mslxdff 0.1.138 → 0.1.140

package/src/cli/interactive.js

@@ -1,9 +1,21 @@
-// 交互式选择器：↑/↓ 移动，Enter 确认，q/Esc 取消；ANSI 原地重绘
+// 交互式选择器：↑/↓ 移动，←/→ 翻页，Enter 确认，q/Esc 取消；ANSI 原地重绘。
+// 页高按终端行数自适应（items ≤ 页高时不分页，行为与旧版全量渲染一致）。
+const PAGE_RESERVE = 6; // 页头 1 + 帮助 2 + 余量
+
+function pageSizeFor(items) {
+  const rows = Number(process.stdout?.rows) || 24;
+  const size = Math.max(4, rows - PAGE_RESERVE);
+  return items.length > size ? size : items.length || 1;
+}
+
 export async function pickInteractive(items, startCursor = 0) {
   const { renderChooser, renderChooserHelp, parseKey } = await import("../chooser.js");
+  const size = pageSizeFor(items);
+  let page = 0;
   let cursor = Math.min(Math.max(startCursor, 0), items.length - 1);
   const draw = () => {
-    const lines = [...renderChooser(items, cursor), ...renderChooserHelp()];
+    const usePage = size < items.length;
+    const lines = [...renderChooser(items, cursor, usePage ? { index: page, size } : {}), ...renderChooserHelp(false, usePage)];
     process.stdout.write("\x1b[2J\x1b[H" + lines.join("\n"));
   };
   draw();
@@ -19,11 +31,22 @@ export async function pickInteractive(items, startCursor = 0) {
     };
     const onData = (chunk) => {
       const key = parseKey(String(chunk));
+      const pages = Math.max(1, Math.ceil(items.length / size));
       if (key === "up") {
         cursor = (cursor - 1 + items.length) % items.length;
+        page = Math.floor(cursor / size);
         draw();
       } else if (key === "down") {
         cursor = (cursor + 1) % items.length;
+        page = Math.floor(cursor / size);
+        draw();
+      } else if (key === "pageup") {
+        page = (page - 1 + pages) % pages;
+        cursor = page * size;
+        draw();
+      } else if (key === "pagedown") {
+        page = (page + 1) % pages;
+        cursor = Math.min(page * size, items.length - 1);
         draw();
       } else if (key === "enter") {
         cleanup();
@@ -37,14 +60,17 @@ export async function pickInteractive(items, startCursor = 0) {
   });
 }
 
-// 多选勾选：↑/↓ 移动，Space 勾选/取消，Enter 保存，q/Esc 取消（返回 Set 或 null）
+// 多选勾选：↑/↓ 移动，←/→ 翻页，Space 勾选/取消，Enter 保存，q/Esc 取消（返回 Set 或 null）
 export async function pickInteractiveMulti(items, initialPicked = new Set(), startCursor = 0) {
   const { renderChooser, renderChooserHelp, parseKey } = await import("../chooser.js");
+  const size = pageSizeFor(items);
+  let page = 0;
   let cursor = Math.min(Math.max(startCursor, 0), items.length - 1);
   const picked = new Set(items.filter((it) => initialPicked.has(it.id)).map((it) => it.id));
   const draw = () => {
+    const usePage = size < items.length;
     const rows = items.map((it, i) => ({ ...it, picked: picked.has(it.id) }));
-    const lines = [...renderChooser(rows, cursor, { multi: true }), ...renderChooserHelp(true)];
+    const lines = [...renderChooser(rows, cursor, { multi: true, ...(usePage ? { index: page, size } : {}) }), ...renderChooserHelp(true, usePage)];
     process.stdout.write("\x1b[2J\x1b[H" + lines.join("\n"));
   };
   draw();
@@ -60,11 +86,22 @@ export async function pickInteractiveMulti(items, initialPicked = new Set(), sta
     };
     const onData = (chunk) => {
       const key = parseKey(String(chunk));
+      const pages = Math.max(1, Math.ceil(items.length / size));
       if (key === "up") {
         cursor = (cursor - 1 + items.length) % items.length;
+        page = Math.floor(cursor / size);
         draw();
       } else if (key === "down") {
         cursor = (cursor + 1) % items.length;
+        page = Math.floor(cursor / size);
+        draw();
+      } else if (key === "pageup") {
+        page = (page - 1 + pages) % pages;
+        cursor = page * size;
+        draw();
+      } else if (key === "pagedown") {
+        page = (page + 1) % pages;
+        cursor = Math.min(page * size, items.length - 1);
         draw();
       } else if (key === "space") {
         const id = items[cursor].id;

package/src/cli/provider-row.js

@@ -40,7 +40,7 @@ export function buildProviderRows({ stateFile, env = process.env } = {}) {
     let allowed = [];
     let allowAny = false;
     try { keys = loadProviderKeys(gid, stateFile ? { file: stateFile } : undefined); } catch {}
-    try { baseUrl = loadProviderBaseUrl(gid, stateFile ? { file: stateFile } : undefined) || cfg?.baseUrl || (gid === "openrouter" ? "https://openrouter.ai/api/v1" : gid === "workbuddy" ? "https://copilot.tencent.com" : ""); } catch { baseUrl = cfg?.baseUrl || ""; }
+    try { baseUrl = loadProviderBaseUrl(gid, stateFile ? { file: stateFile } : undefined) || cfg?.baseUrl || (gid === "openrouter" ? "https://openrouter.ai/api/v1" : gid === "workbuddy" ? "https://copilot.tencent.com" : gid === "traework" ? "https://trae-api-cn.mchost.guru" : gid === "qoder" ? "qoder://native" : ""); } catch { baseUrl = cfg?.baseUrl || ""; }
     try { allowed = loadProviderAllowedModels(gid, stateFile ? { file: stateFile } : undefined); } catch {}
     try { allowAny = loadProviderAllowAnyModels(gid, stateFile ? { file: stateFile } : undefined); } catch {}
     // openrouter 特殊：opencode 例外默认 allowAny true，其余默认 false

package/src/providers/classify.js

@@ -4,7 +4,7 @@
 // latency-compare：key/token 类，direct vs link+remote 比延迟
 export function classifyProvider(id) {
   const s = String(id || "").trim().toLowerCase();
-  if (s === "workbuddy" || s === "cline") return "local-only";
+  if (s === "workbuddy" || s === "cline" || s === "codearts" || s === "traework" || s === "qoder") return "local-only";
   if (s === "opencode") return "quota-pool";
   return "latency-compare";
 }

package/src/providers/codearts/auth-pool.js

@@ -0,0 +1,148 @@
+// 账号池：keyring 的 key = 凭证 blob JSON 字符串（一华为账号一 blob，多账号=多 key 自动轮转）。
+// 职责：blob 解析；STS 凭证临期（默认提前 30min）单飞刷新；轮转写回（saveFn，原位换 key）；
+// 死号（终态失效）标记。瞬时失败保留旧凭证继续用，绝不清已存凭证（对齐 cline isInvalidGrant 纪律）。
+import { refreshStsCredential } from "./sts.js";
+import { REFRESH_SKEW_MS_DEFAULT } from "./const.js";
+
+/** 校验并解析 blob 字符串 → 账号运行时对象；非 blob（如 Bearer key）返回 null。 */
+export function accountFromBlob(raw) {
+  if (typeof raw !== "string" || !raw.trim().startsWith("{")) return null;
+  let j;
+  try { j = JSON.parse(raw); } catch { return null; }
+  if (!j || typeof j !== "object" || !j.refreshToken || !j.codeVerifier || !j.dpopJwk) return null;
+  const expMs = j.expiration ? Date.parse(j.expiration) : NaN;
+  return {
+    blob: raw,
+    userId: String(j.userId || j.user_id || ""),
+    userName: String(j.userName || j.user_name || ""),
+    domainId: String(j.domainId || j.domain_id || ""),
+    refreshToken: String(j.refreshToken || ""),
+    clientId: String(j.clientId || "codearts-agent"),
+    codeVerifier: String(j.codeVerifier || ""),
+    dpopJwk: j.dpopJwk || null,
+    accessKeyId: String(j.accessKeyId || ""),
+    secretAccessKey: String(j.secretAccessKey || ""),
+    securityToken: String(j.securityToken || ""),
+    expiration: String(j.expiration || ""),
+    expiresAtMs: Number.isFinite(expMs) ? expMs : 0,
+    dead: false,
+    lastError: "",
+    refreshInflight: null,
+  };
+}
+
+/** 账号对象 → 可持久化 blob（JSON 字符串；AK/SK/securityToken 是 STS 临时凭证快照）。 */
+export function blobFromAccount(acc) {
+  return JSON.stringify({
+    userId: acc.userId,
+    userName: acc.userName,
+    domainId: acc.domainId,
+    refreshToken: acc.refreshToken,
+    clientId: acc.clientId,
+    codeVerifier: acc.codeVerifier,
+    dpopJwk: acc.dpopJwk,
+    accessKeyId: acc.accessKeyId,
+    secretAccessKey: acc.secretAccessKey,
+    securityToken: acc.securityToken,
+    expiration: acc.expiration,
+  });
+}
+
+export function createAuthPool({
+  keys = [],
+  fetchImpl,
+  stsHost,
+  skewMs = REFRESH_SKEW_MS_DEFAULT,
+  clock = () => Date.now(),
+  saveFn,
+} = {}) {
+  const accounts = new Map(); // blob → account
+  for (const k of keys) {
+    const acc = accountFromBlob(k);
+    if (acc) accounts.set(k, acc);
+  }
+
+  function findByBlob(blob) { return accounts.get(blob) || null; }
+  function aliveAccounts() { return [...accounts.values()].filter((a) => !a.dead); }
+  function pickPrimary() { return aliveAccounts()[0] || null; }
+
+  async function doRefresh(acc) {
+    const r = await refreshStsCredential(
+      { refreshToken: acc.refreshToken, codeVerifier: acc.codeVerifier, dpopJwk: acc.dpopJwk, clientId: acc.clientId },
+      { fetchImpl, stsHost },
+    );
+    if (r.relogin) {
+      acc.dead = true;
+      acc.lastError = r.error || "re-login required";
+      return;
+    }
+    if (r.error) { acc.lastError = r.error; return; } // 瞬时失败：旧凭证还能用就继续用
+    // 成功：STS 字段更新（refreshToken 可能轮转），原位换 blob 写回
+    acc.accessKeyId = r.account.accessKeyId;
+    acc.secretAccessKey = r.account.secretAccessKey;
+    acc.securityToken = r.account.securityToken;
+    acc.expiration = r.account.expiration;
+    acc.expiresAtMs = r.account.expiresAtMs;
+    if (r.account.refreshToken) acc.refreshToken = r.account.refreshToken;
+    if (r.account.userId) acc.userId = r.account.userId;
+    if (r.account.userName) acc.userName = r.account.userName;
+    if (r.account.domainId) acc.domainId = r.account.domainId;
+    acc.lastError = "";
+    acc.dead = false;
+    const newBlob = blobFromAccount(acc);
+    if (newBlob !== acc.blob) {
+      const oldBlob = acc.blob;
+      accounts.delete(oldBlob);
+      acc.blob = newBlob;
+      accounts.set(newBlob, acc);
+      if (saveFn) { try { await saveFn({ oldBlob, newBlob, account: acc }); } catch {} }
+    }
+  }
+
+  /**
+   * 取某账号的有效 STS 凭证（临期自动单飞刷新）。
+   * @throws {Error} blob 不在池内 / 死号（message 带 re-login 提示）
+   */
+  async function getCredential(blob) {
+    const acc = findByBlob(blob);
+    if (!acc) throw new Error("codearts: credential not in pool — restart daemon or re-login");
+    if (acc.dead) throw new Error(`codearts account ${acc.userId || "?"} dead: ${acc.lastError || "re-login required"} — run: mslxdff -provider codearts login`);
+    const now = clock();
+    const needRefresh = !acc.securityToken || !acc.accessKeyId
+      || (acc.expiresAtMs > 0 && now >= acc.expiresAtMs - skewMs);
+    if (needRefresh && !acc.refreshInflight) {
+      acc.refreshInflight = doRefresh(acc).finally(() => { acc.refreshInflight = null; });
+    }
+    if (acc.refreshInflight) await acc.refreshInflight;
+    if (acc.dead) throw new Error(`codearts account ${acc.userId || "?"} dead: ${acc.lastError || "re-login required"} — run: mslxdff -provider codearts login`);
+    return acc;
+  }
+
+  /** 强制下次刷新（401 后调用；清掉缓存的 STS 临时凭证）。 */
+  function invalidate(blob) {
+    const acc = findByBlob(blob);
+    if (!acc) return;
+    acc.securityToken = "";
+    acc.accessKeyId = "";
+    acc.secretAccessKey = "";
+    acc.expiresAtMs = 0;
+  }
+
+  function markDead(blob, reason) {
+    const acc = findByBlob(blob);
+    if (!acc) return;
+    acc.dead = true;
+    acc.lastError = reason || acc.lastError;
+  }
+
+  /** ring 轮转写回后的重排（saveFn 成功后由 index 调用；saveFn 已处理则幂等）。 */
+  function replace(oldBlob, newBlob) {
+    const acc = accounts.get(oldBlob);
+    if (!acc || oldBlob === newBlob) return;
+    accounts.delete(oldBlob);
+    acc.blob = newBlob;
+    accounts.set(newBlob, acc);
+  }
+
+  return { findByBlob, aliveAccounts, pickPrimary, getCredential, invalidate, markDead, replace, accounts: () => [...accounts.values()] };
+}

package/src/providers/codearts/chat.js

@@ -0,0 +1,176 @@
+// CodeArts 聊天服务：上游 body/头组装 + SDK-HMAC-SHA256 签名 + 401 刷新重试 + 环形切号。
+// 上游恒 stream:true（chatBodyV2 契约）；流式客户端转 OpenAI SSE，非流式聚合回 JSON。
+import crypto from "node:crypto";
+import { joinUrl } from "../base.js";
+import { createTransport } from "../../transport/index.js";
+import { SNAP_BASE, EP_CHAT_V2, chatBaseHeaders, MAAS_TYPE_HEADER, MAAS_BENEFIT } from "./const.js";
+import { signRequest } from "./sign.js";
+import { newChatId, preflightResponse, sseToOpenAIResponse, aggregateToCompletion, UpstreamEventError } from "./stream.js";
+
+const MODEL_RULES = [
+  { match: (m) => String(m || "").toLowerCase().includes("deepseek"), scope: "all" },
+  { match: (m) => /(^kimi-|kimi)/i.test(String(m || "")), scope: "toolCalls" },
+];
+
+// DeepSeek 系思考模式要求 assistant 消息回传 reasoning_content，缺失补 " " 占位（ADR-0001 同款）。
+export function injectReasoningPlaceholder(messages, model) {
+  const rule = MODEL_RULES.find((r) => r.match(model));
+  if (!rule || !Array.isArray(messages)) return messages;
+  return messages.map((m) => {
+    if (m?.role !== "assistant") return m;
+    if (typeof m.reasoning_content === "string" && m.reasoning_content.length) return m;
+    if (rule.scope === "toolCalls" && !(Array.isArray(m.tool_calls) && m.tool_calls.length)) return m;
+    return { ...m, reasoning_content: " " };
+  });
+}
+
+const PASSTHROUGH_KEYS = ["temperature", "top_p", "max_tokens", "max_completion_tokens", "reasoning_effort", "tools", "tool_choice", "stop", "presence_penalty", "frequency_penalty", "response_format", "user", "n", "seed"];
+
+export function buildUpstreamBody(body, { chatId, upstreamModel }) {
+  const out = {
+    model: upstreamModel,
+    stream: true, // v2 端点契约：恒流式，非流式由本层聚合
+    messages: injectReasoningPlaceholder(body?.messages || [], upstreamModel),
+    prompt_cache_key: chatId,
+    tool_stream: true,
+    chat_id: chatId,
+  };
+  for (const k of PASSTHROUGH_KEYS) {
+    if (body?.[k] !== undefined && body?.[k] !== null) out[k] = body[k];
+  }
+  return out;
+}
+
+// Session-Id：由 chatId 派生的稳定会话标识（prompt cache 亲和，对齐 Go sessionIDFor）。
+function sessionIdFor(chatId) {
+  return crypto.createHash("sha256").update(`codearts-session:${chatId}`, "utf8").digest("hex").slice(0, 32);
+}
+
+function stripOwnPrefix(model, providerId) {
+  const s = String(model || "");
+  const i = s.indexOf("/");
+  if (i <= 0) return s;
+  return s.slice(0, i).toLowerCase() === String(providerId || "").toLowerCase() ? s.slice(i + 1) : s;
+}
+
+export function createChatService({
+  id = "codearts",
+  baseUrl = SNAP_BASE,
+  chatPath = EP_CHAT_V2,
+  fetchImpl,
+  dispatcher,
+  authPool,
+  catalog,
+  connectTimeoutMs = 30_000,
+  clock = Date.now,
+  } = {}) {
+  const resolvedBase = String(baseUrl).trim().replace(/\/+$/, "") || SNAP_BASE;
+  const transport = createTransport({ fetchImpl, dispatcher, keepAlive: !!dispatcher, timeoutMs: connectTimeoutMs, retry: {} });
+
+  async function sendOnce({ bodyStr, account, benefit, chatId, sessionId, traceId }) {
+    const url = joinUrl(resolvedBase, chatPath);
+    const h = chatBaseHeaders(account.securityToken, traceId);
+    if (benefit) h[MAAS_TYPE_HEADER] = MAAS_BENEFIT;
+    const { headers } = signRequest({ method: "POST", url, headers: h, body: bodyStr, cred: account });
+    // Chat-Id / Session-Id 在签名之后追加（对齐官方客户端：不进 SignedHeaders）。
+    headers["chat-id"] = chatId;
+    headers["session-id"] = sessionId;
+    return transport.request({ url, method: "POST", headers, body: bodyStr, stream: true, timeoutMs: connectTimeoutMs });
+  }
+
+  function errRes(status, msg, code) {
+    return new Response(JSON.stringify({ error: { message: msg, type: "upstream_error", ...(code ? { code } : {}) } }), {
+      status,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  function withTiming(res, t0) {
+    try { res._t = { attempts: [], waitMs: 0, totalMs: Math.round(clock() - t0) }; } catch {}
+    return res;
+  }
+
+  /**
+   * 跑一次对话。body.model 已由 dispatcher 剥前缀（容忍自带前缀）。
+   * @returns {Promise<Response>} 流式 → OpenAI SSE；非流式 → chat.completion JSON
+   */
+  async function runChat(body, activeRing, opts = {}) {
+    const t0 = clock();
+    const requestedModel = String(body?.model || "");
+    const rawModel = stripOwnPrefix(requestedModel, id);
+    const upstreamModel = catalog?.canonical(rawModel) || rawModel;
+    const chatId = newChatId(body, opts);
+    const sessionId = sessionIdFor(chatId);
+    const upstreamBody = buildUpstreamBody(body, { chatId, upstreamModel });
+    const bodyStr = JSON.stringify(upstreamBody);
+    const isStream = body?.stream === true;
+    let lastErr = null;
+
+    const maxTries = Math.max(1, activeRing.size || 1);
+    for (let attempt = 0; attempt < maxTries; attempt++) {
+      const blob = activeRing.next();
+      if (!blob) break;
+      let account;
+      try {
+        account = await authPool.getCredential(blob);
+      } catch (err) {
+        try { activeRing.onError(blob); } catch {}
+        lastErr = err;
+        continue; // 死号/不在池：换下一个账号
+      }
+      const benefit = catalog?.isBenefit ? catalog.isBenefit(account.userId, upstreamModel) : false;
+      const traceId = crypto.randomBytes(8).toString("hex") + String(clock());
+      let res;
+      try {
+        res = await sendOnce({ bodyStr, account, benefit, chatId, sessionId, traceId });
+      } catch (err) {
+        try { activeRing.onError(blob); } catch {}
+        lastErr = err;
+        continue;
+      }
+      if (res.status === 401 || res.status === 403) {
+        // STS 临时凭证失效：强制刷新重试一次，仍 401/403 换号
+        authPool.invalidate(blob);
+        let account2 = null;
+        try { account2 = await authPool.getCredential(blob); } catch { /* 死号 → 换号 */ }
+        if (account2) {
+          const traceId2 = crypto.randomBytes(8).toString("hex") + String(clock());
+          try { res = await sendOnce({ bodyStr, account: account2, benefit, chatId, sessionId, traceId: traceId2 }); } catch (err2) { lastErr = err2; try { activeRing.onError(blob); } catch {} continue; }
+          if (res.status === 401 || res.status === 403) {
+            try { await res.text(); } catch {}
+            try { activeRing.onError(blob); } catch {}
+            lastErr = new Error(`codearts auth still failing after refresh (http ${res.status})`);
+            continue;
+          }
+        } else {
+          try { activeRing.onError(blob); } catch {}
+          continue;
+        }
+      }
+      if (res.status >= 400) {
+        const txt = await res.text().catch(() => "");
+        if (res.status === 429 || res.status >= 500) try { activeRing.onError(blob); } catch {}
+        return withTiming(errRes(res.status, `codearts upstream http ${res.status}: ${String(txt).slice(0, 300)}`), t0);
+      }
+      try {
+        const pre = await preflightResponse(res); // HTTP 200 内嵌错误（排队/未注册/福利未领）→ 抛 UpstreamEventError
+        if (isStream) return withTiming(sseToOpenAIResponse(pre, { model: requestedModel || upstreamModel, id: `chatcmpl-${chatId.slice(0, 12)}` }), t0);
+        const data = await aggregateToCompletion(pre, { model: requestedModel || upstreamModel, id: `chatcmpl-${chatId.slice(0, 12)}` });
+        return withTiming(new Response(JSON.stringify(data), { status: 200, headers: { "Content-Type": "application/json" } }), t0);
+      } catch (err) {
+        if (err instanceof UpstreamEventError) {
+          if (err.status === 429 || err.status >= 500) try { activeRing.onError(blob); } catch {}
+          return withTiming(errRes(err.status, `codearts upstream: ${err.message}`, err.code), t0);
+        }
+        try { activeRing.onError(blob); } catch {}
+        lastErr = err;
+        continue;
+      }
+    }
+    throw Object.assign(lastErr || new Error("codearts: all accounts unavailable"), {
+      _t: { attempts: [], waitMs: 0, totalMs: Math.round(clock() - t0) },
+    });
+  }
+
+  return { runChat, buildUpstreamBody, injectReasoningPlaceholder, _sendOnce: sendOnce };
+}

package/src/providers/codearts/const.js

@@ -0,0 +1,60 @@
+// CodeArts Agent 云端 API 常量（逆向自 HITZY2002/codearts2api，源自 vscode-codebot 26.7.0）。
+// 端点契约见 docs/adr/0027-codearts-provider.md。
+
+// 盘古引擎/聊天网关（product.json snapEngineDomain，商业版 cn-north-4）。
+export const SNAP_BASE = "https://snap-access.cn-north-4.myhuaweicloud.com";
+// STS 令牌端点（refresh_token 与 client_id + DPoP 公钥 + code_verifier 三重绑定）。
+export const STS_HOST = "https://sts.cn-north-4.myhuaweicloud.com";
+// 限时福利（免费套餐）网关（模型发现 + 领取）。
+export const BENEFIT_HOST = "https://opengw.developer.huaweicloud.com";
+// OAuth authorize 入口（注意带 /portal）。
+export const PORTAL_HOST = "https://codearts.huaweicloud.com/portal";
+
+export const EP_CHAT_V2 = "/api/v2/chat/completions";
+export const EP_MODEL_BUILTIN = "/v1/model/builtin";
+export const EP_AGENT_LIST = "/v1/agent-center/agents/useragents";
+export const EP_AGENT_DETAIL = "/v1/agent-center/agents/detail";
+export const EP_BENEFIT_CONFIG = "/api/v1/gateway/config";
+export const EP_BENEFIT_CLAIM = "/api/v1/benefit/claim";
+export const EP_OAUTH_TOKENS = "/v1/oauth2/tokens";
+export const EP_LOGIN_TICKET = "/v1/login/ticket";
+export const SNAP_MANAGER_PATH = "/snap-manager";
+
+// OAuth client：官方 CodeArts Agent 插件的 uri_scheme；refresh_token 与之绑定。
+export const CLIENT_ID = "codearts-agent";
+// ticket 轮询的插件标识（逆向自 huaweicloud.authentication 扩展）。
+export const PLUGIN_NAME = "snap_AIIDE";
+export const PLUGIN_VERSION = "5.2.0";
+
+// 聊天路由头（官方 AgentKernel 形状；均进入 SDK-HMAC-SHA256 签名）。
+export function chatBaseHeaders(securityToken, traceId) {
+  return {
+    "content-type": "application/json",
+    "accept": "text/event-stream",
+    "x-auth-token": securityToken || "",
+    "x-snap-traceid": traceId,
+    "x-language": "zh-cn",
+    "app-id": "CodeAgent3.0",
+    "is_confidential": "false",
+  };
+}
+
+// 福利路由头：必须在 signRequest 之前设置（计入 SignedHeaders），否则 InferHub.002002009.404。
+export const MAAS_TYPE_HEADER = "maas_type";
+export const MAAS_BENEFIT = "benefit";
+
+// 冷启动种子：福利套餐轮换后新模型在首次发现前也按福利路由（宁多带不少带，少带即 404）。
+export const SEED_BENEFIT_MODELS = ["deepseek-v4-flash-0731", "deepseek-v4-pro-0813", "glm-5.3-flash"];
+// 内置模型种子（仅用于大小写归一，不标福利）。
+export const SEED_KNOWN_MODELS = [
+  "GLM-5.2", "GLM-5.2-ArkTS-SPARK", "GLM-5.1", "GLM-4.7",
+  "OpenPangu-2.0-Pro", "OpenPangu-2.0-Flash",
+  "Qwen3-VL-235B", "Qwen3.5-397B-A17B-VL", "Qwen3.6-27B-VL",
+];
+
+// 目录 TTL：超过则建议重新发现（对齐 codearts2api CatalogTTL）。
+export const CATALOG_TTL_MS = 60 * 60 * 1000;
+// listModels 缓存（与全仓 10min 对齐）。
+export const MODELS_CACHE_TTL_MS = 10 * 60 * 1000;
+// STS 凭证提前刷新量（对齐 codearts2api RefreshSkew 30min）。
+export const REFRESH_SKEW_MS_DEFAULT = 30 * 60 * 1000;

package/src/providers/codearts/dpop.js

@@ -0,0 +1,95 @@
+// DPoP（RFC 9449）证明 JWT：ES256 + P-256，供 STS /v1/oauth2/tokens 请求头使用。
+// refresh_token 与首次换取时的 DPoP 公钥绑定：私钥 JWK 必须随凭证持久化（d 字段），
+// 换新私钥刷新会被 STS 拒（400 invalid refresh token: InvalidDPoPHeader）。
+// 算法对齐 HITZY2002/codearts2api internal/upstream/dpop.go。
+import crypto from "node:crypto";
+
+// P-256 阶 n（用于低 S 归一化：s > n/2 → s = n - s，jose 默认低 S 兼容性更好）。
+const P256_N = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;
+
+const b64url = (data) => Buffer.from(data).toString("base64url");
+
+/** 生成可持久化的 DPoP 私钥 JWK（kty/crv/x/y/d，均 base64url 无 padding）。 */
+export function newDpopPrivateJwk() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  const pub = publicKey.export({ format: "jwk" });
+  const priv = privateKey.export({ format: "jwk" });
+  return { kty: "EC", crv: "P-256", x: pub.x, y: pub.y, d: priv.d };
+}
+
+export function dpopPublicJwk(privateJwk) {
+  return { kty: "EC", crv: "P-256", x: privateJwk?.x || "", y: privateJwk?.y || "" };
+}
+
+export function isValidDpopJwk(jwk) {
+  return !!jwk && jwk.kty === "EC" && jwk.crv === "P-256" && typeof jwk.d === "string" && jwk.d.length > 0 && !!jwk.x && !!jwk.y;
+}
+
+/** 从持久化 JWK 恢复私钥对象（非法材料直接抛错，调用方须提示重新登录）。 */
+export function dpopPrivateKey(jwk) {
+  if (!isValidDpopJwk(jwk)) throw new Error("codearts: invalid DPoP private JWK — re-login required");
+  try {
+    return crypto.createPrivateKey({ key: { ...jwk }, format: "jwk" });
+  } catch (err) {
+    throw new Error(`codearts: DPoP private JWK unusable (${err?.message || err}) — re-login required`);
+  }
+}
+
+/** 低 S 归一化：ieee-p1363 64 字节 r||s 原地修正 s（合法：ECDSA (r, n-s) 等价）。 */
+function normalizeLowS(sig) {
+  if (sig.length !== 64) return sig;
+  const s = BigInt("0x" + sig.subarray(32, 64).toString("hex"));
+  const half = P256_N >> 1n;
+  if (s <= half || s === 0n) return sig;
+  const fixed = P256_N - s;
+  Buffer.from(fixed.toString(16).padStart(64, "0"), "hex").copy(sig, 32);
+  return sig;
+}
+
+/**
+ * 生成 DPoP proof JWT。
+ * @param {object} privateJwk 持久化私钥 JWK（含 d）
+ * @param {string} htu 目标端点完整 URL（STS token 端点）
+ * @returns {string} `b64(header).b64(payload).b64(sig)` 三段 JWT
+ */
+export function signDpopProof(privateJwk, htu) {
+  const key = dpopPrivateKey(privateJwk);
+  const header = { alg: "ES256", typ: "dpop+jwt", jwk: dpopPublicJwk(privateJwk) };
+  const payload = {
+    htm: "POST",
+    htu: String(htu || ""),
+    iat: Math.floor(Date.now() / 1000),
+    jti: crypto.randomBytes(32).toString("hex"),
+  };
+  const input = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`;
+  // 标准 JWS/ES256：对 ASCII(input) 做 SHA256+ECDSA（crypto.sign("SHA256", input)）。
+  // 注意：千万别用 sign(null, sha256(input))——OpenSSL 的 noneWithECDSA 把 digest 当整数标量，
+  // 签出来自验能过、但任何标准验签方（含 WebCrypto/华为 STS）都拒签（真机 400 STS5.1804 实锤）。
+  const sig = normalizeLowS(crypto.sign("SHA256", Buffer.from(input, "utf8"), { key, dsaEncoding: "ieee-p1363" }));
+  return `${input}.${b64url(sig)}`;
+}
+
+/** 验签辅助（测试/诊断用）：校验 JWT 签名是否与 JWK 公钥匹配。 */
+export function verifyDpopProof(proof) {
+  const parts = String(proof || "").split(".");
+  if (parts.length !== 3) return { ok: false };
+  try {
+    const header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    const sig = Buffer.from(parts[2], "base64url");
+    const pub = crypto.createPublicKey({ key: { kty: "EC", crv: "P-256", x: header.jwk.x, y: header.jwk.y }, format: "jwk" });
+    const input = Buffer.from(`${parts[0]}.${parts[1]}`, "utf8");
+    const s = BigInt("0x" + sig.subarray(32, 64).toString("hex"));
+    // 标准 JWS/ES256 验签（与签名端对称；dsaEncoding 必须显式 ieee-p1363，node 默认 DER）。
+    const vopts = { dsaEncoding: "ieee-p1363" };
+    const ok = crypto.verify("SHA256", input, { key: pub, ...vopts }, sig)
+      || (s > P256_N >> 1n && crypto.verify("SHA256", input, { key: pub, ...vopts }, (() => {
+        const alt = Buffer.from(sig);
+        Buffer.from((P256_N - s).toString(16).padStart(64, "0"), "hex").copy(alt, 32);
+        return alt;
+      })()));
+    return { ok, header, payload };
+  } catch {
+    return { ok: false };
+  }
+}