dsh-tap 0.20.0

package/local-scan.js

@@ -0,0 +1,104 @@
+/**
+ * local-scan.js — G7 本机登录态自动检测（只读扫描 + 确认后导入）。
+ *
+ * 红线：扫描只读、绝不回传任何 secret 值——findings 只带路径/类型/过期等
+ * 元数据；importLocalCredential 在用户确认后把凭据从原文件直接搬进对应落点
+ * （key 型上游走 openai-compat 注册表，.credentials.yaml 0600）。
+ *
+ * 每个探测器的产出：{ source, label, path, kind, importable, reason?, detail? }
+ * - importable=true 的 finding 必须带 detail.import = { id, baseURL, keyFrom }
+ *   （keyFrom 指出凭据在哪个文件哪个字段，导入时才读真值）。
+ */
+
+import { readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+const HOME = homedir()
+
+function readJsonSafe(path) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'))
+  } catch {
+    return null
+  }
+}
+
+function exists(path) {
+  try {
+    readFileSync(path)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/** 各工具探测器。新增工具 = 往这里加一条（保持只读）。 */
+const DETECTORS = [
+  function qwen() {
+    const creds = readJsonSafe(join(HOME, '.qwen', 'oauth_creds.json'))
+    if (!creds) return null
+    const resource = typeof creds.resource_url === 'string' && creds.resource_url ? creds.resource_url : null
+    const expiry = typeof creds.expiry_date === 'number' ? creds.expiry_date : null
+    const expired = expiry != null && expiry < Date.now()
+    if (typeof creds.access_token !== 'string' || !creds.access_token || !resource) {
+      return { source: 'qwen', label: 'Qwen Code（千问）', path: '~/.qwen/oauth_creds.json', kind: 'oauth', importable: false, reason: 'oauth_creds.json 缺 access_token/resource_url' }
+    }
+    // access_token 当 Bearer 直用（OpenAI 兼容端点 https://<resource>/v1）；
+    // 过期与否以导入时探针实测为准（expiry_date 与真实有效期未必一致；
+    // 另：Qwen OAuth 免费额度 2026-04-15 已停服，存量 token 大概率被拒）。
+    return {
+      source: 'qwen', label: 'Qwen Code（千问）', path: '~/.qwen/oauth_creds.json', kind: 'oauth', importable: true,
+      detail: {
+        expiresAt: expiry,
+        expiredHint: expired,
+        import: { id: 'qwen', displayName: 'Qwen（本机导入）', baseURL: `https://${resource.replace(/^https?:\/\//, '').replace(/\/+$/, '')}/v1`, keyFrom: { file: join(HOME, '.qwen', 'oauth_creds.json'), field: 'access_token' } },
+      },
+    }
+  },
+  function codex() {
+    const auth = readJsonSafe(join(HOME, '.codex', 'auth.json'))
+    if (!auth) return null
+    return { source: 'codex', label: 'Codex（ChatGPT OAuth）', path: '~/.codex/auth.json', kind: 'oauth', importable: false, reason: 'ChatGPT 后端 responses 方言接入复杂，v0.8 暂不支持' }
+  },
+  function codebuddyCli() {
+    if (!exists(join(HOME, '.codebuddy', 'user-state.json'))) return null
+    return { source: 'codebuddy-cli', label: 'CodeBuddy CLI', path: '~/.codebuddy/', kind: 'unknown', importable: false, reason: '文件里无独立凭据（登录态在系统 keyring/内存）；本插件 OAuth 已覆盖同一网关' }
+  },
+  function kimiCode() {
+    if (!exists(join(HOME, '.kimi-code', 'config.toml'))) return null
+    return { source: 'kimi-code', label: 'Kimi Code', path: '~/.kimi-code/', kind: 'unknown', importable: false, reason: '本机服务令牌非 API key；kimi-coding 凭据如已配则无需导入' }
+  },
+  function zcode() {
+    if (!exists(join(HOME, '.zcode', 'cli', 'config.json'))) return null
+    return { source: 'zcode', label: 'ZCode', path: '~/.zcode/', kind: 'unknown', importable: false, reason: '已安装，但凭据不在可见文件里（疑似 keyring/sqlite）' }
+  },
+]
+
+/** 只读扫描：返回所有命中（含"已安装但不可导入"及其原因）。 */
+export function scanLocalCredentials() {
+  const found = []
+  for (const detect of DETECTORS) {
+    try {
+      const hit = detect()
+      if (hit) found.push(hit)
+    } catch {
+      // 单个探测器失败不影响其余（只读操作，失败多为文件竞态删除）。
+    }
+  }
+  return found
+}
+
+/**
+ * 按 finding.detail.import.keyFrom 读凭据真值（导入路径专用，扫描路径禁用）。
+ * 返回 { id, displayName, baseURL, apiKey }。
+ */
+export function readImportCredential(findings, source) {
+  const f = findings.find((x) => x.source === source)
+  if (!f || !f.importable || !f.detail?.import) throw new Error(`${source} 不可导入`)
+  const { id, displayName, baseURL, keyFrom } = f.detail.import
+  const doc = readJsonSafe(keyFrom.file)
+  const apiKey = doc && typeof doc[keyFrom.field] === 'string' ? doc[keyFrom.field].trim() : ''
+  if (!apiKey) throw new Error(`${keyFrom.file} 里没有 ${keyFrom.field}`)
+  return { id, displayName, baseURL, apiKey }
+}

package/package.json

@@ -0,0 +1,82 @@
+{
+  "name": "dsh-tap",
+  "version": "0.20.0",
+  "description": "Unofficial upstream bundle for DeepSeek Harness (dsh): CodeBuddy (copilot.tencent.com) with a runtime-synced model catalogue, web search/fetch, image generation and a streaming bridge; TraeWork CN and Qoder CN subscription channels via local OpenAI translation gateways; plus a key-type OpenAI-compatible provider registry - all managed from a 4-block accordion settings card.",
+  "type": "module",
+  "main": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "local-scan.js",
+    "host-config.js",
+    "core/",
+    "providers/",
+    "lib/client.js",
+    "cordis.patch.yml",
+    "scripts/",
+    "docs/goals/",
+    "docs/reverse/",
+    "docs/rules/",
+    "docs/pitfalls.md",
+    "docs/diagnosis-cache-quota.md",
+    "docs/diagnosis-trae-3003.md",
+    "docs/diagnosis-qoder-flash.md",
+    "README.md",
+    "README.en.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "AGENTS.md"
+  ],
+  "scripts": {
+    "verify": "node scripts/verify-models.mjs",
+    "verify:bridge": "node scripts/verify-bridge.mjs",
+    "verify:core": "node scripts/verify-core-generic.mjs",
+    "verify:providers": "node scripts/verify-providers.mjs",
+    "verify:trae": "node scripts/verify-trae-model-catalog.mjs",
+    "verify:trae-provider": "node scripts/verify-trae-provider.mjs",
+    "verify:qoder": "node scripts/verify-qoder-provider.mjs",
+    "verify:host-config": "node scripts/verify-host-config.mjs",
+    "verify:desktop-acceptance": "node scripts/verify-desktop-acceptance.mjs"
+  },
+  "keywords": [
+    "dsh-plugin",
+    "deepseek-harness",
+    "codebuddy",
+    "trae",
+    "qoder",
+    "llm",
+    "deepseek",
+    "glm",
+    "kimi",
+    "minimax",
+    "hunyuan"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/taikaikaikai-pixel/dsh-tap.git"
+  },
+  "bugs": {
+    "url": "https://github.com/taikaikaikai-pixel/dsh-tap/issues"
+  },
+  "homepage": "https://github.com/taikaikaikai-pixel/dsh-tap#readme",
+  "license": "MIT",
+  "dependencies": {
+    "@deepseek-ai/schemastery": "3.18.1",
+    "yaml": "2.8.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-slots"
+      ],
+      "platform": "web"
+    }
+  }
+}

package/providers/ark/index.js

@@ -0,0 +1,11 @@
+import { createOpenAICompatProvider } from '../openai-compat.js'
+
+/**
+ * 火山引擎 Ark（方舟）preset。OpenAI 兼容端点 = /api/v3；
+ * 目录 GET /models 用 Bearer <Agent Plan key>。
+ */
+export default createOpenAICompatProvider({
+  id: 'ark',
+  displayName: '火山引擎 Ark',
+  baseURL: 'https://ark.cn-beijing.volces.com/api/v3',
+})

package/providers/bailian/index.js

@@ -0,0 +1,10 @@
+import { createOpenAICompatProvider } from '../openai-compat.js'
+
+/**
+ * 阿里云百炼 preset。OpenAI 兼容模式端点 = dashscope compatible-mode。
+ */
+export default createOpenAICompatProvider({
+  id: 'bailian',
+  displayName: '阿里云百炼',
+  baseURL: 'https://dashscope.aliyuncs.com/compatible-mode/v1',
+})

package/providers/bigmodel/index.js

@@ -0,0 +1,11 @@
+import { createOpenAICompatProvider } from '../openai-compat.js'
+
+/**
+ * 智谱 BigModel preset。OpenAI 兼容端点 = /api/paas/v4；
+ * 2026-09-11 实测：GET /models 假 key 401（令牌已过期或验证不正确）。
+ */
+export default createOpenAICompatProvider({
+  id: 'bigmodel',
+  displayName: '智谱 BigModel',
+  baseURL: 'https://open.bigmodel.cn/api/paas/v4',
+})

package/providers/codebuddy/agenttool.js

@@ -0,0 +1,122 @@
+/**
+ * providers/codebuddy/agenttool.js — CodeBuddy /agenttool 后端：
+ * dsh 原生 web_search / web_fetch 工具的网关实现。
+ *
+ * 端点方言：POST JSON，信封 {code, msg, data/results}；错误以 JSON code/msg
+ * 返回（探测证据见 docs/rules/）。UA 头组历史上被 12403 拒过，2026-08-19
+ * 复测已无 UA 门（docs/rules/ua-validation.md §2）——头组按零行为变更保留。
+ *
+ * 计量说明（docs/rules/quota-signals.md R-Q2，STATE.md 课题 4 放行）：探测
+ * 实测 agenttool search/webfetch 响应体**无计量字段**——重构前 search/fetch
+ * 里 `if (data?.usage) recordUsage(...)` 是死路径，本次删除，不重建。
+ */
+
+import { USER_AGENT } from './headers.js'
+import { CREDENTIAL_UNAVAILABLE_MESSAGE } from './errors.js'
+
+/**
+ * @param {{ withKeyRotation: (settingsFn: () => object, attempt: Function) => Promise<object> }} deps
+ */
+export function createAgentTool({ withKeyRotation }) {
+  async function callAgentTool(settings, path, payload, signal) {
+    const { res, err } = await withKeyRotation(settings, (cred) => fetch(`${settings().baseURL}${path}`, {
+      method: 'POST',
+      signal,
+      headers: {
+        Authorization: cred.authorization,
+        ...cred.headers,
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        'User-Agent': USER_AGENT,
+        'X-Requested-With': 'XMLHttpRequest',
+      },
+      body: JSON.stringify(payload),
+    }))
+    if (err) {
+      if (err.message === CREDENTIAL_UNAVAILABLE_MESSAGE) throw err
+      if (signal?.aborted) throw err
+      // undici hides the real reason in err.cause (ECONNRESET, terminated,
+      // certificate errors …) — a bare "fetch failed" is undebuggable.
+      const causes = []
+      for (let e = err; e; e = e.cause) causes.push(e.code ?? e.message ?? String(e))
+      throw new Error(`CodeBuddy agenttool ${path} network error: ${causes.join(' ← ')}`)
+    }
+    if (!res.ok) {
+      const body = await res.text().catch(() => '')
+      // The gateway answers errors as JSON with code/msg — surface both.
+      let codeMsg = ''
+      try { const j = JSON.parse(body); if (j?.code != null) codeMsg = ` code ${j.code}: ${j.msg ?? ''}` } catch { /* not JSON */ }
+      throw new Error(`CodeBuddy agenttool ${path} HTTP ${res.status}${codeMsg || ` ${body.slice(0, 160)}`}`)
+    }
+    const data = await res.json().catch(() => null)
+    if (data && data.code != null && data.code !== 0) {
+      throw new Error(`CodeBuddy agenttool ${path} error ${data.code}: ${data.msg ?? ''}`)
+    }
+    return data
+  }
+
+  /** Search backend: POST /agenttool/v1/search {query, type, max_results}. */
+  function makeSearchProvider(settings) {
+    return {
+      id: 'codebuddy',
+      available() {
+        return true // cheap check only; real failures surface per request
+      },
+      async search(request, signal) {
+        const s = settings()
+        const data = await callAgentTool(
+          settings,
+          '/agenttool/v1/search',
+          {
+            query: request.query,
+            type: 'text2text',
+            max_results: request.maxResults ?? s.searchMaxResults,
+          },
+          signal,
+        )
+        const results = Array.isArray(data?.results) ? data.results : []
+        return {
+          sources: results
+            .filter((r) => typeof r?.url === 'string' && r.url.length > 0)
+            .map((r) => ({
+              url: r.url,
+              ...(typeof r.title === 'string' && r.title.length > 0 ? { title: r.title } : {}),
+              ...(typeof r.snippet === 'string' && r.snippet.length > 0 ? { snippet: r.snippet } : {}),
+            })),
+          // The seam itself truncates to maxResults; we already passed it
+          // through as max_results, so nothing extra was cut here.
+          truncated: false,
+        }
+      },
+    }
+  }
+
+  /**
+   * Fetch backend: POST /agenttool/v1/webfetch {url} → {url, title, content}.
+   * The endpoint answers with decoded content or a JSON error, never the
+   * target page's HTTP status, so a successful call reports statusCode 200
+   * and the body is classified as text.
+   */
+  function makeFetchProvider(settings) {
+    return {
+      id: 'codebuddy',
+      available() {
+        return true
+      },
+      async fetch(request, signal) {
+        const s = settings()
+        const data = await callAgentTool(settings, '/agenttool/v1/webfetch', { url: request.url }, signal)
+        const content = typeof data?.content === 'string' ? data.content : ''
+        const cap = s.fetchBodyCap
+        return {
+          url: typeof data?.url === 'string' && data.url.length > 0 ? data.url : request.url,
+          statusCode: 200,
+          body: { kind: 'text', content: content.slice(0, cap) },
+          truncated: content.length > cap,
+        }
+      },
+    }
+  }
+
+  return { makeSearchProvider, makeFetchProvider }
+}

package/providers/codebuddy/catalog.js

@@ -0,0 +1,227 @@
+/**
+ * providers/codebuddy/catalog.js — CodeBuddy 网关的目录与额度端点方言。
+ *
+ * - GET /v3/config：网关自有模型目录（官方 CLI 同款）。方言：UA 必须过
+ *   12403 门（规则见 headers.js 注释与 docs/rules/ua-validation.md），
+ *   API key 另需 x-api-key 头，OAuth 走 Authorization；`X-Product: SaaS`
+ *   实测迷信（ua-validation.md §3 no-xproduct 臂 200），为零行为变更保留。
+ * - GET /v2/accounts + POST /v2/billing/meter/get-dosage-notify：凭据可达的
+ *   额度侧信号（docs/rules/quota-signals.md）。**所有端点响应头零额度信号**
+ *   （P-Q1/P-Q4 实测）。额度账户级与 WorkBuddy 共享（同一
+ *   Tencent-Cloud.coding-copilot 认证域）。
+ * - POST /billing/meter/get-user-resource：**数值剩余额度**（R-Q7，2026-08-19
+ *   G2 发现）——控制台计费路径族，**OAuth Bearer 专属**（`ck_` key 401），
+ *   返回资源包列表（CapacityRemain/Precise 总量口径、CycleCapacity* 周期口径、
+ *   TotalDosage）。api-key 模式跳过该调用，卡片回落估算档。
+ */
+
+import { USER_AGENT } from './headers.js'
+
+/**
+ * 「目录在列 ≠ /v2 可路由」的已知死条目（恒 11102 service info not found，
+ * 踩坑 #42 同族）。判定证据：docs/probes/codebuddy-efforts-matrix-2026-09-22.json
+ * （六臂全 11102）+ docs/probes/routing-2026-08-19.jsonl；2026-09-26 复核
+ * hy4-preview-x 已离开目录（集合保留——重现即再置灰）。
+ * 用途 = 设置卡「可路由 M」计数 + 行置灰徽标；**不改**镜像/选择器行为
+ * （ transparency only，移除是另一个决策）。上游修复后从表里删 id 即可。
+ */
+export const UNROUTABLE_MODELS = {
+  'glm-4.6v': '目录在列但 /v2/chat/completions 恒 11102 service info not found',
+  'kimi-k2-thinking': '目录在列但 /v2/chat/completions 恒 11102 service info not found',
+  'minimax-m2.5': '目录在列但 /v2/chat/completions 恒 11102 service info not found',
+  'hy4-preview-x': '目录在列但 /v2/chat/completions 恒 11102 service info not found',
+}
+
+/**
+ * @param {{ resolveCredential: (settingsFn: () => object) => Promise<object|null>,
+ *           envKey: (envName: string|undefined) => string|null }} deps
+ */
+export function createCatalog({ resolveCredential, envKey }) {
+  /** 目录端点的认证方言：Authorization + api-key 模式另带 x-api-key。 */
+  async function dialectHeaders(settingsFn) {
+    const s = settingsFn()
+    const cred = await resolveCredential(settingsFn)
+    if (!cred) return null
+    const headers = {
+      Accept: 'application/json',
+      Authorization: cred.authorization,
+      'User-Agent': USER_AGENT,
+      'X-Product': 'SaaS', // 迷信（见文件头注释），零行为变更保留
+    }
+    if (s.authMode !== 'oauth') {
+      const active = s.apiKeys.find((k) => k.name === s.activeApiKey)
+      const raw = active?.key ?? envKey(s.apiKeyEnv)
+      if (raw) headers['x-api-key'] = raw
+    }
+    return headers
+  }
+
+  /** Fetch the gateway's own model catalog (GET /v3/config). */
+  async function fetchModelCatalog(settingsFn) {
+    const headers = await dialectHeaders(settingsFn)
+    if (!headers) throw new Error('凭据不可用：请先在登录区配置 API Key 或完成 OAuth 登录')
+    const res = await fetch(`${settingsFn().baseURL}/v3/config`, { headers })
+    if (!res.ok) throw new Error(`模型目录 HTTP ${res.status}`)
+    const body = await res.json()
+    if (body?.code !== 0) throw new Error(`模型目录错误：${body?.code} ${body?.msg ?? ''}`)
+    const data = body.data ?? {}
+    const cliEnabled = new Set(
+      (data.agents ?? []).find((a) => a.name === 'cli')?.models ?? [],
+    )
+    const models = (data.models ?? [])
+      .filter((m) => typeof m?.id === 'string')
+      .map((m) => {
+        // 思考强度声明两代形态（2026-09-22 实测）：
+        //   legacy {"effort":"high","summary":"auto"} —— 只给默认档；
+        //   current {"canDisableThinking":true,"defaultEffort":"high",
+        //            "supportedEfforts":["low","high","max"]} —— 给能力清单。
+        // 后者是档位表的权威来源（无需探测即可驱动选择器与出站线值）。
+        const reasoning = m.reasoning && typeof m.reasoning === 'object' ? m.reasoning : null
+        const supported = Array.isArray(reasoning?.supportedEfforts)
+          ? reasoning.supportedEfforts.filter((s) => typeof s === 'string' && s)
+          : null
+        const defaultEffort = typeof reasoning?.defaultEffort === 'string' && reasoning.defaultEffort
+          ? reasoning.defaultEffort
+          : null
+        return {
+          id: m.id,
+          name: typeof m.name === 'string' ? m.name : m.id,
+          maxInputTokens: m.maxInputTokens ?? null,
+          maxOutputTokens: m.maxOutputTokens ?? null,
+          images: m.supportsImages === true,
+          cli: cliEnabled.has(m.id),
+          reasoning: !!reasoning && (reasoning.effort != null || defaultEffort != null
+            || supported != null || typeof reasoning.canDisableThinking === 'boolean'),
+          // 目录标注的**默认**档（legacy 的 effort 或新形态的 defaultEffort）——
+          // 卡片把它当"未设置时的既有档位"展示，不是档位清单。
+          reasoningEffort: typeof reasoning?.effort === 'string' && reasoning.effort
+            ? reasoning.effort
+            : defaultEffort,
+          defaultEffort,
+          supportedEfforts: supported,
+          canDisableThinking: typeof reasoning?.canDisableThinking === 'boolean'
+            ? reasoning.canDisableThinking
+            : null,
+        }
+      })
+    return { models, fetchedAt: Date.now() }
+  }
+
+  /**
+   * Quota-side signals the plugin credentials can actually reach. Cached 60s;
+   * never throws. OAuth 模式追加数值剩余额度（/billing/meter/get-user-resource，
+   * quota-signals.md R-Q7）；api-key 模式该路径族 401（OAuth-only），
+   * numericQuota=false，卡片应手填总额度做估算档。
+   */
+  let quotaCache = { at: 0, value: null }
+
+  /** get-user-resource 的数值字段带 Precise 字符串变体；统一取数值。 */
+  const num = (v) => {
+    const n = Number(v)
+    return Number.isFinite(n) ? n : null
+  }
+
+  async function fetchResourceQuota(s, headers) {
+    const res = await fetch(`${s.baseURL}/billing/meter/get-user-resource`, {
+      method: 'POST',
+      headers: { ...headers, 'Content-Type': 'application/json' },
+      body: '{}',
+    })
+    const body = await res.json().catch(() => null)
+    const data = body?.code === 0 ? body.data?.Response?.Data ?? null : null
+    if (!data) return { resource: null, resourceError: `code ${body?.code ?? `http ${res.status}`}` }
+    const packs = (data.Accounts ?? []).map((a) => ({
+      name: a.PackageName ?? '',
+      size: num(a.CapacitySizePrecise ?? a.CapacitySize),
+      remain: num(a.CapacityRemainPrecise ?? a.CapacityRemain),
+      cycleSize: num(a.CycleCapacitySizePrecise ?? a.CycleCapacitySize),
+      cycleRemain: num(a.CycleCapacityRemainPrecise ?? a.CycleCapacityRemain),
+      cycleUsed: num(a.CycleCapacityUsedPrecise ?? a.CycleCapacityUsed),
+      cycleStart: a.CycleStartTime ?? '',
+      cycleEnd: a.CycleEndTime ?? '',
+    }))
+    const sum = (k) => Math.round(packs.reduce((acc, p) => acc + (p[k] ?? 0), 0) * 100) / 100
+    return {
+      resource: {
+        // TotalDosage = Σ 总量口径剩余（实测吻合，取整）；cycle* 为当前周期口径
+        totalRemain: num(data.TotalDosage),
+        cycleRemain: sum('cycleRemain'),
+        cycleUsed: sum('cycleUsed'),
+        cycleSize: sum('cycleSize'),
+        packs,
+      },
+      resourceError: null,
+    }
+  }
+
+  async function fetchQuotaSnapshot(settingsFn) {
+    const s = settingsFn()
+    const cred = await resolveCredential(settingsFn)
+    if (!cred) return { error: '凭据不可用：请先配置 API Key 或完成 OAuth 登录' }
+    const headers = {
+      Accept: 'application/json',
+      Authorization: cred.authorization,
+      ...cred.headers,
+      'User-Agent': USER_AGENT,
+      'X-Product': 'SaaS',
+    }
+    // Same dialect as fetchModelCatalog: api-key mode also carries the raw key
+    // in x-api-key (the gateway authenticates these routes by it).
+    if (s.authMode !== 'oauth') {
+      const active = s.apiKeys.find((k) => k.name === s.activeApiKey)
+      const raw = active?.key ?? envKey(s.apiKeyEnv)
+      if (raw) headers['x-api-key'] = raw
+    }
+    const readJsonBody = (r) => r.json().catch(() => null)
+    const oauthMode = s.authMode === 'oauth'
+    const [accBody, dosageBody, resourcePart] = await Promise.all([
+      fetch(`${s.baseURL}/v2/accounts`, { headers }).then(readJsonBody, () => null),
+      fetch(`${s.baseURL}/v2/billing/meter/get-dosage-notify`, {
+        method: 'POST',
+        headers: { ...headers, 'Content-Type': 'application/json' },
+        body: '{}',
+      }).then(readJsonBody, () => null),
+      // 数值额度：OAuth-only（R-Q7）；api-key 模式不浪费一次 401。
+      oauthMode
+        ? fetchResourceQuota(s, headers).catch(() => ({ resource: null, resourceError: 'network' }))
+        : Promise.resolve({ resource: null, resourceError: null }),
+    ])
+    const accounts = accBody?.code === 0 ? accBody.data?.accounts ?? [] : null
+    // The "current" account is the one flagged lastLogin (observed live), else first.
+    const current = accounts?.find((a) => a?.lastLogin === true) ?? accounts?.[0] ?? null
+    const dosage = dosageBody?.code === 0 ? dosageBody.data ?? null : null
+    return {
+      account: current ? {
+        nickname: current.nickname ?? '',
+        type: current.type ?? '',
+        enterpriseName: current.enterpriseName ?? '',
+        pluginEnabled: current.pluginEnabled === true,
+      } : null,
+      accountsError: accBody?.code === 0 ? null : `code ${accBody?.code ?? 'http'}`,
+      dosage: dosage ? {
+        code: dosage.dosageNotifyCode ?? 0,
+        text: dosage.dosageNotifyZh || dosage.dosageNotifyEn || '',
+        skipUrl: dosage.skipUrl ?? '',
+      } : null,
+      dosageError: dosageBody?.code === 0 ? null : `code ${dosageBody?.code ?? 'http'}`,
+      numericQuota: oauthMode,
+      resource: resourcePart.resource,
+      resourceError: resourcePart.resourceError,
+      fetchedAt: Date.now(),
+    }
+  }
+
+  function quotaSnapshot(settingsFn) {
+    if (quotaCache.value && Date.now() - quotaCache.at < 60_000) {
+      return Promise.resolve(quotaCache.value)
+    }
+    return fetchQuotaSnapshot(settingsFn)
+      .catch((err) => ({ error: err?.message ?? String(err) }))
+      .then((value) => {
+        quotaCache = { at: Date.now(), value }
+        return value
+      })
+  }
+
+  return { fetchModelCatalog, quotaSnapshot }
+}

package/providers/codebuddy/errors.js

@@ -0,0 +1,44 @@
+/**
+ * providers/codebuddy/errors.js — CodeBuddy 网关错误码表。
+ *
+ * 每条含义均以探测证据为准（docs/rules/ 下对应规则文档，可复跑脚本在
+ * scripts/）。这里是**语义参照表**，不是触发逻辑——代码路径按位置内联
+ * 引用，禁止把表项当作"必须长这样"的咒语使用。
+ */
+
+export const ERROR_CODES = {
+  /** /v2/chat/completions 仅流式：非流式请求报此码。证据：AGENTS.md 网关事实节。 */
+  11101: 'chat requires stream:true',
+  /** UA 门（"check ua"）：/v3/config 检查 UA 含 codebuddy/ + 含点版本段。docs/rules/ua-validation.md */
+  12403: 'user-agent gate',
+  /** 路由注册表层：image 家族模型未注册（消息逐字回显模型名）。docs/rules/routing.md */
+  14401: 'image model not routed',
+  /** 路由配置缺失：video/3d 家族注册表层 + video 后端派发层兜底。docs/rules/routing.md */
+  14407: 'route config not found',
+  /** 路由注册表层：chat 家族模型未注册（"service info not found"）。docs/rules/routing.md */
+  11102: 'service info not found',
+  /** chat 后端派发层兜底。docs/rules/routing.md */
+  11103: 'backend dispatch failure',
+  /** 入口通道校验层拒绝（"Illegal API invocation from an unapproved channel"）：
+   *  字面量 role:"developer" 单列拒绝的当前拒绝面（2026-08-18 由 200/content_filter
+   *  变迁为 500/11128）。docs/rules/content-moderation.md */
+  11128: 'unapproved channel',
+  /** 缺少必填参数（OAuth state 创建省略 platform 时观测）。docs/rules/oauth-handshake.md */
+  10001: 'missing required parameter',
+  /** OAuth token 轮询未完成——pending/bogus/过期三态同码，不可区分。docs/rules/oauth-handshake.md */
+  11217: 'oauth state not ready (indistinguishable)',
+  /** refresh token 无效（HTTP 401 伴随）。docs/rules/oauth-handshake.md */
+  12153: 'refresh token invalid',
+  /** reasoning_effort 档位拼写不被该模型接受（extError.code =
+   *  invalid_reasoning_effort）。2026-09-22 实测：deepseek-v4-pro 拒绝
+   *  off/disabled/auto（11150），同一拼写在 glm-5.3-flash 上被静默接受——
+   *  档位表只列实测/目录声明过的拼写。证据 docs/probes/codebuddy-efforts-*.json */
+  11150: 'invalid_reasoning_effort',
+}
+
+/**
+ * 凭据不可用错误（组合根在候选为空时抛出；各出站路径凭 message 识别并
+ * 原样透传，不包装成网络错误）。文案保持与 0.7.4 一致——调用方与设置卡
+ * 均按此串匹配。
+ */
+export const CREDENTIAL_UNAVAILABLE_MESSAGE = 'CodeBuddy 凭据不可用（检查插件配置卡的登录设置）'

package/providers/codebuddy/headers.js

@@ -0,0 +1,36 @@
+/**
+ * providers/codebuddy/headers.js — CodeBuddy 网关的客户端头组。
+ *
+ * 每个字段的"规则/迷信"判定均以实测为准（docs/rules/ua-validation.md §3，
+ * 证据 docs/probes/ua-2026-08-19.jsonl，74 条，可复跑 scripts/probe-ua.mjs）：
+ *
+ * | 字段 | 判定 |
+ * |---|---|
+ * | User-Agent 中的 `CodeBuddy/2.136.0` 段 | **部分是规则**：/v3/config 的 UA 门只做子串匹配 `/codebuddy\/[^a-z\s]*\./i`（大小写不敏感、版本段只需含点、数值不查）；`CLI/unknown` 前缀与具体版本号是迷信。/v2/chat 与 /agenttool 当前实测无 UA 门。 |
+ * | X-IDE-Type / X-IDE-Name / X-IDE-Version / X-Product-Version | **对校验是迷信**（变体矩阵里缺失不影响任何端点的 200） |
+ * | X-Requested-With / X-Private-Data | **迷信**（探测脚本只发 Accept/Auth/x-api-key/UA 仍全通） |
+ * | X-Product: SaaS（仅目录/额度端点携带） | **迷信**（no-xproduct 臂 200） |
+ *
+ * 工程立场：严格按已证规则构造 UA；其余字段标注为迷信但**原样保留**——
+ * 本次重构以零行为变更为纪律，是否参与遥测/路由未证伪（见 ua-validation.md §6），
+ * 不作为能力依赖，也不贸然下线。
+ */
+
+/**
+ * 规则成分：`CodeBuddy/x.y` 段（/v3/config UA 门的唯一检查对象）。
+ * 完整串照抄官方 CLI 形态，前缀与版本号均为已证迷信。
+ * 历史注：AGENTS.md 曾记录 "/agenttool UA 必须是 CLI 形态（12403）"——2026-08-19
+ * 复测 /agenttool 已无 UA 门（ua-validation.md §2 R-B），该记录已过时。
+ */
+export const USER_AGENT = 'CLI/unknown CodeBuddy/2.136.0'
+
+/** 桥与 agenttool 出站的静态头组；规则成分仅 UA 一段，其余为保留的迷信。 */
+export const CLIENT_HEADERS = {
+  'User-Agent': USER_AGENT,
+  'X-IDE-Type': 'CLI',
+  'X-IDE-Name': 'CLI',
+  'X-IDE-Version': '2.133.1',
+  'X-Product-Version': '2.133.1',
+  'X-Requested-With': 'XMLHttpRequest',
+  'X-Private-Data': 'false',
+}