'Code') }),
+          h('span', { style: S.grow }),
+          h('button', { type: 'button', style: S.btnPrimary, disabled: busy || !text.trim() || !code.trim(), onClick: () => void doImport() }, L('导入', 'Import'))),
+        msg ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null)
+    }
+
     /** 签到卡片：平时一行"今日已完成签到：…"；没签完的列出来，一键签到；自动签到开关 */
     function CheckinCard() {
       const [st, setSt] = useState(null)
       const [busy, setBusy] = useState(false)
       const [open, setOpen] = useState(false)
       const [qoder, setQoder] = useState(false)
+      const [wbLogin, setWbLogin] = useState(null)
+      const [doubao, setDoubao] = useState(false)
+      const [transfer, setTransfer] = useState('')
       const [err, setErr] = useState('')
       const refresh = useCallback(() => api('GET', '/checkin').then(setSt, () => {}), [])
+      const addWorkbuddy = async () => {
+        setErr('')
+        try { setWbLogin((await api('POST', '/checkin/workbuddy')).login) } catch (e) { setErr(e.message) }
+      }
+      const removeAccount = async (kind, id, label) => {
+        if (!window.confirm(L(`不再给「${label}」签到？`, `Stop checking in "${label}"?`))) return
+        try { setSt(await api('DELETE', `/checkin/${kind}/${encodeURIComponent(id)}`)) } catch (e) { setErr(e.message) }
+      }
       useEffect(() => { void refresh(); const t = setInterval(refresh, 5 * 60 * 1000); return () => clearInterval(t) }, [refresh])
       if (!st) return null
       const byId = new Map(st.results.map((r) => [r.id, r]))
@@ -1033,8 +1116,12 @@ window.__ModuleLoader__.load({
         // 没有能签到的：只留一个很小的入口
         return h('div', { style: { ...S.section, marginBottom: 16 } },
           h('div', { style: { ...S.meta } }, L('每日签到：登录 WorkBuddy 国内版，或', 'Daily check-in: sign in to WorkBuddy (China), or '),
-            h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setQoder(true) }, L('添加 Qoder', 'Add Qoder'))),
-          qoder ? h(QoderDialog, { onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null)
+            h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setQoder(true) }, L('添加 Qoder', 'Add Qoder')),
+            h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setDoubao(true) }, L('添加豆包', 'Add Doubao')),
+            h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setTransfer('import') }, L('从另一台机器导入', 'Import from another machine'))),
+          transfer ? h(TransferDialog, { mode: transfer, onDone: (r) => { setTransfer(''); setSt(r); setOpen(true) }, onClose: () => setTransfer('') }) : null,
+          qoder ? h(QoderDialog, { onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null,
+          doubao ? h(DoubaoDialog, { onDone: () => { setDoubao(false); void refresh() }, onClose: () => setDoubao(false) }) : null)
       }
       return h('div', { style: S.section },
         h('div', { style: { ...S.card, padding: '10px 14px' } },
@@ -1044,21 +1131,41 @@ window.__ModuleLoader__.load({
               done.length && pending.length ? h('span', { style: { color: C.sub } }, L('；', '; ')) : null,
               pending.length ? h('span', { style: { color: C.text } }, L(`还没签：${pending.map((a) => a.label).join('、')}`, `Not yet: ${pending.map((a) => a.label).join(', ')}`)) : null),
             pending.length ? h('button', { type: 'button', style: S.btnPrimary, disabled: busy, onClick: () => void run() }, busy ? L('签到中…', 'Checking in…') : L('一键签到', 'Check in all')) : null,
-            st.results.length ? h('button', { type: 'button', style: S.btn, onClick: () => setOpen(!open) }, open ? L('收起', 'Hide') : L('详情', 'Details')) : null,
+            // 详情里还有管理账号的按钮，所以没签过也要能打开
+            h('button', { type: 'button', style: S.btn, onClick: () => setOpen(!open) }, open ? L('收起', 'Hide') : L('详情', 'Details')),
             h('label', { style: { ...S.meta, display: 'flex', alignItems: 'center', gap: 4, cursor: 'pointer', whiteSpace: 'nowrap' } },
               h('input', { type: 'checkbox', checked: st.auto, onChange: (e) => void toggleAuto(e.target.checked) }), L('自动签到', 'Auto'))),
+          // 支持、但这台还没设置的：一眼看出还能签哪些，旁边就能加
+          (st.missing || []).length ? h('div', { style: { ...S.line, flexWrap: 'wrap', gap: 6, marginTop: 4, fontSize: 12, color: C.sub } },
+            h('span', null, L('这台还能签：', 'Also available here:')),
+            (st.missing || []).map((m) => h('span', { key: m.id, style: { display: 'inline-flex', alignItems: 'center', gap: 4 } },
+              m.label,
+              m.action ? h('button', { type: 'button', style: { ...S.btn, padding: '1px 6px', fontSize: 11 }, onClick: () => { if (m.action === 'workbuddy') void addWorkbuddy(); else if (m.action === 'qoder') setQoder(true); else setDoubao(true) } }, L('+ 添加', '+ Add')) : h('span', { style: { color: C.faint } }, `（${m.reason}）`)))) : null,
           open ? h('div', { style: { marginTop: 8 } },
             st.results.map((r) => h('div', { key: r.id, style: { fontSize: 12, lineHeight: 1.8, color: r.state === 'failed' ? C.err : C.text } },
               `${r.label}：${CHECKIN_TEXT(r)}`, r.advice ? h('span', { style: { color: C.sub, marginLeft: 6 } }, r.advice) : null)),
-            h('div', { style: { ...S.line, marginTop: 6 } },
-              st.qoder.configured
-                ? h('button', { type: 'button', style: S.btn, onClick: () => { if (window.confirm(L('删除 Qoder 的令牌？之后不再给 Qoder 签到。', 'Remove the Qoder token? Qoder will no longer be checked in.'))) void api('DELETE', '/checkin/qoder').then(setSt, (e) => setErr(e.message)) } }, L('删除 Qoder 令牌', 'Remove Qoder token'))
-                : h('button', { type: 'button', style: S.btn, onClick: () => setQoder(true) }, L('添加 Qoder', 'Add Qoder'))),
+            // 多账号：多加的 WorkBuddy 签到账号、每个 Qoder 令牌，都能删；再加一个
+            h('div', { style: { marginTop: 8, borderTop: `1px solid ${C.border}`, paddingTop: 8 } },
+              h('div', { style: { ...S.meta, marginBottom: 4 } }, L('签到账号（同一家可以加几个账号）', 'Check-in accounts (several per product are fine)')),
+              [...((st.accounts && st.accounts.workbuddy) || []).map((a) => ({ kind: 'workbuddy', id: a.uid, label: a.label })), ...((st.accounts && st.accounts.qoder) || []).map((q) => ({ kind: 'qoder', id: q.id, label: q.label })), ...((st.accounts && st.accounts.doubao) || []).map((d) => ({ kind: 'doubao', id: d.id, label: d.label }))].map((a) =>
+                h('div', { key: `${a.kind}:${a.id}`, style: { ...S.line, minHeight: 24, fontSize: 12 } },
+                  h('span', { style: S.grow }, a.label),
+                  h('button', { type: 'button', style: { ...S.btn, padding: '2px 8px' }, onClick: () => void removeAccount(a.kind, a.id, a.label) }, L('删除', 'Remove')))),
+              h('div', { style: { ...S.line, marginTop: 4, flexWrap: 'wrap' } },
+                h('button', { type: 'button', style: S.btn, onClick: () => void addWorkbuddy() }, L('+ 添加 WorkBuddy 账号', '+ Add a WorkBuddy account')),
+                h('button', { type: 'button', style: S.btn, onClick: () => setQoder(true) }, st.qoder.configured ? L('+ 再加一个 Qoder 账号', '+ Add another Qoder account') : L('+ 添加 Qoder', '+ Add Qoder')),
+                h('button', { type: 'button', style: S.btn, onClick: () => setDoubao(true) }, (st.accounts && st.accounts.doubao && st.accounts.doubao.length) ? L('+ 再加一个豆包账号', '+ Add another Doubao account') : L('+ 添加豆包', '+ Add Doubao'))),
+              h('div', { style: { ...S.line, marginTop: 4, flexWrap: 'wrap' } },
+                h('button', { type: 'button', style: S.btn, onClick: () => setTransfer('export') }, L('复制签到账号到另一台机器', 'Copy check-in accounts to another machine')),
+                h('button', { type: 'button', style: S.btn, onClick: () => setTransfer('import') }, L('导入签到账号', 'Import check-in accounts')))),
             // Trae 读本机 Trae 的登录：这台没装（比如 VPS）就不会出现，在装了 Trae 的电脑上签就行（每个账号一天一次）
             !st.available.some((a) => a.id === 'trae') ? h('div', { style: { ...S.meta, marginTop: 6 } }, L('Trae：这台电脑上没装 Trae，所以不签。在装了 Trae 的电脑上会自动签（一个账号一天签一次就够）。', 'Trae: not installed on this machine, so it is skipped. A computer with Trae installed checks it in automatically (once a day per account is enough).')) : null) : null,
           !open && !st.qoder.configured ? h('div', { style: { ...S.meta, marginTop: 4 } }, h('button', { type: 'button', style: { ...S.btn, padding: '2px 8px' }, onClick: () => setQoder(true) }, L('+ 添加 Qoder', '+ Add Qoder'))) : null,
           err ? h('div', { style: { fontSize: 12, color: C.err, marginTop: 6 } }, err) : null),
-        qoder ? h(QoderDialog, { onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null)
+        qoder ? h(QoderDialog, { another: st.qoder.configured, onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null,
+        transfer ? h(TransferDialog, { mode: transfer, onDone: (r) => { setTransfer(''); setSt(r); setOpen(true) }, onClose: () => setTransfer('') }) : null,
+        doubao ? h(DoubaoDialog, { another: Boolean(st.accounts && st.accounts.doubao && st.accounts.doubao.length), onDone: () => { setDoubao(false); setOpen(true); void refresh() }, onClose: () => setDoubao(false) }) : null,
+        wbLogin ? h(LoginDialog, { source: { id: 'workbuddy-checkin', label: L('WorkBuddy 签到账号', 'WorkBuddy check-in account'), login: 'link' }, session: wbLogin, onDone: () => { setWbLogin(null); setOpen(true); setTimeout(() => void refresh(), 3000) }, onClose: () => { setWbLogin(null); void refresh() } }) : null)
     }
 
     /** 签完在 dsh 右下角提示一次（成功或失败），一天一次 */

package/plugin/index.js

@@ -63,8 +63,10 @@ const ALLOWED = [
   ['GET', /^\/self$/],
   ['GET', /^\/failures$/],
   ['GET', /^\/checkin$/],
-  ['POST', /^\/checkin(\/auto|\/qoder)?$/],
-  ['DELETE', /^\/checkin\/qoder$/],
+  ['POST', /^\/checkin(\/auto|\/qoder|\/workbuddy|\/doubao|\/export|\/import)?$/],
+  ['DELETE', /^\/checkin\/qoder(\/[A-Za-z0-9_-]{1,40})?$/],
+  ['DELETE', /^\/checkin\/workbuddy\/[A-Za-z0-9_-]{1,80}$/],
+  ['DELETE', /^\/checkin\/doubao\/[A-Za-z0-9_-]{1,40}$/],
   ['POST', /^\/models\/test$/],
   ['GET', /^\/combos$/],
   ['POST', /^\/combos$/],