dsh-model 0.26.0 → 0.27.1

package/README.en.md

@@ -28,7 +28,7 @@ English · [中文](README.md)
 | **Trae** | Detected automatically if Trae is installed and signed in; nothing to do | Check-in credits (200 a day in testing) |
 | **Qoder** | Paste a personal access token once (China or international) | That day's check-in credits |
 | **WorkBuddy (China)** | Sign in once (several accounts are fine) | Check-in credits |
-| **Doubao** (experimental) | Copy the sign-in cookie from the browser once (personal accounts only) | Daily trial credits |
+| **Doubao** (experimental) | On Mac / Windows click "Read from this computer" to use the account signed in to the Doubao app or a browser; or paste the cookie by hand (personal accounts only) | Daily trial credits |
 
 - **Automatic by default**: done at a random 5–55 minutes after midnight Beijing time; failures retry an hour later; if the computer was off, it catches up within a minute of starting.
 - **You can see it**: one line at the top of the settings page, "Checked in today: …", with a one-click "Check in all" for anything missed, plus a one-time notice in the corner of dsh.

package/README.md

@@ -28,7 +28,7 @@
 | **Trae** | 本机装了 Trae 并登录过，自动识别，什么都不用做 | 签到送积分（实测每天 200） |
 | **Qoder** | 粘贴一次个人访问令牌（国内版、国际版都行） | 领当天的签到积分 |
 | **WorkBuddy 国内版** | 登录一次（可以加几个账号） | 签到送积分 |
-| **豆包**（实验） | 从浏览器复制一次登录 Cookie（只支持个人账号） | 「天天领额度」送体验额度 |
+| **豆包**（实验） | Mac / Windows 上点「从本机自动读取」，读豆包电脑版或浏览器里已登录的账号；也可以手动粘贴 Cookie（只支持个人账号） | 「天天领额度」送体验额度 |
 
 - **自动签到默认打开**：北京时间零点后随机延后 5–55 分钟签好；失败的一小时后重试；电脑关机错过了，开机一分钟内补签。
 - **结果看得见**：设置页顶部一行「今日已完成签到：…」，没签上的可以「一键签到」；签完在 dsh 右下角提示一次。

package/dist/checkin/accounts.js

@@ -104,6 +104,20 @@ export async function removeQoder(ctx, id) {
     const target = id ?? list[0]?.id;
     await saveQoders(ctx, list.filter((q) => q.id !== target));
 }
+/** Cookie 串里某一项的值 */
+export function cookieValue(cookie, name) {
+    for (const part of cookie.split(/;\s*/)) {
+        const i = part.indexOf('=');
+        if (i > 0 && part.slice(0, i).trim() === name)
+            return part.slice(i + 1);
+    }
+    return undefined;
+}
+/** 同一个豆包账号：uid_tt 一样（Cookie 里别的项每次都会变） */
+const sameDoubaoAccount = (a, b) => {
+    const x = cookieValue(a, 'uid_tt');
+    return a === b || (Boolean(x) && x === cookieValue(b, 'uid_tt'));
+};
 export async function loadDoubaos(ctx) {
     return (await loadSecrets(ctx)).checkin?.doubaos ?? [];
 }
@@ -117,14 +131,17 @@ async function saveDoubaos(ctx, list) {
     secrets.checkin = Object.keys(checkin).length ? checkin : undefined;
     await saveSecrets(ctx, secrets);
 }
-/** 加一个豆包账号；同一个 Cookie 再加 = 改名字。返回 id */
+/** 加一个豆包账号；同一个账号再加 = 换成新的 Cookie（和名字）。返回 id */
 export async function addDoubao(ctx, entry) {
     const list = await loadDoubaos(ctx);
     const name = entry.name?.trim().slice(0, 20);
-    const same = list.find((d) => d.cookie === entry.cookie);
+    const same = list.find((d) => sameDoubaoAccount(d.cookie, entry.cookie));
     if (same) {
+        same.cookie = entry.cookie;
         if (name)
             same.name = name;
+        if (entry.from)
+            same.from = entry.from;
         await saveDoubaos(ctx, list);
         return same.id;
     }
@@ -133,7 +150,7 @@ export async function addDoubao(ctx, entry) {
     while (used.has(String(n)))
         n++;
     const id = String(n);
-    list.push({ id, cookie: entry.cookie, seed: entry.seed ?? randomBytes(16).toString('hex'), ...(name ? { name } : {}), savedAt: new Date().toISOString() });
+    list.push({ id, cookie: entry.cookie, seed: entry.seed ?? randomBytes(16).toString('hex'), ...(name ? { name } : {}), ...(entry.from ? { from: entry.from } : {}), savedAt: new Date().toISOString() });
     await saveDoubaos(ctx, list);
     return id;
 }

package/dist/checkin/browser-cookies.js

@@ -0,0 +1,219 @@
+// checkin/browser-cookies.ts — 从本机已登录的豆包电脑版 / 浏览器里读 doubao.com 的登录 Cookie（设计 §14.21）
+//
+// 用户嫌"F12 → 网络 → 复制 Cookie"太麻烦（2026-10-29）。豆包电脑版（DoubaoWork）和 Chrome、Edge、Brave 都是 Chromium，
+// Cookie 存在 <用户数据>/<配置>/Cookies（新版在 Network/Cookies）这个 SQLite 里，值是加密的：
+//   macOS：v10 + AES-128-CBC，密钥 = PBKDF2(钥匙串里「<应用> Safe Storage」的密码, 'saltysalt', 1003, sha1)。
+//          读钥匙串时 macOS 会弹窗问用户是否允许，用户点允许才读得到。
+//   Windows：v10 + AES-256-GCM，密钥在 Local State 的 os_crypt.encrypted_key 里，用当前用户的 DPAPI 解开。
+//            新版 Chrome 的 v20（应用绑定加密）读不了，跳过。
+//   Linux：不读（VPS 上也没有这些应用）。
+// Cookie 库版本 ≥ 24 时，解开的值前面多 32 字节（host 的 sha256），要去掉。
+// 只读 doubao.com 的 Cookie，只在用户点「从本机找」时读；先只看有没有登录（不碰密钥），有才去解密。
+import { createDecipheriv, pbkdf2Sync } from 'node:crypto';
+import { copyFile, mkdtemp, readdir, readFile, rm, stat } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { run, which } from '../util/exec.js';
+/** 要读的 Cookie 所在域 */
+const HOSTS = ['doubao.com', '.doubao.com', 'www.doubao.com'];
+/** 有这个 Cookie 才算登录了 */
+const SESSION_COOKIE = 'sessionid';
+/** 本机可能有 doubao.com 登录的 Chromium 应用 */
+export function cookieStores(home = homedir(), platform = process.platform, env = process.env) {
+    if (platform === 'darwin') {
+        const s = join(home, 'Library', 'Application Support');
+        return [
+            { label: '豆包电脑版', root: join(s, 'DoubaoWork'), services: ['DoubaoWork Browser Safe Storage', 'DoubaoWork Safe Storage'] },
+            { label: '豆包', root: join(s, 'Doubao'), services: ['Doubao Browser Safe Storage', 'Doubao Safe Storage'] },
+            { label: 'Chrome', root: join(s, 'Google', 'Chrome'), services: ['Chrome Safe Storage'] },
+            { label: 'Edge', root: join(s, 'Microsoft Edge'), services: ['Microsoft Edge Safe Storage'] },
+            { label: 'Brave', root: join(s, 'BraveSoftware', 'Brave-Browser'), services: ['Brave Safe Storage'] },
+        ];
+    }
+    if (platform === 'win32') {
+        const local = env.LOCALAPPDATA || join(home, 'AppData', 'Local');
+        const roaming = env.APPDATA || join(home, 'AppData', 'Roaming');
+        return [
+            { label: '豆包电脑版', root: join(local, 'DoubaoWork', 'User Data'), services: [] },
+            { label: '豆包电脑版', root: join(roaming, 'DoubaoWork'), services: [] },
+            { label: '豆包', root: join(local, 'Doubao', 'User Data'), services: [] },
+            { label: 'Chrome', root: join(local, 'Google', 'Chrome', 'User Data'), services: [] },
+            { label: 'Edge', root: join(local, 'Microsoft', 'Edge', 'User Data'), services: [] },
+            { label: 'Brave', root: join(local, 'BraveSoftware', 'Brave-Browser', 'User Data'), services: [] },
+        ];
+    }
+    return [];
+}
+const exists = async (p) => stat(p).then(() => true, () => false);
+/** 列出 store 里每个配置的 Cookie 库 */
+async function cookieDbs(store) {
+    let names;
+    try {
+        names = await readdir(store.root);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const profile of names.filter((n) => n === 'Default' || /^Profile \d+$/.test(n)).sort()) {
+        for (const rel of [['Network', 'Cookies'], ['Cookies']]) {
+            const file = join(store.root, profile, ...rel);
+            if (await exists(file)) {
+                out.push({ store, profile, file });
+                break;
+            }
+        }
+    }
+    return out;
+}
+/** Chromium 的时间：1601 年起的毫秒（SQL 里已从微秒除下来，微秒超出 JS 安全整数）；0 = 会话 Cookie */
+const chromeTimeToMs = (t) => (t ? t - 11_644_473_600_000 : 0);
+/** 读 Cookie 库：先复制一份再读（应用开着时原文件被锁）。返回 doubao.com 的行和库版本 */
+export async function readCookieDb(file) {
+    const dir = await mkdtemp(join(tmpdir(), 'dshm-ck-'));
+    try {
+        const copy = join(dir, 'Cookies');
+        await copyFile(file, copy);
+        for (const ext of ['-journal', '-wal'])
+            await copyFile(file + ext, copy + ext).catch(() => { });
+        return await querySqlite(copy);
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+}
+const SQL_ROWS = `select host_key, name, value, hex(encrypted_value) as ev, expires_utc / 1000 as expires_utc from cookies where host_key in (${HOSTS.map((h) => `'${h}'`).join(',')})`;
+const SQL_VERSION = `select value from meta where key = 'version'`;
+async function querySqlite(file) {
+    let raw;
+    let version;
+    try {
+        // Node 22.5 起自带 SQLite；更老的 Node 退回系统的 sqlite3 命令
+        const mod = 'node:sqlite'; // 写成变量：@types/node 还没有它的类型
+        const { DatabaseSync } = (await import(mod));
+        const db = new DatabaseSync(file, { readOnly: true });
+        try {
+            raw = db.prepare(SQL_ROWS).all();
+            version = Number(db.prepare(SQL_VERSION).get()?.value) || 0;
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ERR_UNKNOWN_BUILTIN_MODULE' && !/node:sqlite/.test(String(error)))
+            throw error;
+        const bin = await which('sqlite3');
+        if (!bin)
+            throw new Error('读不了浏览器的 Cookie：Node 太旧（要 22.5 以上）且没有 sqlite3 命令');
+        const a = await run(bin, ['-readonly', '-json', file, SQL_ROWS], { timeoutMs: 20_000 });
+        const b = await run(bin, ['-readonly', file, SQL_VERSION], { timeoutMs: 20_000 });
+        if (a.code !== 0)
+            throw new Error(`读 Cookie 库失败：${a.stderr.trim()}`);
+        raw = a.stdout.trim() ? JSON.parse(a.stdout) : [];
+        version = Number(b.stdout.trim()) || 0;
+    }
+    return {
+        rows: raw.map((r) => ({ host_key: r.host_key, name: r.name, value: r.value ?? '', encrypted_value: Buffer.from(r.ev ?? '', 'hex'), expires_utc: Number(r.expires_utc) || 0 })),
+        version,
+    };
+}
+/** 没过期的 Cookie（会话 Cookie 也算） */
+const alive = (r, now) => {
+    const ms = chromeTimeToMs(r.expires_utc);
+    return !ms || ms > now;
+};
+/** 只看哪些地方登录着豆包（不解密、不碰钥匙串，不会弹窗） */
+export async function findDoubaoLogins(home = homedir(), platform = process.platform, now = Date.now()) {
+    const out = [];
+    for (const store of cookieStores(home, platform)) {
+        const dbs = await cookieDbs(store);
+        for (const db of dbs) {
+            const { rows } = await readCookieDb(db.file).catch(() => ({ rows: [] }));
+            if (rows.some((r) => r.name === SESSION_COOKIE && alive(r, now))) {
+                out.push({ label: dbs.length > 1 && db.profile !== 'Default' ? `${store.label}（${db.profile}）` : store.label, db });
+            }
+        }
+    }
+    return out;
+}
+/** macOS：Cookie 密钥 = PBKDF2(钥匙串密码)。读钥匙串会弹窗问用户 */
+async function macKey(services) {
+    let last = '';
+    for (const s of services) {
+        const r = await run('/usr/bin/security', ['find-generic-password', '-w', '-s', s], { timeoutMs: 120_000 });
+        if (r.code === 0 && r.stdout.trim())
+            return pbkdf2Sync(r.stdout.trim(), 'saltysalt', 1003, 16, 'sha1');
+        last = r.stderr.trim();
+        // 用户点了拒绝：不再试别的名字
+        if (/cancel|denied|拒绝|取消/i.test(last) || r.code === 128)
+            throw new CookieAccessDenied();
+    }
+    throw new Error(`钥匙串里没找到它的 Cookie 密钥${last ? `（${last}）` : ''}`);
+}
+/** Windows：Local State 里的密钥，用 DPAPI 解开 */
+async function winKey(root) {
+    const state = JSON.parse(await readFile(join(root, 'Local State'), 'utf8'));
+    const enc = Buffer.from(state.os_crypt?.encrypted_key ?? '', 'base64');
+    if (enc.subarray(0, 5).toString() !== 'DPAPI')
+        throw new Error('Local State 里没有能用的 Cookie 密钥');
+    const script = "Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String($env:DSHM_BLOB); [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'))";
+    const r = await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], { env: { ...process.env, DSHM_BLOB: enc.subarray(5).toString('base64') }, timeoutMs: 30_000 });
+    if (r.code !== 0 || !r.stdout.trim())
+        throw new Error(`解不开 Cookie 密钥：${r.stderr.trim() || `退出码 ${r.code}`}`);
+    return Buffer.from(r.stdout.trim(), 'base64');
+}
+export class CookieAccessDenied extends Error {
+    constructor() {
+        super('没有允许读取钥匙串');
+    }
+}
+/** 解开一个 Cookie 值。读不了（如 v20）返回 null。导出给测试 */
+export function decryptCookie(enc, key, platform, dbVersion) {
+    const tag = enc.subarray(0, 3).toString();
+    if (tag !== 'v10' && tag !== 'v11')
+        return null;
+    let plain;
+    if (platform === 'win32') {
+        const nonce = enc.subarray(3, 15);
+        const body = enc.subarray(15, enc.length - 16);
+        const d = createDecipheriv('aes-256-gcm', key, nonce);
+        d.setAuthTag(enc.subarray(enc.length - 16));
+        plain = Buffer.concat([d.update(body), d.final()]);
+    }
+    else {
+        const d = createDecipheriv('aes-128-cbc', key, Buffer.alloc(16, 0x20));
+        plain = Buffer.concat([d.update(enc.subarray(3)), d.final()]);
+    }
+    return (dbVersion >= 24 ? plain.subarray(32) : plain).toString('utf8');
+}
+/** 读出一处登录的完整 Cookie 串（a=1; b=2）。macOS 会弹钥匙串授权 */
+export async function readDoubaoCookie(login, platform = process.platform, now = Date.now(), testKey) {
+    const { rows, version } = await readCookieDb(login.db.file);
+    const key = testKey ?? (platform === 'darwin' ? await macKey(login.db.store.services) : await winKey(login.db.store.root));
+    // 同名的取更具体的域（www.doubao.com 盖过 .doubao.com）
+    const byName = new Map();
+    let unreadable = 0;
+    for (const r of rows.filter((x) => alive(x, now))) {
+        let value = r.value;
+        if (!value && r.encrypted_value.length) {
+            try {
+                value = decryptCookie(r.encrypted_value, key, platform, version);
+            }
+            catch {
+                value = null;
+            }
+        }
+        if (value === null) {
+            unreadable++;
+            continue;
+        }
+        const prev = byName.get(r.name);
+        if (!prev || r.host_key.length > prev.host.length)
+            byName.set(r.name, { host: r.host_key, value });
+    }
+    if (!byName.get(SESSION_COOKIE)?.value) {
+        throw new Error(unreadable ? `${login.label} 用的是新的加密方式，读不了：请用「手动粘贴 Cookie」` : `${login.label} 里的豆包登录不完整`);
+    }
+    return [...byName].map(([n, v]) => `${n}=${v.value}`).join('; ');
+}

package/dist/checkin/doubao.js

@@ -95,7 +95,7 @@ export async function doubaoStatus(cookie, seed) {
 export async function doubaoCheckin(cookie, seed) {
     const st = await doubaoStatus(cookie, seed);
     if (st.checkedIn === null)
-        throw new Error('这个豆包账号没有签到任务：只有个人账号能领，飞书企业账号不行（也可能活动暂时下线）');
+        throw new Error('这个豆包账号的任务面板里没有「每日签到」（飞书企业账号、或豆包没给这个账号开签到时都是这样）');
     if (st.checkedIn)
         return { state: 'already' };
     const body = await post(apiUrl(CHECKIN_URL, seed), cookie, { scene: CAMPAIGN_GROUP });

package/dist/checkin/index.js

@@ -24,7 +24,7 @@ export function checkinAdvice(itemId, message) {
     const id = itemId.split(':')[0];
     if (/无效|过期|401|403|unauthor|expired|not able to authenticate/i.test(message)) {
         if (id === 'doubao')
-            return L('豆包登录过期：在浏览器里重新登录 doubao.com，到签到卡片里删掉它，再复制 Cookie 添加一次', 'Doubao sign-in expired: sign in at doubao.com again, remove it in the check-in card and add the new cookie');
+            return L('豆包登录过期：在豆包电脑版或浏览器里重新登录，再点签到卡片里的「+ 添加豆包 → 从本机自动读取」（会换成新的登录）', 'Doubao sign-in expired: sign in again in the Doubao app or a browser, then use "+ Add Doubao → Read from this computer" in the check-in card (it replaces the old sign-in)');
         if (id === 'trae')
             return L('Trae 登录过期：打开 Trae 重新登录一次', 'Trae sign-in expired: open Trae and sign in again');
         if (id === 'qoder')

package/dist/daemon/core.js

@@ -20,8 +20,9 @@ import { autoDue, beijingNow, checkinAdvice, ensureJitter, loadCheckin, runCheck
 import { QODER_REGIONS, exchangePat, qoderCheckin } from '../checkin/qoder.js';
 import { findTraeCredentials, traeCheckin } from '../checkin/trae.js';
 import { DoubaoAuthError, doubaoCheckin, doubaoStatus, normalizeCookie } from '../checkin/doubao.js';
+import { CookieAccessDenied, findDoubaoLogins, readDoubaoCookie } from '../checkin/browser-cookies.js';
 import { exportCheckin, importCheckin } from '../checkin/transfer.js';
-import { accountTag, addDoubao, checkinKind, addQoder, listWorkbuddyAccounts, loadDoubaos, loadQoders, removeDoubao, removeQoder, removeWorkbuddyAccount, workbuddyAccountStore, workbuddyAccountsDir } from '../checkin/accounts.js';
+import { accountTag, addDoubao, checkinKind, cookieValue, addQoder, listWorkbuddyAccounts, loadDoubaos, loadQoders, removeDoubao, removeQoder, removeWorkbuddyAccount, workbuddyAccountStore, workbuddyAccountsDir } from '../checkin/accounts.js';
 import { CN_VARIANT } from '../bridge/workbuddy/variants.js';
 import { PKG_ROOT, pkgVersion } from '../util/pkg.js';
 import { randomBytes } from 'node:crypto';
@@ -793,11 +794,14 @@ export class Daemon {
                 qoder: qoders.map((q, i) => ({ id: q.id, label: checkers.find((c) => c.id === (i === 0 ? 'qoder' : `qoder:${q.id}`))?.label ?? q.id, region: q.region })),
                 doubao: (await loadDoubaos(this.ctx)).map((d, i) => ({ id: d.id, label: checkers.find((c) => c.id === (i === 0 ? 'doubao' : `doubao:${d.id}`))?.label ?? d.id })),
             },
+            // 能不能从本机的豆包电脑版 / 浏览器读登录（看守护进程所在的机器，不是看浏览器）
+            localRead: process.platform === 'darwin' ? 'mac' : process.platform === 'win32' ? 'win' : null,
             // 支持、但这台还没设置的（签到卡片里列出来，旁边就是「添加」）
             missing: [
                 ...(checkers.some((c) => checkinKind(c.id) === 'workbuddy') ? [] : [{ id: 'workbuddy', label: L('WorkBuddy 国内版', 'WorkBuddy (China)'), action: 'workbuddy' }]),
                 ...(checkers.some((c) => checkinKind(c.id) === 'qoder') ? [] : [{ id: 'qoder', label: 'Qoder', action: 'qoder' }]),
-                ...(checkers.some((c) => checkinKind(c.id) === 'doubao') ? [] : [{ id: 'doubao', label: L('豆包', 'Doubao'), action: 'doubao' }]),
+                // 本机豆包电脑版 / 浏览器登录着豆包：说出来，点「添加」就能自动读（只看有没有登录，不解密）
+                ...(checkers.some((c) => checkinKind(c.id) === 'doubao') ? [] : [{ id: 'doubao', label: L('豆包', 'Doubao'), action: 'doubao', found: (await findDoubaoLogins().catch(() => [])).map((f) => f.label) }]),
                 ...(checkers.some((c) => checkinKind(c.id) === 'trae') ? [] : [{ id: 'trae', label: 'Trae', reason: L('这台没装 Trae：要在装了 Trae 的电脑上签', 'Trae is not installed here: it is checked in on a computer with Trae') }]),
             ],
         };
@@ -850,6 +854,48 @@ export class Daemon {
             throw new DshModelError('doubao_no_task', L('这个豆包账号没有签到任务：只有个人账号能领每日额度，飞书企业账号不行。请换成个人账号登录后再复制 Cookie', 'This Doubao account has no check-in task: only personal accounts get the daily credits, not Feishu enterprise accounts. Sign in with a personal account and copy the cookie again'));
         await addDoubao(this.ctx, { cookie, seed, ...(name ? { name } : {}) });
     }
+    /**
+     * 从本机找豆包登录（豆包电脑版、Chrome、Edge、Brave），读出 Cookie 加成签到账号。
+     * macOS 会弹窗问用户是否允许读钥匙串；同一个账号在几处都登录着只加一次，已加过的换成新的 Cookie。
+     */
+    async scanDoubao() {
+        const logins = await findDoubaoLogins();
+        if (!logins.length)
+            throw new DshModelError('doubao_not_found', L('这台电脑上没找到登录着的豆包：先在豆包电脑版或浏览器里登录 doubao.com，或用下面的「手动粘贴 Cookie」', 'No signed-in Doubao found on this computer: sign in to doubao.com in the Doubao app or a browser first, or paste the cookie by hand below'));
+        const added = [];
+        const skipped = [];
+        const seen = new Set();
+        for (const login of logins) {
+            let cookie;
+            try {
+                cookie = await readDoubaoCookie(login);
+            }
+            catch (error) {
+                skipped.push({ label: login.label, reason: error instanceof CookieAccessDenied ? L('没有允许读取（钥匙串弹窗里点了拒绝）', 'access was not allowed in the keychain prompt') : String(error.message ?? error) });
+                continue;
+            }
+            const uid = cookieValue(cookie, 'uid_tt') ?? cookie;
+            if (seen.has(uid))
+                continue;
+            seen.add(uid);
+            const existing = (await loadDoubaos(this.ctx)).find((d) => cookieValue(d.cookie, 'uid_tt') === uid);
+            const seed = existing?.seed ?? randomBytes(16).toString('hex');
+            try {
+                const st = await doubaoStatus(cookie, seed);
+                if (st.checkedIn === null) {
+                    skipped.push({ label: login.label, reason: L('读到了登录，但豆包没给这个账号开「每日签到」：它的任务面板里只有一次性的新手任务（选工作领域、生成文档 / PPT 等，要在豆包里自己做）。飞书企业账号也是这样。打开豆包电脑版看看有没有「每日签到」，有的话告诉开发者', 'Signed in, but Doubao has not given this account a daily check-in: its task panel only has one-off starter tasks (pick a work field, make a document / slides…, done inside Doubao). Feishu enterprise accounts look like this too. Check whether the Doubao app shows a daily check-in, and tell the developer if it does') });
+                    continue;
+                }
+            }
+            catch (error) {
+                skipped.push({ label: login.label, reason: error instanceof DoubaoAuthError ? L('登录已过期：在那里重新登录豆包', 'the sign-in expired: sign in to Doubao there again') : String(error.message ?? error) });
+                continue;
+            }
+            await addDoubao(this.ctx, { cookie, seed, from: login.label, ...(existing?.name ? {} : { name: login.label }) });
+            added.push(login.label);
+        }
+        return { added, skipped };
+    }
     /** 加一个 WorkBuddy 签到账号：打开链接授权（同来源登录一样），存成单独一份，只用来签到 */
     async startWorkbuddyCheckinLogin() {
         const all = await loadAll(this.ctx);
@@ -1233,6 +1279,12 @@ export class Daemon {
                 const n = await importCheckin(this.ctx, String(b.text ?? ''), String(b.code ?? ''));
                 return ok({ imported: n, ...(await this.checkinNow(true)) });
             }
+            if (method === 'POST' && path === '/checkin/doubao/scan') {
+                const found = await this.scanDoubao();
+                if (found.added.length)
+                    await this.checkinNow(false).catch(() => null);
+                return ok({ ...found, status: await this.checkinStatus() });
+            }
             if (method === 'POST' && path === '/checkin/doubao') {
                 await this.addDoubaoCookie(String(b.cookie ?? ''), typeof b.name === 'string' ? b.name : undefined);
                 return ok(await this.checkinNow(true));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model",
-  "version": "0.26.0",
+  "version": "0.27.1",
   "description": "Daily check-in credits claimed for you (Trae, Qoder, WorkBuddy China), one OpenAI-compatible address that relays every model, and free or subscription model sources (SiliconFlow, Gemini, Codex, Kimi, Ollama…). For DeepSeek Harness (dsh) and any OpenAI-compatible tool. 每天自动签到领积分 · 一个地址中转所有模型 · 免费和订阅模型随你接。",
   "keywords": [
     "siliconflow",

package/plugin/client.js

@@ -1011,20 +1011,48 @@ window.__ModuleLoader__.load({
         msg ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null)
     }
 
-    /** 添加豆包签到：从浏览器复制一次登录 Cookie（豆包没有令牌，也不读豆包客户端的文件） */
-    function DoubaoDialog({ onDone, onClose, another }) {
+    /** 从本机读豆包登录的结果说成一句话 */
+    const scanText = (r) => [
+      r.added.length ? L(`已添加：${r.added.join('、')}`, `Added: ${r.added.join(', ')}`) : '',
+      ...r.skipped.map((x) => `${x.label}：${x.reason}`),
+    ].filter(Boolean).join('；')
+
+    /** 添加豆包签到：优先从本机已登录的豆包电脑版 / 浏览器自动读；读不了再手动粘贴 Cookie */
+    function DoubaoDialog({ onDone, onClose, another, found, localRead }) {
       const [cookie, setCookie] = useState('')
       const [name, setName] = useState('')
       const [busy, setBusy] = useState(false)
       const [msg, setMsg] = useState('')
+      const [manual, setManual] = useState(false)
+      const scan = async () => {
+        setBusy(true)
+        setMsg(localRead === 'mac' ? L('正在读取…macOS 会弹窗问是否允许读取钥匙串，请点「允许」（点「始终允许」以后就不再问）', 'Reading… macOS will ask to allow keychain access: click Allow (Always Allow skips the question next time)') : L('正在读取…', 'Reading…'))
+        try {
+          const r = await api('POST', '/checkin/doubao/scan')
+          if (r.added.length) { onDone(r.status, scanText(r)); return }
+          setMsg(scanText(r) || L('没读到能用的豆包登录', 'No usable Doubao sign-in found'))
+        } catch (e) { setMsg(e.message) }
+        setBusy(false)
+      }
       const save = async () => {
         setBusy(true)
         setMsg(L('正在用这份 Cookie 查签到任务并签到…', 'Checking this cookie and checking in…'))
         try { await api('POST', '/checkin/doubao', { cookie: cookie.trim(), ...(name.trim() ? { name: name.trim() } : {}) }); onDone() } catch (e) { setMsg(e.message); setBusy(false) }
       }
       const step = (n, text) => h('div', { style: { ...S.meta, lineHeight: 1.7 } }, `${n}. `, text)
+      const canScan = Boolean(localRead)
       return h(Modal, { title: another ? L('再加一个豆包账号', 'Add another Doubao account') : L('添加豆包签到（实验）', 'Add Doubao check-in (experimental)'), onClose },
-        h('p', { style: S.note }, L('豆包「天天领额度」每天送体验额度，只有个人账号能领（飞书企业账号不行）。豆包没有令牌，要从浏览器复制一次登录 Cookie：', 'Doubao gives daily credits to personal accounts (not Feishu enterprise accounts). Doubao has no token, so copy its sign-in cookie from the browser once:')),
+        h('p', { style: S.note }, L('豆包「天天领额度」每天送体验额度，只有个人账号能领（飞书企业账号不行）。', 'Doubao gives daily credits to personal accounts (not Feishu enterprise accounts).')),
+        canScan ? h('div', { style: { ...S.card, padding: '10px 12px', marginBottom: 10 } },
+          h('div', { style: { ...S.meta, marginBottom: 6 } }, found && found.length
+            ? L(`这台电脑上 ${found.join('、')} 登录着豆包，直接读它的登录就行：`, `Doubao is signed in here (${found.join(', ')}); just read that sign-in:`)
+            : L('在豆包电脑版、Chrome、Edge 或 Brave 里登录过 doubao.com 的话，直接读它的登录：', 'If you are signed in to doubao.com in the Doubao app, Chrome, Edge or Brave, read that sign-in:')),
+          h('button', { type: 'button', style: S.btnPrimary, disabled: busy, onClick: () => void scan() }, busy ? L('读取中…', 'Reading…') : L('从本机自动读取', 'Read from this computer')),
+          msg && !manual ? h('div', { style: { fontSize: 12, color: busy ? C.sub : C.warn, marginTop: 8, lineHeight: 1.6 } }, msg) : null,
+          h('div', { style: { ...S.meta, marginTop: 6, color: C.faint } }, L('只读 doubao.com 的登录，保存在本机；豆包里退出登录或过期后，再点一次就会换成新的。', 'Only the doubao.com sign-in is read, and it stays on this machine; after it expires, click again to replace it.'))) : null,
+        canScan && !manual ? h('button', { type: 'button', style: { ...S.btn, padding: '2px 8px', fontSize: 12 }, onClick: () => setManual(true) }, L('▸ 手动粘贴 Cookie', '▸ Paste the cookie by hand')) : null,
+        !canScan || manual ? h('div', null,
+        h('p', { style: S.note }, L('手动：从浏览器复制一次登录 Cookie：', 'By hand: copy the sign-in cookie from the browser once:')),
         step(1, h('span', null, L('用电脑浏览器打开 ', 'Open '), h('a', { href: 'https://www.doubao.com/', target: '_blank', rel: 'noopener noreferrer', style: { color: C.accent } }, 'doubao.com ↗'), L(' 并登录', ' in a desktop browser and sign in'))),
         step(2, L('按 F12 打开开发者工具，切到「网络 / Network」，刷新一下页面', 'Press F12, open the Network tab, and reload the page')),
         step(3, L('点列表里任意一条 doubao.com 的请求，在「请求标头 / Request Headers」里找到 Cookie 那一行，右键复制它的值', 'Click any doubao.com request, find Cookie under Request Headers, and copy its value')),
@@ -1034,7 +1062,7 @@ window.__ModuleLoader__.load({
         h('div', { style: S.line },
           h('input', { type: 'password', style: { ...S.input, ...S.grow }, placeholder: L('粘贴 Cookie', 'Paste the cookie'), value: cookie, onChange: (e) => setCookie(e.target.value), 'aria-label': 'Cookie' }),
           h('button', { type: 'button', style: S.btnPrimary, disabled: busy || !cookie.trim(), onClick: () => void save() }, L('保存', 'Save'))),
-        msg ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null)
+        msg ? h('div', { style: { ...S.meta, marginTop: 8 } }, msg) : null) : null)
     }
 
     /** 把签到账号复制到另一台机器：导出一段加密文本 + 提取码，到那台的页面里导入 */
@@ -1121,7 +1149,7 @@ window.__ModuleLoader__.load({
             h('button', { type: 'button', style: { ...S.btn, marginLeft: 6 }, onClick: () => setTransfer('import') }, L('从另一台机器导入', 'Import from another machine'))),
           transfer ? h(TransferDialog, { mode: transfer, onDone: (r) => { setTransfer(''); setSt(r); setOpen(true) }, onClose: () => setTransfer('') }) : null,
           qoder ? h(QoderDialog, { onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null,
-          doubao ? h(DoubaoDialog, { onDone: () => { setDoubao(false); void refresh() }, onClose: () => setDoubao(false) }) : null)
+          doubao ? h(DoubaoDialog, { localRead: st.localRead, found: ((st.missing || []).find((m) => m.id === 'doubao') || {}).found, onDone: (next) => { setDoubao(false); if (next) setSt(next); else void refresh() }, onClose: () => setDoubao(false) }) : null)
       }
       return h('div', { style: S.section },
         h('div', { style: { ...S.card, padding: '10px 14px' } },
@@ -1139,7 +1167,7 @@ window.__ModuleLoader__.load({
           (st.missing || []).length ? h('div', { style: { ...S.line, flexWrap: 'wrap', gap: 6, marginTop: 4, fontSize: 12, color: C.sub } },
             h('span', null, L('这台还能签：', 'Also available here:')),
             (st.missing || []).map((m) => h('span', { key: m.id, style: { display: 'inline-flex', alignItems: 'center', gap: 4 } },
-              m.label,
+              m.found && m.found.length ? L(`${m.label}（本机 ${m.found.join('、')} 已登录）`, `${m.label} (signed in: ${m.found.join(', ')})`) : m.label,
               m.action ? h('button', { type: 'button', style: { ...S.btn, padding: '1px 6px', fontSize: 11 }, onClick: () => { if (m.action === 'workbuddy') void addWorkbuddy(); else if (m.action === 'qoder') setQoder(true); else setDoubao(true) } }, L('+ 添加', '+ Add')) : h('span', { style: { color: C.faint } }, `（${m.reason}）`)))) : null,
           open ? h('div', { style: { marginTop: 8 } },
             st.results.map((r) => h('div', { key: r.id, style: { fontSize: 12, lineHeight: 1.8, color: r.state === 'failed' ? C.err : C.text } },
@@ -1164,7 +1192,7 @@ window.__ModuleLoader__.load({
           err ? h('div', { style: { fontSize: 12, color: C.err, marginTop: 6 } }, err) : null),
         qoder ? h(QoderDialog, { another: st.qoder.configured, onDone: () => { setQoder(false); void refresh() }, onClose: () => setQoder(false) }) : null,
         transfer ? h(TransferDialog, { mode: transfer, onDone: (r) => { setTransfer(''); setSt(r); setOpen(true) }, onClose: () => setTransfer('') }) : null,
-        doubao ? h(DoubaoDialog, { another: Boolean(st.accounts && st.accounts.doubao && st.accounts.doubao.length), onDone: () => { setDoubao(false); setOpen(true); void refresh() }, onClose: () => setDoubao(false) }) : null,
+        doubao ? h(DoubaoDialog, { another: Boolean(st.accounts && st.accounts.doubao && st.accounts.doubao.length), localRead: st.localRead, found: ((st.missing || []).find((m) => m.id === 'doubao') || {}).found, onDone: (next, note) => { setDoubao(false); setOpen(true); if (next) setSt(next); else void refresh(); if (note) setErr(note) }, onClose: () => setDoubao(false) }) : null,
         wbLogin ? h(LoginDialog, { source: { id: 'workbuddy-checkin', label: L('WorkBuddy 签到账号', 'WorkBuddy check-in account'), login: 'link' }, session: wbLogin, onDone: () => { setWbLogin(null); setOpen(true); setTimeout(() => void refresh(), 3000) }, onClose: () => { setWbLogin(null); void refresh() } }) : null)
     }
 

package/plugin/index.js

@@ -63,7 +63,7 @@ const ALLOWED = [
   ['GET', /^\/self$/],
   ['GET', /^\/failures$/],
   ['GET', /^\/checkin$/],
-  ['POST', /^\/checkin(\/auto|\/qoder|\/workbuddy|\/doubao|\/export|\/import)?$/],
+  ['POST', /^\/checkin(\/auto|\/qoder|\/workbuddy|\/doubao|\/doubao\/scan|\/export|\/import)?$/],
   ['DELETE', /^\/checkin\/qoder(\/[A-Za-z0-9_-]{1,40})?$/],
   ['DELETE', /^\/checkin\/workbuddy\/[A-Za-z0-9_-]{1,80}$/],
   ['DELETE', /^\/checkin\/doubao\/[A-Za-z0-9_-]{1,40}$/],