mslxdff 0.1.136 → 0.1.140

package/src/providers/traework/payload.js

@@ -0,0 +1,86 @@
+// OpenAI → SOLO llm_utils_chat 请求体改写（照抄 traework2api internal/upstream/payload.go）。
+import { DEFAULT_MODEL, FUNCTION } from "./constants.js";
+
+// tool_choice 归一化（上游 Go struct 是 string 类型）。
+export function normalizeToolChoice(obj) {
+  const suppress = () => { delete obj.tools; delete obj.functions; };
+  if (!("tool_choice" in obj)) return;
+  const tc = obj.tool_choice;
+  if (typeof tc === "string") {
+    if (String(tc).trim().toLowerCase() === "none") { delete obj.tool_choice; suppress(); }
+    return;
+  }
+  if (tc && typeof tc === "object" && !Array.isArray(tc)) {
+    const typ = String(tc.type || "").trim().toLowerCase();
+    if (typ === "none") { delete obj.tool_choice; suppress(); }
+    else if (typ === "auto" || typ === "required") obj.tool_choice = typ;
+    else if (typ === "function") {
+      const name = String(tc.function?.name || tc.name || "").trim();
+      obj.tool_choice = name || "auto";
+    } else delete obj.tool_choice;
+    return;
+  }
+  delete obj.tool_choice;
+}
+
+// tools：缺 function 剔除；function.parameters 对象 → JSON 字符串。
+export function normalizeTools(obj) {
+  const raw = obj.tools;
+  if (raw === undefined) return;
+  if (!Array.isArray(raw) || !raw.length) return;
+  const out = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const fn = item.function;
+    if (!fn || typeof fn !== "object") continue;
+    if (fn.parameters && typeof fn.parameters === "object" && !Array.isArray(fn.parameters)) {
+      try { fn.parameters = JSON.stringify(fn.parameters); } catch {}
+    }
+    out.push(item);
+  }
+  if (!out.length) { delete obj.tools; return; }
+  obj.tools = out;
+}
+
+// 单 pass 改写；无法解析时原样返回。
+export function prepareBody(src) {
+  let obj;
+  if (typeof src === "string") {
+    if (!src) return src;
+    try { obj = JSON.parse(src); } catch { return src; }
+  } else if (src && typeof src === "object") {
+    obj = { ...src };
+  } else return src;
+  if (!obj || typeof obj !== "object" || Array.isArray(obj)) return src;
+  obj.stream = true;
+  obj.function = FUNCTION;
+  if (Array.isArray(obj.messages)) {
+    for (const mi of obj.messages) {
+      if (!mi || typeof mi !== "object") continue;
+      if (mi.role === "assistant" && Array.isArray(mi.tool_calls)) {
+        const kept = [];
+        for (const tci of mi.tool_calls) {
+          if (!tci || typeof tci !== "object") continue;
+          const tc = { ...tci };
+          if (tc.function && typeof tc.function === "object") {
+            tc.function_call = tc.function;
+            delete tc.function;
+          }
+          const fc = tc.function_call;
+          if (fc && typeof fc === "object" && !String(fc.name || "").trim()) continue;
+          kept.push(tc);
+        }
+        if (!kept.length) delete mi.tool_calls;
+        else mi.tool_calls = kept;
+      }
+      if (!("content" in mi) || mi.content == null) continue;
+      if (typeof mi.content === "string") mi.content = [{ type: "text", text: mi.content }];
+    }
+  }
+  let model = String(obj.model || "").trim() || DEFAULT_MODEL;
+  obj.config_name = model;
+  obj.model = model;
+  normalizeToolChoice(obj);
+  normalizeTools(obj);
+  return obj;
+}

package/src/providers/traework/sse.js

@@ -0,0 +1,184 @@
+// SOLO 自定义 SSE 解析 → OpenAI SSE（流式转换 + 非流式聚合）。
+// 照抄 traework2api internal/upstream/solosse.go。纯函数，可测。
+import { SOLOStreamError } from "./errors.js";
+
+// 解析一条事件（eventName 为 event 行值，dataLine 为 data 行值）。
+export function parseSOLOLine(eventName, dataLine) {
+  const ev = { event: String(eventName || "").trim(), response: "", reasoning: "", toolCalls: null, usage: null, finishReason: "", errorCode: 0, errorMessage: "" };
+  if (!dataLine) return ev;
+  let raw;
+  try { raw = JSON.parse(dataLine); } catch { throw new Error("solo sse data parse error"); }
+  if (!raw || typeof raw !== "object") return ev;
+  if (ev.event === "output") {
+    if (typeof raw.response === "string") ev.response = raw.response;
+    if (typeof raw.reasoning_content === "string") ev.reasoning = raw.reasoning_content;
+    if ("tool_calls" in raw && raw.tool_calls != null) ev.toolCalls = raw.tool_calls;
+  } else if (ev.event === "token_usage") {
+    ev.usage = raw;
+  } else if (ev.event === "done") {
+    if (typeof raw.finish_reason === "string") ev.finishReason = raw.finish_reason;
+  } else if (ev.event === "error") {
+    if (typeof raw.code === "number") ev.errorCode = raw.code;
+    else if (typeof raw.code === "string" && raw.code.trim() !== "" && Number.isFinite(Number(raw.code))) ev.errorCode = Number(raw.code);
+    if (typeof raw.message === "string") ev.errorMessage = raw.message;
+  }
+  return ev;
+}
+
+// sseState 维护一行 SSE 的 event/data 跨行累积。
+export function createSseState() { return { event: "", data: "" }; }
+export function resetSseState(st) { st.event = ""; st.data = ""; }
+
+// scanLine 处理一行；返回该行触发的事件（事件边界时解析并返回）。
+export function scanLine(st, line) {
+  const s = String(line ?? "");
+  if (s === "") {
+    if (!st.event) { resetSseState(st); return null; }
+    let ev = null;
+    try { ev = parseSOLOLine(st.event, st.data); } catch { ev = null; }
+    resetSseState(st);
+    return ev;
+  }
+  if (s.startsWith("event:")) st.event = s.slice("event:".length).trim();
+  else if (s.startsWith("data:")) st.data += s.slice("data:".length);
+  else if (s.startsWith(":")) { /* 注释行忽略 */ }
+  return null;
+}
+
+function mergeToolCallDelta(merged, delta) {
+  if (typeof delta?.id === "string" && delta.id) merged.id = delta.id;
+  if (typeof delta?.type === "string" && delta.type) merged.type = delta.type;
+  let df = delta?.function && typeof delta.function === "object" ? { ...delta.function } : null;
+  if (!df && delta?.function_call && typeof delta.function_call === "object") df = { ...delta.function_call };
+  if (!df) return;
+  delete df.namespace;
+  delete df.partial_arguments;
+  if (!merged.function || typeof merged.function !== "object") merged.function = {};
+  if (typeof df.name === "string" && df.name) merged.function.name = df.name;
+  if (typeof df.arguments === "string" && df.arguments) {
+    merged.function.arguments = (typeof merged.function.arguments === "string" ? merged.function.arguments : "") + df.arguments;
+  }
+}
+
+function mergeToolCallJSON(toolCalls, toolOrder, raw) {
+  if (raw == null) return;
+  let arr;
+  if (Array.isArray(raw)) arr = raw;
+  else if (raw && typeof raw === "object") arr = [raw];
+  else return;
+  for (const call of arr) {
+    if (!call || typeof call !== "object") continue;
+    const idx = Number.isFinite(Number(call.index)) ? Number(call.index) : 0;
+    if (!Object.prototype.hasOwnProperty.call(toolCalls, idx)) {
+      toolCalls[idx] = { index: idx };
+      toolOrder.push(idx);
+    }
+    mergeToolCallDelta(toolCalls[idx], call);
+  }
+}
+
+// 把 SOLO tool_call 条目 function_call → function（流式 delta 用）。
+export function normalizeStreamToolCalls(raw) {
+  const arr = Array.isArray(raw) ? raw : [raw];
+  const out = [];
+  for (const item of arr) {
+    if (!item || typeof item !== "object") continue;
+    const call = { ...item };
+    if (call.function_call && typeof call.function_call === "object") {
+      call.function = call.function_call;
+      delete call.function_call;
+    }
+    if (call.function && typeof call.function === "object") {
+      call.function = { ...call.function };
+      delete call.function.namespace;
+      delete call.function.partial_arguments;
+    }
+    out.push(call);
+  }
+  return out;
+}
+
+function openAIChunk(id, created, model, delta, finish, usage) {
+  const chunk = { id, object: "chat.completion.chunk", created, model: model || "", choices: [{ index: 0, delta }] };
+  if (finish) chunk.choices[0].finish_reason = finish;
+  if (usage) chunk.usage = usage;
+  return chunk;
+}
+
+// convertToOpenAIChunks：SOLO SSE 文本 → OpenAI SSE 文本（每 chunk flush 语义由调用方保证至少一个 [DONE]）。
+export function convertToOpenAIChunks(soloText, { model = "", chatId = "", created = 0 } = {}) {
+  const id = chatId || `chatcmpl-${Date.now()}`;
+  const ts = created || Math.floor(Date.now() / 1000);
+  const st = createSseState();
+  const frames = [];
+  let pendingUsage = null;
+  let sawDone = false;
+  const push = (delta, finish) => frames.push(`data: ${JSON.stringify(openAIChunk(id, ts, model, delta, finish, pendingUsage || undefined))}\n\n`) || (pendingUsage = null);
+  for (const line of String(soloText || "").split("\n")) {
+    const ev = scanLine(st, line.replace(/\r$/, ""));
+    if (!ev) continue;
+    if (ev.event === "output") {
+      const delta = {};
+      if (ev.response) delta.content = ev.response;
+      if (ev.reasoning) delta.reasoning_content = ev.reasoning;
+      if (ev.toolCalls != null) delta.tool_calls = normalizeStreamToolCalls(ev.toolCalls);
+      if (Object.keys(delta).length) push(delta, "");
+    } else if (ev.event === "token_usage") pendingUsage = ev.usage;
+    else if (ev.event === "done") { push({}, ev.finishReason || "stop"); frames.push("data: [DONE]\n\n"); sawDone = true; }
+    else if (ev.event === "error") {
+      const se = new SOLOStreamError(ev.errorCode, ev.errorMessage);
+      frames.push(`event: error\ndata: ${JSON.stringify(se.message)}\n\n`);
+      frames.push("data: [DONE]\n\n");
+      sawDone = true;
+    }
+  }
+  if (!sawDone) frames.push("data: [DONE]\n\n");
+  return frames.join("");
+}
+
+// aggregateToCompletion：完整 SOLO SSE 文本 → 单个 OpenAI chat.completion（非流式）。
+export function aggregateToCompletion(soloText, { model = "", chatId = "", created = 0 } = {}) {
+  const st = createSseState();
+  let content = "";
+  let reasoning = "";
+  let finishReason = "stop";
+  let usage = null;
+  const toolCalls = {};
+  const toolOrder = [];
+  for (const line of String(soloText || "").split("\n")) {
+    const ev = scanLine(st, line.replace(/\r$/, ""));
+    if (!ev) continue;
+    if (ev.event === "output") {
+      content += ev.response || "";
+      reasoning += ev.reasoning || "";
+      mergeToolCallJSON(toolCalls, toolOrder, ev.toolCalls);
+    } else if (ev.event === "token_usage") usage = ev.usage;
+    else if (ev.event === "done") { if (ev.finishReason) finishReason = ev.finishReason; }
+    else if (ev.event === "error") throw new SOLOStreamError(ev.errorCode, ev.errorMessage);
+  }
+  const message = { role: "assistant", content };
+  if (reasoning) message.reasoning_content = reasoning;
+  if (toolOrder.length) message.tool_calls = [...toolOrder].sort((a, b) => a - b).map((i) => toolCalls[i]);
+  const resp = {
+    id: chatId || `chatcmpl-${Date.now()}`,
+    object: "chat.completion",
+    created: created || Math.floor(Date.now() / 1000),
+    model: model || "",
+    choices: [{ index: 0, message, finish_reason: finishReason }],
+  };
+  if (usage) resp.usage = usage;
+  return resp;
+}
+
+// aggregateStreamReader：ReadableStream（fetch Response.body）→ chat.completion（流式 Response 转非流式用）。
+export async function aggregateStreamReader(stream, opts = {}) {
+  const reader = stream.getReader();
+  const dec = new TextDecoder();
+  let text = "";
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (value) text += dec.decode(value, { stream: !done });
+    if (done) break;
+  }
+  return aggregateToCompletion(text, opts);
+}

package/src/providers/traework/token.js

@@ -0,0 +1,52 @@
+// ExchangeToken 刷新（照抄 traework2api internal/upstream/client.go refreshLocked）。
+import { CLIENT_ID, EP_EXCHANGE, IDE_VERSION, OAUTH_HOST } from "./constants.js";
+import { oauthHeaders } from "./headers.js";
+
+// TokenExpireAt 毫秒 → Unix 秒归一（毫秒 ~1.7e12，秒 ~1.7e9，用 1e12 区分）。
+export function normalizeExpiresAt(v) {
+  const n = Number(v) || 0;
+  return n > 1e12 ? Math.floor(n / 1000) : n;
+}
+
+export async function exchangeRefresh(fetchImpl, apiHost, refreshToken, { timeoutMs = 30_000 } = {}) {
+  const rt = String(refreshToken || "").trim();
+  if (!rt) throw new Error("no refreshToken");
+  const host = String(apiHost || "").trim().replace(/\/+$/, "") || OAUTH_HOST;
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(new Error("traework ExchangeToken timed out")), timeoutMs);
+  if (typeof timer.unref === "function") timer.unref();
+  let res;
+  try {
+    res = await fetchImpl(`${host}${EP_EXCHANGE}`, {
+      method: "POST",
+      headers: oauthHeaders(),
+      body: JSON.stringify({ ClientID: CLIENT_ID, RefreshToken: rt, ClientSecret: "-", UserID: "" }),
+      signal: ctl.signal,
+    });
+  } finally { clearTimeout(timer); }
+  const txt = await res.text().catch(() => "");
+  if (res.status >= 400) throw Object.assign(new Error(`exchange failed: http ${res.status} ${txt.slice(0, 200)}`), { status: res.status, body: txt });
+  let j;
+  try { j = JSON.parse(txt); } catch { throw new Error(`exchange parse: non-JSON ${txt.slice(0, 200)}`); }
+  const result = j?.Result || {};
+  if (!result.Token) throw new Error("refresh_failed: no token in response — re-login required");
+  let expiresAt = 0;
+  if (Number(result.TokenExpireAt) > 0) expiresAt = normalizeExpiresAt(result.TokenExpireAt);
+  else if (Number(result.TokenExpireDuration) > 0) expiresAt = Math.floor(Date.now() / 1000) + Number(result.TokenExpireDuration);
+  return { token: result.Token, refreshToken: result.RefreshToken || rt, expiresAt };
+}
+
+export async function fetchUserInfo(fetchImpl, apiHost, accessToken, { timeoutMs = 30_000 } = {}) {
+  const host = String(apiHost || "").trim().replace(/\/+$/, "") || OAUTH_HOST;
+  const res = await fetchImpl(`${host}/cloudide/api/v3/trae/GetUserInfo`, {
+    method: "POST",
+    headers: { ...oauthHeaders(), "X-Cloudide-Token": accessToken || "" },
+    body: JSON.stringify({ ReqSource: "IDE", IDEVersion: IDE_VERSION }),
+  });
+  const txt = await res.text().catch(() => "");
+  if (res.status >= 400) throw Object.assign(new Error(`userinfo failed: http ${res.status}`), { status: res.status });
+  let j;
+  try { j = JSON.parse(txt); } catch { throw new Error("userinfo parse: non-JSON"); }
+  const r = j?.Result || j || {};
+  return { uid: String(r.UserID || ""), nickname: String(r.ScreenName || ""), enterpriseId: String(r.EnterpriseID || "") };
+}

package/src/providers/traework.js

@@ -0,0 +1,2 @@
+// Shim — 保持历史导入路径兼容，真实实现下沉至 ./traework/ 深模块
+export * from "./traework/index.js";

package/src/providers/workbuddy/account-store.js

@@ -1,17 +1,83 @@
 // WorkBuddy 账号落盘单一源：auths/workbuddy-<uid>.json（0600 tmp+rename）+ state.json keys/auths 按 uid 去重。
 // token-auto / device-login / 刷新（服务端 saveFn 与 CLI 定时任务）共用同一实现，安全细节只维护一份。
 // Note: 刷新落盘只走 applyTokenRefresh，别再各自内联一套 — 见 .agents/notes/implemented/architecture/2026-09-17-workbuddy-persist-single-seam.md
-import { writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync } from "node:fs";
+// Note: 凭据目录别再用 cwd 兜底 — 见 .agents/notes/implemented/architecture/2026-09-20-workbuddy-authdir-follows-state.md
+import { writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync, readdirSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { tmpdir } from "node:os";
-import { isTestEnv } from "../../state/store.js";
+import { isTestEnv, defaultStateFile } from "../../state/store.js";
+
+// 凭据目录单一真相：跟着「账本」（state 文件）走 —— 默认 ~/.config/mslxdff/auths。
+// 旧实现末尾兜底 `join(process.cwd(), "auths")`：在任意目录里起服务就把企业长效
+// refreshToken 写进那个目录，而 .gitignore 只管自己所在的仓库 → 凭据落到不受保护的目录
+// （本机实测：两个真实账号因此分居 `~/.config/mslxdff/auths` 与 `项目根/auths` 两处）。已修。
+// 纯策略：写入目录的唯一目标（explicit > 测试隔离 > 「跟账本走」＝ state 文件同目录/auths）。
+// 抽成纯函数是为了可测 —— `node --test` 下 isTestEnv() 恒真，环境态没法在测试里翻面。
+export function authDirFor({ explicit = "", testEnv = false, stateFile } = {}) {
+  if (explicit) return explicit;
+  if (testEnv) return join(tmpdir(), "mslxdff-test-auths");
+  return join(dirname(stateFile), "auths");
+}
 
 export function resolveAuthDir() {
-  if (process.env.WORKBUDDY_AUTH_DIR) return process.env.WORKBUDDY_AUTH_DIR;
-  const sf = process.env.MSLXDFF_STATE_FILE || "";
-  if (sf.includes("mslxdff-test") || isTestEnv()) return join(tmpdir(), "mslxdff-test-auths");
-  if (sf && sf.includes("mslxdff-")) return join(dirname(sf), "auths");
-  return join(process.cwd(), "auths");
+  return authDirFor({
+    explicit: process.env.WORKBUDDY_AUTH_DIR || "",
+    testEnv: isTestEnv(),
+    stateFile: defaultStateFile(),
+  });
+}
+
+// 纯策略：算出读取候选目录（主位置优先，历史 cwd/auths 只读兜底，相同则去重）。
+// 抽成纯函数是为了可测 —— `node --test` 下 isTestEnv() 恒真，环境态没法在测试里翻面。
+export function authDirCandidates({ primary, explicit = "", testEnv = false, cwdDir = "" } = {}) {
+  const dirs = [primary];
+  if (!explicit && !testEnv && cwdDir && cwdDir !== primary) dirs.push(cwdDir);
+  return dirs;
+}
+
+// 读取候选（迁移期兼容）：主位置优先，历史 `cwd()/auths` 只读兜底。
+// 显式 WORKBUDDY_AUTH_DIR 或测试环境不兜底：既避免测试扫到真实目录，也避免重新引入 cwd 依赖。
+export function resolveAuthDirs() {
+  return authDirCandidates({
+    primary: resolveAuthDir(),
+    explicit: process.env.WORKBUDDY_AUTH_DIR || "",
+    testEnv: isTestEnv(),
+    cwdDir: join(process.cwd(), "auths"),
+  });
+}
+
+// 按 uid 定位账号文件（主位置优先，旧位置兜底）；找不到返回 null。
+export function findAccountFile(uid) {
+  for (const dir of resolveAuthDirs()) {
+    const fp = join(dir, `workbuddy-${uid}.json`);
+    if (existsSync(fp)) return fp;
+  }
+  return null;
+}
+
+// 扫描账号文件（主位置先扫，同 uid 以主位置为准），返回已校验的凭证行。
+// 读取侧单一真相：provider 构造、CLI 账号加载、token-auto 都走这里，别再各自 readdir 一套。
+export function listAccountDocs({ dirs } = {}) {
+  const out = [];
+  const seen = new Set();
+  for (const dir of dirs || resolveAuthDirs()) {
+    let files = [];
+    try {
+      if (!existsSync(dir)) continue;
+      files = readdirSync(dir).filter((f) => f.startsWith("workbuddy-") && f.endsWith(".json"));
+    } catch { continue; }
+    for (const f of files) {
+      try {
+        const doc = JSON.parse(readFileSync(join(dir, f), "utf8"));
+        const uid = doc?.account?.uid;
+        if (!uid || !doc?.auth?.accessToken) continue;
+        if (seen.has(String(uid))) continue;
+        seen.add(String(uid));
+        out.push({ uid: String(uid), file: join(dir, f), dir, doc });
+      } catch {}
+    }
+  }
+  return out;
 }
 
 function jwtExp(token) {

package/src/providers/workbuddy/chat.js

@@ -102,7 +102,7 @@ export function createChatService({
 
   // SDK 通道（缺省启用）：缺省底层走 @ai-sdk/openai-compatible，`legacy`/关闭词
   // （局部 MSLXDFF_WORKBUDDY_SDK，未设则继承全局 MSLXDFF_UPSTREAM_ENGINE）回退原生 transport；
-  // 不可用（Node16/未安装）自动回退并告警一次。上层轮换/刷新/reshape 全链复用。
+  // 不可用（未安装）自动回退并告警一次。上层轮换/刷新/reshape 全链复用。
   // Note: 为什么默认 SDK、翻译层代价与回退语义 — 见 .agents/notes/implemented/feature/2026-09-12-workbuddy-sdk-channel.md
   // 上游非标字段（thinking / reasoning_effort / reasoning_content / tool_choice 字符串）不依赖 SDK 白名单：
   // payload.js 前置语义改写 + AI SDK providerOptions 透传（非白名单 key 原样 spread 进 body，2.0.41 实测）。

package/src/providers/workbuddy/index.js

@@ -1,11 +1,9 @@
 import { createKeyRing } from "../keyring.js";
 import { loadProviderKeys, loadProviderAuths, loadProviderBaseUrl, WORKBUDDY_DEFAULT_BASE_URL, loadProviderModelsPath, loadProviderChatPath } from "../../state.js";
-import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { compatFetch } from "../../compat.js";
-import { join } from "node:path";
 import { envInt, joinUrl, getUndici, createAgent } from "../base.js";
 import { createAuthService, isAuthError, isInsufficientStatus, decodeJwtExp } from "./auth.js";
-import { applyTokenRefresh, resolveAuthDir } from "./account-store.js";
+import { applyTokenRefresh, listAccountDocs } from "./account-store.js";
 import { createChatService } from "./chat.js";
 import { createModelsService } from "./models.js";
 import { createBalanceCache, getCachedBalance as defaultGetCached, setCachedBalance as defaultSetCached } from "./balance.js";
@@ -61,24 +59,16 @@ export function createWorkbuddyProvider({
   let authList = Array.isArray(auths) && auths.length ? auths : authsFromState;
 
   if (!authList.length && !keys.length) {
+    // 账号目录读取统一走 listAccountDocs：主位置（跟 state 走）优先，旧 cwd/auths 只读兜底
     try {
-      const authDir = resolveAuthDir();
-      if (existsSync(authDir)) {
-        const files = readdirSync(authDir).filter((f) => f.startsWith("workbuddy-") && f.endsWith(".json"));
-        for (const f of files) {
-          try {
-            const j = JSON.parse(readFileSync(join(authDir, f), "utf8"));
-            if (j?.auth?.accessToken && j?.account?.uid) {
-              if (!keys.includes(j.auth.accessToken)) keys.push(j.auth.accessToken);
-              authList.push({
-                uid: j.account.uid,
-                domain: j.auth.domain || "www.codebuddy.cn",
-                enterpriseId: j.account.enterpriseId || "",
-                refreshToken: j.auth.refreshToken || "",
-              });
-            }
-          } catch {}
-        }
+      for (const { uid, doc } of listAccountDocs()) {
+        if (!keys.includes(doc.auth.accessToken)) keys.push(doc.auth.accessToken);
+        authList.push({
+          uid,
+          domain: doc.auth.domain || "www.codebuddy.cn",
+          enterpriseId: doc.account.enterpriseId || "",
+          refreshToken: doc.auth.refreshToken || "",
+        });
       }
     } catch {}
   }

package/src/readline-compat.js

@@ -1,8 +1,9 @@
-// readline 兼容层：`node:readline/promises` 需要 Node 17+，老 Node（如 VPS 的 16）
-// 会 `ERR_UNKNOWN_BUILTIN_MODULE` 直接崩在 import 期，连人话报错都来不及打。
-// 这里只用回调版 `node:readline`（Node 12+ 全有），把 `question` 包成 Promise；
-// `prompt()/close()/for await` 回调版原生即有，对我们用到的部分行为一致。
+// readline 统一走回调版 `node:readline`（question 包成 Promise），
+// 顺带给 -chat 一个人话版本门（项目要求 Node >=18，ADR-0024）。
+// 保留理由：回调版在 18+ 行为一致且无 import 期风险（`node:readline/promises`
+// 若被误用于旧运行时会直接 ERR_UNKNOWN_BUILTIN_MODULE，连报错都来不及打）。
 import readline from "node:readline";
+import { MIN_NODE_MAJOR, nodeMajor } from "./compat.js";
 
 export function createInterface(opts) {
   const rl = readline.createInterface(opts);
@@ -11,13 +12,11 @@ export function createInterface(opts) {
   return rl;
 }
 
-export function nodeMajor() {
-  return Number(String(process.versions?.node || "0").split(".")[0]) || 0;
-}
+export { nodeMajor };
 
-// -chat 依赖 fetch（<18 由 src/compat.js 用 undici polyfill），低于 engines 下限
-// 直接给一句人话。返回 true=通过，false=已打印升级指引。
-export function assertChatNode({ min = 16 } = {}) {
+// -chat 版本门：项目要求 Node >=18（ADR-0024），不满足直接给人话 + 升级指引。
+// 返回 true=通过，false=已打印升级指引。
+export function assertChatNode({ min = MIN_NODE_MAJOR } = {}) {
   const major = nodeMajor();
   if (major >= min) return true;
   console.error(`Node 版本过旧（当前 v${process.versions.node}），-chat 需要 Node ${min}+（推荐 20+）。`);

package/src/routes/models-route.js

@@ -15,7 +15,17 @@ export function isCodexModelsCaller(req) {
   return /(^|&)client_version=/.test(q);
 }
 
-export async function modelsHandler({ req, res, models, plugins, capabilities, wbSource }) {
+// 勾选即对外目录：modelPicks 非空时 /v1/models 只暴露勾选的模型（与 -models 交互勾选语义闭环）；
+// 空勾选 = 不过滤（保留旧默认全量目录，防呆：新装/清空勾选不至于对外空目录）。?all=1 逃生门。
+// Note: 空勾选不裁剪 + ?all=1 逃生门是硬边界（缺一即成单向棘轮/下游零模型）— 见 .agents/notes/implemented/architecture/2026-09-21-models-list-scoped-by-picks.md
+export function filterByPicks(data, picks) {
+  if (!picks?.length) return data;
+  const set = new Set(picks.map(String));
+  const list = (Array.isArray(data?.data) ? data.data : []).filter((m) => set.has(String(m?.id || "")));
+  return { ...(data || { object: "list" }), data: list };
+}
+
+export async function modelsHandler({ req, res, models, plugins, capabilities, wbSource, loadPicks } = {}) {
   if (!models) return json(res, 501, { error: "Models service not configured" });
   const codex = isCodexModelsCaller(req);
   const withCodex = (out) => (codex && out && typeof out === "object" ? { ...out, models: [] } : out);
@@ -30,6 +40,14 @@ export async function modelsHandler({ req, res, models, plugins, capabilities, w
         data = await mergeModelsList(data, { capsSvc: capabilities, wbSource });
       } catch { /* 富化失败不阻塞 /models */ }
     }
+    // 勾选即对外目录（?all=1 逃生门）：picks 非空只暴露勾选项；空 picks 不过滤
+    if (!/(^|&)all=1(&|$)/.test(qs)) {
+      let picks = [];
+      try {
+        picks = (loadPicks ? await loadPicks() : (await import("../state.js")).loadModelPicks()) || [];
+      } catch { picks = []; }
+      data = filterByPicks(data, picks);
+    }
     // 插件 hook：models:list — 返回数组可替换对外模型列表（{object:"list",data:[...]} 或纯 id 数组）
     if (plugins?.length) {
       const ml = await runHook(plugins, "models:list", { data });

package/src/runtime/bootstrap.js

@@ -27,6 +27,16 @@ export async function startDaemonMain(VERSION) {
     try { logs.appendEvent({ ts: Date.now(), type: "workbuddy-checkin-setup-failed", error: String(e?.message || e).slice(0, 200) }); } catch {}
   });
 
+  const { setupTraeworkCheckin } = await import("./traework-checkin.js");
+  void setupTraeworkCheckin({ bus, logs }).catch((e) => {
+    try { logs.appendEvent({ ts: Date.now(), type: "traework-checkin-setup-failed", error: String(e?.message || e).slice(0, 200) }); } catch {}
+  });
+
+  const { setupQoderCheckin } = await import("./qoder-checkin.js");
+  void setupQoderCheckin({ bus, logs }).catch((e) => {
+    try { logs.appendEvent({ ts: Date.now(), type: "qoder-checkin-setup-failed", error: String(e?.message || e).slice(0, 200) }); } catch {}
+  });
+
   const { setupWorkbuddyGrowth } = await import("./workbuddy-growth.js");
   void setupWorkbuddyGrowth({ bus, logs }).catch((e) => {
     try { logs.appendEvent({ ts: Date.now(), type: "workbuddy-growth-setup-failed", error: String(e?.message || e).slice(0, 200) }); } catch {}

package/src/runtime/provider-gate.js

@@ -0,0 +1,30 @@
+// 定制 provider 启用门禁（纯函数 + auth 号型名单），从 providers-setup.js 拆出以守住 ≤10KB 体积门。
+// 背景：门禁曾要求 `baseUrl && keys` 两者皆有，导致 qoder（keys 有、baseUrl 空）被静默跳过 ——
+// 表现为 /v1/models 无该供应商模型、`-models` 挑不到、网关报 `Model qoder/x is not supported`。
+// Note: auth 号型不要求 baseUrl 是硬约束（旧门禁 baseUrl&&keys 曾静默跳过整家 qoder）— 见 .agents/notes/implemented/bug-fix/2026-09-21-auth-doc-provider-gate.md
+
+/** 凭证在 auth 目录、无需 baseUrl 的「auth 号型」定制供应商（端点由各自 constants 决定）。 */
+export const AUTH_DOC_PROVIDER_IDS = ["workbuddy", "traework", "qoder"];
+
+/**
+ * - auth 号型：keys 或 auths 或 auth 目录有号 → 启用（baseUrl 可空）
+ * - 其他定制（cline/codearts/插件注册）：有 keys → 启用（baseUrl 可空，端点由工厂决定）
+ */
+export function shouldEnableCustomProvider(gid, { keys = [], auths = [], hasAuthDocs = false } = {}) {
+  if (AUTH_DOC_PROVIDER_IDS.includes(gid)) return keys.length > 0 || auths.length > 0 || hasAuthDocs;
+  return keys.length > 0;
+}
+
+/** 按 gid 载入各自 account-store 并列出落盘账号（失败/无目录 → 空数组，不抛）。 */
+export async function loadAuthDocs(gid) {
+  try {
+    const store = gid === "workbuddy"
+      ? await import("../providers/workbuddy/account-store.js")
+      : gid === "traework"
+        ? await import("../providers/traework/account-store.js")
+        : await import("../providers/qoder/account-store.js");
+    return store.listAccountDocs();
+  } catch {
+    return [];
+  }
+}

package/src/runtime/providers-setup.js

@@ -14,11 +14,22 @@ import { loadProviderKeys, loadProviderAuths, loadProviderConfigs } from "../sta
 import { refreshIntervalMs, modelCooldownMs, slowCooldownMs, peerCooldownMs, peerLimitCooldownMs, peerHeatMs, banWindowMs, banThreshold } from "../cli/policy.js";
 import { errMsg } from "../cli/util.js";
 
+
+import { shouldEnableCustomProvider, loadAuthDocs } from "./provider-gate.js";
 /**
  * 世界组装 — 插件加载 → providers → models/auto/peers/groups/bans。
  * 无参（读 env/state 自身），返回 ctx 由门面接力 server-lifecycle。
  */
 export async function setupProviders() {
+  // 供应商 id 统一（旧 cline id → cline）：必须在实例化任何 provider 之前跑；幂等，失败不阻断启动
+  try {
+    const { runStateMigrations } = await import("../state/migrations.js");
+    const mig = await runStateMigrations({ file: defaultStateFile() });
+    if (mig.applied.length) console.log(`state migrations applied: ${mig.applied.join(", ")}`);
+    for (const e of mig.errors) console.log(`state migration failed: ${e.id} — ${e.error}`);
+  } catch (err) {
+    console.log(`state migrations failed: ${errMsg(err)}`);
+  }
   const { token, created } = await loadToken();
   const pkgRoot2 = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
   const pluginDirs = resolvePluginDirs({ pkgRoot: pkgRoot2 });
@@ -76,12 +87,16 @@ export async function setupProviders() {
       const { getCustomProviderFactory } = await import("../providers/registry.js");
       const customFactory = await getCustomProviderFactory(gid, base);
       if (customFactory) {
-        if (gid === "workbuddy" && !keys.length) continue;
-        if (gid !== "workbuddy" && (!base || !keys.length)) continue;
+        // auth 号型（workbuddy/traework/qoder）：无 keys 但 auth 目录有号也启用；baseUrl 可空
+        // （端点由各自 constants 决定，如 qoder 的 qoder://native）。
+        const hasAuthDocs = !keys.length && !auths.length ? (await loadAuthDocs(gid)).length > 0 : false;
+        if (!shouldEnableCustomProvider(gid, { keys, auths, hasAuthDocs })) continue;
         try {
           const provider = gid === "workbuddy"
             ? await customFactory({ baseUrl: base || "https://copilot.tencent.com", apiKeys: keys, auths })
-            : await customFactory({ id: gid, baseUrl: base, apiKeys: keys });
+            : gid === "traework"
+              ? await customFactory({ baseUrl: base || "https://trae-api-cn.mchost.guru", apiKeys: keys, auths })
+              : await customFactory({ id: gid, baseUrl: base, apiKeys: keys });
           providers.push(provider);
           console.log(`provider enabled: ${gid} (${keys.length} key${keys.length > 1 ? "s" : ""}) baseUrl=${base || provider.baseUrl} [custom]`);
           appendEvent({ ts: Date.now(), type: "provider-enabled", provider: gid, keys: keys.length, baseUrl: base || provider.baseUrl });