mslxdff 0.1.138 → 0.1.140

package/src/providers/codearts/sse.js

@@ -0,0 +1,204 @@
+// CodeArts SSE 帧解析（纯函数，无 IO）。
+// 线格式（实测，对齐 codearts2api internal/upstream/sse.go）：逐行 `data: <json>`，
+// 无空行分隔、部分行无 event: 前缀；同时兼容标准 event:+data:+空行。
+// 帧：起始 {id,model,type:"answer",chat_id,…}；全文快照 {text:"<累计全文>",output,
+// prompt_tokens,completion_tokens}（text 是快照非增量 → 替换语义）；增量
+// {choices:[{delta:{content,reasoning_content,tool_calls}}]} 或顶层 {delta:{…}}；
+// 结束 {"text":"[DONE]","error_code":"0"}；错误 {"error_code":"…","error_msg":"…"}。
+
+export function createSseState() {
+  return { pendingEvent: "", content: "", reason: "", finish: "", usage: null, error: null, done: false, calls: new Map(), forward: null };
+}
+
+// 降级：finish_reason=tool_calls 但 calls 为空（上游偶发空 tool_calls 帧 + 零文本，
+// 真机 glm-5.3-flash 实测）→ 降 stop，否则 OpenAI 客户端判"无输出结束回合"报错。
+// 注意：有真实 tool_calls 时必须原样透传，否则工具链断裂。
+export function effectiveFinish(st) {
+  if (st?.finish === "tool_calls" && !(st?.calls?.size > 0)) return "stop";
+  return st?.finish || "stop";
+}
+
+export function scanLine(line, state) {
+  const raw = String(line || "").replace(/\r?\n$/, "");
+  if (raw.startsWith("event:")) { state.pendingEvent = raw.slice(6).trim(); return null; }
+  if (raw.startsWith("data:")) {
+    const ev = state.pendingEvent || "";
+    state.pendingEvent = "";
+    return { event: ev, data: raw.slice(5).trim() };
+  }
+  if (!raw.trim()) { state.pendingEvent = ""; return null; }
+  return null;
+}
+
+// OpenAI 兼容 chunk：choices[0].delta 或顶层 delta。
+export function deltaFromChunk(payload) {
+  if (payload?.delta && typeof payload.delta === "object") return { delta: payload.delta, finishReason: "" };
+  const choices = Array.isArray(payload?.choices) ? payload.choices : [];
+  if (!choices.length || typeof choices[0] !== "object") return { delta: null, finishReason: "" };
+  const c0 = choices[0];
+  return {
+    delta: c0.delta && typeof c0.delta === "object" ? c0.delta : null,
+    finishReason: typeof c0.finish_reason === "string" ? c0.finish_reason : "",
+  };
+}
+
+// tool_calls 分片按 index 聚合（id/type/name/arguments 增量拼接）。
+export function applyToolCallDeltas(st, delta) {
+  const rawCalls = delta?.tool_calls;
+  if (!Array.isArray(rawCalls)) return;
+  rawCalls.forEach((raw, position) => {
+    if (!raw || typeof raw !== "object") return;
+    const index = typeof raw.index === "number" ? raw.index : position;
+    let call = st.calls.get(index);
+    if (!call) { call = { index, type: "function", id: "", function: { name: "", arguments: "" } }; st.calls.set(index, call); }
+    if (typeof raw.id === "string" && raw.id) call.id = raw.id;
+    if (typeof raw.type === "string" && raw.type) call.type = raw.type;
+    const fn = raw.function;
+    if (fn && typeof fn === "object") {
+      if (typeof fn.name === "string") call.function.name += fn.name;
+      if (typeof fn.arguments === "string") call.function.arguments += fn.arguments;
+    }
+  });
+}
+
+export function sortedToolCalls(st) {
+  return [...st.calls.keys()].sort((a, b) => a - b).map((i) => {
+    const c = st.calls.get(i);
+    return { index: c.index, type: c.type || "function", id: c.id, function: { name: c.function.name, arguments: c.function.arguments } };
+  });
+}
+
+const firstText = (payload, keys) => {
+  for (const k of keys) if (typeof payload?.[k] === "string") return payload[k];
+  return "";
+};
+
+function markUsage(st, payload) {
+  const p = Number(payload?.prompt_tokens), c = Number(payload?.completion_tokens);
+  if (Number.isFinite(p) || Number.isFinite(c)) {
+    st.usage = {
+      prompt_tokens: Number.isFinite(p) ? p : (st.usage?.prompt_tokens || 0),
+      completion_tokens: Number.isFinite(c) ? c : (st.usage?.completion_tokens || 0),
+    };
+  }
+}
+
+// 结构化问答帧判定（对齐 codearts2api isValidStructuredQA）：question+answer 必须同时为字符串、
+// 长度受控、answer 不似代码；options 若在场须为 2-10 项数组。防止把整段 JSON 当正文。
+const CODE_HINTS = ["import ", "def ", "class ", "func ", "package ", "module ", "struct ", "interface "];
+export function isValidStructuredQA(obj) {
+  if (!obj || typeof obj !== "object") return false;
+  const { question, answer, options } = obj;
+  if (typeof question !== "string" || typeof answer !== "string") return false;
+  if (!question.length || question.length > 500) return false;
+  if (!answer.length || answer.length > 100) return false;
+  const low = answer.toLowerCase();
+  if (CODE_HINTS.some((h) => low.includes(h))) return false;
+  if (options !== undefined) {
+    if (!Array.isArray(options) || options.length < 2 || options.length > 10) return false;
+  }
+  return true;
+}
+
+function tryStructuredAnswer(st, payload) {
+  if (st.content || !isValidStructuredQA(payload)) return;
+  st.content = payload.answer;
+}
+
+// 单事件应用到聚合状态（对齐 Go applyEvent 的替换/追加语义）。
+export function applyEvent(st, event, data) {
+  const ev = String(event || "").trim().toLowerCase();
+  const trimmed = String(data || "").trim();
+  if (ev === "" && trimmed === "[DONE]") { if (!st.finish) st.finish = "stop"; st.done = true; return; }
+  let payload = null;
+  if (trimmed && trimmed !== "[DONE]") { try { payload = JSON.parse(trimmed); } catch { payload = null; } }
+
+  const checkError = () => {
+    const code = firstText(payload || {}, ["error_code", "code"]);
+    if (code && code !== "0") {
+      st.error = { code, msg: firstText(payload || {}, ["error_msg", "message", "msg"]) || "request failed" };
+      return true;
+    }
+    return false;
+  };
+  const applyDeltaLike = (textKeys) => {
+    if (checkError()) return true;
+    const { delta, finishReason } = deltaFromChunk(payload);
+    if (finishReason) st.finish = finishReason;
+    // 本帧原生 OpenAI 字段（role/tool_calls/finish）→ 流式层原样转发。
+    // 少转 tool_calls 会让客户端收到 finish_reason=tool_calls 却无工具可执行 → 回合空停（真机复现）。
+    st.forward = {
+      role: delta && typeof delta.role === "string" ? delta.role : "",
+      toolCalls: delta && Array.isArray(delta.tool_calls) && delta.tool_calls.length ? delta.tool_calls : null,
+      finish: finishReason || "",
+    };
+    if (delta) {
+      applyToolCallDeltas(st, delta);
+      if (typeof delta.content === "string" && delta.content) st.content += delta.content;
+      if (typeof delta.reasoning_content === "string" && delta.reasoning_content) st.reason += delta.reasoning_content;
+      return true;
+    }
+    markUsage(st, payload);
+    const t = firstText(payload || {}, textKeys);
+    if (t) {
+      if (trimmed === "[DONE]" || t === "[DONE]" || /^done$/i.test(t)) { st.finish = "stop"; st.done = true; return true; }
+      st.content = t; // 全文快照 → 替换
+      return true;
+    }
+    const out = Array.isArray(payload?.output) ? payload.output : null;
+    if (out && out.length) {
+      const sb = out.filter((x) => x?.type === "output_text" && typeof x.text === "string").map((x) => x.text).join("");
+      if (sb) st.content = sb;
+      return true;
+    }
+    tryStructuredAnswer(st, payload || {});
+    return true;
+  };
+
+  switch (ev) {
+    case "reasoning": case "thinking": case "onreasoning": case "onthinking": {
+      const t = firstText(payload || {}, ["text", "reasoning", "content", "thinking"]);
+      if (t) st.reason += t;
+      return;
+    }
+    case "done": case "end": case "finish": {
+      if (checkError()) return;
+      const f = firstText(payload || {}, ["finish_reason", "finish", "reason"]);
+      st.finish = f || "stop";
+      st.done = true;
+      return;
+    }
+    case "onanswer": case "answer": case "delta": case "message": case "content": case "": case "data": {
+      if (trimmed === "[DONE]") { if (!st.finish) st.finish = "stop"; st.done = true; return; }
+      applyDeltaLike(ev === "" || ev === "data" ? ["text", "content", "delta"] : ["text", "content", "delta", "message"]);
+      return;
+    }
+    default: return; // related_question_answer 等杂帧忽略
+  }
+}
+
+// HTTP 200 内嵌错误 → 状态映射（429/400/502），让网关按状态码走冷却/降级。
+export function embeddedErrorFromData(data) {
+  const trimmed = String(data || "").trim();
+  if (!trimmed || trimmed === "[DONE]") return null;
+  let payload;
+  try { payload = JSON.parse(trimmed); } catch { return null; }
+  const code = typeof payload?.error_code === "string" ? payload.error_code : "";
+  if (!code || code === "0") return null;
+  const message = typeof payload?.error_msg === "string" ? payload.error_msg : "";
+  const combined = `${code} ${message}`.trim();
+  const low = combined.toLowerCase();
+  let status = 502;
+  if (/429|tm\.00001041|tpm|并发会话/.test(low)) status = 429;
+  else if (/002002009|not registered|4004\.200|benefit not found/.test(low)) status = 400;
+  return { status, message: combined.slice(0, 300) };
+}
+
+export class UpstreamEventError extends Error {
+  constructor(message, { status = 502, code = "" } = {}) {
+    super(message);
+    this.name = "UpstreamEventError";
+    this.status = status;
+    this.code = code;
+  }
+}

package/src/providers/codearts/stream.js

@@ -0,0 +1,209 @@
+// 非流式聚合、chat_id 派生。解析纯函数见 ./sse.js。
+import crypto from "node:crypto";
+import { createSseState, scanLine, applyEvent, sortedToolCalls, embeddedErrorFromData, effectiveFinish, isValidStructuredQA, UpstreamEventError } from "./sse.js";
+
+// chat.js 从这里拿错误类（保持单一导入面）。
+export { UpstreamEventError };
+
+// 只读到首个 data: 事件：正常帧原样回放（不破坏流式）；内嵌业务错误转 UpstreamEventError 供上层重试/冷却。
+export async function preflightResponse(resp) {
+  if (!resp?.body) return resp;
+  const reader = resp.body.getReader();
+  const dec = new TextDecoder();
+  const prefix = [];
+  let buf = "";
+  const state = { pendingEvent: "" };
+  const headers = new Headers(resp.headers);
+  headers.delete("content-length");
+  while (true) {
+    const { done, value } = await reader.read();
+    if (value?.length) {
+      const chunk = dec.decode(value, { stream: true });
+      prefix.push(chunk);
+      buf += chunk;
+    }
+    let idx;
+    while ((idx = buf.indexOf("\n")) >= 0) {
+      const line = buf.slice(0, idx);
+      buf = buf.slice(idx + 1);
+      const ev = scanLine(line, state);
+      if (ev) {
+        const err = embeddedErrorFromData(ev.data);
+        if (err) {
+          try { await reader.cancel(); } catch {}
+          throw new UpstreamEventError(err.message, { status: err.status, code: err.message });
+        }
+        return replay(prefix, buf, reader, resp.status, headers);
+      }
+    }
+    if (done) return replay(prefix, buf, null, resp.status, headers);
+  }
+}
+
+function replay(chunks, tail, reader, status, headers) {
+  const enc = new TextEncoder();
+  let primed = false;
+  const stream = new ReadableStream({
+    async pull(controller) {
+      if (!primed) {
+        primed = true;
+        for (const c of chunks) controller.enqueue(enc.encode(c));
+        if (tail) controller.enqueue(enc.encode(tail));
+        if (!reader) { controller.close(); return; }
+      }
+      try {
+        const { done, value } = await reader.read();
+        if (done) controller.close();
+        else controller.enqueue(value);
+      } catch (err) { controller.error(err); }
+    },
+    cancel() { try { reader?.cancel?.(); } catch {} },
+  });
+  return new Response(stream, { status, headers });
+}
+
+// chat_id 必须 32 位 hex（UUID 去连字符），否则上游报「请求参数错误：chat_id」。
+export function newChatId(body, opts) {
+  const raw = String(body?.chat_id || body?.conversation_id || opts?.sessionId || "").trim();
+  const hex = raw.toLowerCase().replace(/[^0-9a-f]/g, "");
+  if (hex.length >= 32) return hex.slice(0, 32);
+  return crypto.createHash("sha256").update(raw || crypto.randomUUID(), "utf8").digest("hex").slice(0, 32);
+}
+
+// 解包：模型把整段 QA JSON（或 ```json/```markdown 包裹）当正文时只取 answer（对齐 codearts2api unwrapQAContent）。
+export function unwrapQAContent(s) {
+  const text = String(s || "");
+  const trimmed = text.trim();
+  if (!trimmed) return text;
+  const direct = parseQaAnswer(trimmed);
+  if (direct !== null) return direct;
+  if (!trimmed.startsWith("```")) return text;
+  const lines = trimmed.split("\n");
+  if (lines.length < 3 || lines[lines.length - 1].trim() !== "```") return text;
+  const inner = lines.slice(1, -1).join("\n");
+  const ans = parseQaAnswer(inner.trim());
+  return ans !== null ? ans : inner;
+}
+
+function parseQaAnswer(s) {
+  try {
+    const obj = JSON.parse(s);
+    return isValidStructuredQA(obj) ? obj.answer : null;
+  } catch { return null; }
+}
+
+const chunkLine = (id, model, delta, finish) => {
+  const choice = { index: 0, delta };
+  if (finish) choice.finish_reason = finish;
+  return `data: ${JSON.stringify({ id, object: "chat.completion.chunk", created: Math.floor(Date.now() / 1000), model, choices: [choice] })}\n\n`;
+};
+
+/** 上游 SSE → OpenAI SSE 流式转换（快照替换/增量混合语义，保证至少一个 finish chunk + [DONE]）。 */
+export function sseToOpenAIResponse(resp, { model, id }) {
+  const dec = new TextDecoder();
+  const enc = new TextEncoder();
+  const reader = resp.body.getReader();
+  let buf = "";
+  const state = createSseState();
+  let finishSent = false;
+  const stream = new ReadableStream({
+    async pull(controller) {
+      const emit = (text) => controller.enqueue(enc.encode(text));
+      const finishChunk = () => { if (!finishSent) { emit(chunkLine(id, model, {}, effectiveFinish(state))); finishSent = true; } };
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (value?.length) buf += dec.decode(value, { stream: true });
+          let idx;
+          while ((idx = buf.indexOf("\n")) >= 0) {
+            const line = buf.slice(0, idx);
+            buf = buf.slice(idx + 1);
+            const ev = scanLine(line, state);
+            if (!ev) continue;
+            if (ev.data === "[DONE]") {
+              finishChunk();
+              emit("data: [DONE]\n\n");
+              controller.close();
+              return;
+            }
+            const beforeC = state.content.length, beforeR = state.reason.length;
+            state.forward = null; // 每帧重置：仅本帧 delta 路径产生 forward，防重复转发
+            applyEvent(state, ev.event, ev.data);
+            if (state.error) {
+              emit(`event: error\ndata: ${JSON.stringify({ error: { message: `${state.error.code} ${state.error.msg}`.trim(), type: "upstream_error", code: "CODEARTS_STREAM_ERROR" } })}\n\n`);
+              emit("data: [DONE]\n\n");
+              controller.close();
+              return;
+            }
+            const delta = {};
+            const fwd = state.forward || {};
+            if (fwd.role) delta.role = fwd.role;
+            if (fwd.toolCalls) delta.tool_calls = fwd.toolCalls; // 工具调用分片原样转发（缺它=回合空停）
+            if (state.reason.length > beforeR) delta.reasoning_content = state.reason.slice(beforeR);
+            if (state.content.length > beforeC) delta.content = state.content.slice(beforeC);
+            if (Object.keys(delta).length) emit(chunkLine(id, model, delta, ""));
+            if (fwd.finish) finishChunk(); // 上游 finish_reason 出现即发（含 tool_calls；空 calls 自动降 stop）
+            if (state.done) {
+              finishChunk();
+              emit("data: [DONE]\n\n");
+              controller.close();
+              return;
+            }
+          }
+          if (done) {
+            finishChunk();
+            emit("data: [DONE]\n\n");
+            controller.close();
+            return;
+          }
+        }
+      } catch (err) { controller.error(err); }
+    },
+    cancel() { try { reader.cancel(); } catch {} },
+  });
+  return new Response(stream, { status: resp.status, headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", "Connection": "keep-alive", "X-Accel-Buffering": "no" } });
+}
+
+/** 上游 SSE → OpenAI chat.completion JSON（非流式聚合；内嵌错误抛 UpstreamEventError）。 */
+export async function aggregateToCompletion(resp, { model, id }) {
+  const dec = new TextDecoder();
+  const reader = resp.body.getReader();
+  let buf = "";
+  const state = createSseState();
+  outer: while (true) {
+    const { done, value } = await reader.read();
+    if (value?.length) buf += dec.decode(value, { stream: true });
+    let idx;
+    while ((idx = buf.indexOf("\n")) >= 0) {
+      const line = buf.slice(0, idx);
+      buf = buf.slice(idx + 1);
+      const ev = scanLine(line, state);
+      if (ev) applyEvent(state, ev.event, ev.data);
+      if (state.error || state.done) break outer;
+    }
+    if (done) break;
+  }
+  try { await reader.cancel(); } catch {}
+  if (state.error) {
+    const status = embeddedErrorFromData(JSON.stringify({ error_code: state.error.code, error_msg: state.error.msg }))?.status || 502;
+    throw new UpstreamEventError(`${state.error.code} ${state.error.msg}`.trim(), { status, code: state.error.code });
+  }
+  const message = { role: "assistant", content: unwrapQAContent(state.content) };
+  if (state.reason) message.reasoning_content = state.reason;
+  const calls = sortedToolCalls(state);
+  if (calls.length) {
+    message.tool_calls = calls;
+    if (!state.content) message.content = null;
+  }
+  const usage = state.usage
+    ? { ...state.usage, total_tokens: (state.usage.prompt_tokens || 0) + (state.usage.completion_tokens || 0) }
+    : { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 };
+  return {
+    id: id || `chatcmpl-${Date.now()}`,
+    object: "chat.completion",
+    created: Math.floor(Date.now() / 1000),
+    model,
+    choices: [{ index: 0, message, finish_reason: effectiveFinish(state), logprobs: null }],
+    usage,
+  };
+}

package/src/providers/codearts/sts.js

@@ -0,0 +1,124 @@
+// STS /v1/oauth2/tokens：授权码换凭证 + refresh_token 续期（DPoP 必带）。
+// 终态失效（refresh_token 过期/已用/DPoP 或 client_id 不匹配）→ relogin=true，
+// 与网络/5xx 瞬时失败分开，避免好号被误杀或死号无限刷。
+import { STS_HOST, EP_OAUTH_TOKENS, CLIENT_ID } from "./const.js";
+import { signDpopProof } from "./dpop.js";
+import { compatFetch } from "../../compat.js";
+
+function tokenErr(rawText) {
+  try { return JSON.parse(rawText) || {}; } catch { return {}; }
+}
+
+// 对齐 codearts2api：invalid_grant / ExpiredRefreshToken / InvalidDPoPHeader /
+// invalid client id / has been used → 终态，必须重新登录。
+export function isReLoginRejected(status, rawText) {
+  const t = tokenErr(rawText);
+  const code = String(t.error_code || "");
+  const msg = String(t.error_msg || "");
+  const low = (t.error || msg).toLowerCase();
+  return t.error === "invalid_grant"
+    || code.includes("ExpiredRefreshToken")
+    || code.includes("InvalidDPoPHeader")
+    || low.includes("invalid client id")
+    || low.includes("has been used");
+}
+
+/** 归一化 STS 响应（新 credentials / 旧 credential 双形状）。 */
+export function normalizeTokenResponse(json) {
+  const c = json?.credentials || {};
+  const legacy = json?.credential || {};
+  const securityToken = c.security_token || legacy.securitytoken || "";
+  const accessKeyId = c.access_key_id || legacy.access || "";
+  const secretAccessKey = c.secret_access_key || legacy.secret || "";
+  const expiration = c.expiration || legacy.expires_at || "";
+  if (!securityToken || !accessKeyId || !secretAccessKey) return null;
+  const expiresAtMs = expiration ? Date.parse(expiration) : NaN;
+  return {
+    userId: String(json.user_id || ""),
+    userName: String(json.user_name || ""),
+    domainId: String(json.domain_id || ""),
+    refreshToken: String(json.refresh_token || ""),
+    accessKeyId,
+    secretAccessKey,
+    securityToken,
+    expiration,
+    expiresAtMs: Number.isFinite(expiresAtMs) ? expiresAtMs : 0,
+  };
+}
+
+async function postToken({ url, form, dpopJwk, fetchImpl }) {
+  const doFetch = fetchImpl || compatFetch;
+  const proof = signDpopProof(dpopJwk, url);
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", dpop: proof },
+    body: form.toString(),
+  });
+  const raw = await res.text().catch(() => "");
+  return { res, raw };
+}
+
+/**
+ * 授权码换凭证（登录用）。
+ * @param {object} p { code, verifier, redirectUri, clientId?, dpopJwk, fetchImpl?, stsHost? }
+ */
+export async function exchangeAuthorizationCode({ code, verifier, redirectUri, clientId = CLIENT_ID, dpopJwk, fetchImpl, stsHost } = {}) {
+  const url = (stsHost || STS_HOST) + EP_OAUTH_TOKENS;
+  const form = new URLSearchParams({
+    client_id: clientId,
+    code: String(code || ""),
+    code_verifier: String(verifier || ""),
+    grant_type: "authorization_code",
+    redirect_uri: String(redirectUri || ""),
+  });
+  const { res, raw } = await postToken({ url, form, dpopJwk, fetchImpl });
+  if (res.status >= 400) throw new Error(`codearts sts exchange http ${res.status}: ${String(raw).slice(0, 200)}`);
+  const json = JSON.parse(raw);
+  const account = normalizeTokenResponse(json);
+  if (!account) throw new Error("codearts sts exchange: response missing credentials");
+  account.clientId = clientId;
+  return account;
+}
+
+/**
+ * 用 refresh_token 换新 STS 凭证（refresh_token 单次轮换，响应里取新值写回）。
+ * @param {object} blob 账号凭证 blob（refreshToken/codeVerifier/dpopJwk/clientId）
+ * @param {object} [opts] { fetchImpl, stsHost }
+ * @returns {{account, refreshToken?, relogin?, error?}}
+ */
+export async function refreshStsCredential(blob, { fetchImpl, stsHost } = {}) {
+  const refreshToken = String(blob?.refreshToken || "");
+  const verifier = String(blob?.codeVerifier || "");
+  const jwk = blob?.dpopJwk;
+  const clientId = String(blob?.clientId || CLIENT_ID);
+  if (!refreshToken) return { account: null, relogin: true, error: "missing refresh_token" };
+  if (!verifier) return { account: null, relogin: true, error: "missing code_verifier" };
+  if (!jwk || !jwk.d) return { account: null, relogin: true, error: "missing DPoP private key — re-login required" };
+
+  const url = (stsHost || STS_HOST) + EP_OAUTH_TOKENS;
+  const form = new URLSearchParams({
+    client_id: clientId,
+    code_verifier: verifier,
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+  });
+  let res, raw;
+  try {
+    ({ res, raw } = await postToken({ url, form, dpopJwk: jwk, fetchImpl }));
+  } catch (err) {
+    return { account: null, error: `network: ${err?.message || err}` };
+  }
+  if (res.status >= 400) {
+    if (isReLoginRejected(res.status, raw)) {
+      const t = tokenErr(raw);
+      return { account: null, relogin: true, status: res.status, code: t.error_code, error: `refresh rejected: ${String(raw).slice(0, 200)}` };
+    }
+    return { account: null, status: res.status, error: `sts http ${res.status}: ${String(raw).slice(0, 200)}` };
+  }
+  let json;
+  try { json = JSON.parse(raw); } catch { return { account: null, error: "sts returned non-JSON body" }; }
+  const account = normalizeTokenResponse(json);
+  if (!account) return { account: null, error: "sts response missing credentials" };
+  account.clientId = clientId;
+  return { account, refreshToken: account.refreshToken || null };
+}

package/src/providers/codearts.js

@@ -0,0 +1 @@
+export * from "./codearts/index.js";

package/src/providers/qoder/account-store.js

@@ -0,0 +1,107 @@
+// qoder 账号落盘单一源：auths/qoder-<uid>.json（0600 tmp+rename）+ state.json providerConfigs.qoder keys/auths 按 uid 去重。
+// 凭证形状对齐 qoder2api：secret = {"device_token":"dt-xxx","refresh_token":"drt-xxx"}，region 进 auth 行。
+import { writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync, readdirSync, readFileSync, chmodSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { tmpdir } from "node:os";
+import { isTestEnv, defaultStateFile } from "../../state/store.js";
+import { normalizeRegion } from "./constants.js";
+
+export function authDirFor({ explicit = "", testEnv = false, stateFile } = {}) {
+  if (explicit) return explicit;
+  if (testEnv) return join(tmpdir(), "mslxdff-test-auths");
+  return join(dirname(stateFile), "auths");
+}
+
+export function resolveAuthDir() {
+  return authDirFor({
+    explicit: process.env.QODER_AUTH_DIR || "",
+    testEnv: isTestEnv(),
+    stateFile: defaultStateFile(),
+  });
+}
+
+export function resolveAuthDirs() {
+  const primary = resolveAuthDir();
+  const cwdDir = join(process.cwd(), "auths");
+  return primary === cwdDir ? [primary] : [primary, cwdDir];
+}
+
+export function listAccountDocs({ dirs } = {}) {
+  const out = [];
+  const seen = new Set();
+  for (const dir of dirs || resolveAuthDirs()) {
+    let files = [];
+    try {
+      if (!existsSync(dir)) continue;
+      files = readdirSync(dir).filter((f) => f.startsWith("qoder-") && f.endsWith(".json"));
+    } catch { continue; }
+    for (const f of files) {
+      try {
+        const doc = JSON.parse(readFileSync(join(dir, f), "utf8"));
+        const uid = doc?.account?.uid;
+        if (!uid || !doc?.auth?.deviceToken) continue;
+        if (seen.has(String(uid))) continue;
+        seen.add(String(uid));
+        out.push({ uid: String(uid), file: join(dir, f), dir, doc });
+      } catch {}
+    }
+  }
+  return out;
+}
+
+function writeAccountFile({ uid, deviceToken, refreshToken = "", region = "global", name = "", email = "", userType = "personal_standard", organizationId = "", organizationName = "" }) {
+  const authDir = resolveAuthDir();
+  mkdirSync(authDir, { recursive: true });
+  const doc = {
+    account: { uid, name, email, userType, organizationId, organizationName },
+    auth: { deviceToken, refreshToken, region: normalizeRegion(region) },
+  };
+  const fp = join(authDir, `qoder-${uid}.json`);
+  const tmp = `${fp}.tmp`;
+  writeFileSync(tmp, JSON.stringify(doc, null, 2), { mode: 0o600 });
+  try {
+    if (existsSync(fp)) { try { chmodSync(fp, 0o600); } catch {} unlinkSync(fp); }
+    renameSync(tmp, fp);
+  } catch {
+    writeFileSync(fp, JSON.stringify(doc, null, 2), { mode: 0o600 });
+    try { unlinkSync(tmp); } catch {}
+  }
+  try { chmodSync(fp, 0o600); } catch {}
+  return fp;
+}
+
+// state 落盘：key 存 JSON blob（对齐 qoder2api ParseOAuthSecret 形状），auths 存 uid 索引行。
+async function persistAccounts(accounts, file) {
+  const { loadProviderConfigs, saveProviderConfig } = await import("../../state.js");
+  const cfg = (loadProviderConfigs(file ? { file } : {})?.qoder) || {};
+  const keys = [...(Array.isArray(cfg.keys) ? cfg.keys : [])];
+  const auths = [...(Array.isArray(cfg.auths) ? cfg.auths : [])];
+  let updated = 0;
+  for (const acc of accounts) {
+    if (!acc?.uid || !acc?.deviceToken) continue;
+    const blob = JSON.stringify({ device_token: acc.deviceToken, refresh_token: acc.refreshToken || "" });
+    const row = { uid: acc.uid, domain: acc.domain || "qoder.com", region: normalizeRegion(acc.region), name: acc.name || "", refreshToken: acc.refreshToken || "" };
+    const idx = auths.findIndex((a) => a?.uid === acc.uid);
+    if (idx >= 0) { keys[idx] = blob; auths[idx] = row; updated += 1; }
+    else { keys.push(blob); auths.push(row); }
+  }
+  saveProviderConfig("qoder", { baseUrl: cfg.baseUrl || "", keys, auths }, file ? { file } : {});
+  return { keys, auths, updated };
+}
+
+export async function saveQoderAccount({ uid, deviceToken, refreshToken = "", region = "global", name = "", email = "", userType = "personal_standard", organizationId = "", organizationName = "", domain = "qoder.com", file } = {}) {
+  if (!uid || !deviceToken) throw new Error("saveQoderAccount: 缺少 uid/deviceToken");
+  const fp = writeAccountFile({ uid, deviceToken, refreshToken, region, name, email, userType, organizationId, organizationName });
+  const st = await persistAccounts([{ uid, deviceToken, refreshToken, region, name, domain }], file);
+  return { file: fp, accounts: st.keys.length, updated: st.updated > 0 };
+}
+
+// 重建 provider 的行级 auth：由 keys[i] blob + auths[i] 还原 deviceToken。
+export function accountFromBlob(blob) {
+  try {
+    const j = JSON.parse(String(blob || "{}"));
+    return { deviceToken: String(j.device_token || ""), refreshToken: String(j.refresh_token || "") };
+  } catch {
+    return null;
+  }
+}