mslxdff 0.1.136 → 0.1.140

package/src/providers/qoder/chat.js

@@ -0,0 +1,72 @@
+// qoder 对话服务：上游恒 stream:true；请求方 stream=true → 真流式转发边收边吐，
+// false → 聚合回 JSON。装配走 request.js，帧格式走 sse.js，两条管线共享。
+import { compatFetch, timeoutSignal } from "../../compat.js";
+import { normalizeRegion } from "./constants.js";
+import { buildUpstreamRequest } from "./request.js";
+import { reshapeQoderStream } from "./stream.js";
+import { aggregateQoderStream, toCompletionJson } from "./aggregate.js";
+import { errorStatus } from "./sse.js";
+
+function errRes(status, msg, type = "upstream_error") {
+  return new Response(JSON.stringify({ error: { message: msg, type } }), { status, headers: { "Content-Type": "application/json" } });
+}
+
+function mapUpstreamError(status, detail) {
+  return { kind: status === 401 || status === 403 ? "auth" : "upstream", status, detail: String(detail || "").slice(0, 300) };
+}
+
+export function createChatService({ id = "qoder", fetchImpl, timeoutMs } = {}) {
+  if (!fetchImpl) fetchImpl = compatFetch;
+
+  // body: OpenAI chat 请求；sess: 已建 COSY 会话；region: 该账号所属区（每号独立选端点）。返回 Response。
+  async function runChat(body, sess, region = "global") {
+    const stream = body?.stream !== false;
+    const model = body?.model || "qfmodel";
+    const chatId = "chatcmpl-qoder-" + Math.random().toString(16).slice(2, 10);
+    const tools = Array.isArray(body?.tools) && body.tools.length ? body.tools : null;
+    const messages = Array.isArray(body?.messages) ? body.messages : [];
+    const maxTokens = Number(body?.max_tokens) || 0;
+
+    let upRes;
+    try {
+      const req = buildUpstreamRequest({ sess, region: normalizeRegion(region), model, messages, tools, maxTokens });
+      upRes = await fetchImpl(req.url, {
+        method: "POST",
+        headers: req.headers,
+        body: req.bodyStr,
+        signal: timeoutSignal(timeoutMs || 120_000),
+      });
+    } catch (e) {
+      const detail = String(e?.message || e).slice(0, 300);
+      if (stream) return reshapeQoderStream(new Response("data: [DONE]\n\n"), { model, chatId });
+      return errRes(502, detail);
+    }
+    if (upRes.status !== 200) {
+      const detail = await upRes.text().catch(() => "");
+      const e = mapUpstreamError(upRes.status, detail);
+      if (stream) {
+        // 首包错误也走流内 error 事件（与旧 reshapeStream catch 语义一致：200 + event:error + DONE）
+        const enc = new TextEncoder();
+        const s = new ReadableStream({
+          start(c) {
+            c.enqueue(enc.encode(`data: ${JSON.stringify({ id: chatId, object: "chat.completion.chunk", created: Math.floor(Date.now() / 1000), model, choices: [{ index: 0, delta: {}, finish_reason: null }] })}\n\n`));
+            c.enqueue(enc.encode(`event: error\ndata: ${JSON.stringify({ message: e.detail, type: e.kind })}\n\ndata: [DONE]\n\n`));
+            c.close();
+          },
+        });
+        return new Response(s, { status: 200, headers: { "Content-Type": "text/event-stream" } });
+      }
+      return errRes(errorStatus(e), e.detail, e.kind);
+    }
+    if (stream) return reshapeQoderStream(upRes, { model, chatId });
+    try {
+      const agg = await aggregateQoderStream(upRes);
+      const out = toCompletionJson({ model, chatId, ...agg });
+      return new Response(JSON.stringify(out), { status: 200, headers: { "Content-Type": "application/json" } });
+    } catch (e) {
+      return errRes(errorStatus(e), String(e?.detail || e?.message || e).slice(0, 300), e?.kind || "upstream_error");
+    }
+  }
+
+  return { runChat };
+}

package/src/providers/qoder/checkin.js

@@ -0,0 +1,160 @@
+// qoder 签到/额度（移植 qoder2api checkin.go，修两处硬伤）：
+//   ① 域名按区域选（Go 硬编码 openapi.qoder.com.cn → 国际号必然 401 TOKEN_EXPIRE）；
+//   ② 活动类型放宽（Go 只认 CLAIM_BENEFIT，国际站活动是 VIEW_DETAILS 会被漏掉）。
+// 认证只需 Bearer deviceToken + cosy-clienttype:10，无 COSY 签名、claim 空 body。
+// 主流程：cn 走 daily-check-in（GET status → POST claim，409=今日已领）；
+//         404/非 200 → 回落 campaigns（GET /sash/api/v1/me/campaigns → POST .../{id}/claim）。
+// Note: 域名必须按每号 region 选（两站账号不通用），默认只领 CLAIM_BENEFIT — 见 .agents/notes/implemented/feature/2026-09-21-qoder-checkin-region-endpoints.md
+import { EP_CAMPAIGNS, EP_CHECKIN_STATUS, EP_CHECKIN_CLAIM, EP_QUOTA, openapiBase, normalizeRegion } from "./constants.js";
+import { compatFetch, timeoutSignal } from "../../compat.js";
+
+export function checkinHeaders(deviceToken) {
+  return {
+    authorization: "Bearer " + String(deviceToken || ""),
+    accept: "application/json",
+    "accept-language": "zh-CN",
+    "user-agent": "Qoder",
+    "cosy-clienttype": "10",
+  };
+}
+
+async function call(fetchImpl, region, path, { method = "GET", deviceToken, body, timeoutMs = 20000 } = {}) {
+  const base = openapiBase(region);
+  const headers = checkinHeaders(deviceToken);
+  const init = { method, headers, signal: timeoutSignal(timeoutMs) };
+  if (method !== "GET") {
+    headers.origin = base;
+    if (body !== undefined) init.body = JSON.stringify(body);
+  }
+  let res;
+  try {
+    res = await fetchImpl(base + path, init);
+  } catch (e) {
+    return { status: 0, json: null, text: "", error: String(e?.message || e).slice(0, 200) };
+  }
+  const text = await res.text().catch(() => "");
+  let json = null;
+  if (text) { try { json = JSON.parse(text); } catch {} }
+  return { status: res.status, json, text };
+}
+
+export function listCampaigns({ deviceToken, region, fetchImpl = compatFetch, timeoutMs } = {}) {
+  return call(fetchImpl, region, EP_CAMPAIGNS, { deviceToken, timeoutMs });
+}
+
+export function claimCampaign({ deviceToken, region, campaignId, fetchImpl = compatFetch, timeoutMs } = {}) {
+  return call(fetchImpl, region, `${EP_CAMPAIGNS}/${campaignId}/claim`, { method: "POST", deviceToken, timeoutMs });
+}
+
+export function dailyCheckinStatus({ deviceToken, region, fetchImpl = compatFetch, timeoutMs } = {}) {
+  return call(fetchImpl, region, EP_CHECKIN_STATUS, { deviceToken, timeoutMs });
+}
+
+export function dailyCheckinClaim({ deviceToken, region, fetchImpl = compatFetch, timeoutMs } = {}) {
+  return call(fetchImpl, region, EP_CHECKIN_CLAIM, { method: "POST", deviceToken, body: {}, timeoutMs });
+}
+
+// 余额：/api/v2/quota/usage → userQuota{total,used,remaining,unit} + isQuotaExceeded
+export async function fetchQuota({ deviceToken, region, fetchImpl = compatFetch, timeoutMs } = {}) {
+  const r = await call(fetchImpl, region, EP_QUOTA, { deviceToken, timeoutMs });
+  if (r.status !== 200) return { ok: false, status: r.status, error: r.error || r.text.slice(0, 160) };
+  const q = r.json?.userQuota || {};
+  return {
+    ok: true,
+    total: Number(q.total) || 0,
+    used: Number(q.used) || 0,
+    remaining: Number(q.remaining) || 0,
+    unit: String(q.unit || "credits"),
+    exhausted: Boolean(r.json?.isQuotaExceeded),
+  };
+}
+
+// 选活动：优先 CLAIM_BENEFIT（真积分），allowPromo 时也认 VIEW_DETAILS 等促销条目。
+export function pickCampaign(campaigns, { allowPromo = false } = {}) {
+  const list = Array.isArray(campaigns) ? campaigns : [];
+  let benefit = null;
+  let promo = null;
+  let claimed = false;
+  for (const c of list) {
+    if (c?.claimStatus === "CLAIMED") claimed = true;
+    if (c?.claimStatus !== "CLAIMABLE") continue;
+    if (c?.actionType === "CLAIM_BENEFIT") benefit = benefit || c;
+    else if (allowPromo) promo = promo || c;
+  }
+  return { target: benefit || promo, claimed };
+}
+
+// 单账号签到：返回 { ok, status: claimed|already|no_campaign|error, amount, streak, ... }
+export async function runCheckin({ deviceToken, region, fetchImpl = compatFetch, allowPromo = false, probeOnly = false, timeoutMs } = {}) {
+  const reg = normalizeRegion(region);
+  const r = {
+    region: reg, ok: false, status: "error", message: "", amount: 0,
+    streak: 0, totalDays: 0, totalCredits: 0, reward: 0,
+  };
+  if (!deviceToken) { r.message = "无 device token（先 mslxdff -provider qoder login）"; return r; }
+
+  const st = await dailyCheckinStatus({ deviceToken, region: reg, fetchImpl, timeoutMs });
+  if (st.status === 200 && st.json?.status) {
+    r.streak = Number(st.json.currentStreakDays) || 0;
+    r.totalDays = Number(st.json.totalClaimDays) || 0;
+    r.totalCredits = Number(st.json.totalRewardCredits) || 0;
+    r.reward = Number(st.json.rewardCredits) || 0;
+  }
+  if (st.status === 401) { r.message = `device token 失效（HTTP 401）：请重新 mslxdff -provider qoder login`; return r; }
+
+  // 干跑：只报状态，不发任何 claim 请求
+  if (probeOnly && st.status === 200 && st.json?.status) {
+    r.ok = true;
+    r.status = st.json.status === "CLAIMED" ? "already" : "claimable";
+    r.message = `干跑：status=${st.json.status} 每日奖励 ${r.reward}`;
+    return r;
+  }
+  // 主流程：daily-check-in（国内站）
+  if (st.status === 200 && st.json?.status) {
+    const claim = await dailyCheckinClaim({ deviceToken, region: reg, fetchImpl, timeoutMs });
+    if (claim.status === 409) { r.ok = true; r.status = "already"; r.message = "今日已领取"; return r; }
+    if (claim.status === 200) {
+      r.ok = true; r.status = "claimed";
+      r.amount = Number(claim.json?.rewardCredits) || r.reward || 0;
+      r.streak += 1; r.totalDays += 1; r.totalCredits += r.amount;
+      r.message = `签到成功 +${r.amount}`;
+      return r;
+    }
+    // 其它错误 → 保留统计，回落 campaigns
+  }
+
+  const list = await listCampaigns({ deviceToken, region: reg, fetchImpl, timeoutMs });
+  if (list.status === 401) { r.message = "device token 失效（HTTP 401）：请重新 mslxdff -provider qoder login"; return r; }
+  if (list.status !== 200) {
+    r.message = `查询活动失败 HTTP ${list.status || "-"}: ${String(list.error || list.text).slice(0, 160)}`;
+    return r;
+  }
+  const { target, claimed } = pickCampaign(list.json?.campaigns, { allowPromo });
+  if (probeOnly) {
+    r.ok = true; r.status = target ? "claimable" : "no_campaign";
+    r.message = target
+      ? `干跑：可领 ${target.actionType} ${target.campaignKey || ""}`.trim()
+      : (claimed ? "干跑：今日已领取" : "干跑：无可用签到活动");
+    return r;
+  }
+  if (!target) {
+    r.ok = true; r.status = "no_campaign";
+    r.message = claimed ? "今日已领取" : "无可用签到活动";
+    return r;
+  }
+  const claim = await claimCampaign({ deviceToken, region: reg, campaignId: target.campaignId, fetchImpl, timeoutMs });
+  if (claim.status !== 200 || claim.json?.status !== "CLAIMED") {
+    r.message = `领取失败 HTTP ${claim.status || "-"}: ${String(claim.error || claim.text).slice(0, 160)}`;
+    return r;
+  }
+  r.ok = true;
+  r.amount = Number(claim.json?.benefit?.amount) || 0;
+  r.expiresAt = String(claim.json?.expiresAt || "");
+  r.campaignKey = String(target.campaignKey || "");
+  if (claim.json?.replayed) { r.status = "already"; r.message = "今日已领取（幂等返回）"; }
+  else {
+    r.status = "claimed";
+    r.message = r.amount > 0 ? `领取成功 +${r.amount} ${r.campaignKey}`.trim() : `领取成功 ${r.campaignKey}`.trim();
+  }
+  return r;
+}

package/src/providers/qoder/constants.js

@@ -0,0 +1,45 @@
+// qoder 上游技术常量（转译 qoder2api account/region.go，禁止改值）
+export const OAUTH_CLIENT_ID = "e883ade2-e6e3-4d6d-adf7-f92ceff5fdcb";
+
+// Region → 端点（global=国际站 *.qoder.sh / cn=国内站 *.qoder.com.cn）
+export const ENDPOINTS = {
+  global: {
+    deviceLoginBase: "https://qoder.com/device/selectAccounts",
+    pollEndpoint: "https://openapi.qoder.sh/api/v1/deviceToken/poll",
+    userinfoBase: "https://openapi.qoder.sh/api/v1/userinfo",
+    chatStreamURL: "https://api1.qoder.sh/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1",
+    modelListURL: "https://api2.qoder.sh/algo/api/v2/model/list?Encode=1",
+    jobTokenURL: "https://center.qoder.sh/algo/api/v3/user/jobToken?Encode=1",
+    openapiBase: "https://openapi.qoder.sh",
+  },
+  cn: {
+    deviceLoginBase: "https://qoder.com.cn/device/selectAccounts",
+    pollEndpoint: "https://openapi.qoder.com.cn/api/v1/deviceToken/poll",
+    userinfoBase: "https://openapi.qoder.com.cn/api/v1/userinfo",
+    chatStreamURL: "https://gateway.qoder.com.cn/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1",
+    modelListURL: "https://gateway.qoder.com.cn/algo/api/v2/model/list?Encode=1",
+    jobTokenURL: "https://gateway.qoder.com.cn/algo/api/v3/user/jobToken?Encode=1",
+    openapiBase: "https://openapi.qoder.com.cn",
+  },
+};
+
+export function normalizeRegion(s) {
+  const v = String(s || "").trim().toLowerCase();
+  return v === "cn" ? "cn" : "global";
+}
+
+export function getEndpoints(region) {
+  return ENDPOINTS[normalizeRegion(region)];
+}
+
+// 签到/额度路径（同 base 换域名）：global=openapi.qoder.sh（有 campaigns，daily-check-in 404）；
+// cn=openapi.qoder.com.cn（两者皆有；Go 版签到硬编码该域，故只服务国内号）。
+export const EP_CAMPAIGNS = "/sash/api/v1/me/campaigns";
+export const EP_CHECKIN_STATUS = "/sash/api/v1/me/daily-check-in/status";
+export const EP_CHECKIN_CLAIM = "/sash/api/v1/me/daily-check-in/claim";
+export const EP_PLAN = "/api/v2/user/plan";
+export const EP_QUOTA = "/api/v2/quota/usage";
+
+export function openapiBase(region) {
+  return getEndpoints(region).openapiBase;
+}

package/src/providers/qoder/encode.js

@@ -0,0 +1,42 @@
+// qoder COSY 自定义 base64 编解码（转译 qoder2api internal/cosy/encoding.go）
+// 自定义字母表 + 1/3 尾部轮转，`$` 代 `=`
+const CUSTOM = "_doRTgHZBKcGVjlvpC,@aFSx#DPuNJme&i*MzLOEn)sUrthbf%Y^w.(kIQyXqWA!";
+const STD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const CUSTOM_PAD = "$";
+
+const c2s = new Array(128).fill(-1);
+const s2c = new Array(128).fill(-1);
+
+for (let i = 0; i < 64; i++) {
+  c2s[CUSTOM.charCodeAt(i)] = STD.charCodeAt(i);
+  s2c[STD.charCodeAt(i)] = CUSTOM.charCodeAt(i);
+}
+c2s[CUSTOM_PAD.charCodeAt(0)] = "=".charCodeAt(0);
+s2c["=".charCodeAt(0)] = CUSTOM_PAD.charCodeAt(0);
+
+export function cosyEncode(plain) {
+  const std = Buffer.from(plain).toString("base64");
+  const n = std.length;
+  const a = Math.floor(n / 3);
+  const rearranged = std.slice(n - a) + std.slice(a, n - a) + std.slice(0, a);
+  const out = new Array(n);
+  for (let i = 0; i < n; i++) {
+    const c = rearranged.charCodeAt(i);
+    if (c >= 128 || s2c[c] < 0) throw new Error("char out of alphabet: " + c);
+    out[i] = String.fromCharCode(s2c[c]);
+  }
+  return out.join("");
+}
+
+export function cosyDecode(encoded) {
+  const n = encoded.length;
+  const mapped = new Array(n);
+  for (let i = 0; i < n; i++) {
+    const c = encoded.charCodeAt(i);
+    if (c >= 128 || c2s[c] < 0) throw new Error("char out of custom alphabet: " + c);
+    mapped[i] = String.fromCharCode(c2s[c]);
+  }
+  const a = Math.floor(n / 3);
+  const std = mapped.slice(n - a).join("") + mapped.slice(a, n - a).join("") + mapped.slice(0, a).join("");
+  return Buffer.from(std, "base64");
+}

package/src/providers/qoder/fingerprint.js

@@ -0,0 +1,39 @@
+// qoder 设备指纹派生（转译 qoder2api internal/cosy/fingerprint.go + session.go）
+// fingerprint: 由 seed（uid 优先，无 uid 用 credential）派生 machineId/machineToken/machineType
+import { createHash, randomBytes } from "node:crypto";
+
+export function fingerprintSeed(uid, credential) {
+  if (uid) return uid;
+  return "cred:" + credential;
+}
+
+export function deriveMachineId(seed) {
+  return createHash("md5").update("machine:" + seed).digest("hex");
+}
+
+export function deriveMachineType(seed) {
+  return createHash("md5").update("machinetype:" + seed).digest("hex").slice(0, 18);
+}
+
+export function deriveMachineToken(seed) {
+  const sum = createHash("sha512").update("machinetoken:" + seed).digest();
+  return sum.toString("base64url").slice(0, 43);
+}
+
+export function newUUID() {
+  const b = randomBytes(16);
+  const hex = b.toString("hex");
+  return `${hex.slice(0,8)}-${hex.slice(8,12)}-${hex.slice(12,16)}-${hex.slice(16,20)}-${hex.slice(20,32)}`;
+}
+
+export function newRequestId() {
+  return randomBytes(12).toString("hex");
+}
+
+export function unixSec() {
+  return Math.floor(Date.now() / 1000);
+}
+
+export function unixMs() {
+  return Date.now();
+}

package/src/providers/qoder/index.js

@@ -0,0 +1,106 @@
+// qoder provider 门面（原生直连，零桥依赖）：
+// 多号 = keys[] 里每条 device_token blob（auths/qoder-<uid>.json 落盘由 login 维护）；
+// 每请求 round-robin 选号 → 建会话 → COSY 签名直调上游；恒 local-only 不借 key。
+import { loadProviderKeys, loadProviderConfig } from "../../state.js";
+import { listAccountDocs } from "./account-store.js";
+import { defaultStateFile } from "../../state/store.js";
+import { createKeyRing } from "../keyring.js";
+import { envInt } from "../base.js";
+import { accountFromBlob } from "./account-store.js";
+import { normalizeRegion } from "./constants.js";
+import { fingerprintSeed, deriveMachineId, deriveMachineToken, deriveMachineType } from "./fingerprint.js";
+import { newSession } from "./session.js";
+import { createChatService } from "./chat.js";
+import { createModelsService } from "./models.js";
+import { compatFetch } from "../../compat.js";
+
+function buildSessionFor(cred) {
+  const uid = cred.uid || cred.deviceToken.slice(0, 8);
+  const seed = fingerprintSeed(uid, cred.deviceToken);
+  const identity = {
+    name: cred.name || "", aid: uid, uid, yxUid: "",
+    organizationId: cred.organizationId || "", organizationName: cred.organizationName || "",
+    userType: cred.userType || "personal_standard",
+    securityOauthToken: cred.deviceToken, refreshToken: cred.refreshToken || "",
+  };
+  return newSession(identity, deriveMachineId(seed), deriveMachineToken(seed), deriveMachineType(seed));
+}
+
+export function createQoderProvider({
+  id = "qoder",
+  apiKeys,
+  file,
+  region,
+  fetchImpl,
+  cooldownMs = envInt("MSLXDFF_QODER_COOLDOWN_MS", 30_000),
+  connectTimeoutMs = Number(process.env.MSLXDFF_QODER_TIMEOUT_MS) || 120_000,
+} = {}) {
+  const keys = (() => {
+    if (Array.isArray(apiKeys) && apiKeys.length) return [...new Set(apiKeys.map((k) => String(k).trim()).filter(Boolean))];
+    try { return loadProviderKeys(id, file ? { file } : {}); } catch { return []; }
+  })();
+  let authList = [];
+  try { authList = loadProviderConfig(id, file ? { file } : {})?.auths || []; } catch {}
+  // auths 行的 region 会被 state.normalizeAuths 剥掉：每号真实 region 从 auths/qoder-<uid>.json 读（单一源）
+  try {
+    const docs = listAccountDocs();
+    for (const d of docs) {
+      const row = authList.find((a) => String(a?.uid) === String(d.uid));
+      if (row) row.region = d.doc?.auth?.region || "global";
+      else authList.push({ uid: d.uid, refreshToken: d.doc?.auth?.refreshToken || "", region: d.doc?.auth?.region || "global", name: d.doc?.account?.name || "" });
+    }
+  } catch {}
+  const ring = createKeyRing(keys, { cooldownMs });
+  if (!fetchImpl) fetchImpl = compatFetch;
+
+
+
+  // 凭据 → 会话（会话含 RSA/AES 临时密钥，进程内可复用；此处按请求轻建，成本低）
+  function pickSession() {
+    const key = ring.next() || keys[0] || "";
+    const blob = accountFromBlob(key);
+    if (!blob?.deviceToken) return null;
+    const auth = authList.find((a) => String(a?.refreshToken || "") === String(blob.refreshToken || "")) || authList[0] || {};
+    const region = normalizeRegion(region0 || auth.region || "global");
+    const sess = buildSessionFor({ ...blob, uid: auth.uid, name: auth.name, region });
+    return { sess, region };
+  }
+  const region0 = region; // 构造参数优先
+
+  const chatSvc = createChatService({ id, fetchImpl, timeoutMs: connectTimeoutMs });
+  // models 服务按号选区：构造时无固定 region，listModels(sess, region) 动态传
+  const modelsSvc = createModelsService({ id, fetchImpl });
+
+  async function chat(body) {
+    const picked = pickSession();
+    if (!picked) {
+      return new Response(JSON.stringify({ error: { message: "qoder: 无可用账号 — 先跑 mslxdff -provider qoder login", type: "auth_error" } }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    const stripped = { ...body };
+    if (typeof stripped.model === "string" && stripped.model.startsWith("qoder/")) stripped.model = stripped.model.slice(6);
+    return chatSvc.runChat(stripped, picked.sess, picked.region);
+  }
+
+  async function listModels() {
+    const picked = pickSession();
+    if (!picked) return [];
+    try { return await modelsSvc.listModels(picked.sess, picked.region); } catch { return []; }
+  }
+
+  async function preheat() {
+    try {
+      const picked = pickSession();
+      if (!picked) return { ok: false, error: "no account" };
+      await modelsSvc.listModels(picked.sess, picked.region);
+      return { ok: true };
+    } catch (e) { return { ok: false, error: String(e?.message || e).slice(0, 120) }; }
+  }
+
+  async function close() {}
+  async function chatWithKeys(body, keysOverride) {
+    const tmp = createQoderProvider({ id, apiKeys: keysOverride, file, fetchImpl, cooldownMs, connectTimeoutMs });
+    return tmp.chat(body);
+  }
+
+  return { id, chat, chatWithKeys, listModels, preheat, close, keyRing: ring, baseUrl: "qoder://native", region: normalizeRegion(region || authList[0]?.region) };
+}

package/src/providers/qoder/models.js

@@ -0,0 +1,62 @@
+// qoder 模型服务（转译 bridge.go ListModels/extractModels）：原生 COSY 签名拉 /model/list，
+// 10min 缓存；暴露全部 15 个 key（含 enable=false 的展示，allowlist 由上层过滤）。
+import { compatFetch, timeoutSignal } from "../../compat.js";
+import { getEndpoints, normalizeRegion } from "./constants.js";
+import { buildCosyHeaders, pathSigFrom } from "./session.js";
+import { joinModelId } from "../model-id.js";
+
+const CACHE_TTL_MS = 10 * 60 * 1000;
+const CREATED = 1753600000;
+const OWNER = "qoder";
+
+export function extractModels(chatList) {
+  const out = [];
+  for (const m of Array.isArray(chatList) ? chatList : []) {
+    if (!m?.key) continue;
+    out.push({
+      id: m.key,
+      name: String(m.display_name || m.key),
+      enable: Boolean(m.enable),
+      isDefault: Boolean(m.is_default),
+      isReasoning: Boolean(m.is_reasoning),
+      contextLength: Number(m.max_input_tokens) || 0,
+      priceFactor: Number(m.price_factor) || 0,
+    });
+  }
+  return out;
+}
+
+export function createModelsService({ id = "qoder", fetchImpl, clock = Date.now } = {}) {
+  let cache = null, fetchedAt = 0;
+
+  async function listModels(sess, region = "global") {
+    const normRegion = normalizeRegion(region);
+    const now = clock();
+    if (cache && now - fetchedAt < CACHE_TTL_MS) return cache;
+    const ep = getEndpoints(normRegion);
+    const url = ep.modelListURL;
+    const headers = buildCosyHeaders(sess, pathSigFrom(url), "", "application/json");
+    const res = await fetchImpl(url, { headers, signal: timeoutSignal(15000) });
+    if (!res.ok) throw new Error(`models http ${res.status}`);
+    const j = await res.json().catch(() => ({}));
+    const models = extractModels(j.chat) || extractModels(j.assistant);
+    if (!models.length) throw new Error("models list empty");
+    cache = models.map((m) => ({
+      id: joinModelId(id, m.id),
+      object: "model",
+      created: CREATED,
+      owned_by: OWNER,
+      name: m.name,
+      context_length: m.contextLength,
+      enable: m.enable,
+      is_reasoning: m.isReasoning,
+      price_factor: m.priceFactor,
+    }));
+    fetchedAt = now;
+    return cache;
+  }
+
+  function clearCache() { cache = null; fetchedAt = 0; }
+
+  return { listModels, clearCache, _getCache: () => cache };
+}

package/src/providers/qoder/oauth.js

@@ -0,0 +1,85 @@
+// qoder OAuth 设备授权（转译 qoder2api account/oauth.go）：
+// 1. startLogin: PKCE(S256) + nonce → 返回授权链接
+// 2. pollDeviceToken: 轮询 deviceToken/poll，404=未授权继续，200={token:dt-xxx, refresh_token:drt-xxx}
+// 3. fetchUserInfo: GET /api/v1/userinfo（Bearer dt-xxx）→ uid/name/organization_id
+import { randomBytes, createHash } from "node:crypto";
+import { compatFetch, timeoutSignal } from "../../compat.js";
+import { OAUTH_CLIENT_ID, getEndpoints } from "./constants.js";
+
+const POLL_MS = 3000;
+export const POLL_TIMEOUT_MS = 10 * 60 * 1000; // 对齐 qoder2api 10 分钟
+
+export function pkce() {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+
+export function hex16() {
+  return randomBytes(16).toString("hex");
+}
+
+export function buildLoginUrl({ region = "global", nonce, challenge } = {}) {
+  const ep = getEndpoints(region);
+  const params = new URLSearchParams({
+    nonce,
+    challenge,
+    challenge_method: "S256",
+    client_id: OAUTH_CLIENT_ID,
+  });
+  return `${ep.deviceLoginBase}?${params.toString()}`;
+}
+
+// 单次轮询：404/空 token → 未授权（返回 null）；200 且有 token → bundle；5xx → 抛错。
+export async function pollDeviceToken({ region = "global", nonce, verifier, fetchImpl = compatFetch } = {}) {
+  const ep = getEndpoints(region);
+  const url = `${ep.pollEndpoint}?nonce=${encodeURIComponent(nonce)}&verifier=${encodeURIComponent(verifier)}&challenge_method=S256`;
+  let res;
+  try {
+    res = await fetchImpl(url, { signal: timeoutSignal(20000) });
+  } catch (e) {
+    throw new Error(`轮询失败: ${e.message}`);
+  }
+  if (res.status === 404) return null; // 还没授权
+  if (res.status >= 500) throw new Error(`deviceToken 端点故障: HTTP ${res.status}`);
+  const txt = await res.text().catch(() => "");
+  let j;
+  try { j = JSON.parse(txt); } catch { throw new Error(`deviceToken 返回非 JSON: ${txt.slice(0, 200)}`); }
+  const deviceToken = String(j.token || "");
+  if (!deviceToken) return null;
+  return { deviceToken, refreshToken: String(j.refresh_token || "") };
+}
+
+// userinfo：ResolveOAuthUserID 优先 id/userId/uid（qoder2api bridge.go）。
+export async function fetchUserInfo({ region = "global", deviceToken, fetchImpl = compatFetch } = {}) {
+  const ep = getEndpoints(region);
+  const res = await fetchImpl(ep.userinfoBase, {
+    headers: { Authorization: `Bearer ${deviceToken}` },
+    signal: timeoutSignal(20000),
+  });
+  const txt = await res.text().catch(() => "");
+  let j;
+  try { j = JSON.parse(txt); } catch { throw new Error(`userinfo 返回非 JSON: HTTP ${res.status} ${txt.slice(0, 200)}`); }
+  if (!res.ok) throw new Error(`userinfo HTTP ${res.status}: ${txt.slice(0, 200)}`);
+  const uid = String(j.id || j.userId || j.uid || "");
+  if (!uid) throw new Error(`userinfo 无 uid: ${txt.slice(0, 200)}`);
+  return {
+    uid,
+    name: String(j.name || ""),
+    email: String(j.email || ""),
+    userType: String(j.userType || j.user_type || "personal_standard"),
+    organizationId: String(j.organization_id || ""),
+    organizationName: String(j.organization_name || ""),
+  };
+}
+
+// 轮询直到授权成功，返回 bundle；超时抛错。deps.log 便于测试注入。
+export async function waitForAuth({ region, nonce, verifier, fetchImpl = compatFetch, log = console.log, deadline = Date.now() + POLL_TIMEOUT_MS } = {}) {
+  for (;;) {
+    if (Date.now() > deadline) throw new Error("授权超时（10 分钟），请重新运行 mslxdff -provider qoder login");
+    const bundle = await pollDeviceToken({ region, nonce, verifier, fetchImpl });
+    if (bundle) return bundle;
+    await new Promise((r) => setTimeout(r, POLL_MS));
+    try { process.stdout.write("."); } catch {}
+  }
+}