dsh-model 0.25.0 → 0.27.0

package/README.en.md

@@ -28,10 +28,12 @@ English · [中文](README.md)
 | **Trae** | Detected automatically if Trae is installed and signed in; nothing to do | Check-in credits (200 a day in testing) |
 | **Qoder** | Paste a personal access token once (China or international) | That day's check-in credits |
 | **WorkBuddy (China)** | Sign in once (several accounts are fine) | Check-in credits |
-| **Doubao** (experimental) | Copy the sign-in cookie from the browser once (personal accounts only) | Daily trial credits |
+| **Doubao** (experimental) | On Mac / Windows click "Read from this computer" to use the account signed in to the Doubao app or a browser; or paste the cookie by hand (personal accounts only) | Daily trial credits |
 
 - **Automatic by default**: done at a random 5–55 minutes after midnight Beijing time; failures retry an hour later; if the computer was off, it catches up within a minute of starting.
 - **You can see it**: one line at the top of the settings page, "Checked in today: …", with a one-click "Check in all" for anything missed, plus a one-time notice in the corner of dsh.
+- **What else this machine can do**: the card lists the supported products not set up here yet, each with "+ Add".
+- **Move it to an always-on VPS**: "Copy check-in accounts to another machine" gives an encrypted text and a code to import on the VPS page (Qoder and Doubao; sign in to WorkBuddy on the VPS itself, and Trae stays on the computer that has Trae).
 - **Several accounts**: each product can have more than one. In the check-in card's Details: "+ Add a WorkBuddy account" (approve through a link) and "+ Add another Qoder account"; several Trae installs are checked in once per account automatically.
 - **Check-in only, credits untouched**: they stay on your account for use in each product's own app. Command line: `dsh-model checkin`.
 
@@ -51,7 +53,7 @@ Your model sources each have their own API and sign-in. dsh-model puts them behi
 | Kind | Sources |
 |---|---|
 | **Free (suggested)** | **SiliconFlow** (reachable from China; some models free after identity verification), **Gemini** (if you can reach Google; the best free models) |
-| Free · limited | Groq, OpenRouter (`:free` models) |
+| Free · limited | **Zhipu GLM** (the Flash models), **iFlytek Spark** (Spark Lite), Baidu Qianfan (ERNIE Speed / Lite), Groq, OpenRouter (`:free` models) |
 | Local | Ollama, LM Studio: appear once started, no sign-in |
 | Subscription | Codex (ChatGPT Plus / Pro), Kimi Code, Grok, Muse, Devin: sign in from the management page |
 | Pay as you go | DeepSeek official, OpenCode Zen, any OpenAI-compatible service |
@@ -112,6 +114,10 @@ If a source is signed in but has no usable plan (say, a Kimi account without Kim
 | Gemini (Google AI Studio), Groq | Free · limited | Paste a free API key; daily / per-minute limits apply |
 | OpenRouter | Free · limited | `:free` models are free (about 50 requests a day) |
 | SiliconFlow | Free · limited | Some small models are free after identity verification |
+| Zhipu GLM | Free · limited | The Flash models (e.g. GLM-4.7-Flash) are free; reachable from China |
+| iFlytek Spark | Free · limited | Spark Lite is free with no token cap, 2 requests per second; use the console's APIPassword as the key |
+| Baidu Qianfan | Free · limited | ERNIE Speed / Lite are free for now (rate limited) |
+| Volcengine Ark (Doubao models), MiniMax, Huawei Cloud ModelArts | Paid | Official APIs, just add a key; Ark and Huawei Cloud have free quotas for new users |
 | DeepSeek official, any OpenAI-compatible service | Paid | Paste an API key (and a URL for other services) |
 | Codex | Paid | ChatGPT Plus / Pro |
 | Kimi | Paid | Kimi Code plan |

package/README.md

@@ -28,10 +28,12 @@
 | **Trae** | 本机装了 Trae 并登录过，自动识别，什么都不用做 | 签到送积分（实测每天 200） |
 | **Qoder** | 粘贴一次个人访问令牌（国内版、国际版都行） | 领当天的签到积分 |
 | **WorkBuddy 国内版** | 登录一次（可以加几个账号） | 签到送积分 |
-| **豆包**（实验） | 从浏览器复制一次登录 Cookie（只支持个人账号） | 「天天领额度」送体验额度 |
+| **豆包**（实验） | Mac / Windows 上点「从本机自动读取」，读豆包电脑版或浏览器里已登录的账号；也可以手动粘贴 Cookie（只支持个人账号） | 「天天领额度」送体验额度 |
 
 - **自动签到默认打开**：北京时间零点后随机延后 5–55 分钟签好；失败的一小时后重试；电脑关机错过了，开机一分钟内补签。
 - **结果看得见**：设置页顶部一行「今日已完成签到：…」，没签上的可以「一键签到」；签完在 dsh 右下角提示一次。
+- **这台还能签哪些**：卡片里列出支持、但这台还没设置的，旁边就是「+ 添加」。
+- **放到 VPS 上签，不会漏**：「复制签到账号到另一台机器」导出一段加密文本和提取码，到 VPS 的页面里「导入」即可（Qoder、豆包；WorkBuddy 在 VPS 上各自登录，Trae 留在装了 Trae 的电脑上签）。
 - **多账号**：一家可以签几个账号。在签到卡片的「详情」里「+ 添加 WorkBuddy 账号」（打开链接授权）、「+ 再加一个 Qoder 账号」；本机装了几个 Trae 会自动按账号各签一次。
 - **只签到，不碰积分**：积分留在你的账号里，照常在各家官方软件里用。命令行：`dsh-model checkin`。
 
@@ -51,7 +53,7 @@
 | 类型 | 来源 |
 |---|---|
 | **免费（推荐）** | **硅基流动**（国内直连，实名后部分模型免费）、**Gemini**（能上外网，免费模型里质量最好） |
-| 免费 · 额度少 | Groq、OpenRouter（`:free` 模型） |
+| 免费 · 额度少 | **智谱 GLM**（Flash 系列免费）、**讯飞星火**（Spark Lite 免费）、百度千帆（ERNIE Speed / Lite）、Groq、OpenRouter（`:free` 模型） |
 | 本机 | Ollama、LM Studio：启动后自动出现，不用登录 |
 | 订阅 | Codex（ChatGPT Plus / Pro）、Kimi Code、Grok、Muse、Devin：在管理页里登录即可 |
 | 按量付费 | DeepSeek 官方、OpenCode Zen、任意 OpenAI 兼容服务 |
@@ -112,6 +114,10 @@ dsh-model setup
 | Gemini（Google AI Studio）、Groq | 免费·额度少 | 填免费 API key 即可，每天 / 每分钟有上限 |
 | OpenRouter | 免费·额度少 | 名字带 `:free` 的模型免费（每天约 50 次） |
 | 硅基流动 | 免费·额度少 | 实名认证后部分小模型免费 |
+| 智谱 GLM | 免费·额度少 | Flash 系列（如 GLM-4.7-Flash）免费，国内直连 |
+| 讯飞星火 | 免费·额度少 | Spark Lite 免费不限量，每秒 2 次；key 填控制台的 APIPassword |
+| 百度千帆 | 免费·额度少 | ERNIE Speed / Lite 长期免费（限速） |
+| 火山方舟（豆包大模型）、MiniMax 开放平台、华为云 ModelArts | 需付费 | 官方 API，填 key 即可；火山方舟、华为云有新用户免费额度 |
 | DeepSeek 官方、其他 OpenAI 兼容服务 | 需付费 | 填 API key（其他服务还要填地址） |
 | Codex | 需付费 | ChatGPT Plus / Pro |
 | Kimi | 需付费 | Kimi Code 套餐 |

package/dist/checkin/accounts.js

@@ -104,6 +104,20 @@ export async function removeQoder(ctx, id) {
     const target = id ?? list[0]?.id;
     await saveQoders(ctx, list.filter((q) => q.id !== target));
 }
+/** Cookie 串里某一项的值 */
+export function cookieValue(cookie, name) {
+    for (const part of cookie.split(/;\s*/)) {
+        const i = part.indexOf('=');
+        if (i > 0 && part.slice(0, i).trim() === name)
+            return part.slice(i + 1);
+    }
+    return undefined;
+}
+/** 同一个豆包账号：uid_tt 一样（Cookie 里别的项每次都会变） */
+const sameDoubaoAccount = (a, b) => {
+    const x = cookieValue(a, 'uid_tt');
+    return a === b || (Boolean(x) && x === cookieValue(b, 'uid_tt'));
+};
 export async function loadDoubaos(ctx) {
     return (await loadSecrets(ctx)).checkin?.doubaos ?? [];
 }
@@ -117,14 +131,17 @@ async function saveDoubaos(ctx, list) {
     secrets.checkin = Object.keys(checkin).length ? checkin : undefined;
     await saveSecrets(ctx, secrets);
 }
-/** 加一个豆包账号；同一个 Cookie 再加 = 改名字。返回 id */
+/** 加一个豆包账号；同一个账号再加 = 换成新的 Cookie（和名字）。返回 id */
 export async function addDoubao(ctx, entry) {
     const list = await loadDoubaos(ctx);
     const name = entry.name?.trim().slice(0, 20);
-    const same = list.find((d) => d.cookie === entry.cookie);
+    const same = list.find((d) => sameDoubaoAccount(d.cookie, entry.cookie));
     if (same) {
+        same.cookie = entry.cookie;
         if (name)
             same.name = name;
+        if (entry.from)
+            same.from = entry.from;
         await saveDoubaos(ctx, list);
         return same.id;
     }
@@ -133,7 +150,7 @@ export async function addDoubao(ctx, entry) {
     while (used.has(String(n)))
         n++;
     const id = String(n);
-    list.push({ id, cookie: entry.cookie, seed: entry.seed ?? randomBytes(16).toString('hex'), ...(name ? { name } : {}), savedAt: new Date().toISOString() });
+    list.push({ id, cookie: entry.cookie, seed: entry.seed ?? randomBytes(16).toString('hex'), ...(name ? { name } : {}), ...(entry.from ? { from: entry.from } : {}), savedAt: new Date().toISOString() });
     await saveDoubaos(ctx, list);
     return id;
 }

package/dist/checkin/browser-cookies.js

@@ -0,0 +1,219 @@
+// checkin/browser-cookies.ts — 从本机已登录的豆包电脑版 / 浏览器里读 doubao.com 的登录 Cookie（设计 §14.21）
+//
+// 用户嫌"F12 → 网络 → 复制 Cookie"太麻烦（2026-10-29）。豆包电脑版（DoubaoWork）和 Chrome、Edge、Brave 都是 Chromium，
+// Cookie 存在 <用户数据>/<配置>/Cookies（新版在 Network/Cookies）这个 SQLite 里，值是加密的：
+//   macOS：v10 + AES-128-CBC，密钥 = PBKDF2(钥匙串里「<应用> Safe Storage」的密码, 'saltysalt', 1003, sha1)。
+//          读钥匙串时 macOS 会弹窗问用户是否允许，用户点允许才读得到。
+//   Windows：v10 + AES-256-GCM，密钥在 Local State 的 os_crypt.encrypted_key 里，用当前用户的 DPAPI 解开。
+//            新版 Chrome 的 v20（应用绑定加密）读不了，跳过。
+//   Linux：不读（VPS 上也没有这些应用）。
+// Cookie 库版本 ≥ 24 时，解开的值前面多 32 字节（host 的 sha256），要去掉。
+// 只读 doubao.com 的 Cookie，只在用户点「从本机找」时读；先只看有没有登录（不碰密钥），有才去解密。
+import { createDecipheriv, pbkdf2Sync } from 'node:crypto';
+import { copyFile, mkdtemp, readdir, readFile, rm, stat } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { run, which } from '../util/exec.js';
+/** 要读的 Cookie 所在域 */
+const HOSTS = ['doubao.com', '.doubao.com', 'www.doubao.com'];
+/** 有这个 Cookie 才算登录了 */
+const SESSION_COOKIE = 'sessionid';
+/** 本机可能有 doubao.com 登录的 Chromium 应用 */
+export function cookieStores(home = homedir(), platform = process.platform, env = process.env) {
+    if (platform === 'darwin') {
+        const s = join(home, 'Library', 'Application Support');
+        return [
+            { label: '豆包电脑版', root: join(s, 'DoubaoWork'), services: ['DoubaoWork Browser Safe Storage', 'DoubaoWork Safe Storage'] },
+            { label: '豆包', root: join(s, 'Doubao'), services: ['Doubao Browser Safe Storage', 'Doubao Safe Storage'] },
+            { label: 'Chrome', root: join(s, 'Google', 'Chrome'), services: ['Chrome Safe Storage'] },
+            { label: 'Edge', root: join(s, 'Microsoft Edge'), services: ['Microsoft Edge Safe Storage'] },
+            { label: 'Brave', root: join(s, 'BraveSoftware', 'Brave-Browser'), services: ['Brave Safe Storage'] },
+        ];
+    }
+    if (platform === 'win32') {
+        const local = env.LOCALAPPDATA || join(home, 'AppData', 'Local');
+        const roaming = env.APPDATA || join(home, 'AppData', 'Roaming');
+        return [
+            { label: '豆包电脑版', root: join(local, 'DoubaoWork', 'User Data'), services: [] },
+            { label: '豆包电脑版', root: join(roaming, 'DoubaoWork'), services: [] },
+            { label: '豆包', root: join(local, 'Doubao', 'User Data'), services: [] },
+            { label: 'Chrome', root: join(local, 'Google', 'Chrome', 'User Data'), services: [] },
+            { label: 'Edge', root: join(local, 'Microsoft', 'Edge', 'User Data'), services: [] },
+            { label: 'Brave', root: join(local, 'BraveSoftware', 'Brave-Browser', 'User Data'), services: [] },
+        ];
+    }
+    return [];
+}
+const exists = async (p) => stat(p).then(() => true, () => false);
+/** 列出 store 里每个配置的 Cookie 库 */
+async function cookieDbs(store) {
+    let names;
+    try {
+        names = await readdir(store.root);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const profile of names.filter((n) => n === 'Default' || /^Profile \d+$/.test(n)).sort()) {
+        for (const rel of [['Network', 'Cookies'], ['Cookies']]) {
+            const file = join(store.root, profile, ...rel);
+            if (await exists(file)) {
+                out.push({ store, profile, file });
+                break;
+            }
+        }
+    }
+    return out;
+}
+/** Chromium 的时间：1601 年起的毫秒（SQL 里已从微秒除下来，微秒超出 JS 安全整数）；0 = 会话 Cookie */
+const chromeTimeToMs = (t) => (t ? t - 11_644_473_600_000 : 0);
+/** 读 Cookie 库：先复制一份再读（应用开着时原文件被锁）。返回 doubao.com 的行和库版本 */
+export async function readCookieDb(file) {
+    const dir = await mkdtemp(join(tmpdir(), 'dshm-ck-'));
+    try {
+        const copy = join(dir, 'Cookies');
+        await copyFile(file, copy);
+        for (const ext of ['-journal', '-wal'])
+            await copyFile(file + ext, copy + ext).catch(() => { });
+        return await querySqlite(copy);
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+}
+const SQL_ROWS = `select host_key, name, value, hex(encrypted_value) as ev, expires_utc / 1000 as expires_utc from cookies where host_key in (${HOSTS.map((h) => `'${h}'`).join(',')})`;
+const SQL_VERSION = `select value from meta where key = 'version'`;
+async function querySqlite(file) {
+    let raw;
+    let version;
+    try {
+        // Node 22.5 起自带 SQLite；更老的 Node 退回系统的 sqlite3 命令
+        const mod = 'node:sqlite'; // 写成变量：@types/node 还没有它的类型
+        const { DatabaseSync } = (await import(mod));
+        const db = new DatabaseSync(file, { readOnly: true });
+        try {
+            raw = db.prepare(SQL_ROWS).all();
+            version = Number(db.prepare(SQL_VERSION).get()?.value) || 0;
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ERR_UNKNOWN_BUILTIN_MODULE' && !/node:sqlite/.test(String(error)))
+            throw error;
+        const bin = await which('sqlite3');
+        if (!bin)
+            throw new Error('读不了浏览器的 Cookie：Node 太旧（要 22.5 以上）且没有 sqlite3 命令');
+        const a = await run(bin, ['-readonly', '-json', file, SQL_ROWS], { timeoutMs: 20_000 });
+        const b = await run(bin, ['-readonly', file, SQL_VERSION], { timeoutMs: 20_000 });
+        if (a.code !== 0)
+            throw new Error(`读 Cookie 库失败：${a.stderr.trim()}`);
+        raw = a.stdout.trim() ? JSON.parse(a.stdout) : [];
+        version = Number(b.stdout.trim()) || 0;
+    }
+    return {
+        rows: raw.map((r) => ({ host_key: r.host_key, name: r.name, value: r.value ?? '', encrypted_value: Buffer.from(r.ev ?? '', 'hex'), expires_utc: Number(r.expires_utc) || 0 })),
+        version,
+    };
+}
+/** 没过期的 Cookie（会话 Cookie 也算） */
+const alive = (r, now) => {
+    const ms = chromeTimeToMs(r.expires_utc);
+    return !ms || ms > now;
+};
+/** 只看哪些地方登录着豆包（不解密、不碰钥匙串，不会弹窗） */
+export async function findDoubaoLogins(home = homedir(), platform = process.platform, now = Date.now()) {
+    const out = [];
+    for (const store of cookieStores(home, platform)) {
+        const dbs = await cookieDbs(store);
+        for (const db of dbs) {
+            const { rows } = await readCookieDb(db.file).catch(() => ({ rows: [] }));
+            if (rows.some((r) => r.name === SESSION_COOKIE && alive(r, now))) {
+                out.push({ label: dbs.length > 1 && db.profile !== 'Default' ? `${store.label}（${db.profile}）` : store.label, db });
+            }
+        }
+    }
+    return out;
+}
+/** macOS：Cookie 密钥 = PBKDF2(钥匙串密码)。读钥匙串会弹窗问用户 */
+async function macKey(services) {
+    let last = '';
+    for (const s of services) {
+        const r = await run('/usr/bin/security', ['find-generic-password', '-w', '-s', s], { timeoutMs: 120_000 });
+        if (r.code === 0 && r.stdout.trim())
+            return pbkdf2Sync(r.stdout.trim(), 'saltysalt', 1003, 16, 'sha1');
+        last = r.stderr.trim();
+        // 用户点了拒绝：不再试别的名字
+        if (/cancel|denied|拒绝|取消/i.test(last) || r.code === 128)
+            throw new CookieAccessDenied();
+    }
+    throw new Error(`钥匙串里没找到它的 Cookie 密钥${last ? `（${last}）` : ''}`);
+}
+/** Windows：Local State 里的密钥，用 DPAPI 解开 */
+async function winKey(root) {
+    const state = JSON.parse(await readFile(join(root, 'Local State'), 'utf8'));
+    const enc = Buffer.from(state.os_crypt?.encrypted_key ?? '', 'base64');
+    if (enc.subarray(0, 5).toString() !== 'DPAPI')
+        throw new Error('Local State 里没有能用的 Cookie 密钥');
+    const script = "Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String($env:DSHM_BLOB); [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'))";
+    const r = await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], { env: { ...process.env, DSHM_BLOB: enc.subarray(5).toString('base64') }, timeoutMs: 30_000 });
+    if (r.code !== 0 || !r.stdout.trim())
+        throw new Error(`解不开 Cookie 密钥：${r.stderr.trim() || `退出码 ${r.code}`}`);
+    return Buffer.from(r.stdout.trim(), 'base64');
+}
+export class CookieAccessDenied extends Error {
+    constructor() {
+        super('没有允许读取钥匙串');
+    }
+}
+/** 解开一个 Cookie 值。读不了（如 v20）返回 null。导出给测试 */
+export function decryptCookie(enc, key, platform, dbVersion) {
+    const tag = enc.subarray(0, 3).toString();
+    if (tag !== 'v10' && tag !== 'v11')
+        return null;
+    let plain;
+    if (platform === 'win32') {
+        const nonce = enc.subarray(3, 15);
+        const body = enc.subarray(15, enc.length - 16);
+        const d = createDecipheriv('aes-256-gcm', key, nonce);
+        d.setAuthTag(enc.subarray(enc.length - 16));
+        plain = Buffer.concat([d.update(body), d.final()]);
+    }
+    else {
+        const d = createDecipheriv('aes-128-cbc', key, Buffer.alloc(16, 0x20));
+        plain = Buffer.concat([d.update(enc.subarray(3)), d.final()]);
+    }
+    return (dbVersion >= 24 ? plain.subarray(32) : plain).toString('utf8');
+}
+/** 读出一处登录的完整 Cookie 串（a=1; b=2）。macOS 会弹钥匙串授权 */
+export async function readDoubaoCookie(login, platform = process.platform, now = Date.now(), testKey) {
+    const { rows, version } = await readCookieDb(login.db.file);
+    const key = testKey ?? (platform === 'darwin' ? await macKey(login.db.store.services) : await winKey(login.db.store.root));
+    // 同名的取更具体的域（www.doubao.com 盖过 .doubao.com）
+    const byName = new Map();
+    let unreadable = 0;
+    for (const r of rows.filter((x) => alive(x, now))) {
+        let value = r.value;
+        if (!value && r.encrypted_value.length) {
+            try {
+                value = decryptCookie(r.encrypted_value, key, platform, version);
+            }
+            catch {
+                value = null;
+            }
+        }
+        if (value === null) {
+            unreadable++;
+            continue;
+        }
+        const prev = byName.get(r.name);
+        if (!prev || r.host_key.length > prev.host.length)
+            byName.set(r.name, { host: r.host_key, value });
+    }
+    if (!byName.get(SESSION_COOKIE)?.value) {
+        throw new Error(unreadable ? `${login.label} 用的是新的加密方式，读不了：请用「手动粘贴 Cookie」` : `${login.label} 里的豆包登录不完整`);
+    }
+    return [...byName].map(([n, v]) => `${n}=${v.value}`).join('; ');
+}

package/dist/checkin/index.js

@@ -24,7 +24,7 @@ export function checkinAdvice(itemId, message) {
     const id = itemId.split(':')[0];
     if (/无效|过期|401|403|unauthor|expired|not able to authenticate/i.test(message)) {
         if (id === 'doubao')
-            return L('豆包登录过期：在浏览器里重新登录 doubao.com，到签到卡片里删掉它，再复制 Cookie 添加一次', 'Doubao sign-in expired: sign in at doubao.com again, remove it in the check-in card and add the new cookie');
+            return L('豆包登录过期：在豆包电脑版或浏览器里重新登录，再点签到卡片里的「+ 添加豆包 → 从本机自动读取」（会换成新的登录）', 'Doubao sign-in expired: sign in again in the Doubao app or a browser, then use "+ Add Doubao → Read from this computer" in the check-in card (it replaces the old sign-in)');
         if (id === 'trae')
             return L('Trae 登录过期：打开 Trae 重新登录一次', 'Trae sign-in expired: open Trae and sign in again');
         if (id === 'qoder')

package/dist/checkin/transfer.js

@@ -0,0 +1,65 @@
+// checkin/transfer.ts — 把签到账号复制到另一台机器（设计 §14.20）：比如 Mac 上加好的，搬到不关机的 VPS 上签
+//
+// 只搬能在任何机器上用的：Qoder 令牌、豆包 Cookie。
+//   WorkBuddy 不搬：登录令牌会续期轮换，两台用同一份会互相顶掉，所以每台各自登录。
+//   Trae 不搬：读的是本机 Trae 软件的登录，要在装了 Trae 的电脑上签。
+// 导出 = 一段加密文本 + 一个 8 位提取码（分开显示，光有文本解不开）。AES-256-GCM，密钥由提取码经 scrypt 派生。
+import { createCipheriv, createDecipheriv, randomBytes, randomInt, scryptSync } from 'node:crypto';
+import { DshModelError } from '../errors.js';
+import { L } from '../i18n.js';
+import { addDoubao, addQoder, loadDoubaos, loadQoders } from './accounts.js';
+const PREFIX = 'dshm-checkin:v1:';
+/** 去掉容易看错的 0/O、1/I/L */
+const ALPHABET = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789';
+const keyFrom = (code, salt) => scryptSync(code.replace(/[\s-]/g, '').toUpperCase(), salt, 32, { N: 1 << 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 });
+export function sealBundle(bundle, code) {
+    const c = code ?? Array.from({ length: 8 }, () => ALPHABET[randomInt(ALPHABET.length)]).join('');
+    const salt = randomBytes(16);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', keyFrom(c, salt), iv);
+    const body = Buffer.concat([cipher.update(JSON.stringify(bundle), 'utf8'), cipher.final()]);
+    const text = PREFIX + Buffer.concat([salt, iv, cipher.getAuthTag(), body]).toString('base64url');
+    return { text, code: `${c.slice(0, 4)}-${c.slice(4)}` };
+}
+export function openBundle(text, code) {
+    const t = text.trim();
+    if (!t.startsWith(PREFIX))
+        throw new DshModelError('bad_transfer', L('这不是 dsh-model 导出的签到账号（应以 dshm-checkin: 开头）', 'This is not a dsh-model check-in export (it should start with dshm-checkin:)'));
+    const raw = Buffer.from(t.slice(PREFIX.length), 'base64url');
+    if (raw.length < 16 + 12 + 16 + 2)
+        throw new DshModelError('bad_transfer', L('导出的文本不完整：复制时可能少了一截', 'The export text is incomplete: part of it may be missing'));
+    const salt = raw.subarray(0, 16);
+    const iv = raw.subarray(16, 28);
+    const tag = raw.subarray(28, 44);
+    try {
+        const d = createDecipheriv('aes-256-gcm', keyFrom(code, salt), iv);
+        d.setAuthTag(tag);
+        const json = Buffer.concat([d.update(raw.subarray(44)), d.final()]).toString('utf8');
+        const b = JSON.parse(json);
+        return { qoders: Array.isArray(b.qoders) ? b.qoders : [], doubaos: Array.isArray(b.doubaos) ? b.doubaos : [] };
+    }
+    catch {
+        throw new DshModelError('bad_transfer_code', L('提取码不对，或者文本被改动过', 'Wrong code, or the text was changed'));
+    }
+}
+/** 导出这台机器上能搬的签到账号 */
+export async function exportCheckin(ctx) {
+    const qoders = await loadQoders(ctx);
+    const doubaos = await loadDoubaos(ctx);
+    if (!qoders.length && !doubaos.length)
+        throw new DshModelError('nothing_to_export', L('这台机器上没有能复制的签到账号（只能复制 Qoder 和豆包；WorkBuddy 请在那台机器上各自登录，Trae 要在装了 Trae 的电脑上签）', 'Nothing to copy from this machine (only Qoder and Doubao can be copied; sign in to WorkBuddy on each machine, and Trae needs a computer with Trae installed)'));
+    const sealed = sealBundle({
+        qoders: qoders.map((q) => ({ pat: q.pat, region: q.region, ...(q.name ? { name: q.name } : {}) })),
+        doubaos: doubaos.map((d) => ({ cookie: d.cookie, seed: d.seed, ...(d.name ? { name: d.name } : {}) })),
+    });
+    return { ...sealed, counts: { qoder: qoders.length, doubao: doubaos.length } };
+}
+/** 导入：已有的同一个令牌 / Cookie 不会重复加 */
+export async function importCheckin(ctx, text, code) {
+    const b = openBundle(text, code);
+    for (const q of b.qoders)
+        await addQoder(ctx, q);
+    for (const d of b.doubaos)
+        await addDoubao(ctx, d);
+    return { qoder: b.qoders.length, doubao: b.doubaos.length };
+}

package/dist/daemon/core.js

@@ -20,7 +20,9 @@ import { autoDue, beijingNow, checkinAdvice, ensureJitter, loadCheckin, runCheck
 import { QODER_REGIONS, exchangePat, qoderCheckin } from '../checkin/qoder.js';
 import { findTraeCredentials, traeCheckin } from '../checkin/trae.js';
 import { DoubaoAuthError, doubaoCheckin, doubaoStatus, normalizeCookie } from '../checkin/doubao.js';
-import { accountTag, addDoubao, addQoder, listWorkbuddyAccounts, loadDoubaos, loadQoders, removeDoubao, removeQoder, removeWorkbuddyAccount, workbuddyAccountStore, workbuddyAccountsDir } from '../checkin/accounts.js';
+import { CookieAccessDenied, findDoubaoLogins, readDoubaoCookie } from '../checkin/browser-cookies.js';
+import { exportCheckin, importCheckin } from '../checkin/transfer.js';
+import { accountTag, addDoubao, checkinKind, cookieValue, addQoder, listWorkbuddyAccounts, loadDoubaos, loadQoders, removeDoubao, removeQoder, removeWorkbuddyAccount, workbuddyAccountStore, workbuddyAccountsDir } from '../checkin/accounts.js';
 import { CN_VARIANT } from '../bridge/workbuddy/variants.js';
 import { PKG_ROOT, pkgVersion } from '../util/pkg.js';
 import { randomBytes } from 'node:crypto';
@@ -792,6 +794,16 @@ export class Daemon {
                 qoder: qoders.map((q, i) => ({ id: q.id, label: checkers.find((c) => c.id === (i === 0 ? 'qoder' : `qoder:${q.id}`))?.label ?? q.id, region: q.region })),
                 doubao: (await loadDoubaos(this.ctx)).map((d, i) => ({ id: d.id, label: checkers.find((c) => c.id === (i === 0 ? 'doubao' : `doubao:${d.id}`))?.label ?? d.id })),
             },
+            // 能不能从本机的豆包电脑版 / 浏览器读登录（看守护进程所在的机器，不是看浏览器）
+            localRead: process.platform === 'darwin' ? 'mac' : process.platform === 'win32' ? 'win' : null,
+            // 支持、但这台还没设置的（签到卡片里列出来，旁边就是「添加」）
+            missing: [
+                ...(checkers.some((c) => checkinKind(c.id) === 'workbuddy') ? [] : [{ id: 'workbuddy', label: L('WorkBuddy 国内版', 'WorkBuddy (China)'), action: 'workbuddy' }]),
+                ...(checkers.some((c) => checkinKind(c.id) === 'qoder') ? [] : [{ id: 'qoder', label: 'Qoder', action: 'qoder' }]),
+                // 本机豆包电脑版 / 浏览器登录着豆包：说出来，点「添加」就能自动读（只看有没有登录，不解密）
+                ...(checkers.some((c) => checkinKind(c.id) === 'doubao') ? [] : [{ id: 'doubao', label: L('豆包', 'Doubao'), action: 'doubao', found: (await findDoubaoLogins().catch(() => [])).map((f) => f.label) }]),
+                ...(checkers.some((c) => checkinKind(c.id) === 'trae') ? [] : [{ id: 'trae', label: 'Trae', reason: L('这台没装 Trae：要在装了 Trae 的电脑上签', 'Trae is not installed here: it is checked in on a computer with Trae') }]),
+            ],
         };
     }
     checkinInflight;
@@ -842,6 +854,48 @@ export class Daemon {
             throw new DshModelError('doubao_no_task', L('这个豆包账号没有签到任务：只有个人账号能领每日额度，飞书企业账号不行。请换成个人账号登录后再复制 Cookie', 'This Doubao account has no check-in task: only personal accounts get the daily credits, not Feishu enterprise accounts. Sign in with a personal account and copy the cookie again'));
         await addDoubao(this.ctx, { cookie, seed, ...(name ? { name } : {}) });
     }
+    /**
+     * 从本机找豆包登录（豆包电脑版、Chrome、Edge、Brave），读出 Cookie 加成签到账号。
+     * macOS 会弹窗问用户是否允许读钥匙串；同一个账号在几处都登录着只加一次，已加过的换成新的 Cookie。
+     */
+    async scanDoubao() {
+        const logins = await findDoubaoLogins();
+        if (!logins.length)
+            throw new DshModelError('doubao_not_found', L('这台电脑上没找到登录着的豆包：先在豆包电脑版或浏览器里登录 doubao.com，或用下面的「手动粘贴 Cookie」', 'No signed-in Doubao found on this computer: sign in to doubao.com in the Doubao app or a browser first, or paste the cookie by hand below'));
+        const added = [];
+        const skipped = [];
+        const seen = new Set();
+        for (const login of logins) {
+            let cookie;
+            try {
+                cookie = await readDoubaoCookie(login);
+            }
+            catch (error) {
+                skipped.push({ label: login.label, reason: error instanceof CookieAccessDenied ? L('没有允许读取（钥匙串弹窗里点了拒绝）', 'access was not allowed in the keychain prompt') : String(error.message ?? error) });
+                continue;
+            }
+            const uid = cookieValue(cookie, 'uid_tt') ?? cookie;
+            if (seen.has(uid))
+                continue;
+            seen.add(uid);
+            const existing = (await loadDoubaos(this.ctx)).find((d) => cookieValue(d.cookie, 'uid_tt') === uid);
+            const seed = existing?.seed ?? randomBytes(16).toString('hex');
+            try {
+                const st = await doubaoStatus(cookie, seed);
+                if (st.checkedIn === null) {
+                    skipped.push({ label: login.label, reason: L('登录的是飞书企业账号，没有每日额度（只有个人账号能领）', 'signed in with a Feishu enterprise account, which gets no daily credits (personal accounts only)') });
+                    continue;
+                }
+            }
+            catch (error) {
+                skipped.push({ label: login.label, reason: error instanceof DoubaoAuthError ? L('登录已过期：在那里重新登录豆包', 'the sign-in expired: sign in to Doubao there again') : String(error.message ?? error) });
+                continue;
+            }
+            await addDoubao(this.ctx, { cookie, seed, from: login.label, ...(existing?.name ? {} : { name: login.label }) });
+            added.push(login.label);
+        }
+        return { added, skipped };
+    }
     /** 加一个 WorkBuddy 签到账号：打开链接授权（同来源登录一样），存成单独一份，只用来签到 */
     async startWorkbuddyCheckinLogin() {
         const all = await loadAll(this.ctx);
@@ -1219,6 +1273,18 @@ export class Daemon {
             }
             if (method === 'POST' && path === '/checkin/workbuddy')
                 return ok({ login: await this.startWorkbuddyCheckinLogin() });
+            if (method === 'POST' && path === '/checkin/export')
+                return ok(await exportCheckin(this.ctx));
+            if (method === 'POST' && path === '/checkin/import') {
+                const n = await importCheckin(this.ctx, String(b.text ?? ''), String(b.code ?? ''));
+                return ok({ imported: n, ...(await this.checkinNow(true)) });
+            }
+            if (method === 'POST' && path === '/checkin/doubao/scan') {
+                const found = await this.scanDoubao();
+                if (found.added.length)
+                    await this.checkinNow(false).catch(() => null);
+                return ok({ ...found, status: await this.checkinStatus() });
+            }
             if (method === 'POST' && path === '/checkin/doubao') {
                 await this.addDoubaoCookie(String(b.cookie ?? ''), typeof b.name === 'string' ? b.name : undefined);
                 return ok(await this.checkinNow(true));

package/dist/daemon/usage.js

@@ -13,7 +13,7 @@ import { join } from 'node:path';
 import { beijingTimeToIso } from '../bridge/workbuddy/upstream.js';
 const TIMEOUT_MS = 15_000;
 /** 这几家暂不支持（见设计 §14.6） */
-export const USAGE_UNSUPPORTED = new Set(['antigravity', 'devin', 'meta', 'opencode', 'ollama', 'lmstudio', 'gemini', 'groq', 'openrouter', 'siliconflow', 'deepseek', 'custom']);
+export const USAGE_UNSUPPORTED = new Set(['antigravity', 'devin', 'meta', 'opencode', 'ollama', 'lmstudio', 'gemini', 'groq', 'openrouter', 'siliconflow', 'zhipu', 'spark', 'qianfan', 'ark', 'minimax', 'modelarts', 'deepseek', 'custom']);
 async function getJson(url, headers) {
     const res = await fetch(url, { headers: { Accept: 'application/json', ...headers }, signal: AbortSignal.timeout(TIMEOUT_MS) });
     const text = await res.text();

package/dist/engine/compat.js

@@ -71,7 +71,7 @@ export async function loadCompatUpstreams(ctx) {
             });
         }
     }
-    // 自带 API key 的来源：有 key、有模型、没被关掉就接进来（走出站代理，不 direct）
+    // 自带 API key 的来源：有 key、有模型、没被关掉就接进来（海外的走出站代理，国内平台直连）
     const keyCat = await loadKeyCatalog(ctx.paths.home);
     for (const [id, s] of Object.entries(secrets.apikeys ?? {})) {
         const p = keyProvider(id);
@@ -83,6 +83,8 @@ export async function loadCompatUpstreams(ctx) {
             label: p.label,
             baseUrl: s.base ?? p.base,
             apiKey: s.key,
+            // 国内平台直连，不绕出站代理
+            ...(p.direct ? { direct: true } : {}),
             models: models.map((m) => ({ name: m.id, alias: `${id}/${m.id}`, displayName: `${p.label} · ${m.id}`, dshName: m.free ? `${m.id} · Free` : m.id, ...(m.free ? { rate: 0 } : {}), group: id, groupLabel: p.label })),
         });
     }

package/dist/integrations/apikeys.js

@@ -13,6 +13,13 @@ export const KEY_PROVIDERS = [
     { id: 'groq', label: 'Groq', base: 'https://api.groq.com/openai/v1', keyUrl: 'https://console.groq.com/keys' },
     { id: 'openrouter', label: 'OpenRouter', base: 'https://openrouter.ai/api/v1', keyUrl: 'https://openrouter.ai/keys' },
     { id: 'siliconflow', label: '硅基流动 SiliconFlow', base: 'https://api.siliconflow.cn/v1', keyUrl: 'https://cloud.siliconflow.cn/account/ak', listQuery: 'type=text&sub_type=chat' },
+    // 国内大厂的官方 API（2026-10-29 加）：智谱、讯飞星火有长期免费的模型
+    { id: 'zhipu', label: '智谱 GLM', base: 'https://open.bigmodel.cn/api/paas/v4', keyUrl: 'https://open.bigmodel.cn/usercenter/apikeys', fallbackModels: ['glm-4.7-flash', 'glm-4.6', 'glm-4.5-air'], freeRe: /flash/i, direct: true },
+    { id: 'spark', label: '讯飞星火', base: 'https://spark-api-open.xf-yun.com/v1', keyUrl: 'https://console.xfyun.cn/services/cbm', fallbackModels: ['lite', 'generalv3', 'pro-128k', 'generalv3.5', 'max-32k', '4.0Ultra'], freeRe: /^lite$/i, direct: true },
+    { id: 'qianfan', label: '百度千帆', base: 'https://qianfan.baidubce.com/v2', keyUrl: 'https://console.bce.baidu.com/iam/#/iam/apikey/list', fallbackModels: ['ernie-speed-128k', 'ernie-lite-8k', 'ernie-4.5-turbo-128k', 'deepseek-v3'], freeRe: /^ernie-(speed|lite)/i, direct: true },
+    { id: 'ark', label: '火山方舟（豆包大模型）', base: 'https://ark.cn-beijing.volces.com/api/v3', keyUrl: 'https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey', fallbackModels: ['doubao-seed-1-6-flash-250615', 'doubao-seed-1-6-250615', 'deepseek-v3-1-250821'], direct: true },
+    { id: 'minimax', label: 'MiniMax 开放平台', base: 'https://api.minimaxi.com/v1', keyUrl: 'https://platform.minimaxi.com/user-center/basic-information/interface-key', fallbackModels: ['MiniMax-M2', 'MiniMax-M1', 'MiniMax-Text-01'], direct: true },
+    { id: 'modelarts', label: '华为云 ModelArts', base: 'https://api.modelarts-maas.com/v1', keyUrl: 'https://console.huaweicloud.com/modelarts/?region=cn-southwest-2#/model-studio/authmanage', fallbackModels: ['DeepSeek-V3', 'DeepSeek-R1', 'qwen3-235b-a22b'], direct: true },
     { id: 'deepseek', label: 'DeepSeek 官方', base: 'https://api.deepseek.com/v1', keyUrl: 'https://platform.deepseek.com/api_keys' },
     { id: 'custom', label: '其他 OpenAI 兼容服务', base: '', keyUrl: '' },
 ];
@@ -37,22 +44,60 @@ export function parseModelList(providerId, body) {
         if (!id)
             continue;
         const pricing = m.pricing;
-        const free = id.endsWith(':free') || (pricing ? Number(pricing.prompt) === 0 && Number(pricing.completion) === 0 : false);
+        const free = id.endsWith(':free') || (pricing ? Number(pricing.prompt) === 0 && Number(pricing.completion) === 0 : false) || Boolean(keyProvider(providerId)?.freeRe?.test(id));
         out.push({ id, ...(free ? { free: true } : {}) });
     }
     // OpenRouter 有几百个模型：付费的照样能用，但先把免费的排前面，挑默认时就先挑它们
     return out.sort((a, b) => Number(Boolean(b.free)) - Number(Boolean(a.free)) || a.id.localeCompare(b.id));
 }
 /** 用这把 key 拉模型列表：拉得到就是可用的 key（不花 token） */
-export async function fetchKeyModels(provider, key, base, proxy) {
-    const url = `${base}/models${provider.listQuery ? `?${provider.listQuery}` : ''}`;
-    const r = await run('curl', ['-s', '-m', '25', '-w', '\n%{http_code}', '-K', '-', ...(proxy ? ['-x', proxy] : []), url], {
+/** 带 key 的一次请求（curl：认代理，key 经 stdin 传、不进进程参数） */
+async function keyRequest(provider, key, url, proxy) {
+    const viaProxy = proxy && !provider.direct;
+    const r = await run('curl', ['-s', '-m', '25', '-w', '\n%{http_code}', '-K', '-', ...(viaProxy ? ['-x', proxy] : provider.direct ? ['--noproxy', '*'] : []), url], {
         input: `header = "Authorization: Bearer ${key.replace(/"/g, '')}"\n`,
         timeoutMs: 40_000,
     });
     const lines = r.stdout.trimEnd().split('\n');
-    const status = Number(lines.pop()) || null;
-    const text = lines.join('\n');
+    return { status: Number(lines.pop()) || null, text: lines.join('\n') };
+}
+/** 不支持列模型的平台：发一次 1 个 token 的对话验证 key，返回内置的常用模型 */
+async function verifyByChat(provider, key, base, proxy) {
+    const models = provider.fallbackModels ?? [];
+    const probe = models[0];
+    // curl 的 --data-binary @- 和 -K - 都读 stdin，这里把请求体写进临时文件
+    const { writeFile, rm, mkdtemp } = await import('node:fs/promises');
+    const { tmpdir } = await import('node:os');
+    const dir = await mkdtemp(join(tmpdir(), 'dsh-model-key-'));
+    const file = join(dir, 'body.json');
+    await writeFile(file, JSON.stringify({ model: probe, messages: [{ role: 'user', content: 'ok' }], max_tokens: 1, stream: false }), { mode: 0o600 });
+    try {
+        const viaProxy = proxy && !provider.direct;
+        const r = await run('curl', ['-s', '-m', '40', '-w', '\n%{http_code}', '-K', '-', ...(viaProxy ? ['-x', proxy] : provider.direct ? ['--noproxy', '*'] : []), '-X', 'POST', '--data-binary', `@${file}`, `${base}/chat/completions`], {
+            input: `header = "Authorization: Bearer ${key.replace(/"/g, '')}"\nheader = "Content-Type: application/json"\n`,
+            timeoutMs: 60_000,
+        });
+        const lines = r.stdout.trimEnd().split('\n');
+        const status = Number(lines.pop()) || null;
+        const text = lines.join('\n');
+        if (status === 401 || status === 403 || /invalid.*(api.?key|token)|apikey not found|authenticat|鉴权|令牌/i.test(status === 200 ? '' : text)) {
+            throw new DshModelError('key_rejected', L(`${provider.label} 不认这把 key（HTTP ${status ?? '-'}）`, `${provider.label} rejected the key (HTTP ${status ?? '-'})`), L(`到 ${provider.keyUrl} 重新创建一把`, `Create a new one at ${provider.keyUrl}`));
+        }
+        // 200 = 能用；429 = key 对、只是限流；其余（模型没开通等）key 也是对的，照常保存
+        if (!status)
+            throw new DshModelError('key_check_failed', L(`连不上 ${base}`, `Cannot reach ${base}`));
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+    return parseModelList(provider.id, { data: models.map((id) => ({ id })) });
+}
+export async function fetchKeyModels(provider, key, base, proxy) {
+    const url = `${base}/models${provider.listQuery ? `?${provider.listQuery}` : ''}`;
+    const { status, text } = await keyRequest(provider, key, url, proxy);
+    // 有内置列表的平台：列模型不成功（不支持，或这个接口要额外权限）就改用一次短对话验证 key，由它来判断 key 对不对
+    if (provider.fallbackModels?.length && status !== 200)
+        return verifyByChat(provider, key, base, proxy);
     if (status === 401 || status === 403)
         throw new DshModelError('key_rejected', L(`${provider.label} 不认这把 key（HTTP ${status}）`, `${provider.label} rejected the key (HTTP ${status})`), provider.keyUrl ? L(`到 ${provider.keyUrl} 重新创建一把`, `Create a new one at ${provider.keyUrl}`) : undefined);
     if (status !== 200) {
@@ -63,8 +108,12 @@ export async function fetchKeyModels(provider, key, base, proxy) {
         models = parseModelList(provider.id, JSON.parse(text));
     }
     catch {
+        if (provider.fallbackModels?.length)
+            return verifyByChat(provider, key, base, proxy);
         throw new DshModelError('key_check_failed', L(`${provider.label} 的模型列表看不懂`, `Could not read the ${provider.label} model list`));
     }
+    if (!models.length && provider.fallbackModels?.length)
+        return verifyByChat(provider, key, base, proxy);
     if (!models.length)
         throw new DshModelError('key_no_models', L(`${provider.label} 没有返回任何模型`, `${provider.label} returned no models`));
     return models;

package/dist/sources.js

@@ -20,6 +20,13 @@ export const SOURCES = [
     { id: 'groq', label: 'Groq', kind: 'apikey', login: 'key', subscribeUrl: 'https://console.groq.com/keys', pricing: { tier: 'limited', zh: '免费 key，每个模型每分钟 / 每天有上限', en: 'Free key with per-model per-minute / per-day limits' } },
     { id: 'openrouter', label: 'OpenRouter', kind: 'apikey', login: 'key', subscribeUrl: 'https://openrouter.ai/keys', pricing: { tier: 'limited', zh: '名字带 :free 的模型免费（每天约 50 次，充值 10 美元后约 1000 次）；其余按量付费', en: ':free models are free (about 50/day, about 1,000/day after a $10 top-up); others pay as you go' } },
     { id: 'siliconflow', label: '硅基流动 SiliconFlow', kind: 'apikey', login: 'key', subscribeUrl: 'https://cloud.siliconflow.cn/account/ak', pricing: { tier: 'limited', zh: '实名认证后部分小模型免费（限速）；其余按量付费', en: 'Some small models are free after identity verification (rate limited); others pay as you go' } },
+    // 国内大厂官方 API（2026-10-29 加）：免费档按各家公开说明，以官网为准
+    { id: 'zhipu', label: '智谱 GLM', kind: 'apikey', login: 'key', subscribeUrl: 'https://open.bigmodel.cn/usercenter/apikeys', pricing: { tier: 'limited', zh: 'Flash 系列（如 GLM-4.7-Flash）免费；其余按量付费。国内直连', en: 'The Flash models (e.g. GLM-4.7-Flash) are free; others pay as you go. Reachable from China' } },
+    { id: 'spark', label: '讯飞星火', kind: 'apikey', login: 'key', subscribeUrl: 'https://console.xfyun.cn/services/cbm', pricing: { tier: 'limited', zh: 'Spark Lite 免费不限量，但每秒只能 2 次；key 填控制台里的 APIPassword。国内直连', en: 'Spark Lite is free with no token cap but only 2 requests per second; use the APIPassword from the console. Reachable from China' } },
+    { id: 'qianfan', label: '百度千帆', kind: 'apikey', login: 'key', subscribeUrl: 'https://console.bce.baidu.com/iam/#/iam/apikey/list', pricing: { tier: 'limited', zh: 'ERNIE Speed / Lite 长期免费（限速）；其余按量付费。国内直连', en: 'ERNIE Speed / Lite are free for now (rate limited); others pay as you go. Reachable from China' } },
+    { id: 'ark', label: '火山方舟（豆包大模型）', kind: 'apikey', login: 'key', subscribeUrl: 'https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey', pricing: { tier: 'paid', zh: '按量付费，新用户有限时免费额度；模型要先在控制台开通。国内直连', en: 'Pay as you go with a time-limited free quota for new users; enable models in the console first. Reachable from China' } },
+    { id: 'minimax', label: 'MiniMax 开放平台', kind: 'apikey', login: 'key', subscribeUrl: 'https://platform.minimaxi.com/user-center/basic-information/interface-key', pricing: { tier: 'paid', zh: '按量付费或 Coding Plan 套餐。国内直连', en: 'Pay as you go or a Coding Plan. Reachable from China' } },
+    { id: 'modelarts', label: '华为云 ModelArts', kind: 'apikey', login: 'key', subscribeUrl: 'https://console.huaweicloud.com/modelarts/?region=cn-southwest-2#/model-studio/authmanage', pricing: { tier: 'paid', zh: '按量付费，新用户有免费额度；模型要先在 ModelArts Studio 里开通。国内直连', en: 'Pay as you go with a free quota for new users; enable models in ModelArts Studio first. Reachable from China' } },
     { id: 'deepseek', label: 'DeepSeek 官方', kind: 'apikey', login: 'key', subscribeUrl: 'https://platform.deepseek.com/api_keys', pricing: { tier: 'paid', zh: '按量付费（价格低）', en: 'Pay as you go (low prices)' } },
     { id: 'custom', label: '其他 OpenAI 兼容服务', kind: 'apikey', login: 'key', pricing: { tier: 'paid', zh: '填地址和 key，接入任意 OpenAI 兼容服务', en: 'Enter a URL and a key for any OpenAI-compatible service' } },
     { id: 'opencode', label: 'OpenCode Zen', kind: 'opencode', login: 'key', subscribeUrl: 'https://opencode.ai/zen', pricing: { tier: 'paid', zh: '要先充值拿 key 按量计费；它的免费模型只能在 OpenCode 软件里用', en: 'Top up for a pay-as-you-go key; its free models only work inside the OpenCode app' } },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Daily check-in credits claimed for you (Trae, Qoder, WorkBuddy China), one OpenAI-compatible address that relays every model, and free or subscription model sources (SiliconFlow, Gemini, Codex, Kimi, Ollama…). For DeepSeek Harness (dsh) and any OpenAI-compatible tool. 每天自动签到领积分 · 一个地址中转所有模型 · 免费和订阅模型随你接。",
   "keywords": [
     "siliconflow",

package/plugin/client.js

@@ -1011,20 +1011,49 @@ window.__ModuleLoader__.load({
         msg ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null)
     }
 
-    /** 添加豆包签到：从浏览器复制一次登录 Cookie（豆包没有令牌，也不读豆包客户端的文件） */
-    function DoubaoDialog({ onDone, onClose, another }) {
+    /** 从本机读豆包登录的结果说成一句话 */
+    const scanText = (r) => [
+      r.added.length ? L(`已添加：${r.added.join('、')}`, `Added: ${r.added.join(', ')}`) : '',
+      ...r.skipped.map((x) => `${x.label}：${x.reason}`),
+    ].filter(Boolean).join('；')
+
+    /** 添加豆包签到：优先从本机已登录的豆包电脑版 / 浏览器自动读；读不了再手动粘贴 Cookie */
+    function DoubaoDialog({ onDone, onClose, another, found, localRead }) {
       const [cookie, setCookie] = useState('')
       const [name, setName] = useState('')
       const [busy, setBusy] = useState(false)
       const [msg, setMsg] = useState('')
+      const [manual, setManual] = useState(false)
+      const scan = async () => {
+        setBusy(true)
+        setMsg(localRead === 'mac' ? L('正在读取…macOS 会弹窗问是否允许读取钥匙串，请点「允许」（点「始终允许」以后就不再问）', 'Reading… macOS will ask to allow keychain access: click Allow (Always Allow skips the question next time)') : L('正在读取…', 'Reading…'))
+        try {
+          const r = await api('POST', '/checkin/doubao/scan')
+          if (r.added.length) { onDone(r.status, scanText(r)); return }
+          setMsg(scanText(r) || L('没读到能用的豆包登录', 'No usable Doubao sign-in found'))
+          setManual(true)
+        } catch (e) { setMsg(e.message); setManual(true) }
+        setBusy(false)
+      }
       const save = async () => {
         setBusy(true)
         setMsg(L('正在用这份 Cookie 查签到任务并签到…', 'Checking this cookie and checking in…'))
         try { await api('POST', '/checkin/doubao', { cookie: cookie.trim(), ...(name.trim() ? { name: name.trim() } : {}) }); onDone() } catch (e) { setMsg(e.message); setBusy(false) }
       }
       const step = (n, text) => h('div', { style: { ...S.meta, lineHeight: 1.7 } }, `${n}. `, text)
+      const canScan = Boolean(localRead)
       return h(Modal, { title: another ? L('再加一个豆包账号', 'Add another Doubao account') : L('添加豆包签到（实验）', 'Add Doubao check-in (experimental)'), onClose },
-        h('p', { style: S.note }, L('豆包「天天领额度」每天送体验额度，只有个人账号能领（飞书企业账号不行）。豆包没有令牌，要从浏览器复制一次登录 Cookie：', 'Doubao gives daily credits to personal accounts (not Feishu enterprise accounts). Doubao has no token, so copy its sign-in cookie from the browser once:')),
+        h('p', { style: S.note }, L('豆包「天天领额度」每天送体验额度，只有个人账号能领（飞书企业账号不行）。', 'Doubao gives daily credits to personal accounts (not Feishu enterprise accounts).')),
+        canScan ? h('div', { style: { ...S.card, padding: '10px 12px', marginBottom: 10 } },
+          h('div', { style: { ...S.meta, marginBottom: 6 } }, found && found.length
+            ? L(`这台电脑上 ${found.join('、')} 登录着豆包，直接读它的登录就行：`, `Doubao is signed in here (${found.join(', ')}); just read that sign-in:`)
+            : L('在豆包电脑版、Chrome、Edge 或 Brave 里登录过 doubao.com 的话，直接读它的登录：', 'If you are signed in to doubao.com in the Doubao app, Chrome, Edge or Brave, read that sign-in:')),
+          h('button', { type: 'button', style: S.btnPrimary, disabled: busy, onClick: () => void scan() }, busy ? L('读取中…', 'Reading…') : L('从本机自动读取', 'Read from this computer')),
+          h('div', { style: { ...S.meta, marginTop: 6, color: C.faint } }, L('只读 doubao.com 的登录，保存在本机；豆包里退出登录或过期后，再点一次就会换成新的。', 'Only the doubao.com sign-in is read, and it stays on this machine; after it expires, click again to replace it.'))) : null,
+        canScan && !manual ? h('button', { type: 'button', style: { ...S.btn, padding: '2px 8px', fontSize: 12 }, onClick: () => setManual(true) }, L('▸ 手动粘贴 Cookie', '▸ Paste the cookie by hand')) : null,
+        msg && !manual ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null,
+        !canScan || manual ? h('div', null,
+        h('p', { style: S.note }, L('手动：从浏览器复制一次登录 Cookie：', 'By hand: copy the sign-in cookie from the browser once:')),
         step(1, h('span', null, L('用电脑浏览器打开 ', 'Open '), h('a', { href: 'https://www.doubao.com/', target: '_blank', rel: 'noopener noreferrer', style: { color: C.accent } }, 'doubao.com ↗'), L(' 并登录', ' in a desktop browser and sign in'))),
         step(2, L('按 F12 打开开发者工具，切到「网络 / Network」，刷新一下页面', 'Press F12, open the Network tab, and reload the page')),
         step(3, L('点列表里任意一条 doubao.com 的请求，在「请求标头 / Request Headers」里找到 Cookie 那一行，右键复制它的值', 'Click any doubao.com request, find Cookie under Request Headers, and copy its value')),
@@ -1034,6 +1063,49 @@ window.__ModuleLoader__.load({
         h('div', { style: S.line },
           h('input', { type: 'password', style: { ...S.input, ...S.grow }, placeholder: L('粘贴 Cookie', 'Paste the cookie'), value: cookie, onChange: (e) => setCookie(e.target.value), 'aria-label': 'Cookie' }),
           h('button', { type: 'button', style: S.btnPrimary, disabled: busy || !cookie.trim(), onClick: () => void save() }, L('保存', 'Save'))),
+        msg ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null) : null)
+    }
+
+    /** 把签到账号复制到另一台机器：导出一段加密文本 + 提取码，到那台的页面里导入 */
+    function TransferDialog({ mode, onDone, onClose }) {
+      const [out, setOut] = useState(null)
+      const [text, setText] = useState('')
+      const [code, setCode] = useState('')
+      const [busy, setBusy] = useState(false)
+      const [msg, setMsg] = useState('')
+      useEffect(() => {
+        if (mode !== 'export') return
+        api('POST', '/checkin/export').then(setOut, (e) => setMsg(e.message))
+      }, [mode])
+      const doImport = async () => {
+        setBusy(true)
+        setMsg(L('正在导入并签到…', 'Importing and checking in…'))
+        try {
+          const r = await api('POST', '/checkin/import', { text: text.trim(), code: code.trim() })
+          onDone(r)
+        } catch (e) { setMsg(e.message); setBusy(false) }
+      }
+      if (mode === 'export') {
+        return h(Modal, { title: L('复制签到账号到另一台机器', 'Copy check-in accounts to another machine'), onClose },
+          h('p', { style: S.note }, L('比如搬到不关机的 VPS 上签，就不会漏。会复制 Qoder 令牌和豆包 Cookie；WorkBuddy 请在那台机器上各自登录（复制过去两边会互相顶掉），Trae 要在装了 Trae 的电脑上签。', 'For example move them to an always-on VPS so no day is missed. Qoder tokens and Doubao cookies are copied; sign in to WorkBuddy on that machine itself (a copied sign-in would knock the other out), and Trae needs a computer with Trae.')),
+          out ? h('div', null,
+            h('div', { style: { ...S.meta, marginBottom: 4 } }, L(`1. 复制这段文本（${out.counts.qoder} 个 Qoder、${out.counts.doubao} 个豆包）：`, `1. Copy this text (${out.counts.qoder} Qoder, ${out.counts.doubao} Doubao):`)),
+            h('div', { style: S.line },
+              h('textarea', { readOnly: true, value: out.text, rows: 3, style: { ...S.input, ...S.mono, ...S.grow, resize: 'none' }, 'aria-label': L('导出的文本', 'Exported text') }),
+              h(CopyButton, { get: out.text })),
+            h('div', { style: { ...S.meta, margin: '10px 0 4px' } }, L('2. 记下提取码（光有文本解不开）：', '2. Note the code (the text alone cannot be opened):')),
+            h('div', { style: S.line }, h('span', { style: { ...S.mono, fontSize: 18, letterSpacing: 2 } }, out.code), h(CopyButton, { get: out.code })),
+            h('div', { style: { ...S.meta, marginTop: 10 } }, L('3. 打开那台机器的「设置 → dsh-model」，签到卡片「详情」→「导入签到账号」，把两样都粘进去。', '3. On the other machine open Settings → dsh-model, check-in card Details → "Import check-in accounts", and paste both.')),
+            h('div', { style: { fontSize: 12, color: C.warn, marginTop: 8 } }, L('这段文本加提取码就等于你的登录，只在自己的两台机器之间用。', 'Text plus code amount to your sign-ins: use them only between your own machines.'))) : null,
+          msg ? h('div', { style: { fontSize: 12, color: C.err, marginTop: 8 } }, msg) : null)
+      }
+      return h(Modal, { title: L('导入签到账号', 'Import check-in accounts'), onClose },
+        h('p', { style: S.note }, L('粘贴另一台机器「复制签到账号」给出的文本和提取码。已有的同一个账号不会重复加。', 'Paste the text and code from "Copy check-in accounts" on the other machine. Accounts already here are not added twice.')),
+        h('textarea', { rows: 3, placeholder: 'dshm-checkin:v1:…', value: text, onChange: (e) => setText(e.target.value), style: { ...S.input, ...S.mono, width: '100%', boxSizing: 'border-box', resize: 'none', marginBottom: 8 }, 'aria-label': L('导出的文本', 'Exported text') }),
+        h('div', { style: S.line },
+          h('input', { style: { ...S.input, ...S.mono, width: 160 }, placeholder: L('提取码', 'Code'), value: code, onChange: (e) => setCode(e.target.value), 'aria-label': L('提取码', 'Code') }),
+          h('span', { style: S.grow }),
+          h('button', { type: 'button', style: S.btnPrimary, disabled: busy || !text.trim() || !code.trim(), onClick: () => void doImport() }, L('导入', 'Import'))),
         msg ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null)
     }
 
@@ -1045,6 +1117,7 @@ window.__ModuleLoader__.load({
       const [qoder, setQoder] = useState(false)
       const [wbLogin, setWbLogin] = useState(null)
       const [doubao, setDoubao] = useState(false)
+      const [transfer, setTransfer] = useState('')
       const [err, setErr] = useState('')
       const refresh = useCallback(() => api('GET', '/checkin').then(setSt, () => {}), [])
       const addWorkbuddy = async () => {
@@ -1073,9 +1146,11 @@ window.__ModuleLoader__.load({
         return h('div', { style: { ...S.section, marginBottom: 16 } },
           h('div', { style: { ...S.meta } }, L('每日签到：登录 WorkBuddy 国内版，或', 'Daily check-in: sign in to WorkBuddy (China), or '),
             h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setQoder(true) }, L('添加 Qoder', 'Add Qoder')),
-            h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setDoubao(true) }, L('添加豆包', 'Add Doubao'))),
+            h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setDoubao(true) }, L('添加豆包', 'Add Doubao')),
+            h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setTransfer('import') }, L('从另一台机器导入', 'Import from another machine'))),
+          transfer ? h(TransferDialog, { mode: transfer, onDone: (r) => { setTransfer(''); setSt(r); setOpen(true) }, onClose: () => setTransfer('') }) : null,
           qoder ? h(QoderDialog, { onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null,
-          doubao ? h(DoubaoDialog, { onDone: () => { setDoubao(false); void refresh() }, onClose: () => setDoubao(false) }) : null)
+          doubao ? h(DoubaoDialog, { localRead: st.localRead, found: ((st.missing || []).find((m) => m.id === 'doubao') || {}).found, onDone: (next) => { setDoubao(false); if (next) setSt(next); else void refresh() }, onClose: () => setDoubao(false) }) : null)
       }
       return h('div', { style: S.section },
         h('div', { style: { ...S.card, padding: '10px 14px' } },
@@ -1089,6 +1164,12 @@ window.__ModuleLoader__.load({
             h('button', { type: 'button', style: S.btn, onClick: () => setOpen(!open) }, open ? L('收起', 'Hide') : L('详情', 'Details')),
             h('label', { style: { ...S.meta, display: 'flex', alignItems: 'center', gap: 4, cursor: 'pointer', whiteSpace: 'nowrap' } },
               h('input', { type: 'checkbox', checked: st.auto, onChange: (e) => void toggleAuto(e.target.checked) }), L('自动签到', 'Auto'))),
+          // 支持、但这台还没设置的：一眼看出还能签哪些，旁边就能加
+          (st.missing || []).length ? h('div', { style: { ...S.line, flexWrap: 'wrap', gap: 6, marginTop: 4, fontSize: 12, color: C.sub } },
+            h('span', null, L('这台还能签：', 'Also available here:')),
+            (st.missing || []).map((m) => h('span', { key: m.id, style: { display: 'inline-flex', alignItems: 'center', gap: 4 } },
+              m.found && m.found.length ? L(`${m.label}（本机 ${m.found.join('、')} 已登录）`, `${m.label} (signed in: ${m.found.join(', ')})`) : m.label,
+              m.action ? h('button', { type: 'button', style: { ...S.btn, padding: '1px 6px', fontSize: 11 }, onClick: () => { if (m.action === 'workbuddy') void addWorkbuddy(); else if (m.action === 'qoder') setQoder(true); else setDoubao(true) } }, L('+ 添加', '+ Add')) : h('span', { style: { color: C.faint } }, `（${m.reason}）`)))) : null,
           open ? h('div', { style: { marginTop: 8 } },
             st.results.map((r) => h('div', { key: r.id, style: { fontSize: 12, lineHeight: 1.8, color: r.state === 'failed' ? C.err : C.text } },
               `${r.label}：${CHECKIN_TEXT(r)}`, r.advice ? h('span', { style: { color: C.sub, marginLeft: 6 } }, r.advice) : null)),
@@ -1102,13 +1183,17 @@ window.__ModuleLoader__.load({
               h('div', { style: { ...S.line, marginTop: 4, flexWrap: 'wrap' } },
                 h('button', { type: 'button', style: S.btn, onClick: () => void addWorkbuddy() }, L('+ 添加 WorkBuddy 账号', '+ Add a WorkBuddy account')),
                 h('button', { type: 'button', style: S.btn, onClick: () => setQoder(true) }, st.qoder.configured ? L('+ 再加一个 Qoder 账号', '+ Add another Qoder account') : L('+ 添加 Qoder', '+ Add Qoder')),
-                h('button', { type: 'button', style: S.btn, onClick: () => setDoubao(true) }, (st.accounts && st.accounts.doubao && st.accounts.doubao.length) ? L('+ 再加一个豆包账号', '+ Add another Doubao account') : L('+ 添加豆包', '+ Add Doubao')))),
+                h('button', { type: 'button', style: S.btn, onClick: () => setDoubao(true) }, (st.accounts && st.accounts.doubao && st.accounts.doubao.length) ? L('+ 再加一个豆包账号', '+ Add another Doubao account') : L('+ 添加豆包', '+ Add Doubao'))),
+              h('div', { style: { ...S.line, marginTop: 4, flexWrap: 'wrap' } },
+                h('button', { type: 'button', style: S.btn, onClick: () => setTransfer('export') }, L('复制签到账号到另一台机器', 'Copy check-in accounts to another machine')),
+                h('button', { type: 'button', style: S.btn, onClick: () => setTransfer('import') }, L('导入签到账号', 'Import check-in accounts')))),
             // Trae 读本机 Trae 的登录：这台没装（比如 VPS）就不会出现，在装了 Trae 的电脑上签就行（每个账号一天一次）
             !st.available.some((a) => a.id === 'trae') ? h('div', { style: { ...S.meta, marginTop: 6 } }, L('Trae：这台电脑上没装 Trae，所以不签。在装了 Trae 的电脑上会自动签（一个账号一天签一次就够）。', 'Trae: not installed on this machine, so it is skipped. A computer with Trae installed checks it in automatically (once a day per account is enough).')) : null) : null,
           !open && !st.qoder.configured ? h('div', { style: { ...S.meta, marginTop: 4 } }, h('button', { type: 'button', style: { ...S.btn, padding: '2px 8px' }, onClick: () => setQoder(true) }, L('+ 添加 Qoder', '+ Add Qoder'))) : null,
           err ? h('div', { style: { fontSize: 12, color: C.err, marginTop: 6 } }, err) : null),
         qoder ? h(QoderDialog, { another: st.qoder.configured, onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null,
-        doubao ? h(DoubaoDialog, { another: Boolean(st.accounts && st.accounts.doubao && st.accounts.doubao.length), onDone: () => { setDoubao(false); setOpen(true); void refresh() }, onClose: () => setDoubao(false) }) : null,
+        transfer ? h(TransferDialog, { mode: transfer, onDone: (r) => { setTransfer(''); setSt(r); setOpen(true) }, onClose: () => setTransfer('') }) : null,
+        doubao ? h(DoubaoDialog, { another: Boolean(st.accounts && st.accounts.doubao && st.accounts.doubao.length), localRead: st.localRead, found: ((st.missing || []).find((m) => m.id === 'doubao') || {}).found, onDone: (next, note) => { setDoubao(false); setOpen(true); if (next) setSt(next); else void refresh(); if (note) setErr(note) }, onClose: () => setDoubao(false) }) : null,
         wbLogin ? h(LoginDialog, { source: { id: 'workbuddy-checkin', label: L('WorkBuddy 签到账号', 'WorkBuddy check-in account'), login: 'link' }, session: wbLogin, onDone: () => { setWbLogin(null); setOpen(true); setTimeout(() => void refresh(), 3000) }, onClose: () => { setWbLogin(null); void refresh() } }) : null)
     }
 

package/plugin/index.js

@@ -63,7 +63,7 @@ const ALLOWED = [
   ['GET', /^\/self$/],
   ['GET', /^\/failures$/],
   ['GET', /^\/checkin$/],
-  ['POST', /^\/checkin(\/auto|\/qoder|\/workbuddy|\/doubao)?$/],
+  ['POST', /^\/checkin(\/auto|\/qoder|\/workbuddy|\/doubao|\/doubao\/scan|\/export|\/import)?$/],
   ['DELETE', /^\/checkin\/qoder(\/[A-Za-z0-9_-]{1,40})?$/],
   ['DELETE', /^\/checkin\/workbuddy\/[A-Za-z0-9_-]{1,80}$/],
   ['DELETE', /^\/checkin\/doubao\/[A-Za-z0-9_-]{1,40}$/],