hiwork-core 0.0.2 → 0.0.6

package/lib/index.js

@@ -3137,9 +3137,21 @@ function isUnloading(ctx) {
 }
 
 // src/version.ts
-var PKG_VERSION = false ? "dev" : "0.0.2";
+var PKG_VERSION = false ? "dev" : "0.0.6";
 
 // src/ai-router-client.ts
+var AUTH_AUTHORIZE_PATH = "/api/auth/authorize";
+var AUTH_TOKEN_PATH = "/api/auth/token";
+var AUTH_SESSIONS_PATH = "/api/auth/sessions";
+var ME_ANALYTICS_SUMMARY_PATH = "/api/me/analytics/summary";
+var ME_ANALYTICS_TRENDS_PATH = "/api/me/analytics/trends";
+var ME_ANALYTICS_MODEL_TRENDS_PATH = "/api/me/analytics/model-trends";
+var ME_KEY_RECHARGES_PATH = "/api/me/key/recharges";
+var ME_COST_ESTIMATE_PATH = "/api/me/cost-estimate";
+var ME_DAILY_QUOTE_PATH = "/api/me/daily-quote";
+var ME_DAILY_QUOTE_RANDOM_PATH = "/api/me/daily-quote/random";
+var DEFAULT_CLIENT_ID = "hiwork-desktop";
+var DEFAULT_REDIRECT_URI = "hiwork://auth/callback";
 var GatewayError = class extends Error {
   constructor(code, message, status) {
     super(message);
@@ -3148,13 +3160,32 @@ var GatewayError = class extends Error {
     this.name = "GatewayError";
   }
 };
+function buildAuthorizeURL(opts) {
+  const params = [
+    ["client_id", opts.clientId ?? DEFAULT_CLIENT_ID],
+    ["redirect_uri", opts.redirectUri ?? DEFAULT_REDIRECT_URI],
+    ["code_challenge", opts.codeChallenge],
+    ["code_challenge_method", "S256"],
+    ["state", opts.state],
+    ["device_id", opts.deviceId],
+    ["device_name", opts.deviceName],
+    ["platform", opts.platform],
+    ["app_version", opts.appVersion]
+  ];
+  const query = params.map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join("&");
+  return `${opts.baseURL}${AUTH_AUTHORIZE_PATH}?${query}`;
+}
 var AiRouterClient = class {
   constructor(baseURL, timeoutMs = 1e4) {
     this.baseURL = baseURL;
     this.timeoutMs = timeoutMs;
   }
-  async login(username, password) {
-    const res = await this.request("/api/admin/auth/login", { method: "POST", body: { username, password } });
+  async login(username, password, device) {
+    const res = await this.request("/api/admin/auth/login", {
+      method: "POST",
+      body: { username, password },
+      headers: deviceHeaders(device)
+    });
     const sid = extractSessionId(res.headers);
     if (res.status === 429) throw new GatewayError("RATE_LIMITED", "\u767B\u5F55\u5C1D\u8BD5\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5", 429);
     if (res.status === 401) throw new GatewayError("AUTH_FAILED", "\u7528\u6237\u540D\u6216\u5BC6\u7801\u9519\u8BEF", 401);
@@ -3163,6 +3194,45 @@ var AiRouterClient = class {
     const user = await res.json();
     return { sessionCookie: `session_id=${sid}`, user };
   }
+  /**
+   * POST /api/auth/token：用一次性 code + PKCE verifier 换取会话。
+   * 返回 `session_id=<sid>`（与 login 同形状，编排层可直接复用），user 原样返回。
+   * 任何日志/异常信息都不得包含 code / code_verifier / session_id 明文。
+   */
+  async exchangeCode(input) {
+    const res = await this.requestOrUnreachable(AUTH_TOKEN_PATH, {
+      method: "POST",
+      body: { code: input.code, code_verifier: input.codeVerifier, device_id: input.deviceId }
+    });
+    if (res.status === 400) {
+      const payload = await readJson(res);
+      if (isInvalidGrant(payload)) throw new GatewayError("AUTH_FAILED", "\u6388\u6743\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55", 400);
+      throw new GatewayError("GATEWAY_UNREACHABLE", `\u7F51\u5173\u8FD4\u56DE\u9519\u8BEF\uFF08HTTP ${res.status}\uFF09`, res.status);
+    }
+    if (!res.ok) throw new GatewayError("GATEWAY_UNREACHABLE", `\u7F51\u5173\u8FD4\u56DE\u9519\u8BEF\uFF08HTTP ${res.status}\uFF09`, res.status);
+    const data = await readJson(res);
+    if (data === void 0 || data.session_id === void 0 || data.session_id === "") {
+      throw new GatewayError("GATEWAY_UNREACHABLE", "\u7F51\u5173\u5151\u6362\u6210\u529F\u4F46\u672A\u8FD4\u56DE\u4F1A\u8BDD\u6807\u8BC6", res.status);
+    }
+    return { sessionCookie: `session_id=${data.session_id}`, user: data.user };
+  }
+  /** GET /api/auth/sessions：当前账号的登录设备列表。 */
+  async listSessions(sessionCookie) {
+    const res = await this.requestOrUnreachable(AUTH_SESSIONS_PATH, { method: "GET", sessionCookie });
+    if (res.status === 401) throw new GatewayError("SESSION_EXPIRED", "\u7F51\u5173\u4F1A\u8BDD\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55", 401);
+    if (!res.ok) throw new GatewayError("GATEWAY_UNREACHABLE", `\u7F51\u5173\u8FD4\u56DE\u9519\u8BEF\uFF08HTTP ${res.status}\uFF09`, res.status);
+    return await res.json();
+  }
+  /** DELETE /api/auth/sessions/:id：远程吊销指定会话（204 成功；404 表示已不存在）。 */
+  async revokeSession(sessionCookie, sessionId) {
+    const res = await this.requestOrUnreachable(`${AUTH_SESSIONS_PATH}/${encodeURIComponent(sessionId)}`, {
+      method: "DELETE",
+      sessionCookie
+    });
+    if (res.status === 401) throw new GatewayError("SESSION_EXPIRED", "\u7F51\u5173\u4F1A\u8BDD\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55", 401);
+    if (res.status === 404) throw new GatewayError("NOT_FOUND", "\u4F1A\u8BDD\u4E0D\u5B58\u5728\u6216\u5DF2\u88AB\u540A\u9500", 404);
+    if (!res.ok) throw new GatewayError("GATEWAY_UNREACHABLE", `\u7F51\u5173\u8FD4\u56DE\u9519\u8BEF\uFF08HTTP ${res.status}\uFF09`, res.status);
+  }
   async getMyKey(sessionCookie, keyId) {
     const qs = keyId === void 0 ? "" : `?key_id=${encodeURIComponent(keyId)}`;
     const res = await this.request(`/api/me/key${qs}`, { method: "GET", sessionCookie });
@@ -3192,10 +3262,85 @@ var AiRouterClient = class {
     } catch {
     }
   }
+  /** GET /api/me/analytics/summary：按模型聚合的用量汇总。 */
+  async getMySummary(sessionCookie, keyId, range) {
+    const query = meQuery([["key_id", keyId], ["range", range]]);
+    return await this.getMeJson(`${ME_ANALYTICS_SUMMARY_PATH}${query}`, sessionCookie);
+  }
+  /** GET /api/me/analytics/trends：token/费用走势。 */
+  async getMyTrends(sessionCookie, keyId, range) {
+    const query = meQuery([["key_id", keyId], ["range", range]]);
+    return await this.getMeJson(`${ME_ANALYTICS_TRENDS_PATH}${query}`, sessionCookie);
+  }
+  /** GET /api/me/analytics/model-trends：按模型拆分的走势。 */
+  async getMyModelTrends(sessionCookie, keyId, range) {
+    const query = meQuery([["key_id", keyId], ["range", range]]);
+    return await this.getMeJson(`${ME_ANALYTICS_MODEL_TRENDS_PATH}${query}`, sessionCookie);
+  }
+  /** GET /api/me/key/recharges：当前 Key 的充值台账（可按模型过滤）。 */
+  async getMyKeyRecharges(sessionCookie, keyId, modelName) {
+    const query = meQuery([["key_id", keyId], ["model_name", modelName]]);
+    return await this.getMeJson(`${ME_KEY_RECHARGES_PATH}${query}`, sessionCookie);
+  }
+  /** GET /api/me/daily-quote：当日条目（服务端东八区取模轮换，全网同一天同一条）。 */
+  async getMyDailyQuote(sessionCookie) {
+    return await this.getMeJson(ME_DAILY_QUOTE_PATH, sessionCookie);
+  }
+  /** GET /api/me/daily-quote/random：换一句（exclude 为当前条目 id；非法值由网关按缺省处理）。 */
+  async getMyDailyQuoteRandom(sessionCookie, excludeId) {
+    const query = meQuery([["exclude", excludeId === void 0 ? void 0 : String(excludeId)]]);
+    return await this.getMeJson(`${ME_DAILY_QUOTE_RANDOM_PATH}${query}`, sessionCookie);
+  }
+  /**
+   * POST /api/me/cost-estimate：网关权威计价。请求体里的四个 token 桶原样上报，
+   * `input_tokens` 不含 cache；任何折算与单价计算都在网关侧完成。
+   */
+  async estimateCost(sessionCookie, items) {
+    const res = await this.requestOrUnreachable(ME_COST_ESTIMATE_PATH, {
+      method: "POST",
+      sessionCookie,
+      body: { items }
+    });
+    if (res.status === 401) throw new GatewayError("SESSION_EXPIRED", "\u7F51\u5173\u4F1A\u8BDD\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55", 401);
+    if (res.status === 403) {
+      throw new GatewayError("NO_KEY_ASSIGNED", "\u5F53\u524D\u8D26\u53F7\u5C1A\u672A\u88AB\u5206\u914D\u865A\u62DF KEY\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458\u5206\u914D KEY \u540E\u518D\u767B\u5F55/\u5237\u65B0", 403);
+    }
+    if (!res.ok) throw new GatewayError("GATEWAY_UNREACHABLE", `\u7F51\u5173\u8FD4\u56DE\u9519\u8BEF\uFF08HTTP ${res.status}\uFF09`, res.status);
+    return await parseMeJson(res);
+  }
+  /**
+   * /api/me 自助端点的 GET 公共路径：网络异常 → GATEWAY_UNREACHABLE，
+   * 401/403/400 映射为稳定 code，响应体非 JSON 时不把原文带进异常。
+   */
+  async getMeJson(path, sessionCookie) {
+    const res = await this.requestOrUnreachable(path, { method: "GET", sessionCookie });
+    if (res.status === 401) throw new GatewayError("SESSION_EXPIRED", "\u7F51\u5173\u4F1A\u8BDD\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55", 401);
+    if (res.status === 403) {
+      throw new GatewayError("NO_KEY_ASSIGNED", "\u5F53\u524D\u8D26\u53F7\u5C1A\u672A\u88AB\u5206\u914D\u865A\u62DF KEY\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458\u5206\u914D KEY \u540E\u518D\u767B\u5F55/\u5237\u65B0", 403);
+    }
+    if (res.status === 400) {
+      throw new GatewayError("KEY_INVALID", "\u6240\u9009 KEY \u65E0\u6548\u6216\u5DF2\u88AB\u5220\u9664\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9 KEY \u540E\u5237\u65B0", 400);
+    }
+    if (!res.ok) throw new GatewayError("GATEWAY_UNREACHABLE", `\u7F51\u5173\u8FD4\u56DE\u9519\u8BEF\uFF08HTTP ${res.status}\uFF09`, res.status);
+    return await parseMeJson(res);
+  }
+  /**
+   * 浏览器授权相关端点专用：网络层异常（连接失败 / 超时 / DNS）统一映射为
+   * GATEWAY_UNREACHABLE，避免裸 fetch 错误漏到编排层。
+   * login 等既有方法不经过此处，行为保持不变。
+   */
+  async requestOrUnreachable(path, opts) {
+    try {
+      return await this.request(path, opts);
+    } catch {
+      throw new GatewayError("GATEWAY_UNREACHABLE", "\u7F51\u5173\u4E0D\u53EF\u8FBE\uFF0C\u8BF7\u68C0\u67E5\u7F51\u7EDC\u540E\u91CD\u8BD5");
+    }
+  }
   async request(path, opts) {
     const headers = { "user-agent": `hiwork-core/${PKG_VERSION}` };
     if (opts.body !== void 0) headers["content-type"] = "application/json";
     if (opts.sessionCookie !== void 0) headers["cookie"] = opts.sessionCookie;
+    Object.assign(headers, opts.headers ?? {});
     const init = {
       method: opts.method,
       headers,
@@ -3205,6 +3350,33 @@ var AiRouterClient = class {
     return fetch(`${this.baseURL}${path}`, init);
   }
 };
+function headerSafeValue(value) {
+  if (typeof value !== "string") return void 0;
+  let out = "";
+  for (const char of value) {
+    const code = char.codePointAt(0) ?? 0;
+    if (code >= 32 && code <= 126) out += char;
+  }
+  const trimmed = out.trim();
+  return trimmed === "" ? void 0 : trimmed;
+}
+function safeDeviceId(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return /^[\x21-\x7e]+$/.test(trimmed) ? trimmed : void 0;
+}
+function deviceHeaders(device) {
+  const deviceId = device?.deviceId === void 0 ? void 0 : safeDeviceId(device.deviceId);
+  if (deviceId === void 0) return {};
+  const headers = { "X-HiWork-Device-Id": deviceId };
+  const deviceName = device?.deviceName === void 0 ? void 0 : headerSafeValue(device.deviceName);
+  if (deviceName !== void 0) headers["X-HiWork-Device-Name"] = deviceName;
+  const platform = device?.platform === void 0 ? void 0 : headerSafeValue(device.platform);
+  if (platform !== void 0) headers["X-HiWork-Platform"] = platform;
+  const appVersion = device?.appVersion === void 0 ? void 0 : headerSafeValue(device.appVersion);
+  if (appVersion !== void 0) headers["X-HiWork-App-Version"] = appVersion;
+  return headers;
+}
 function extractSessionId(headers) {
   const raws = typeof headers.getSetCookie === "function" ? headers.getSetCookie() : [headers.get("set-cookie")].filter((raw) => raw !== null);
   for (const raw of raws) {
@@ -3213,22 +3385,35 @@ function extractSessionId(headers) {
   }
   return void 0;
 }
-
-// src/default-workspace.ts
-import { mkdir } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join } from "node:path";
-var DEFAULT_WORKSPACE_DIR = join(homedir(), "HiWork", "Default");
-var DEFAULT_WORKSPACE_TITLE = "\u9ED8\u8BA4\u5DE5\u4F5C\u533A";
-async function ensureDefaultWorkspace(registry, warn, dir = DEFAULT_WORKSPACE_DIR) {
+async function readJson(res) {
   try {
-    if (registry.list().length > 0) return;
-    await mkdir(dir, { recursive: true });
-    await registry.create(dir, DEFAULT_WORKSPACE_TITLE);
-  } catch (error) {
-    warn(`hiwork-core: ensure default workspace failed: ${error instanceof Error ? error.message : String(error)}`);
+    return await res.json();
+  } catch {
+    return void 0;
+  }
+}
+function meQuery(params) {
+  const pairs = [];
+  for (const [key, value] of params) {
+    if (value === void 0) continue;
+    pairs.push(`${key}=${encodeURIComponent(value)}`);
+  }
+  return pairs.length === 0 ? "" : `?${pairs.join("&")}`;
+}
+async function parseMeJson(res) {
+  const data = await readJson(res);
+  if (data === void 0 || data === null) {
+    throw new GatewayError("GATEWAY_UNREACHABLE", "\u7F51\u5173\u8FD4\u56DE\u7684\u54CD\u5E94\u65E0\u6CD5\u89E3\u6790\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5", res.status);
   }
+  return data;
 }
+function isInvalidGrant(payload) {
+  return typeof payload === "object" && payload !== null && payload.error === "invalid_grant";
+}
+
+// src/browser-login.ts
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { hostname } from "node:os";
 
 // src/provision.ts
 var API_KEY_REF = "AI_ROUTER_API_KEY";
@@ -3236,22 +3421,34 @@ var SESSION_REF = "AI_ROUTER_SESSION";
 var PENDING_PASSWORD_REF = "AI_ROUTER_PENDING_PASSWORD";
 var REMEMBERED_PASSWORD_REF = "AI_ROUTER_REMEMBERED_PASSWORD";
 var PROVIDER_ROUTES = {
-  "ai-router": "openai-responses",
-  "ai-router-anthropic": "anthropic-messages"
+  "ai-router-chat": "openai-completions",
+  "ai-router-anthropic": "anthropic-messages",
+  "ai-router": "openai-responses"
 };
 var DSH_SUPPORTED_MODALITIES = ["text", "image"];
-var PROVIDER_ROUTE_NAMES = ["ai-router", "ai-router-anthropic"];
+var PROVIDER_ROUTE_NAMES = [
+  "ai-router-chat",
+  "ai-router-anthropic",
+  "ai-router"
+];
 var LEGACY_PROVIDER_ROUTE_NAMES = ["ai-router-responses"];
 var ROUTE_DISPLAY_NAMES = {
-  "ai-router": "AI Router",
-  "ai-router-anthropic": "AI Router \xB7 Anthropic"
+  "ai-router-chat": "\u7EBF\u8DEFC",
+  "ai-router-anthropic": "\u7EBF\u8DEFM",
+  "ai-router": "\u7EBF\u8DEFR"
 };
+var GATEWAY_PROTOCOLS = ["openai_chat_completions", "anthropic_messages", "openai_responses"];
 var GATEWAY_PROTOCOL_TO_ROUTE = {
-  openai_chat_completions: "ai-router",
+  openai_responses: "ai-router",
   anthropic_messages: "ai-router-anthropic",
-  openai_responses: "ai-router"
+  openai_chat_completions: "ai-router-chat"
 };
-var ROUTE_PRIORITY = ["ai-router", "ai-router-anthropic"];
+function routeToProtocol(route) {
+  for (const protocol of GATEWAY_PROTOCOLS) {
+    if (GATEWAY_PROTOCOL_TO_ROUTE[protocol] === route) return protocol;
+  }
+  return void 0;
+}
 function computeModelIds(budgets) {
   return [...new Set(
     budgets.filter((b) => b.model_status !== "inactive").map((b) => b.model_name).filter((id) => typeof id === "string" && id.length > 0)
@@ -3296,17 +3493,24 @@ function computeRouteModels(budgets, mapping) {
   const routes = {};
   const unmatched = [];
   for (const model of computeModelDescriptors(budgets)) {
-    const route = ROUTE_PRIORITY.find((r) => mapping.some((item) => matchesRoute(item, r, model.id)));
-    if (route === void 0) {
-      unmatched.push(model);
-      continue;
+    let matched = false;
+    for (const route of PROVIDER_ROUTE_NAMES) {
+      if (!mapping.some((item) => matchesRoute(item, route, model.id))) continue;
+      (routes[route] ??= []).push(model);
+      matched = true;
     }
-    ;
-    (routes[route] ??= []).push(model);
+    if (!matched) unmatched.push(model);
   }
-  if (unmatched.length > 0) routes["ai-router"] = [...routes["ai-router"] ?? [], ...unmatched];
+  if (unmatched.length > 0) routes["ai-router-chat"] = [...routes["ai-router-chat"] ?? [], ...unmatched];
   return routes;
 }
+function pickFallbackDefaultModel(routeModels) {
+  for (const route of PROVIDER_ROUTE_NAMES) {
+    const first = routeModels[route]?.[0];
+    if (first !== void 0) return { provider: route, model: first.id };
+  }
+  return void 0;
+}
 function protocolBaseURL(baseURL, protocol) {
   const bare = baseURL.replace(/\/+$/, "");
   return protocol === "anthropic-messages" ? bare : `${bare}/v1`;
@@ -3333,7 +3537,7 @@ function buildPiAiProviderProfiles(opts) {
   return profiles;
 }
 
-// src/orchestration.ts
+// src/provision-session.ts
 function computeBudgets(budgets) {
   return budgets.filter((b) => typeof b.model_name === "string" && b.model_name.length > 0).filter((b) => b.model_status !== "inactive").map((b) => ({
     model_name: b.model_name,
@@ -3356,6 +3560,385 @@ function toLoginError(error, fallback) {
   if (error instanceof GatewayError) return { code: error.code, message: error.message };
   return { code: "GATEWAY_UNREACHABLE", message: fallback };
 }
+async function provisionSession(opts) {
+  const keys = await opts.gateway.getMyKeys(opts.sessionCookie);
+  const key = await opts.gateway.getMyKey(opts.sessionCookie, opts.value.keyId);
+  const modelIds = computeModelIds(key.budgets);
+  await opts.credentials.set(API_KEY_REF, key.key.key);
+  await opts.onApiKeyWritten?.();
+  const routeModels = modelIds.length > 0 ? computeRouteModels(key.budgets, key.model_mapping ?? []) : void 0;
+  await opts.piAi.applyAiRouterProfiles(
+    routeModels === void 0 ? null : buildPiAiProviderProfiles({ baseURL: opts.baseURL, routeModels })
+  );
+  if (routeModels !== void 0) await opts.defaultModel?.ensure(routeModels);
+  const displayName = opts.user.display_name?.trim() || void 0;
+  const set2 = {
+    ...opts.username === void 0 ? {} : { username: opts.username },
+    ...displayName === void 0 ? {} : { displayName },
+    lastLogin: {
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      modelCount: modelIds.length,
+      gatewayName: key.gateway_name ?? ""
+    },
+    budgets: computeBudgets(key.budgets),
+    keys: computeKeys(keys)
+  };
+  const unset = [...opts.requestUnset ?? []];
+  if (displayName === void 0) unset.push("displayName");
+  if (key.key.enabled === false) {
+    set2.lastError = { code: "KEY_DISABLED", message: "Key \u5F53\u524D\u88AB\u7981\u7528\uFF0C\u8C03\u7528\u4F1A\u5931\u8D25" };
+  } else {
+    unset.push("lastError");
+  }
+  await opts.state.patch({ set: set2, unset });
+  await opts.ensureWorkspace?.();
+}
+
+// src/browser-login.ts
+var BROWSER_LOGIN_TTL_MS = 10 * 60 * 1e3;
+var DEVICE_ID_REF = "hiwork_device_id";
+var NO_BASE_URL_ERROR = {
+  code: "GATEWAY_UNREACHABLE",
+  message: "\u7F51\u5173\u5730\u5740\u672A\u914D\u7F6E\uFF0C\u65E0\u6CD5\u53D1\u8D77\u6D4F\u89C8\u5668\u767B\u5F55"
+};
+var pushedDeviceInfo;
+var pendingAuth;
+function setDeviceInfo(info) {
+  const deviceId = typeof info.deviceId === "string" ? info.deviceId.trim() : "";
+  if (deviceId === "") return;
+  const deviceName = typeof info.deviceName === "string" ? info.deviceName.trim() : "";
+  const appVersion = typeof info.appVersion === "string" ? info.appVersion.trim() : "";
+  pushedDeviceInfo = {
+    deviceId,
+    ...deviceName === "" ? {} : { deviceName },
+    ...appVersion === "" ? {} : { appVersion }
+  };
+}
+function hostName() {
+  try {
+    return hostname().trim();
+  } catch {
+    return "";
+  }
+}
+async function resolveDeviceInfo(credentials) {
+  const platform = process.platform;
+  const appVersion = PKG_VERSION;
+  const pushed = pushedDeviceInfo;
+  if (pushed !== void 0) {
+    const stored2 = await credentials.resolve(DEVICE_ID_REF).catch(() => void 0);
+    if (stored2?.value.trim() !== pushed.deviceId) {
+      await credentials.set(DEVICE_ID_REF, pushed.deviceId).catch(() => {
+      });
+    }
+    return { deviceId: pushed.deviceId, ...pushed.deviceName === void 0 ? {} : { deviceName: pushed.deviceName }, platform, appVersion };
+  }
+  const stored = await credentials.resolve(DEVICE_ID_REF).catch(() => void 0);
+  const storedId = stored?.value.trim();
+  if (storedId !== void 0 && storedId !== "") {
+    return { deviceId: storedId, deviceName: hostName(), platform, appVersion };
+  }
+  const generated = randomUUID();
+  await credentials.set(DEVICE_ID_REF, generated).catch(() => {
+  });
+  return { deviceId: generated, deviceName: hostName(), platform, appVersion };
+}
+function randomToken(bytes) {
+  return randomBytes(bytes).toString("base64url");
+}
+function pkceChallenge(codeVerifier) {
+  return createHash("sha256").update(codeVerifier).digest("base64url");
+}
+async function startBrowserLogin(opts) {
+  const baseURL = opts.value.baseURL;
+  if (baseURL === void 0 || baseURL === "") {
+    await opts.state.patch({
+      set: { lastError: NO_BASE_URL_ERROR },
+      unset: ["browserLoginRequest", "browserLogin"]
+    }).catch(() => {
+    });
+    return void 0;
+  }
+  const now = opts.now ?? Date.now;
+  const startedAt = now();
+  const codeVerifier = randomToken(32);
+  const state = randomToken(16);
+  const device = await resolveDeviceInfo(opts.credentials);
+  pendingAuth = { state, codeVerifier, deviceId: device.deviceId, startedAt };
+  const authorizeUrl = buildAuthorizeURL({
+    baseURL,
+    codeChallenge: pkceChallenge(codeVerifier),
+    state,
+    deviceId: device.deviceId,
+    deviceName: device.deviceName ?? "",
+    platform: device.platform ?? process.platform,
+    appVersion: device.appVersion ?? PKG_VERSION
+  });
+  try {
+    await opts.state.patch({
+      set: { browserLogin: { authorizeUrl, startedAt: new Date(startedAt).toISOString() } },
+      unset: ["browserLoginRequest", "lastError"]
+    });
+  } catch (error) {
+    pendingAuth = void 0;
+    throw error;
+  }
+  return { authorizeUrl, state };
+}
+async function failBrowserLogin(state, loginError) {
+  await state.patch({
+    set: { lastError: loginError },
+    unset: ["browserLoginRequest", "browserLogin"]
+  }).catch(() => {
+  });
+  return loginError;
+}
+async function reconcileStaleBrowserLogin(state, value) {
+  if (value.browserLogin === void 0) return;
+  await state.patch({
+    set: { lastError: { code: "AUTH_FAILED", message: "\u4E0A\u6B21\u6D4F\u89C8\u5668\u6388\u6743\u672A\u5B8C\u6210\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" } },
+    unset: ["browserLoginRequest", "browserLogin"]
+  }).catch(() => {
+  });
+}
+async function completeBrowserLogin(input, opts) {
+  const now = opts.now ?? Date.now;
+  const log = opts.log ?? (() => {
+  });
+  const pending = pendingAuth;
+  if (pending === void 0) {
+    log("hiwork-core: \u6536\u5230\u6D4F\u89C8\u5668\u6388\u6743\u56DE\u8C03\u4F46\u6CA1\u6709\u5F85\u5B8C\u6210\u7684\u6388\u6743\u8BF7\u6C42\uFF0C\u5DF2\u5FFD\u7565");
+    return null;
+  }
+  if (typeof input.state !== "string" || input.state !== pending.state) {
+    log("hiwork-core: \u6D4F\u89C8\u5668\u6388\u6743\u56DE\u8C03 state \u6821\u9A8C\u5931\u8D25\uFF08\u7591\u4F3C\u52AB\u6301\uFF09\uFF0C\u5DF2\u4E22\u5F03\u672C\u6B21\u56DE\u8C03");
+    return null;
+  }
+  try {
+    if (now() - pending.startedAt > BROWSER_LOGIN_TTL_MS) {
+      log("hiwork-core: \u6D4F\u89C8\u5668\u6388\u6743\u56DE\u8C03\u5DF2\u8D85\u65F6\uFF08\u8D85\u8FC7 10 \u5206\u949F\uFF09\uFF0C\u5DF2\u62D2\u7EDD");
+      return await failBrowserLogin(opts.state, { code: "AUTH_FAILED", message: "\u6388\u6743\u5DF2\u8D85\u65F6\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" });
+    }
+    if (typeof input.error === "string" && input.error !== "") {
+      log(`hiwork-core: \u6D4F\u89C8\u5668\u6388\u6743\u88AB\u62D2\u7EDD\uFF08${input.error.slice(0, 64)}\uFF09`);
+      return await failBrowserLogin(opts.state, { code: "AUTH_FAILED", message: "\u6388\u6743\u88AB\u53D6\u6D88\u6216\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" });
+    }
+    if (typeof input.code !== "string" || input.code === "") {
+      log("hiwork-core: \u6D4F\u89C8\u5668\u6388\u6743\u56DE\u8C03\u7F3A\u5C11 code\uFF0C\u5DF2\u4E22\u5F03");
+      return await failBrowserLogin(opts.state, { code: "AUTH_FAILED", message: "\u6388\u6743\u56DE\u8C03\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" });
+    }
+    const baseURL = opts.value.baseURL;
+    if (baseURL === void 0 || baseURL === "") return await failBrowserLogin(opts.state, NO_BASE_URL_ERROR);
+    const { sessionCookie, user } = await opts.gateway.exchangeCode({
+      code: input.code,
+      codeVerifier: pending.codeVerifier,
+      deviceId: pending.deviceId
+    });
+    await opts.credentials.set(SESSION_REF, sessionCookie);
+    const username = typeof user.username === "string" && user.username.trim() !== "" ? user.username.trim() : void 0;
+    await provisionSession({
+      gateway: opts.gateway,
+      credentials: opts.credentials,
+      piAi: opts.piAi,
+      state: opts.state,
+      baseURL,
+      value: opts.value,
+      sessionCookie,
+      user,
+      username,
+      requestUnset: ["browserLoginRequest", "browserLogin"],
+      ...opts.defaultModel === void 0 ? {} : { defaultModel: opts.defaultModel },
+      ...opts.ensureWorkspace === void 0 ? {} : { ensureWorkspace: opts.ensureWorkspace }
+    });
+    return null;
+  } catch (error) {
+    const loginError = toLoginError(error, "\u65E0\u6CD5\u8FDE\u63A5\u7F51\u5173\uFF0C\u8BF7\u68C0\u67E5 baseURL \u6216\u7F51\u7EDC");
+    return await failBrowserLogin(opts.state, loginError);
+  } finally {
+    pendingAuth = void 0;
+  }
+}
+
+// src/client-policy.ts
+var DEFAULT_LOGIN_MODE = "both";
+var CLIENT_POLICY_PATH = "/api/client/policy";
+var CLIENT_POLICY_TIMEOUT_MS = 5e3;
+function buildClientPolicyURL(opts) {
+  const baseURL = typeof opts.baseURL === "string" ? opts.baseURL.trim().replace(/\/+$/, "") : "";
+  if (baseURL === "") return void 0;
+  const params = [
+    ["platform", opts.platform],
+    ["arch", opts.arch],
+    ["version", opts.version],
+    ["device_id", opts.deviceId]
+  ];
+  const query = params.filter(([, value]) => typeof value === "string" && value !== "").map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join("&");
+  return query === "" ? `${baseURL}${CLIENT_POLICY_PATH}` : `${baseURL}${CLIENT_POLICY_PATH}?${query}`;
+}
+function parseLoginMode(payload) {
+  if (typeof payload !== "object" || payload === null) return void 0;
+  const value = payload.loginMode;
+  return value === "browser" || value === "form" || value === "both" ? value : void 0;
+}
+async function fetchClientPolicy(opts) {
+  const url = buildClientPolicyURL(opts);
+  if (url === void 0) return void 0;
+  try {
+    const res = await fetch(url, {
+      method: "GET",
+      headers: { "user-agent": `hiwork-core/${PKG_VERSION}`, accept: "application/json" },
+      signal: AbortSignal.timeout(opts.timeoutMs ?? CLIENT_POLICY_TIMEOUT_MS)
+    });
+    if (res.status !== 200) return void 0;
+    let payload;
+    try {
+      payload = await res.json();
+    } catch {
+      return void 0;
+    }
+    const loginMode = parseLoginMode(payload);
+    return loginMode === void 0 ? void 0 : { loginMode };
+  } catch {
+    return void 0;
+  }
+}
+
+// src/default-model.ts
+var DEFAULT_MODEL_NS = "agent-default-model";
+async function ensureDefaultModel(routeModels, ports) {
+  if (!ports.available()) return void 0;
+  const current = ports.read();
+  if (current !== void 0 && await routable(current, routeModels, ports)) return void 0;
+  const next = pickFallbackDefaultModel(routeModels);
+  if (next === void 0) return void 0;
+  await ports.write(next);
+  return next;
+}
+async function routable(selection, routeModels, ports) {
+  const models = routeModels[selection.provider];
+  if (models !== void 0) return models.some((model) => model.id === selection.model);
+  return ports.isRoutableElsewhere(selection);
+}
+
+// src/default-workspace.ts
+import { mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var DEFAULT_WORKSPACE_DIR = join(homedir(), "HiWork", "Default");
+var DEFAULT_WORKSPACE_TITLE = "\u9ED8\u8BA4\u5DE5\u4F5C\u533A";
+async function ensureDefaultWorkspace(registry, warn, dir = DEFAULT_WORKSPACE_DIR) {
+  try {
+    if (registry.list().length > 0) return;
+    await mkdir(dir, { recursive: true });
+    await registry.create(dir, DEFAULT_WORKSPACE_TITLE);
+  } catch (error) {
+    warn(`hiwork-core: ensure default workspace failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+// src/daily-rpc.ts
+var DAILY_RPC_CHANNEL = "/hiwork-daily";
+var DAILY_RPC_ENDPOINTS = ["today", "random"];
+var DailyRequestError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "DailyRequestError";
+  }
+};
+var DAILY_MESSAGE_FALLBACK = {
+  SESSION_EXPIRED: "\u767B\u5F55\u72B6\u6001\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55",
+  GATEWAY_UNREACHABLE: "\u7F51\u5173\u6682\u65F6\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+  RATE_LIMITED: "\u8BF7\u6C42\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5",
+  NOT_FOUND: "\u7F51\u5173\u672A\u627E\u5230\u5BF9\u5E94\u7684\u6570\u636E",
+  AUTH_FAILED: "\u767B\u5F55\u72B6\u6001\u5F02\u5E38\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55"
+};
+var DAILY_GENERIC_FAILURE_MESSAGE = "\u6BCF\u65E5\u4E00\u53E5\u6682\u65F6\u65E0\u6CD5\u83B7\u53D6\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5";
+var DAILY_SESSION_EXPIRED_MESSAGE = "\u767B\u5F55\u72B6\u6001\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55";
+function displayDailyGatewayMessage(code, message) {
+  const text = typeof message === "string" ? message.trim() : "";
+  if (text === "") return DAILY_MESSAGE_FALLBACK[code] ?? DAILY_GENERIC_FAILURE_MESSAGE;
+  const leaksImplementationDetail = /https?:\/\//i.test(text) || /\bHTTP\s*\d{3}\b/i.test(text) || /\bbaseURL\b/i.test(text);
+  if (leaksImplementationDetail) return DAILY_MESSAGE_FALLBACK[code] ?? DAILY_GENERIC_FAILURE_MESSAGE;
+  return text;
+}
+function parseDailyPayload(endpoint, raw) {
+  if (raw === void 0 || raw === null) return {};
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw new DailyRequestError("bad-request", "\u6BCF\u65E5\u4E00\u53E5\u8BF7\u6C42\u53C2\u6570\u4E0D\u5408\u6CD5\u3002");
+  }
+  const record = raw;
+  const keys = Object.keys(record);
+  if (endpoint === "today") {
+    if (keys.length > 0) throw new DailyRequestError("bad-request", `\u6BCF\u65E5\u4E00\u53E5\u8BF7\u6C42\u5305\u542B\u672A\u77E5\u5B57\u6BB5 '${keys[0]}'\u3002`);
+    return {};
+  }
+  for (const key of keys) {
+    if (key !== "excludeId") throw new DailyRequestError("bad-request", `\u6BCF\u65E5\u4E00\u53E5\u8BF7\u6C42\u5305\u542B\u672A\u77E5\u5B57\u6BB5 '${key}'\u3002`);
+  }
+  const payload = {};
+  const rawExcludeId = record["excludeId"];
+  if (rawExcludeId !== void 0) {
+    if (typeof rawExcludeId !== "number" || !Number.isInteger(rawExcludeId) || rawExcludeId <= 0) {
+      throw new DailyRequestError("bad-request", "\u6BCF\u65E5\u4E00\u53E5\u8BF7\u6C42\u7684 excludeId \u5FC5\u987B\u662F\u6B63\u6574\u6570\u3002");
+    }
+    payload.excludeId = rawExcludeId;
+  }
+  return payload;
+}
+function isDailyRpcEndpoint(endpoint) {
+  return DAILY_RPC_ENDPOINTS.includes(endpoint);
+}
+function isAborted(signal) {
+  return signal?.aborted === true;
+}
+async function handleDailyEndpoint(endpoint, rawPayload, deps, signal) {
+  try {
+    if (isAborted(signal)) return failure("cancelled", "\u6BCF\u65E5\u4E00\u53E5\u8BF7\u6C42\u5DF2\u53D6\u6D88\u3002");
+    if (!isDailyRpcEndpoint(endpoint)) {
+      throw new DailyRequestError("bad-request", `\u672A\u77E5\u7684\u6BCF\u65E5\u4E00\u53E5\u7AEF\u70B9 '${endpoint}'`);
+    }
+    const payload = parseDailyPayload(endpoint, rawPayload);
+    const sessionCookie = await deps.resolveSession();
+    if (sessionCookie === void 0 || sessionCookie === "") {
+      return failure("SESSION_EXPIRED", DAILY_SESSION_EXPIRED_MESSAGE);
+    }
+    const gateway = deps.gateway();
+    if (gateway === void 0) {
+      return failure("GATEWAY_UNREACHABLE", "\u7F51\u5173\u5730\u5740\u672A\u914D\u7F6E\uFF0C\u8BF7\u5148\u5728\u300C\u7F51\u5173\u6A21\u578B\u300D\u91CC\u5B8C\u6210\u767B\u5F55");
+    }
+    if (isAborted(signal)) return failure("cancelled", "\u6BCF\u65E5\u4E00\u53E5\u8BF7\u6C42\u5DF2\u53D6\u6D88\u3002");
+    const value = await callEndpoint(gateway, sessionCookie, endpoint, payload);
+    return { ok: true, value };
+  } catch (error) {
+    if (error instanceof DailyRequestError) return failure(error.code, error.message);
+    if (error instanceof GatewayError) {
+      return failure(error.code, displayDailyGatewayMessage(error.code, error.message));
+    }
+    deps.log?.(`hiwork-core: \u6BCF\u65E5\u4E00\u53E5 RPC '${endpoint}' \u5931\u8D25\uFF08${error instanceof Error ? error.name : typeof error}\uFF09`);
+    return failure("internal", DAILY_GENERIC_FAILURE_MESSAGE);
+  }
+}
+async function callEndpoint(gateway, sessionCookie, endpoint, payload) {
+  switch (endpoint) {
+    case "today":
+      return await gateway.getMyDailyQuote(sessionCookie);
+    case "random":
+      return await gateway.getMyDailyQuoteRandom(sessionCookie, payload.excludeId);
+  }
+}
+function failure(code, message) {
+  return { ok: false, error: { code, message, details: {} } };
+}
+function registerDailyRpc(ctx, deps) {
+  const handler = (endpoint, payload, signal) => handleDailyEndpoint(endpoint, payload, deps, signal);
+  const remove = ctx.connection.rpc.handle(DAILY_RPC_CHANNEL, handler, { authority: "loopback" });
+  return async () => {
+    await remove();
+  };
+}
+
+// src/orchestration.ts
 async function runLogin(opts) {
   const pending = opts.value.pendingLogin;
   const baseURL = opts.value.baseURL;
@@ -3369,40 +3952,23 @@ async function runLogin(opts) {
   try {
     const password = await opts.credentials.resolve(pending.passwordRef);
     if (password === void 0) throw new GatewayError("AUTH_FAILED", "\u767B\u5F55\u51ED\u636E\u7F3A\u5931\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55");
-    const { sessionCookie, user } = await opts.gateway.login(pending.username, password.value);
+    const device = await resolveDeviceInfo(opts.credentials);
+    const { sessionCookie, user } = await opts.gateway.login(pending.username, password.value, device);
     await opts.credentials.set(SESSION_REF, sessionCookie);
-    const keys = await opts.gateway.getMyKeys(sessionCookie);
-    const key = await opts.gateway.getMyKey(sessionCookie, opts.value.keyId);
-    const modelIds = computeModelIds(key.budgets);
-    await opts.credentials.set(API_KEY_REF, key.key.key);
-    if (opts.value.rememberPassword === true) await opts.credentials.set(REMEMBERED_PASSWORD_REF, password.value);
-    else await opts.credentials.unset(REMEMBERED_PASSWORD_REF).catch(() => {
-    });
-    if (pending.passwordRef !== REMEMBERED_PASSWORD_REF) await opts.credentials.unset(pending.passwordRef);
-    await opts.piAi.applyAiRouterProfiles(
-      modelIds.length > 0 ? buildPiAiProviderProfiles({ baseURL, routeModels: computeRouteModels(key.budgets, key.model_mapping ?? []) }) : null
-    );
-    const displayName = user.display_name?.trim() || void 0;
-    const set2 = {
+    await provisionSession({
+      ...opts,
+      baseURL,
+      sessionCookie,
+      user,
       username: pending.username,
-      ...displayName === void 0 ? {} : { displayName },
-      lastLogin: {
-        at: (/* @__PURE__ */ new Date()).toISOString(),
-        modelCount: modelIds.length,
-        gatewayName: key.gateway_name ?? ""
-      },
-      budgets: computeBudgets(key.budgets),
-      keys: computeKeys(keys)
-    };
-    const unset = ["pendingLogin"];
-    if (displayName === void 0) unset.push("displayName");
-    if (key.key.enabled === false) {
-      set2.lastError = { code: "KEY_DISABLED", message: "Key \u5F53\u524D\u88AB\u7981\u7528\uFF0C\u8C03\u7528\u4F1A\u5931\u8D25" };
-    } else {
-      unset.push("lastError");
-    }
-    await opts.state.patch({ set: set2, unset });
-    await opts.ensureWorkspace?.();
+      requestUnset: ["pendingLogin"],
+      onApiKeyWritten: async () => {
+        if (opts.value.rememberPassword === true) await opts.credentials.set(REMEMBERED_PASSWORD_REF, password.value);
+        else await opts.credentials.unset(REMEMBERED_PASSWORD_REF).catch(() => {
+        });
+        if (pending.passwordRef !== REMEMBERED_PASSWORD_REF) await opts.credentials.unset(pending.passwordRef);
+      }
+    });
     return null;
   } catch (error) {
     const loginError = toLoginError(error, "\u65E0\u6CD5\u8FDE\u63A5\u7F51\u5173\uFF0C\u8BF7\u68C0\u67E5 baseURL \u6216\u7F51\u7EDC");
@@ -3430,9 +3996,11 @@ async function runRefresh(opts) {
     const key = await opts.gateway.getMyKey(session.value, opts.value.keyId);
     const modelIds = computeModelIds(key.budgets);
     await opts.credentials.set(API_KEY_REF, key.key.key);
+    const routeModels = modelIds.length > 0 ? computeRouteModels(key.budgets, key.model_mapping ?? []) : void 0;
     await opts.piAi.applyAiRouterProfiles(
-      modelIds.length > 0 ? buildPiAiProviderProfiles({ baseURL, routeModels: computeRouteModels(key.budgets, key.model_mapping ?? []) }) : null
+      routeModels === void 0 ? null : buildPiAiProviderProfiles({ baseURL, routeModels })
     );
+    if (routeModels !== void 0) await opts.defaultModel?.ensure(routeModels);
     const set2 = {
       lastLogin: {
         at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -3482,12 +4050,31 @@ async function runLogout(opts) {
   });
   await opts.piAi.applyAiRouterProfiles(null);
   await opts.state.patch({
-    unset: ["pendingLogin", "refreshRequest", "logoutRequest", "username", "displayName", "lastLogin", "lastError", "keyId", "budgets", "keys"]
+    unset: [
+      "pendingLogin",
+      "refreshRequest",
+      "logoutRequest",
+      "browserLoginRequest",
+      "browserLogin",
+      "username",
+      "displayName",
+      "lastLogin",
+      "lastError",
+      "keyId",
+      "budgets",
+      "keys"
+    ]
   });
 }
+async function handleBrowserLoginRequest(opts) {
+  const started = await startBrowserLogin(opts);
+  if (started !== void 0) return null;
+  return NO_BASE_URL_ERROR;
+}
 async function handleAiRouterSectionChange(opts) {
   const v = opts.value;
   if (v.pendingLogin !== void 0) return runLogin(opts);
+  if (v.browserLoginRequest !== void 0) return handleBrowserLoginRequest(opts);
   if (v.refreshRequest !== void 0) return runRefresh(opts);
   if (v.logoutRequest !== void 0) {
     await runLogout(opts);
@@ -3496,9 +4083,269 @@ async function handleAiRouterSectionChange(opts) {
   return null;
 }
 
+// src/usage-rpc.ts
+var USAGE_RPC_CHANNEL = "/hiwork-usage";
+var USAGE_RPC_ENDPOINTS = ["summary", "trends", "model-trends", "recharges", "keys", "key", "estimate"];
+var USAGE_RPC_RANGES = ["today", "yesterday", "24h", "7d", "30d", "mtd"];
+var USAGE_ESTIMATE_MAX_ITEMS = 50;
+var UsageRequestError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "UsageRequestError";
+  }
+};
+var GATEWAY_MESSAGE_FALLBACK = {
+  SESSION_EXPIRED: "\u767B\u5F55\u72B6\u6001\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55",
+  GATEWAY_UNREACHABLE: "\u7F51\u5173\u6682\u65F6\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+  NO_KEY_ASSIGNED: "\u5F53\u524D\u8D26\u53F7\u5C1A\u672A\u88AB\u5206\u914D\u865A\u62DF KEY\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458",
+  KEY_INVALID: "\u6240\u9009 KEY \u65E0\u6548\u6216\u5DF2\u88AB\u5220\u9664\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9 KEY",
+  RATE_LIMITED: "\u8BF7\u6C42\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5",
+  NOT_FOUND: "\u7F51\u5173\u672A\u627E\u5230\u5BF9\u5E94\u7684\u6570\u636E",
+  AUTH_FAILED: "\u767B\u5F55\u72B6\u6001\u5F02\u5E38\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55"
+};
+var USAGE_GENERIC_FAILURE_MESSAGE = "\u7528\u91CF\u6570\u636E\u6682\u65F6\u65E0\u6CD5\u83B7\u53D6\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5";
+var USAGE_SESSION_EXPIRED_MESSAGE = "\u767B\u5F55\u72B6\u6001\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55";
+function displayGatewayMessage(code, message) {
+  const text = typeof message === "string" ? message.trim() : "";
+  if (text === "") return GATEWAY_MESSAGE_FALLBACK[code] ?? USAGE_GENERIC_FAILURE_MESSAGE;
+  const leaksImplementationDetail = /https?:\/\//i.test(text) || /\bHTTP\s*\d{3}\b/i.test(text) || /\bbaseURL\b/i.test(text);
+  if (leaksImplementationDetail) return GATEWAY_MESSAGE_FALLBACK[code] ?? USAGE_GENERIC_FAILURE_MESSAGE;
+  return text;
+}
+function parseUsagePayload(raw) {
+  if (raw === void 0 || raw === null) return {};
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw new UsageRequestError("bad-request", "\u7528\u91CF\u8BF7\u6C42\u53C2\u6570\u4E0D\u5408\u6CD5\u3002");
+  }
+  const record = raw;
+  for (const key of Object.keys(record)) {
+    if (key !== "keyId" && key !== "range") {
+      throw new UsageRequestError("bad-request", `\u7528\u91CF\u8BF7\u6C42\u5305\u542B\u672A\u77E5\u5B57\u6BB5 '${key}'\u3002`);
+    }
+  }
+  const payload = {};
+  const rawKeyId = record["keyId"];
+  if (rawKeyId !== void 0) {
+    if (typeof rawKeyId !== "string") throw new UsageRequestError("bad-request", "\u7528\u91CF\u8BF7\u6C42\u7684 keyId \u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u3002");
+    const keyId = rawKeyId.trim();
+    if (keyId !== "") payload.keyId = keyId;
+  }
+  const rawRange = record["range"];
+  if (rawRange !== void 0) {
+    if (typeof rawRange !== "string" || !USAGE_RPC_RANGES.includes(rawRange)) {
+      throw new UsageRequestError("bad-request", `\u7528\u91CF\u8BF7\u6C42\u7684 range \u4E0D\u5408\u6CD5\uFF08\u53EF\u7528\u503C\uFF1A${USAGE_RPC_RANGES.join(" / ")}\uFF09\u3002`);
+    }
+    payload.range = rawRange;
+  }
+  return payload;
+}
+function isUsageRpcEndpoint(endpoint) {
+  return USAGE_RPC_ENDPOINTS.includes(endpoint);
+}
+var ESTIMATE_ITEM_KEYS = [
+  "route",
+  "model",
+  "input_tokens",
+  "output_tokens",
+  "cache_read_tokens",
+  "cache_write_tokens",
+  "at"
+];
+function parseEstimatePayload(raw) {
+  if (raw === void 0 || raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new UsageRequestError("bad-request", "\u8BA1\u4EF7\u8BF7\u6C42\u53C2\u6570\u4E0D\u5408\u6CD5\u3002");
+  }
+  const record = raw;
+  for (const key of Object.keys(record)) {
+    if (key !== "items") throw new UsageRequestError("bad-request", `\u8BA1\u4EF7\u8BF7\u6C42\u5305\u542B\u672A\u77E5\u5B57\u6BB5 '${key}'\u3002`);
+  }
+  const rawItems = record["items"];
+  if (!Array.isArray(rawItems)) throw new UsageRequestError("bad-request", "\u8BA1\u4EF7\u8BF7\u6C42\u7684 items \u5FC5\u987B\u662F\u6570\u7EC4\u3002");
+  if (rawItems.length === 0) throw new UsageRequestError("bad-request", "\u8BA1\u4EF7\u8BF7\u6C42\u7684 items \u4E0D\u80FD\u4E3A\u7A7A\u3002");
+  return rawItems.map((item, index) => parseEstimateItem(item, index));
+}
+function parseEstimateItem(raw, index) {
+  const position = index + 1;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new UsageRequestError("bad-request", `\u8BA1\u4EF7\u8BF7\u6C42\u7B2C ${position} \u9879\u5FC5\u987B\u662F\u5BF9\u8C61\u3002`);
+  }
+  const record = raw;
+  for (const key of Object.keys(record)) {
+    if (!ESTIMATE_ITEM_KEYS.includes(key)) {
+      throw new UsageRequestError("bad-request", `\u8BA1\u4EF7\u8BF7\u6C42\u7B2C ${position} \u9879\u5305\u542B\u672A\u77E5\u5B57\u6BB5 '${key}'\u3002`);
+    }
+  }
+  const item = {
+    route: requiredText(record["route"], position, "route"),
+    model: requiredText(record["model"], position, "model"),
+    input_tokens: tokenCount(record["input_tokens"], position, "input_tokens"),
+    output_tokens: tokenCount(record["output_tokens"], position, "output_tokens")
+  };
+  const cacheRead = optionalTokenCount(record["cache_read_tokens"], position, "cache_read_tokens");
+  if (cacheRead !== void 0) item.cache_read_tokens = cacheRead;
+  const cacheWrite = optionalTokenCount(record["cache_write_tokens"], position, "cache_write_tokens");
+  if (cacheWrite !== void 0) item.cache_write_tokens = cacheWrite;
+  const at = record["at"];
+  if (at !== void 0) {
+    if (typeof at !== "string" || !isRfc3339(at)) {
+      throw new UsageRequestError("bad-request", `\u8BA1\u4EF7\u8BF7\u6C42\u7B2C ${position} \u9879\u7684 at \u5FC5\u987B\u662F RFC3339 \u65F6\u95F4\u3002`);
+    }
+    item.at = at;
+  }
+  return item;
+}
+function isRfc3339(value) {
+  const match = RFC3339_PATTERN.exec(value);
+  if (match === null) return false;
+  const field = (index) => Number(match[index] ?? Number.NaN);
+  const year = field(1);
+  const month = field(2);
+  const day = field(3);
+  const hour = field(4);
+  const minute = field(5);
+  const second = field(6);
+  if (![year, month, day, hour, minute, second].every((part) => Number.isInteger(part))) return false;
+  if (month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month)) return false;
+  if (hour > 23 || minute > 59 || second > 59) return false;
+  if (match[7] !== void 0) {
+    const offsetHour = field(8);
+    const offsetMinute = field(9);
+    if (!Number.isInteger(offsetHour) || !Number.isInteger(offsetMinute)) return false;
+    if (offsetHour > 23 || offsetMinute > 59) return false;
+  }
+  return true;
+}
+var RFC3339_PATTERN = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|([+-])(\d{2}):(\d{2}))$/;
+function daysInMonth(year, month) {
+  if (month === 2) return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28;
+  return [31, 0, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1] ?? 0;
+}
+function requiredText(value, position, field) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new UsageRequestError("bad-request", `\u8BA1\u4EF7\u8BF7\u6C42\u7B2C ${position} \u9879\u7684 ${field} \u4E0D\u80FD\u4E3A\u7A7A\u3002`);
+  }
+  return value.trim();
+}
+function tokenCount(value, position, field) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+    throw new UsageRequestError("bad-request", `\u8BA1\u4EF7\u8BF7\u6C42\u7B2C ${position} \u9879\u7684 ${field} \u5FC5\u987B\u662F\u975E\u8D1F\u6574\u6570\u3002`);
+  }
+  return value;
+}
+function optionalTokenCount(value, position, field) {
+  return value === void 0 ? void 0 : tokenCount(value, position, field);
+}
+function unpriced(reason) {
+  return { cost: 0, priced: false, channelResolved: false, reason };
+}
+function summarizeEstimate(results, expected) {
+  if (results.length !== expected) return unpriced("incomplete");
+  let cost = 0;
+  let channelResolved = true;
+  for (const result of results) {
+    if (result?.priced !== true) return unpriced(result?.reason ?? "unpriced");
+    const value = result.cost;
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return unpriced("invalid_cost");
+    cost += value;
+    if (result.channel_resolved !== true) channelResolved = false;
+  }
+  return { cost, priced: true, channelResolved };
+}
+async function handleEstimateEndpoint(items, deps, signal) {
+  const sessionCookie = await deps.resolveSession();
+  if (sessionCookie === void 0 || sessionCookie === "") return { ok: true, value: unpriced("no_session") };
+  if (isAborted2(signal)) return failure2("cancelled", "\u7528\u91CF\u8BF7\u6C42\u5DF2\u53D6\u6D88\u3002");
+  if (items.length > USAGE_ESTIMATE_MAX_ITEMS) return { ok: true, value: unpriced("too_many_items") };
+  const gatewayItems = [];
+  for (const item of items) {
+    const protocol = routeToProtocol(item.route);
+    if (protocol === void 0) continue;
+    gatewayItems.push({
+      route: protocol,
+      model: item.model,
+      input_tokens: item.input_tokens,
+      output_tokens: item.output_tokens,
+      ...item.cache_read_tokens === void 0 ? {} : { cache_read_tokens: item.cache_read_tokens },
+      ...item.cache_write_tokens === void 0 ? {} : { cache_write_tokens: item.cache_write_tokens },
+      ...item.at === void 0 ? {} : { at: item.at }
+    });
+  }
+  if (gatewayItems.length === 0) return { ok: true, value: unpriced("no_route") };
+  const gateway = deps.gateway();
+  if (gateway === void 0) {
+    return failure2("GATEWAY_UNREACHABLE", "\u7F51\u5173\u5730\u5740\u672A\u914D\u7F6E\uFF0C\u8BF7\u5148\u5728\u300C\u7F51\u5173\u6A21\u578B\u300D\u91CC\u5B8C\u6210\u767B\u5F55");
+  }
+  if (isAborted2(signal)) return failure2("cancelled", "\u7528\u91CF\u8BF7\u6C42\u5DF2\u53D6\u6D88\u3002");
+  const response = await gateway.estimateCost(sessionCookie, gatewayItems);
+  const results = response?.items;
+  if (!Array.isArray(results)) {
+    deps.log?.("hiwork-core: \u8BA1\u4EF7 RPC \u6536\u5230\u65E0\u6548\u54CD\u5E94\uFF08items \u4E0D\u662F\u6570\u7EC4\uFF09");
+    return failure2("internal", USAGE_GENERIC_FAILURE_MESSAGE);
+  }
+  return { ok: true, value: summarizeEstimate(results, gatewayItems.length) };
+}
+function isAborted2(signal) {
+  return signal?.aborted === true;
+}
+async function handleUsageEndpoint(endpoint, rawPayload, deps, signal) {
+  try {
+    if (isAborted2(signal)) return failure2("cancelled", "\u7528\u91CF\u8BF7\u6C42\u5DF2\u53D6\u6D88\u3002");
+    if (!isUsageRpcEndpoint(endpoint)) {
+      throw new UsageRequestError("bad-request", `\u672A\u77E5\u7684\u7528\u91CF\u7AEF\u70B9 '${endpoint}'`);
+    }
+    if (endpoint === "estimate") return await handleEstimateEndpoint(parseEstimatePayload(rawPayload), deps, signal);
+    const payload = parseUsagePayload(rawPayload);
+    const sessionCookie = await deps.resolveSession();
+    if (sessionCookie === void 0 || sessionCookie === "") {
+      return failure2("SESSION_EXPIRED", USAGE_SESSION_EXPIRED_MESSAGE);
+    }
+    const gateway = deps.gateway();
+    if (gateway === void 0) {
+      return failure2("GATEWAY_UNREACHABLE", "\u7F51\u5173\u5730\u5740\u672A\u914D\u7F6E\uFF0C\u8BF7\u5148\u5728\u300C\u7F51\u5173\u6A21\u578B\u300D\u91CC\u5B8C\u6210\u767B\u5F55");
+    }
+    if (isAborted2(signal)) return failure2("cancelled", "\u7528\u91CF\u8BF7\u6C42\u5DF2\u53D6\u6D88\u3002");
+    const value = await callEndpoint2(gateway, sessionCookie, endpoint, payload);
+    return { ok: true, value };
+  } catch (error) {
+    if (error instanceof UsageRequestError) return failure2(error.code, error.message);
+    if (error instanceof GatewayError) {
+      return failure2(error.code, displayGatewayMessage(error.code, error.message));
+    }
+    deps.log?.(`hiwork-core: \u7528\u91CF RPC '${endpoint}' \u5931\u8D25\uFF08${error instanceof Error ? error.name : typeof error}\uFF09`);
+    return failure2("internal", USAGE_GENERIC_FAILURE_MESSAGE);
+  }
+}
+async function callEndpoint2(gateway, sessionCookie, endpoint, payload) {
+  switch (endpoint) {
+    case "summary":
+      return await gateway.getMySummary(sessionCookie, payload.keyId, payload.range);
+    case "trends":
+      return await gateway.getMyTrends(sessionCookie, payload.keyId, payload.range);
+    case "model-trends":
+      return await gateway.getMyModelTrends(sessionCookie, payload.keyId, payload.range);
+    case "recharges":
+      return await gateway.getMyKeyRecharges(sessionCookie, payload.keyId);
+    case "keys":
+      return await gateway.getMyKeys(sessionCookie);
+    case "key":
+      return await gateway.getMyKey(sessionCookie, payload.keyId);
+  }
+}
+function failure2(code, message) {
+  return { ok: false, error: { code, message, details: {} } };
+}
+function registerUsageRpc(ctx, deps) {
+  const handler = (endpoint, payload, signal) => handleUsageEndpoint(endpoint, payload, deps, signal);
+  const remove = ctx.connection.rpc.handle(USAGE_RPC_CHANNEL, handler, { authority: "loopback" });
+  return async () => {
+    await remove();
+  };
+}
+
 // src/index.ts
 var name = "hiwork-core";
-var inject = ["settings", "credentials", "workspaceRegistry"];
+var inject = ["settings", "credentials", "workspaceRegistry", "connection"];
 var NS = "ai-router";
 var PI_AI_NS = "llm-pi-ai";
 var lastErrorSchema = Schema.object({ code: Schema.string().required(), message: Schema.string().required() }).default(void 0);
@@ -3513,6 +4360,10 @@ var Config = Schema.object({
   rememberPassword: Schema.boolean().default(false),
   refreshRequest: Schema.object({ at: Schema.string().required() }).default(void 0),
   logoutRequest: Schema.object({ at: Schema.string().required() }).default(void 0),
+  browserLoginRequest: Schema.object({ at: Schema.string().required() }).default(void 0),
+  browserLogin: Schema.object({ authorizeUrl: Schema.string().required(), startedAt: Schema.string().required() }).default(void 0),
+  // 三值枚举：非法值写入直接被 schema 拒绝（客户端还会再归一一次，双保险）。
+  loginMode: Schema.union([Schema.const("browser"), Schema.const("form"), Schema.const("both")]),
   budgets: Schema.array(Schema.object({
     model_name: Schema.string().required(),
     total_budget: Schema.number(),
@@ -3550,10 +4401,169 @@ async function writeNamespace(settings, ns, ops) {
   }
   throw new Error(`settings namespace "${ns}" write conflicted repeatedly`);
 }
+function readDefaultSelection(settings) {
+  const value = settings.get(DEFAULT_MODEL_NS);
+  if (value === null || typeof value !== "object") return void 0;
+  const { provider, model } = value;
+  if (typeof provider !== "string" || typeof model !== "string") return void 0;
+  return { provider, model };
+}
+function createDefaultModelPort(opts) {
+  const { settings, llm } = opts;
+  return {
+    ensure: async (routeModels) => {
+      const next = await ensureDefaultModel(routeModels, {
+        available: () => settings.describe().some((descriptor) => descriptor.ns === DEFAULT_MODEL_NS),
+        read: () => readDefaultSelection(settings),
+        isRoutableElsewhere: async ({ provider, model }) => {
+          if (llm === void 0) return false;
+          if (!llm.listProviders().some((entry) => entry.id === provider)) return false;
+          try {
+            return (await llm.listModels(provider)).some((entry) => entry.id === model);
+          } catch {
+            return false;
+          }
+        },
+        write: async (selection) => {
+          await writeNamespace(settings, DEFAULT_MODEL_NS, [
+            { op: "set", path: ["provider"], value: selection.provider },
+            { op: "set", path: ["model"], value: selection.model },
+            // 换模型后旧的 effort 可能不被新模型支持，一并清掉。
+            { op: "unset", path: ["reasoningEffort"] }
+          ]);
+        }
+      });
+      if (next !== void 0) opts.log?.(`hiwork-core: \u9ED8\u8BA4\u6A21\u578B\u6821\u6B63\u4E3A ${next.provider}/${next.model}`);
+    }
+  };
+}
+var IPC_AUTH_CALLBACK = "hiwork:auth-callback";
+var IPC_DEVICE_INFO = "hiwork:device-info";
+var IPC_FIELD_MAX_LENGTH = 4096;
+var IPC_DEVICE_ID_MAX_LENGTH = 128;
+var IPC_DEVICE_NAME_MAX_LENGTH = 256;
+var IPC_APP_VERSION_MAX_LENGTH = 32;
+function readOptionalString(value, maxLength) {
+  if (value === void 0) return { ok: true, value: void 0 };
+  if (typeof value !== "string" || value.length > maxLength) return { ok: false };
+  return { ok: true, value };
+}
+function parseAuthCallback(message) {
+  const code = readOptionalString(message.code, IPC_FIELD_MAX_LENGTH);
+  const state = readOptionalString(message.state, IPC_FIELD_MAX_LENGTH);
+  const error = readOptionalString(message.error, IPC_FIELD_MAX_LENGTH);
+  if (!code.ok || !state.ok || !error.ok) return void 0;
+  return {
+    ...code.value === void 0 ? {} : { code: code.value },
+    ...state.value === void 0 ? {} : { state: state.value },
+    ...error.value === void 0 ? {} : { error: error.value }
+  };
+}
+function parseDeviceInfo(message) {
+  const deviceId = readOptionalString(message.deviceId, IPC_DEVICE_ID_MAX_LENGTH);
+  const deviceName = readOptionalString(message.deviceName, IPC_DEVICE_NAME_MAX_LENGTH);
+  const appVersion = readOptionalString(message.appVersion, IPC_APP_VERSION_MAX_LENGTH);
+  if (!deviceId.ok || !deviceName.ok || !appVersion.ok) return void 0;
+  const id = deviceId.value?.trim();
+  if (id === void 0 || id === "") return void 0;
+  const name2 = deviceName.value?.trim();
+  const version = appVersion.value?.trim();
+  return {
+    deviceId: id,
+    ...name2 === void 0 || name2 === "" ? {} : { deviceName: name2 },
+    ...version === void 0 || version === "" ? {} : { appVersion: version }
+  };
+}
+function errorName(error) {
+  return error instanceof Error ? error.name : typeof error;
+}
+function registerIpcMessageHandler(ports) {
+  const log = ports.log ?? (() => {
+  });
+  let authInFlight = false;
+  let disposed = false;
+  const handler = (message) => {
+    if (disposed) return;
+    if (typeof message !== "object" || message === null || Array.isArray(message)) return;
+    const envelope = message;
+    const type = envelope.type;
+    if (typeof type !== "string") return;
+    if (type === IPC_AUTH_CALLBACK) {
+      const input = parseAuthCallback(envelope);
+      if (input === void 0) {
+        log("hiwork-core: \u6536\u5230\u5B57\u6BB5\u975E\u6CD5\u7684\u6D4F\u89C8\u5668\u6388\u6743 IPC \u6D88\u606F\uFF0C\u5DF2\u5FFD\u7565");
+        return;
+      }
+      if (authInFlight) {
+        log("hiwork-core: \u4E0A\u4E00\u6B21\u6D4F\u89C8\u5668\u6388\u6743\u56DE\u8C03\u4ECD\u5728\u5904\u7406\u4E2D\uFF0C\u5DF2\u5FFD\u7565\u672C\u6B21\u91CD\u590D\u56DE\u8C03");
+        return;
+      }
+      authInFlight = true;
+      try {
+        void Promise.resolve(ports.complete(input)).catch((error) => {
+          log(`hiwork-core: \u6D4F\u89C8\u5668\u6388\u6743\u56DE\u8C03\u5904\u7406\u5F02\u5E38\uFF08${errorName(error)}\uFF09`);
+        }).finally(() => {
+          authInFlight = false;
+        });
+      } catch (error) {
+        log(`hiwork-core: \u6D4F\u89C8\u5668\u6388\u6743\u56DE\u8C03\u5206\u53D1\u5931\u8D25\uFF08${errorName(error)}\uFF09`);
+        authInFlight = false;
+      }
+      return;
+    }
+    if (type === IPC_DEVICE_INFO) {
+      const info = parseDeviceInfo(envelope);
+      if (info === void 0) {
+        log("hiwork-core: \u6536\u5230\u5B57\u6BB5\u975E\u6CD5\u7684\u8BBE\u5907\u4FE1\u606F IPC \u6D88\u606F\uFF0C\u5DF2\u5FFD\u7565");
+        return;
+      }
+      ports.setDevice(info);
+      try {
+        void Promise.resolve(ports.persistDeviceId(info.deviceId)).catch(() => {
+        });
+      } catch {
+      }
+      return;
+    }
+  };
+  ports.source.on("message", handler);
+  return () => {
+    if (disposed) return;
+    disposed = true;
+    ports.source.off("message", handler);
+  };
+}
+async function projectLoginMode(opts) {
+  let loginMode = DEFAULT_LOGIN_MODE;
+  try {
+    const baseURL = opts.baseURL;
+    if (baseURL !== void 0 && baseURL !== "") {
+      const device = await resolveDeviceInfo(opts.credentials);
+      const policy = await (opts.fetchPolicy ?? fetchClientPolicy)({
+        baseURL,
+        version: opts.version ?? PKG_VERSION,
+        platform: opts.platform ?? process.platform,
+        arch: opts.arch ?? process.arch,
+        deviceId: device.deviceId,
+        ...opts.timeoutMs === void 0 ? {} : { timeoutMs: opts.timeoutMs }
+      });
+      if (policy !== void 0) loginMode = policy.loginMode;
+    }
+  } catch (error) {
+    opts.log?.(`hiwork-core: \u5BA2\u6237\u7AEF\u7B56\u7565\u62C9\u53D6\u5931\u8D25\uFF0C\u767B\u5F55\u65B9\u5F0F\u56DE\u9000 both\uFF08${errorName(error)}\uFF09`);
+  }
+  try {
+    await opts.state.patch({ set: { loginMode } });
+  } catch (error) {
+    opts.log?.(`hiwork-core: \u5BA2\u6237\u7AEF\u7B56\u7565\u5199\u5165\u5931\u8D25\uFF08${errorName(error)}\uFF09`);
+  }
+  return loginMode;
+}
 function apply(ctx, config) {
   let current = () => ({ ...config });
   const settings = ctx.get("settings");
   const credentials = ctx.get("credentials");
+  const llm = ctx.get("llm");
   if (settings === void 0) throw new Error("settings service unavailable");
   const gatewayFor = (baseURL) => new AiRouterClient(baseURL.replace(/\/+$/, ""));
   const ports = {
@@ -3587,6 +4597,11 @@ function apply(ctx, config) {
         await writeNamespace(settings, PI_AI_NS, ops);
       }
     },
+    defaultModel: createDefaultModelPort({
+      settings,
+      llm,
+      log: (message) => ctx.logger.info(message)
+    }),
     state: {
       patch: async (patch) => {
         if (settings === void 0) throw new Error("settings service unavailable");
@@ -3602,26 +4617,50 @@ function apply(ctx, config) {
     }
   };
   let inFlight;
+  let policyRequested = false;
+  const requestClientPolicy = () => {
+    if (policyRequested) return;
+    const baseURL = current().baseURL;
+    if (baseURL === void 0 || baseURL === "") return;
+    policyRequested = true;
+    void projectLoginMode({
+      baseURL,
+      credentials: ports.credentials,
+      state: ports.state,
+      log: (message) => {
+        ctx.logger.warn(message);
+      }
+    }).catch(() => {
+    });
+  };
   settings.installSection(ctx, NS, Config, config, {
     setSource: (source) => {
       current = source;
     },
     onChange: () => {
+      requestClientPolicy();
       const value = current();
-      const requested = value.pendingLogin ?? value.refreshRequest ?? value.logoutRequest;
+      const requested = value.pendingLogin ?? value.browserLoginRequest ?? value.refreshRequest ?? value.logoutRequest;
       if (requested === void 0) return;
       if (inFlight !== void 0) return;
       inFlight = (async () => {
         try {
           const gateway = gatewayFor(value.baseURL ?? "");
-          await handleAiRouterSectionChange({ gateway, ...ports, value });
+          await handleAiRouterSectionChange({
+            gateway,
+            ...ports,
+            value,
+            log: (message) => {
+              ctx.logger.warn(message);
+            }
+          });
         } catch (error) {
           ctx.logger.error("hiwork-core: ai-router section change failed", error);
           await ports.credentials.unset(PENDING_PASSWORD_REF).catch(() => {
           });
           await ports.state.patch({
             set: { lastError: { code: "GATEWAY_UNREACHABLE", message: "\u7F51\u5173\u63D2\u4EF6\u5904\u7406\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u914D\u7F6E\u4E0E\u7F51\u7EDC" } },
-            unset: ["pendingLogin", "refreshRequest", "logoutRequest"]
+            unset: ["pendingLogin", "browserLoginRequest", "browserLogin", "refreshRequest", "logoutRequest"]
           }).catch(() => {
           });
         }
@@ -3630,6 +4669,51 @@ function apply(ctx, config) {
       });
     }
   });
+  requestClientPolicy();
+  void reconcileStaleBrowserLogin(ports.state, current());
+  const connection = ctx.get("connection");
+  if (connection === void 0) throw new Error("connection service unavailable");
+  ctx.effect(() => registerUsageRpc({ connection, logger: ctx.logger }, {
+    resolveSession: async () => (await ports.credentials.resolve(SESSION_REF))?.value,
+    gateway: () => {
+      const baseURL = current().baseURL;
+      return baseURL === void 0 || baseURL === "" ? void 0 : gatewayFor(baseURL);
+    },
+    log: (message) => {
+      ctx.logger.warn(message);
+    }
+  }), "hiwork-core: usage rpc");
+  ctx.effect(() => registerDailyRpc({ connection, logger: ctx.logger }, {
+    resolveSession: async () => (await ports.credentials.resolve(SESSION_REF))?.value,
+    gateway: () => {
+      const baseURL = current().baseURL;
+      return baseURL === void 0 || baseURL === "" ? void 0 : gatewayFor(baseURL);
+    },
+    log: (message) => {
+      ctx.logger.warn(message);
+    }
+  }), "hiwork-core: daily rpc");
+  ctx.effect(() => registerIpcMessageHandler({
+    source: process,
+    complete: (input) => {
+      const value = current();
+      return completeBrowserLogin(input, {
+        ...ports,
+        value,
+        gateway: gatewayFor(value.baseURL ?? ""),
+        log: (message) => {
+          ctx.logger.warn(message);
+        }
+      });
+    },
+    setDevice: (info) => {
+      setDeviceInfo(info);
+    },
+    persistDeviceId: (deviceId) => ports.credentials.set(DEVICE_ID_REF, deviceId),
+    log: (message) => {
+      ctx.logger.warn(message);
+    }
+  }), "hiwork-core: ipc message listener");
   if (config.lastLogin === void 0 && config.rememberPassword === true && config.username !== void 0 && config.baseURL !== void 0 && credentials !== void 0) {
     void credentials.resolve(REMEMBERED_PASSWORD_REF).then((hit) => {
       if (hit === void 0 || settings === void 0) return;
@@ -3641,6 +4725,9 @@ function apply(ctx, config) {
 export {
   Config,
   apply,
+  createDefaultModelPort,
   inject,
-  name
+  name,
+  projectLoginMode,
+  registerIpcMessageHandler
 };