mslxdff 0.1.136 → 0.1.140

package/src/providers/qoder/payload.js

@@ -0,0 +1,156 @@
+// qoder 消息/payload 组装（转译 qoder2api bridge.go CallQoderWithOpts + messages.go）
+// 模板：baseprompt.json（vendored 数据文件，含 {UUID1..5}/{TIME1} 占位符，加载时替换一次）
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { newUUID, unixMs } from "./fingerprint.js";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// 模板单例：进程内加载一次（替换占位符后 JSON.parse），每请求深拷贝
+let _template = null;
+export function loadTemplate(templatePath) {
+  if (_template && !templatePath) return _template;
+  let tmpl = readFileSync(templatePath || join(__dirname, "baseprompt.json"), "utf8");
+  for (const k of ["{UUID1}", "{UUID2}", "{UUID3}", "{UUID4}", "{UUID5}"]) tmpl = tmpl.split(k).join(newUUID());
+  tmpl = tmpl.split("{TIME1}").join(String(unixMs()));
+  _template = JSON.parse(tmpl);
+  return _template;
+}
+
+export function blankResponseMeta() {
+  return {
+    id: "",
+    usage: {
+      prompt_tokens: 0, completion_tokens: 0, total_tokens: 0,
+      completion_tokens_details: { reasoning_tokens: 0 },
+      prompt_tokens_details: { cached_tokens: 0 },
+    },
+  };
+}
+
+// OpenAI user 消息 → Qoder contents 形状
+export function buildUserMessage(text) {
+  return {
+    role: "user", content: "",
+    contents: [{ type: "text", text: String(text || "") }],
+    response_meta: blankResponseMeta(),
+    reasoning_content_signature: "",
+  };
+}
+
+export function buildStructuredMessage(role, text) {
+  return { role, content: String(text || ""), response_meta: blankResponseMeta(), reasoning_content_signature: "" };
+}
+
+export function normalizeContent(content) {
+  if (typeof content === "string") return content;
+  if (content == null) return "";
+  if (Array.isArray(content)) {
+    let out = "";
+    for (const b of content) {
+      const t = typeof b === "object" && b ? b.text : b;
+      if (typeof t === "string") out += (out ? "\n\n" : "") + t;
+    }
+    return out;
+  }
+  return JSON.stringify(content);
+}
+
+// 提取最后一条 user 消息文本（仿 ExtractLatestUserPrompt）
+export function extractLatestUserPrompt(messages) {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i];
+    if (m?.role === "user") return normalizeContent(m.content);
+  }
+  return "";
+}
+
+// OpenAI messages → Qoder messages（仿 BuildQoderMessages：无 system 前置模板 system；
+// user 含 tool_result 数组拆成 tool 行；assistant tool_calls 透传）
+export function buildQoderMessages(template, incoming, toolsEnabled) {
+  const rebuilt = [];
+  const hasSystem = (incoming || []).some((m) => m?.role === "system");
+  if (!hasSystem && template) {
+    for (const m of template.messages || []) {
+      if (m?.role === "system") rebuilt.push(JSON.parse(JSON.stringify(m)));
+    }
+  }
+  for (const m of incoming || []) {
+    if (!m || typeof m !== "object") continue;
+    const text = normalizeContent(m.content);
+    if (m.role === "user") {
+      // tool_result 数组形态 → tool 行
+      if (Array.isArray(m.content) && m.content[0]?.type === "tool_result") {
+        for (const b of m.content) {
+          if (b?.type !== "tool_result") continue;
+          rebuilt.push({ role: "tool", tool_call_id: b.tool_use_id || "", content: normalizeContent(b.content) });
+        }
+        continue;
+      }
+      rebuilt.push(buildUserMessage(text));
+    } else if (m.role === "assistant" && toolsEnabled && Array.isArray(m.tool_calls) && m.tool_calls.length) {
+      const out = buildStructuredMessage("assistant", text);
+      out.tool_calls = m.tool_calls;
+      rebuilt.push(out);
+    } else if (m.role === "tool") {
+      const out = buildStructuredMessage("tool", text);
+      if (m.tool_call_id) out.tool_call_id = m.tool_call_id;
+      if (m.name) out.name = m.name;
+      rebuilt.push(out);
+    } else if (text) {
+      rebuilt.push(buildStructuredMessage(m.role === "system" ? "system" : m.role || "user", text));
+    }
+  }
+  return rebuilt;
+}
+
+// 组装上游请求体（仿 CallQoderWithOpts）
+export function buildQoderBody({ template, userType, model, messages, tools, maxTokens, isReasoning }) {
+  const body = JSON.parse(JSON.stringify(template || loadTemplate()));
+  const nid = newUUID();
+  body.request_id = nid;
+  body.chat_record_id = nid;
+  body.request_set_id = newUUID();
+  body.session_id = newUUID();
+  body.stream = true;
+  body.aliyun_user_type = userType || "personal_standard";
+  if (body.model_config) {
+    body.model_config.key = model;
+    if (isReasoning) body.model_config.is_reasoning = true;
+  }
+  if (maxTokens > 0 && body.parameters) body.parameters.max_tokens = maxTokens;
+  const prompt = extractLatestUserPrompt(messages);
+  if (body.business) {
+    body.business.id = newUUID();
+    body.business.begin_at = unixMs();
+    body.business.name = prompt.length > 30 ? prompt.slice(0, 30) : prompt;
+  }
+  if (body.chat_context) {
+    if (body.chat_context.text) body.chat_context.text.text = prompt;
+    if (body.chat_context.extra?.originalContent) body.chat_context.extra.originalContent.text = prompt;
+  }
+  body.messages = messages;
+  if (tools != null) body.tools = tools;
+  return { body, prompt, mcSource: body.model_config?.source || "system" };
+}
+
+// 客户端模型名 → 上游 key（仿 defaultModelMapping 双向 substring，家族关键字兜底）
+const DEFAULT_MAPPING = {
+  opus: "qmodel_38max", sonnet: "gmodel", haiku: "qfmodel",
+  gpt: "dmodel", gemini: "gmodel", glm: "gmodel", kimi: "kmodel", deepseek: "dmodel",
+  qwen: "qfmodel", flash: "qfmodel", mini: "efficient", pro: "performance", max: "performance",
+};
+// 上游原生 key 白名单（model/list 实测 15 个）——精确命中直接透传，防被家族关键字抢走
+const UPSTREAM_KEYS = new Set(["auto", "ultimate", "performance", "efficient", "qmodel_38max", "qfmodel", "qmodel_latest", "qmodel", "kmodel_latest", "kmodel", "gmodel", "gfmodel", "dmodel", "dfmodel", "mmodel"]);
+export function mapModel(model) {
+  const m = String(model || "").trim();
+  if (!m || m.toLowerCase() === "auto") return "qfmodel";
+  const low = m.toLowerCase();
+  if (UPSTREAM_KEYS.has(low)) return low;
+  if (DEFAULT_MAPPING[low]) return DEFAULT_MAPPING[low];
+  for (const [k, v] of Object.entries(DEFAULT_MAPPING)) {
+    if (low.includes(k) || k.includes(low)) return v;
+  }
+  return low;
+}

package/src/providers/qoder/request.js

@@ -0,0 +1,26 @@
+// qoder 上游请求装配（纯函数，无网络）：OpenAI body → COSY 签名请求（url/headers/bodyStr）。
+// 从 chat.js 拆出，使真流式/聚合两条管线共享同一装配口（单一来源，防两处签名漂移）。
+import { getEndpoints, normalizeRegion } from "./constants.js";
+import { buildCosyHeaders, pathSigFrom } from "./session.js";
+import { cosyEncode } from "./encode.js";
+import { buildQoderBody, mapModel } from "./payload.js";
+
+export function buildUpstreamRequest({ sess, region, model, messages, tools, maxTokens }) {
+  const upstreamModel = mapModel(model);
+  const { body, mcSource } = buildQoderBody({
+    template: undefined,
+    userType: sess?.identity?.userType,
+    model: upstreamModel,
+    messages,
+    tools,
+    maxTokens,
+  });
+  const ep = getEndpoints(normalizeRegion(region));
+  const url = ep.chatStreamURL;
+  const bodyStr = cosyEncode(Buffer.from(JSON.stringify(body)));
+  const headers = buildCosyHeaders(sess, pathSigFrom(url), bodyStr, "text/event-stream");
+  headers["x-model-key"] = upstreamModel;
+  headers["x-model-source"] = mcSource;
+  headers["accept"] = "text/event-stream";
+  return { url, headers, bodyStr, upstreamModel, mcSource };
+}

package/src/providers/qoder/session.js

@@ -0,0 +1,135 @@
+// qoder COSY 签名与会话（转译 qoder2api internal/cosy/session.go + signature.go + auth.go）
+// 会话：RSA-OAEP 加密 tempKey + AES-CBC 加密身份 payload → cosyKey + info
+// 签名：md5(payloadB64 + "\n" + cosyKey + "\n" + date + "\n" + body + "\n" + pathSig)
+import { createHash, randomBytes, createCipheriv, publicEncrypt } from "node:crypto";
+import { cosyEncode } from "./encode.js";
+import { newUUID, unixSec } from "./fingerprint.js";
+
+export const APP_CODE = "cosy";
+export const VERSION = "1.0.10";
+// base64("war, war never changes")
+const SECRET_B64 = "d2FyLCB3YXIgbmV2ZXIgY2hhbmdlcw==";
+
+const SERVER_PUB_KEY = `-----BEGIN PUBLIC KEY-----
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
+4k6Pz1EaDicBMpdpxKduSZu5OANqUq8er4GM95omAGIOPOh+Nx0spthYA2BqGz+l
+6HRkPJ7S236FZz73In/KVuLnwI8JJ2CbuJap8kvheCCZpmAWpb/cPx/3Vr/J6I17
+XcW+ML9FoCI6AOvOzwIDAQAB
+-----END PUBLIC KEY-----`;
+
+export function signLegacy(date) {
+  const s = APP_CODE + "&" + SECRET_B64 + "&" + date;
+  return createHash("md5").update(s).digest("hex");
+}
+
+export function currentDate() {
+  return new Date().toUTCString();
+}
+
+export function buildPayloadB64(info) {
+  const m = JSON.stringify({
+    cosyVersion: VERSION,
+    ideVersion: "",
+    info,
+    requestId: newUUID(),
+    version: "v1",
+  });
+  return Buffer.from(m).toString("base64");
+}
+
+export function signRequest(payloadB64, cosyKey, cosyDate, body, pathWithoutAlgo) {
+  const s = payloadB64 + "\n" + cosyKey + "\n" + cosyDate + "\n" + body + "\n" + pathWithoutAlgo;
+  return createHash("md5").update(s).digest("hex");
+}
+
+export function composeBearer(payloadB64, sig) {
+  return "Bearer COSY." + payloadB64 + "." + sig;
+}
+
+export function psfRsaEncrypt(plaintext) {
+  return publicEncrypt(
+    { key: SERVER_PUB_KEY, padding: 1 }, // PKCS1v15
+    plaintext
+  );
+}
+
+function aesEncrypt(plain, key) {
+  const bs = 16;
+  const pad = bs - (plain.length % bs);
+  const padded = Buffer.alloc(plain.length + pad, pad);
+  plain.copy(padded);
+  const iv = key.slice(0, bs);
+  const cipher = createCipheriv("aes-128-cbc", key, iv);
+  return Buffer.concat([cipher.update(padded), cipher.final()]);
+}
+
+export function authPayloadJSON(id) {
+  return JSON.stringify({
+    name: id.name || "",
+    aid: id.aid || "",
+    uid: id.uid || "",
+    yx_uid: id.yxUid || "",
+    organization_id: id.organizationId || "",
+    organization_name: id.organizationName || "",
+    user_type: id.userType || "personal_standard",
+    security_oauth_token: id.securityOauthToken || "",
+    refresh_token: id.refreshToken || "",
+  });
+}
+
+export function newSession(id, machineId, machineToken, machineType) {
+  const raw = randomBytes(16);
+  const tempKey = Buffer.from(raw.toString("hex").slice(0, 16), "utf8").slice(0, 16);
+  // 确保正好 16 字节
+  const key16 = Buffer.alloc(16);
+  tempKey.copy(key16);
+
+  const cosyKeyBytes = psfRsaEncrypt(key16);
+  const cosyKey = cosyKeyBytes.toString("base64");
+
+  const payloadBytes = Buffer.from(authPayloadJSON(id), "utf8");
+  const encPayload = aesEncrypt(payloadBytes, key16);
+  const info = encPayload.toString("base64");
+
+  return { tempKey: key16, cosyKey, info, identity: id, machineId, machineToken, machineType };
+}
+
+// 去除 /algo 前缀的 PathSig
+export function pathSigFrom(url) {
+  try {
+    const u = new URL(url);
+    let p = u.pathname;
+    if (p.startsWith("/algo")) p = p.slice(5);
+    return p;
+  } catch {
+    return "";
+  }
+}
+
+// 构造请求头
+export function buildCosyHeaders(sess, pathSig, bodyStr, accept) {
+  const payloadB64 = buildPayloadB64(sess.info);
+  const date = String(unixSec());
+  const sig = signRequest(payloadB64, sess.cosyKey, date, bodyStr || "", pathSig);
+  const bearer = composeBearer(payloadB64, sig);
+  return {
+    "cosy-data-policy": "agree",
+    "content-type": "application/json",
+    "cosy-machinetype": sess.machineType,
+    "cosy-clienttype": "5",
+    "cosy-date": date,
+    "cosy-user": sess.identity.uid,
+    "cosy-key": sess.cosyKey,
+    "cache-control": "no-cache",
+    "accept": accept || "application/json",
+    "authorization": bearer,
+    "cosy-version": VERSION,
+    "cosy-machineid": sess.machineId,
+    "cosy-machinetoken": sess.machineToken,
+    "login-version": "v2",
+    "user-agent": "Go-http-client/2.0",
+    "cosy-scene": "assistant",
+    "cosy-business-product": "ide",
+    "cosy-business-type": "agent",
+  };
+}

package/src/providers/qoder/sse.js

@@ -0,0 +1,46 @@
+// qoder 上游 SSE 信封解析（转译 qoder2api bridge.go ExtractDelta）
+// 帧形态：data:{"headers":{},"body":"<内层JSON>","statusCodeValue":200}
+// 信封 statusCodeValue!=200 = 瞬时上游错；内层 code!=0 = 业务错；usage 同帧合并
+export function extractDelta(dataLine) {
+  let wrapper;
+  try { wrapper = JSON.parse(dataLine); } catch { return {}; }
+  if (wrapper.statusCodeValue !== undefined && Number(wrapper.statusCodeValue) !== 200) {
+    const detail = typeof wrapper.body === "string" && wrapper.body ? wrapper.body : JSON.stringify(wrapper).slice(0, 400);
+    return { err: { kind: "upstream", status: Number(wrapper.statusCodeValue) || 502, detail } };
+  }
+  const inner = wrapper.body;
+  if (!inner || typeof inner !== "string") return {};
+  let j;
+  try { j = JSON.parse(inner); } catch { return {}; }
+  let usageIn = 0, usageOut = 0;
+  if (j.usage && typeof j.usage === "object") {
+    usageIn = Math.trunc(Number(j.usage.prompt_tokens) || 0);
+    usageOut = Math.trunc(Number(j.usage.completion_tokens) || 0);
+  }
+  const choices = Array.isArray(j.choices) ? j.choices : [];
+  for (const ch of choices) {
+    const delta = ch?.delta;
+    if (!delta) continue;
+    const role = typeof delta.role === "string" ? delta.role : "";
+    const content = typeof delta.content === "string" ? delta.content : "";
+    const reasoning = typeof delta.reasoning_content === "string" ? delta.reasoning_content : "";
+    const toolCalls = Array.isArray(delta.tool_calls) && delta.tool_calls.length ? delta.tool_calls : null;
+    if (role || content || reasoning || toolCalls) {
+      return { role, content, reasoning, toolCalls, usageIn, usageOut };
+    }
+  }
+  if (typeof j.code === "string" && j.code && j.code !== "0") {
+    return { err: { kind: /inappropriate|DataInspection|Sensitive|ContentFilter/i.test(String(j.message)) ? "content_policy" : "business", code: j.code, detail: String(j.message || "") } };
+  }
+  if (usageIn > 0 || usageOut > 0) return { usageIn, usageOut };
+  return {};
+}
+
+// 错误四分类 → HTTP 状态（对齐 errors.go ErrorStatus 语义）
+export function errorStatus(err) {
+  if (!err) return 500;
+  if (err.kind === "content_policy") return 400;
+  if (err.kind === "auth") return [401, 403].includes(err.status) ? err.status : 401;
+  if (err.kind === "upstream") return [401, 403, 429].includes(err.status) ? err.status : 502;
+  return 502;
+}

package/src/providers/qoder/stream.js

@@ -0,0 +1,81 @@
+// qoder 真流式转发：上游 Response.body → OpenAI SSE Response（边收边转，不攒数组）。
+// 对标 traework chat.js reshapeSoloStream（reader.read 循环 + sendChunk 即时写）。
+// usage 只在尾帧出现：收到即记，附在 finish chunk 上一次发出（与旧回放语义一致）。
+import { extractDelta } from "./sse.js";
+
+function openaiChunk({ model, chatId, delta, finish, usage }) {
+  const c = {
+    id: chatId,
+    object: "chat.completion.chunk",
+    created: Math.floor(Date.now() / 1000),
+    model,
+    choices: [{ index: 0, delta, finish_reason: finish || null }],
+  };
+  if (usage && finish) c.usage = usage;
+  return `data: ${JSON.stringify(c)}\n\n`;
+}
+
+function errorEvent(e) {
+  return `event: error\ndata: ${JSON.stringify({ message: String(e?.detail || e?.message || e), type: e?.kind || "upstream_error" })}\n\n`;
+}
+
+export function reshapeQoderStream(upstreamRes, { model, chatId }) {
+  const src = upstreamRes.body;
+  const enc = new TextEncoder();
+  const dec = new TextDecoder();
+  let buf = "";
+  let usage = null;
+  let finish = "stop";
+  let sawContent = false;
+  let finishSent = false;
+  const stream = new ReadableStream({
+    async start(ctrl) {
+      const reader = src.getReader();
+      const send = (t) => ctrl.enqueue(enc.encode(t));
+      try {
+        send(openaiChunk({ model, chatId, delta: { role: "assistant" } }));
+        for (;;) {
+          const { done, value } = await reader.read();
+          if (value) buf += dec.decode(value, { stream: !done });
+          const lines = buf.split("\n");
+          buf = lines.pop();
+          for (const raw of lines) {
+            const line = raw.replace(/\r$/, "");
+            if (!line.startsWith("data:")) continue;
+            const payload = line.slice(5).trim();
+            if (!payload || payload === "[DONE]") continue;
+            const d = extractDelta(payload);
+            if (d.err) throw d.err;
+            if (d.usageIn || d.usageOut) {
+              usage = { prompt_tokens: d.usageIn, completion_tokens: d.usageOut, total_tokens: d.usageIn + d.usageOut };
+            }
+            const delta = {};
+            if (d.content) { delta.content = d.content; sawContent = true; }
+            if (d.reasoning) { delta.reasoning_content = d.reasoning; sawContent = true; }
+            if (d.toolCalls) { delta.tool_calls = d.toolCalls; finish = "tool_calls"; sawContent = true; }
+            if (Object.keys(delta).length) send(openaiChunk({ model, chatId, delta }));
+          }
+          if (done) break;
+        }
+        if (!sawContent && !usage) {
+          throw { kind: "upstream", status: 502, detail: "empty upstream stream" };
+        }
+        send(openaiChunk({ model, chatId, delta: {}, finish, usage }));
+        send("data: [DONE]\n\n");
+        finishSent = true;
+      } catch (e) {
+        if (!finishSent) {
+          try { send(openaiChunk({ model, chatId, delta: {} })); } catch {}
+          try { send(errorEvent(e)); } catch {}
+          try { send("data: [DONE]\n\n"); } catch {}
+          finishSent = true;
+        }
+      }
+      try { ctrl.close(); } catch {}
+    },
+  });
+  return new Response(stream, {
+    status: 200,
+    headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive" },
+  });
+}

package/src/providers/qoder.js

@@ -0,0 +1,2 @@
+// Shim — 保持历史导入路径兼容，真实实现下沉至 ./qoder/ 深模块
+export * from "./qoder/index.js";

package/src/providers/registry.js

@@ -10,11 +10,26 @@ export const customProviders = [
     match: (id, baseUrl) => id === "workbuddy" || String(baseUrl).includes("copilot.tencent"),
     load: () => import("./workbuddy.js").then((m) => m.createWorkbuddyProvider),
   },
+  {
+    id: "traework",
+    match: (id, baseUrl) => id === "traework" || String(baseUrl).includes("trae"),
+    load: () => import("./traework.js").then((m) => m.createTraeworkProvider),
+  },
   {
     id: "cline",
-    match: (id, baseUrl) => id === "cline" || id === "clinebot" || String(baseUrl).includes("cline.bot"),
+    match: (id, baseUrl) => id === "cline" || String(baseUrl).includes("cline.bot"),
     load: () => import("./cline.js").then((m) => m.createClineProvider),
   },
+  {
+    id: "codearts",
+    match: (id, baseUrl) => id === "codearts" || String(baseUrl).includes("myhuaweicloud.com"),
+    load: () => import("./codearts.js").then((m) => m.createCodeartsProvider),
+  },
+  {
+    id: "qoder",
+    match: (id, baseUrl) => id === "qoder" || String(baseUrl).includes("qoder"),
+    load: () => import("./qoder/index.js").then((m) => m.createQoderProvider),
+  },
 ];
 
 // 供 bench/probe 等需要定制化解析模型列表的场景

package/src/providers/share-keys.js

@@ -3,12 +3,14 @@
 import { splitModelId, DEFAULT_PROVIDER } from "./model-id.js";
 import { classifyProvider } from "./classify.js";
 import { loadProviderKeys, listProviderIdsWithKeys } from "../state.js";
+import { isRefreshToken } from "./cline/headers.js";
 
 export const SHARE_KEYS_HEADER = "x-mslxdff-share-keys";
 
 // 硬排除：refresh-token 型凭据（对端刷新会轮换 token，与本机互相踢下线）——正确性问题。
-const NEVER_SHARE_IDS = new Set(["cline", "clinebot"]);
-
+// 二层保护：① 按 id 硬排除（cline 恒 local-only）；② 按凭据形状兜底（见 shareableProviderIds）。
+// traework 与 workbuddy 同为本机账号绑定型（auths/*.json + uid），恒不借出。
+const NEVER_SHARE_IDS = new Set(["cline", "codearts", "traework", "qoder"]);
 // 本节点应 cast key 到出站转发的供应商 id 集合 = 所有「本机有 key」的供应商，
 // 减去：opencode（无 key 且恒排除）、local-only（workbuddy/cline系，本就不走组员）、刷新型凭据。
 export function shareableProviderIds({ file } = {}) {
@@ -17,6 +19,9 @@ export function shareableProviderIds({ file } = {}) {
     if (id === DEFAULT_PROVIDER) continue;
     if (NEVER_SHARE_IDS.has(id)) continue;
     try { if (classifyProvider(id) === "local-only") continue; } catch {}
+    // 形状兜底：id 白名单可能有残留（迁移未跑/回滚/手改 config），只要该供应商现有 key 里
+    // 有一个是 refreshToken 形态，就一律不外借——refreshToken 借出去会被对端刷新轮换，双向踢下线。
+    try { if (loadProviderKeys(id, { file }).some((k) => isRefreshToken(k, id))) continue; } catch {}
     ids.push(id);
   }
   return ids;

package/src/providers/traework/account-store.js

@@ -0,0 +1,149 @@
+// traework 账号落盘单一源：auths/trae-<uid>.json（0600 tmp+rename）+ state.json keys/auths 按 uid 去重。
+// 仿 src/providers/workbuddy/account-store.js。
+import { writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync, readdirSync, readFileSync, chmodSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { tmpdir } from "node:os";
+import { isTestEnv, defaultStateFile } from "../../state/store.js";
+
+export function authDirFor({ explicit = "", testEnv = false, stateFile } = {}) {
+  if (explicit) return explicit;
+  if (testEnv) return join(tmpdir(), "mslxdff-test-auths");
+  return join(dirname(stateFile), "auths");
+}
+
+export function resolveAuthDir() {
+  return authDirFor({
+    explicit: process.env.TRAEWORK_AUTH_DIR || "",
+    testEnv: isTestEnv(),
+    stateFile: defaultStateFile(),
+  });
+}
+
+export function authDirCandidates({ primary, explicit = "", testEnv = false, cwdDir = "" } = {}) {
+  const dirs = [primary];
+  if (!explicit && !testEnv && cwdDir && cwdDir !== primary) dirs.push(cwdDir);
+  return dirs;
+}
+
+export function resolveAuthDirs() {
+  return authDirCandidates({
+    primary: resolveAuthDir(),
+    explicit: process.env.TRAEWORK_AUTH_DIR || "",
+    testEnv: isTestEnv(),
+    cwdDir: join(process.cwd(), "auths"),
+  });
+}
+
+export function findAccountFile(uid) {
+  for (const dir of resolveAuthDirs()) {
+    const fp = join(dir, `trae-${uid}.json`);
+    if (existsSync(fp)) return fp;
+  }
+  return null;
+}
+
+// 扫描 trae-*.json，返回已校验的凭证行。读取侧单一真相。
+export function listAccountDocs({ dirs } = {}) {
+  const out = [];
+  const seen = new Set();
+  for (const dir of dirs || resolveAuthDirs()) {
+    let files = [];
+    try {
+      if (!existsSync(dir)) continue;
+      files = readdirSync(dir).filter((f) => f.startsWith("trae-") && f.endsWith(".json"));
+    } catch { continue; }
+    for (const f of files) {
+      try {
+        const doc = JSON.parse(readFileSync(join(dir, f), "utf8"));
+        const uid = doc?.account?.uid || doc?.uid;
+        const at = doc?.auth?.accessToken || doc?.accessToken;
+        if (!uid || !at) continue;
+        if (seen.has(String(uid))) continue;
+        seen.add(String(uid));
+        out.push({ uid: String(uid), file: join(dir, f), dir, doc });
+      } catch {}
+    }
+  }
+  return out;
+}
+
+function writeAccountFile({ uid, accessToken, refreshToken = "", expiresAt = 0, domain = "trae.cn", apiHost = "", machineId = "", deviceId = "", enterpriseId = "", nickname = "" }) {
+  const authDir = resolveAuthDir();
+  mkdirSync(authDir, { recursive: true });
+  const exp = expiresAt || Math.floor(Date.now() / 1000) + 5184000;
+  const doc = {
+    account: { uid, enterpriseId, nickname },
+    auth: { accessToken, refreshToken, expiresAt: exp, domain, apiHost, machineId, deviceId },
+  };
+  const fp = join(authDir, `trae-${uid}.json`);
+  const tmp = `${fp}.tmp`;
+  writeFileSync(tmp, JSON.stringify(doc, null, 2), { mode: 0o600 });
+  try {
+    if (existsSync(fp)) { try { chmodSync(fp, 0o600); } catch {} unlinkSync(fp); }
+    renameSync(tmp, fp);
+  } catch {
+    writeFileSync(fp, JSON.stringify(doc, null, 2), { mode: 0o600 });
+    try { unlinkSync(tmp); } catch {}
+  }
+  try { chmodSync(fp, 0o600); } catch {}
+  return fp;
+}
+
+async function persistAccounts(accounts, file, extraKeys = []) {
+  const { loadProviderConfigs, saveProviderConfig } = await import("../../state.js");
+  const cfg = (loadProviderConfigs(file ? { file } : {})?.traework) || {};
+  const keys = [...(Array.isArray(cfg.keys) ? cfg.keys : [])];
+  const auths = [...(Array.isArray(cfg.auths) ? cfg.auths : [])];
+  let updated = 0;
+  for (const acc of accounts) {
+    if (!acc?.uid || !acc?.accessToken) continue;
+    const row = { uid: acc.uid, domain: acc.domain || "trae.cn", apiHost: acc.apiHost || "", machineId: acc.machineId || "", deviceId: acc.deviceId || "", enterpriseId: acc.enterpriseId || "", refreshToken: acc.refreshToken || "" };
+    const atIdx = auths.findIndex((a) => a?.uid === acc.uid);
+    if (atIdx >= 0) { keys[atIdx] = acc.accessToken; auths[atIdx] = row; updated += 1; }
+    else { keys.push(acc.accessToken); auths.push(row); }
+  }
+  for (const k of extraKeys) if (k && !keys.includes(k)) keys.push(k);
+  saveProviderConfig("traework", { baseUrl: cfg.baseUrl || "https://trae-api-cn.mchost.guru", keys, auths }, file ? { file } : {});
+  return { keys, auths, updated };
+}
+
+export async function saveTraeworkAccount({ uid, enterpriseId = "", nickname = "", accessToken, refreshToken = "", expiresAt = 0, domain = "trae.cn", apiHost = "", machineId = "", deviceId = "", file } = {}) {
+  if (!uid || !accessToken) throw new Error("saveTraeworkAccount: 缺少 uid/accessToken");
+  const fp = writeAccountFile({ uid, accessToken, refreshToken, expiresAt, domain, apiHost, machineId, deviceId, enterpriseId, nickname });
+  const st = await persistAccounts([{ uid, accessToken, refreshToken, domain, apiHost, machineId, deviceId, enterpriseId }], file);
+  return { file: fp, accounts: st.keys.length, updated: st.updated > 0 };
+}
+
+function accountsFromArrays(keys, authList) {
+  const accounts = [];
+  const extraKeys = [];
+  const n = Math.max(keys.length, authList.length);
+  for (let i = 0; i < n; i++) {
+    const a = authList[i];
+    if (a && typeof a === "object" && a.uid) {
+      accounts.push({ uid: a.uid, accessToken: keys[i] || "", refreshToken: a.refreshToken || "", domain: a.domain, apiHost: a.apiHost, machineId: a.machineId, deviceId: a.deviceId, enterpriseId: a.enterpriseId });
+    } else if (keys[i]) extraKeys.push(keys[i]);
+  }
+  return { accounts, extraKeys };
+}
+
+// 刷新后的 token 落盘：平行数组按下标更新 + state + auths 文件单点落盘。
+export async function applyTokenRefresh({ uid, oldKey, newToken, refreshToken = "", domain = "trae.cn", apiHost = "", machineId = "", deviceId = "", enterpriseId = "", auth = null, keys = [], authList = [], file } = {}) {
+  if (!uid || !newToken) return { updated: false, accounts: keys.length, file: null };
+  const keyIdx = keys.indexOf(oldKey);
+  const uidIdx = authList.findIndex((a) => a && String(a.uid) === String(uid));
+  const idx = keyIdx >= 0 ? keyIdx : uidIdx;
+  const matched = idx >= 0;
+  if (idx >= 0) keys[idx] = newToken;
+  else if (!keys.includes(newToken)) keys.push(newToken);
+  if (uidIdx >= 0) {
+    const prev = authList[uidIdx] && typeof authList[uidIdx] === "object" ? authList[uidIdx] : null;
+    authList[uidIdx] = { ...(prev || auth || {}), uid, domain: prev?.domain || auth?.domain || domain, apiHost: prev?.apiHost || auth?.apiHost || apiHost, machineId: prev?.machineId || auth?.machineId || machineId, deviceId: prev?.deviceId || auth?.deviceId || deviceId, enterpriseId: prev?.enterpriseId || auth?.enterpriseId || enterpriseId, refreshToken };
+  } else {
+    authList.push({ ...(auth || {}), uid, domain: auth?.domain || domain, apiHost: auth?.apiHost || apiHost, machineId: auth?.machineId || machineId, deviceId: auth?.deviceId || deviceId, enterpriseId: auth?.enterpriseId || enterpriseId, refreshToken });
+  }
+  const fp = writeAccountFile({ uid, accessToken: newToken, refreshToken, domain, apiHost, machineId, deviceId, enterpriseId });
+  const { accounts, extraKeys } = accountsFromArrays(keys, authList);
+  const st = await persistAccounts(accounts, file, extraKeys);
+  return { updated: matched, accounts: st.keys.length, file: fp };
+}