mslxdff 0.1.138 → 0.1.141

package/src/cli/commands/provider/traework-login.js

@@ -0,0 +1,202 @@
+// mslxdff -provider traework login — 复刻 traework2api login.sh。
+// 随机 hex16 machine/device id → 构造 trae.cn 授权链接 → 打印 → stdin 读回调链接 →
+// 解析 refreshToken/userInfo/userJwt → ExchangeToken → GetUserInfo → 落盘 → 自动签到+查积分。
+import { randomBytes } from "node:crypto";
+import { compatFetch, timeoutSignal } from "../../../compat.js";
+import { CLIENT_ID, IDE_VERSION, OAUTH_HOST } from "../../../providers/traework/constants.js";
+import { normalizeExpiresAt } from "../../../providers/traework/token.js";
+
+const API_HOST = OAUTH_HOST;
+const APP_VERSION = IDE_VERSION;
+
+function hex(n) { return randomBytes(n).toString("hex"); }
+
+function readStdinLine(prompt) {
+  return new Promise((resolve) => {
+    try { process.stdout.write(`${prompt}`); } catch {}
+    let data = "";
+    const onData = (chunk) => { data += String(chunk || ""); if (data.includes("\n")) done(); };
+    const done = () => {
+      try { process.stdin.removeListener("data", onData); } catch {}
+      try { if (process.stdin.isTTY) process.stdin.setRawMode(false); } catch {}
+      try { process.stdin.pause(); } catch {}
+      resolve(data.trim());
+    };
+    try {
+      process.stdin.resume();
+      process.stdin.setEncoding("utf8");
+      process.stdin.on("data", onData);
+      process.stdin.on("end", done);
+    } catch { resolve(""); }
+  });
+}
+export function buildLoginUrl({ machineId, deviceId, traceId = hex(8) } = {}) {
+  const params = new URLSearchParams({
+    login_version: "1",
+    auth_from: "solo",
+    login_channel: "native_ide",
+    plugin_version: "2.3.62834",
+    auth_type: "local",
+    client_id: CLIENT_ID,
+    redirect: "0",
+    login_trace_id: traceId,
+    auth_callback_url: "http://127.0.0.1:18080/authorize",
+    machine_id: machineId,
+    device_id: deviceId,
+    x_device_id: deviceId,
+    x_machine_id: machineId,
+    x_device_brand: "PC",
+    x_device_type: "PC",
+    x_os_version: "1.0",
+    x_app_version: APP_VERSION,
+    x_app_type: "stable",
+  });
+  return `https://www.trae.cn/authorization?${params.toString()}`;
+}
+
+// 解析回调链接：parse_qs + 双层 unquote 容错 → { refreshToken, userInfo, userJwt }。
+export function parseCallbackUrl(url) {
+  let u;
+  try { u = new URL(String(url || "").trim()); } catch { throw new Error("回调链接不是合法 URL，请复制浏览器地址栏完整链接"); }
+  const qs = u.searchParams;
+  const rawRefresh = qs.get("refreshToken") || "";
+  const parseJsonParam = (raw) => {
+    if (!raw) return {};
+    for (const v of [raw, decodeURIComponent(raw)]) {
+      try { const o = JSON.parse(v); if (o && typeof o === "object") return o; } catch {}
+    }
+    return {};
+  };
+  const userInfo = parseJsonParam(qs.get("userInfo") || "");
+  const userJwt = parseJsonParam(qs.get("userJwt") || "");
+  let refreshToken = rawRefresh || String(userJwt.RefreshToken || "");
+  return {
+    refreshToken,
+    userInfo: { uid: String(userInfo.UserID || ""), nickname: String(userInfo.ScreenName || ""), enterpriseId: String(userInfo.TenantID || "") },
+    userJwt: { token: String(userJwt.Token || ""), refreshToken: String(userJwt.RefreshToken || ""), expiresAt: Number(userJwt.TokenExpireAt) || 0 },
+  };
+}
+
+async function postJson(fetchImpl, url, obj, headers = {}) {
+  const res = await fetchImpl(url, { method: "POST", headers: { "Content-Type": "application/json", "User-Agent": `Trae/${APP_VERSION}`, ...headers }, body: JSON.stringify(obj), signal: timeoutSignal(30000) });
+  const txt = await res.text();
+  let j;
+  try { j = JSON.parse(txt); } catch { throw new Error(`上游返回非 JSON: ${txt.slice(0, 200)}`); }
+  if (res.status >= 400) throw new Error(`上游 HTTP ${res.status}: ${txt.slice(0, 200)}`);
+  return j;
+}
+
+export async function handleTraeworkLogin(id, sub, rest = [], deps = {}) {
+  if (String(id || "").toLowerCase() !== "traework") return false;
+  if (sub !== "login" && sub !== "auth" && sub !== "oauth") return false;
+  const fetchImpl = deps.fetchImpl || compatFetch;
+  const log = deps.log || ((m) => console.log(m));
+  const machineId = hex(16);
+  const deviceId = hex(16);
+  const loginUrl = buildLoginUrl({ machineId, deviceId });
+  log("=".repeat(60));
+  log("  TRAE SOLO 登录");
+  log("=".repeat(60));
+  log("");
+  log("  1. 在浏览器打开下面链接，用手机号/验证码登录");
+  log("  2. 登录成功后浏览器会跳到打不开的 127.0.0.1 地址");
+  log("  3. 复制浏览器地址栏的完整链接，粘贴到下面");
+  log("");
+  log(`  ${loginUrl}`);
+  log("");
+  let callback;
+  if (deps.callbackUrl) callback = deps.callbackUrl;
+  else callback = await readStdinLine("登录完成后，请粘贴浏览器地址栏的完整回调链接: ");
+  if (!callback || !String(callback).trim()) { console.error("未输入回调链接，已取消"); process.exit(1); }
+  const parsed = parseCallbackUrl(callback);
+  let token = "";
+  let refreshToken = parsed.refreshToken;
+  let expiresAt = 0;
+  if (refreshToken) {
+    const resp = await postJson(fetchImpl, `${API_HOST}/cloudide/api/v3/trae/oauth/ExchangeToken`, { ClientID: CLIENT_ID, RefreshToken: refreshToken, ClientSecret: "-", UserID: "" });
+    const result = resp?.Result || {};
+    token = result.Token || "";
+    if (!token) { console.error(`ExchangeToken 失败: ${JSON.stringify(resp).slice(0, 300)}`); process.exit(1); }
+    refreshToken = result.RefreshToken || refreshToken;
+    expiresAt = normalizeExpiresAt(result.TokenExpireAt || 0);
+    if (!(expiresAt > Math.floor(Date.now() / 1000))) expiresAt = Math.floor(Date.now() / 1000) + (Number(result.TokenExpireDuration) || 1209600);
+    log("ExchangeToken 成功");
+  } else {
+    token = parsed.userJwt.token;
+    expiresAt = normalizeExpiresAt(parsed.userJwt.expiresAt);
+    if (!token) { console.error("回调链接缺少 refreshToken，且 userJwt 也没有 Token"); process.exit(1); }
+    log("无 refreshToken，使用 userJwt 的 Token 兜底");
+  }
+  let uid = parsed.userInfo.uid;
+  let nickname = parsed.userInfo.nickname;
+  let enterpriseId = parsed.userInfo.enterpriseId;
+  try {
+    const ui = await postJson(fetchImpl, `${API_HOST}/cloudide/api/v3/trae/GetUserInfo`, { ReqSource: "IDE", IDEVersion: APP_VERSION }, { "x-cloudide-token": token });
+    const u = ui?.Result || ui || {};
+    if (u.UserID) { uid = String(u.UserID); nickname = String(u.ScreenName || nickname); enterpriseId = String(u.EnterpriseID || enterpriseId); }
+  } catch (e) { log(`GetUserInfo 失败（使用回调 userInfo）: ${e.message}`); }
+  if (!uid) { console.error("未能获取 uid，请检查 token 是否有效"); process.exit(1); }
+  const { saveTraeworkAccount } = await import("../../../providers/traework/account-store.js");
+  const save = deps.saveAccount || saveTraeworkAccount;
+  const saved = await save({ uid, enterpriseId, nickname, accessToken: token, refreshToken, expiresAt, domain: "trae.cn", apiHost: API_HOST, machineId, deviceId });
+  // 自动签到 + 查积分
+  try {
+    const { checkinStatus, checkinClaim, entUsage } = await import("../../../providers/traework/checkin.js");
+    const cred = { accessToken: token, deviceId };
+    const st = await checkinStatus({ cred, fetchImpl });
+    log(`签到状态: checked_in=${st.checkedIn} credits=${st.credits} enable=${st.enable}`);
+    if (!st.checkedIn && st.enable) {
+      await checkinClaim({ cred, fetchImpl });
+      log("签到: success");
+    }
+    const ent = await entUsage({ cred, fetchImpl });
+    log(`当前积分: ${ent.remain}`);
+  } catch (e) { log(`签到/查积分: ${String(e?.message || e).slice(0, 200)}`); }
+  log("");
+  log("=".repeat(60));
+  log("  登录完成！");
+  log(`  UID: ${uid}`);
+  log(`  Nickname: ${nickname || "（未获取到）"}`);
+  log(`  账号数: ${saved.accounts}`);
+  log("=".repeat(60));
+  log("下一步：mslxdff -restart（用户终端跑），然后 mslxdff -provider traework models 验证");
+  if (!deps.noExit) process.exit(0);
+  return true;
+}
+
+// 手动签到：-provider traework checkin
+export async function handleTraeworkCheckin(id, sub, rest = [], deps = {}) {
+  if (String(id || "").toLowerCase() !== "traework") return false;
+  if (sub !== "checkin") return false;
+  const fetchImpl = deps.fetchImpl || compatFetch;
+  const log = deps.log || ((m) => console.log(m));
+  const { loadProviderConfig, loadProviderKeys, defaultStateFile } = await import("../../../state.js");
+  const cfg = loadProviderConfig("traework");
+  const keys = deps.keys || loadProviderKeys("traework");
+  const authList = deps.auths || cfg?.auths || [];
+  if (!keys.length || !authList.length) { console.error("没有 traework 账号，请先 mslxdff -provider traework login"); process.exit(1); }
+  const { checkinStatus, checkinClaim, entUsage } = await import("../../../providers/traework/checkin.js");
+  for (let i = 0; i < Math.min(keys.length, authList.length); i++) {
+    const auth = authList[i];
+    const at = keys[i];
+    if (!auth?.uid || !at) continue;
+    const cred = { accessToken: at, deviceId: auth?.deviceId || "", uid: auth.uid };
+    log(`账号 ${auth.uid.slice(0, 8)}...`);
+    try {
+      const st = await checkinStatus({ cred, fetchImpl });
+      log(`  签到状态: checked_in=${st.checkedIn} credits=${st.credits} enable=${st.enable}`);
+      if (!st.checkedIn && st.enable) {
+        await checkinClaim({ cred, fetchImpl });
+        log(`  签到: success`);
+        const st2 = await checkinStatus({ cred, fetchImpl });
+        log(`  签到后积分: ${st2.credits}`);
+      }
+      const ent = await entUsage({ cred, fetchImpl });
+      log(`  总积分: ${ent.remain}`);
+    } catch (e) {
+      log(`  失败: ${String(e?.message || e).slice(0, 120)}`);
+    }
+  }
+  if (!deps.noExit) process.exit(0);
+  return true;
+}

package/src/cli/interactive.js

@@ -1,9 +1,21 @@
-// 交互式选择器：↑/↓ 移动，Enter 确认，q/Esc 取消；ANSI 原地重绘
+// 交互式选择器：↑/↓ 移动，←/→ 翻页，Enter 确认，q/Esc 取消；ANSI 原地重绘。
+// 页高按终端行数自适应（items ≤ 页高时不分页，行为与旧版全量渲染一致）。
+const PAGE_RESERVE = 6; // 页头 1 + 帮助 2 + 余量
+
+function pageSizeFor(items) {
+  const rows = Number(process.stdout?.rows) || 24;
+  const size = Math.max(4, rows - PAGE_RESERVE);
+  return items.length > size ? size : items.length || 1;
+}
+
 export async function pickInteractive(items, startCursor = 0) {
   const { renderChooser, renderChooserHelp, parseKey } = await import("../chooser.js");
+  const size = pageSizeFor(items);
+  let page = 0;
   let cursor = Math.min(Math.max(startCursor, 0), items.length - 1);
   const draw = () => {
-    const lines = [...renderChooser(items, cursor), ...renderChooserHelp()];
+    const usePage = size < items.length;
+    const lines = [...renderChooser(items, cursor, usePage ? { index: page, size } : {}), ...renderChooserHelp(false, usePage)];
     process.stdout.write("\x1b[2J\x1b[H" + lines.join("\n"));
   };
   draw();
@@ -19,11 +31,22 @@ export async function pickInteractive(items, startCursor = 0) {
     };
     const onData = (chunk) => {
       const key = parseKey(String(chunk));
+      const pages = Math.max(1, Math.ceil(items.length / size));
       if (key === "up") {
         cursor = (cursor - 1 + items.length) % items.length;
+        page = Math.floor(cursor / size);
         draw();
       } else if (key === "down") {
         cursor = (cursor + 1) % items.length;
+        page = Math.floor(cursor / size);
+        draw();
+      } else if (key === "pageup") {
+        page = (page - 1 + pages) % pages;
+        cursor = page * size;
+        draw();
+      } else if (key === "pagedown") {
+        page = (page + 1) % pages;
+        cursor = Math.min(page * size, items.length - 1);
         draw();
       } else if (key === "enter") {
         cleanup();
@@ -37,14 +60,17 @@ export async function pickInteractive(items, startCursor = 0) {
   });
 }
 
-// 多选勾选：↑/↓ 移动，Space 勾选/取消，Enter 保存，q/Esc 取消（返回 Set 或 null）
+// 多选勾选：↑/↓ 移动，←/→ 翻页，Space 勾选/取消，Enter 保存，q/Esc 取消（返回 Set 或 null）
 export async function pickInteractiveMulti(items, initialPicked = new Set(), startCursor = 0) {
   const { renderChooser, renderChooserHelp, parseKey } = await import("../chooser.js");
+  const size = pageSizeFor(items);
+  let page = 0;
   let cursor = Math.min(Math.max(startCursor, 0), items.length - 1);
   const picked = new Set(items.filter((it) => initialPicked.has(it.id)).map((it) => it.id));
   const draw = () => {
+    const usePage = size < items.length;
     const rows = items.map((it, i) => ({ ...it, picked: picked.has(it.id) }));
-    const lines = [...renderChooser(rows, cursor, { multi: true }), ...renderChooserHelp(true)];
+    const lines = [...renderChooser(rows, cursor, { multi: true, ...(usePage ? { index: page, size } : {}) }), ...renderChooserHelp(true, usePage)];
     process.stdout.write("\x1b[2J\x1b[H" + lines.join("\n"));
   };
   draw();
@@ -60,11 +86,22 @@ export async function pickInteractiveMulti(items, initialPicked = new Set(), sta
     };
     const onData = (chunk) => {
       const key = parseKey(String(chunk));
+      const pages = Math.max(1, Math.ceil(items.length / size));
       if (key === "up") {
         cursor = (cursor - 1 + items.length) % items.length;
+        page = Math.floor(cursor / size);
         draw();
       } else if (key === "down") {
         cursor = (cursor + 1) % items.length;
+        page = Math.floor(cursor / size);
+        draw();
+      } else if (key === "pageup") {
+        page = (page - 1 + pages) % pages;
+        cursor = page * size;
+        draw();
+      } else if (key === "pagedown") {
+        page = (page + 1) % pages;
+        cursor = Math.min(page * size, items.length - 1);
         draw();
       } else if (key === "space") {
         const id = items[cursor].id;

package/src/cli/provider-row.js

@@ -40,7 +40,7 @@ export function buildProviderRows({ stateFile, env = process.env } = {}) {
     let allowed = [];
     let allowAny = false;
     try { keys = loadProviderKeys(gid, stateFile ? { file: stateFile } : undefined); } catch {}
-    try { baseUrl = loadProviderBaseUrl(gid, stateFile ? { file: stateFile } : undefined) || cfg?.baseUrl || (gid === "openrouter" ? "https://openrouter.ai/api/v1" : gid === "workbuddy" ? "https://copilot.tencent.com" : ""); } catch { baseUrl = cfg?.baseUrl || ""; }
+    try { baseUrl = loadProviderBaseUrl(gid, stateFile ? { file: stateFile } : undefined) || cfg?.baseUrl || (gid === "openrouter" ? "https://openrouter.ai/api/v1" : gid === "workbuddy" ? "https://copilot.tencent.com" : gid === "traework" ? "https://trae-api-cn.mchost.guru" : gid === "qoder" ? "qoder://native" : ""); } catch { baseUrl = cfg?.baseUrl || ""; }
     try { allowed = loadProviderAllowedModels(gid, stateFile ? { file: stateFile } : undefined); } catch {}
     try { allowAny = loadProviderAllowAnyModels(gid, stateFile ? { file: stateFile } : undefined); } catch {}
     // openrouter 特殊：opencode 例外默认 allowAny true，其余默认 false

package/src/providers/classify.js

@@ -4,7 +4,7 @@
 // latency-compare：key/token 类，direct vs link+remote 比延迟
 export function classifyProvider(id) {
   const s = String(id || "").trim().toLowerCase();
-  if (s === "workbuddy" || s === "cline") return "local-only";
+  if (s === "workbuddy" || s === "cline" || s === "codearts" || s === "traework" || s === "qoder") return "local-only";
   if (s === "opencode") return "quota-pool";
   return "latency-compare";
 }

package/src/providers/cline/index.js

@@ -1,5 +1,5 @@
 import { createKeyRing } from "../keyring.js";
-import { loadProviderKeys, loadProviderBaseUrl, loadProviderModelsPath, loadProviderChatPath, saveProviderConfig } from "../../state.js";
+  import { loadProviderKeys, loadProviderBaseUrl, loadProviderModelsPath, loadProviderChatPath, saveProviderConfig, loadProviderAuths } from "../../state.js";
 import { envInt, joinUrl, getUndici, createAgent, collectApiKeysGeneric, createChatRunner } from "../base.js";
 import { compatFetch } from "../../compat.js";
 import { joinModelId } from "../model-id.js";
@@ -68,8 +68,14 @@ export function createClineProvider({
           const idx = cur.indexOf(oldRefreshToken);
           if (idx >= 0) {
             const next = [...cur]; next[idx] = newRefreshToken;
-            // 优先写 providerConfigs，兼容旧路径由 saveProviderConfig 处理
-            saveProviderConfig(id, { baseUrl: resolvedBase, keys: next }, file ? { file } : {});
+            // 优先写 providerConfigs，兼容旧路径由 saveProviderConfig 处理；auths 邮箱映射同步新串防漂移
+            let auths;
+            try {
+              const list = loadProviderAuths(id, file ? { file } : {});
+              const ai = list.findIndex((a) => String(a?.refreshToken || "") === String(oldRefreshToken || ""));
+              if (ai >= 0) { auths = [...list]; auths[ai] = { ...auths[ai], refreshToken: newRefreshToken }; }
+            } catch {}
+            saveProviderConfig(id, { baseUrl: resolvedBase, keys: next, ...(auths ? { auths } : {}) }, file ? { file } : {});
           }
           // 只回写 cline 自己（旧 id 轮换回写已随 id 统一删除，见 .scratch/cline-unify/SPEC.md §4.1）
         } catch {}

package/src/providers/codearts/auth-pool.js

@@ -0,0 +1,148 @@
+// 账号池：keyring 的 key = 凭证 blob JSON 字符串（一华为账号一 blob，多账号=多 key 自动轮转）。
+// 职责：blob 解析；STS 凭证临期（默认提前 30min）单飞刷新；轮转写回（saveFn，原位换 key）；
+// 死号（终态失效）标记。瞬时失败保留旧凭证继续用，绝不清已存凭证（对齐 cline isInvalidGrant 纪律）。
+import { refreshStsCredential } from "./sts.js";
+import { REFRESH_SKEW_MS_DEFAULT } from "./const.js";
+
+/** 校验并解析 blob 字符串 → 账号运行时对象；非 blob（如 Bearer key）返回 null。 */
+export function accountFromBlob(raw) {
+  if (typeof raw !== "string" || !raw.trim().startsWith("{")) return null;
+  let j;
+  try { j = JSON.parse(raw); } catch { return null; }
+  if (!j || typeof j !== "object" || !j.refreshToken || !j.codeVerifier || !j.dpopJwk) return null;
+  const expMs = j.expiration ? Date.parse(j.expiration) : NaN;
+  return {
+    blob: raw,
+    userId: String(j.userId || j.user_id || ""),
+    userName: String(j.userName || j.user_name || ""),
+    domainId: String(j.domainId || j.domain_id || ""),
+    refreshToken: String(j.refreshToken || ""),
+    clientId: String(j.clientId || "codearts-agent"),
+    codeVerifier: String(j.codeVerifier || ""),
+    dpopJwk: j.dpopJwk || null,
+    accessKeyId: String(j.accessKeyId || ""),
+    secretAccessKey: String(j.secretAccessKey || ""),
+    securityToken: String(j.securityToken || ""),
+    expiration: String(j.expiration || ""),
+    expiresAtMs: Number.isFinite(expMs) ? expMs : 0,
+    dead: false,
+    lastError: "",
+    refreshInflight: null,
+  };
+}
+
+/** 账号对象 → 可持久化 blob（JSON 字符串；AK/SK/securityToken 是 STS 临时凭证快照）。 */
+export function blobFromAccount(acc) {
+  return JSON.stringify({
+    userId: acc.userId,
+    userName: acc.userName,
+    domainId: acc.domainId,
+    refreshToken: acc.refreshToken,
+    clientId: acc.clientId,
+    codeVerifier: acc.codeVerifier,
+    dpopJwk: acc.dpopJwk,
+    accessKeyId: acc.accessKeyId,
+    secretAccessKey: acc.secretAccessKey,
+    securityToken: acc.securityToken,
+    expiration: acc.expiration,
+  });
+}
+
+export function createAuthPool({
+  keys = [],
+  fetchImpl,
+  stsHost,
+  skewMs = REFRESH_SKEW_MS_DEFAULT,
+  clock = () => Date.now(),
+  saveFn,
+} = {}) {
+  const accounts = new Map(); // blob → account
+  for (const k of keys) {
+    const acc = accountFromBlob(k);
+    if (acc) accounts.set(k, acc);
+  }
+
+  function findByBlob(blob) { return accounts.get(blob) || null; }
+  function aliveAccounts() { return [...accounts.values()].filter((a) => !a.dead); }
+  function pickPrimary() { return aliveAccounts()[0] || null; }
+
+  async function doRefresh(acc) {
+    const r = await refreshStsCredential(
+      { refreshToken: acc.refreshToken, codeVerifier: acc.codeVerifier, dpopJwk: acc.dpopJwk, clientId: acc.clientId },
+      { fetchImpl, stsHost },
+    );
+    if (r.relogin) {
+      acc.dead = true;
+      acc.lastError = r.error || "re-login required";
+      return;
+    }
+    if (r.error) { acc.lastError = r.error; return; } // 瞬时失败：旧凭证还能用就继续用
+    // 成功：STS 字段更新（refreshToken 可能轮转），原位换 blob 写回
+    acc.accessKeyId = r.account.accessKeyId;
+    acc.secretAccessKey = r.account.secretAccessKey;
+    acc.securityToken = r.account.securityToken;
+    acc.expiration = r.account.expiration;
+    acc.expiresAtMs = r.account.expiresAtMs;
+    if (r.account.refreshToken) acc.refreshToken = r.account.refreshToken;
+    if (r.account.userId) acc.userId = r.account.userId;
+    if (r.account.userName) acc.userName = r.account.userName;
+    if (r.account.domainId) acc.domainId = r.account.domainId;
+    acc.lastError = "";
+    acc.dead = false;
+    const newBlob = blobFromAccount(acc);
+    if (newBlob !== acc.blob) {
+      const oldBlob = acc.blob;
+      accounts.delete(oldBlob);
+      acc.blob = newBlob;
+      accounts.set(newBlob, acc);
+      if (saveFn) { try { await saveFn({ oldBlob, newBlob, account: acc }); } catch {} }
+    }
+  }
+
+  /**
+   * 取某账号的有效 STS 凭证（临期自动单飞刷新）。
+   * @throws {Error} blob 不在池内 / 死号（message 带 re-login 提示）
+   */
+  async function getCredential(blob) {
+    const acc = findByBlob(blob);
+    if (!acc) throw new Error("codearts: credential not in pool — restart daemon or re-login");
+    if (acc.dead) throw new Error(`codearts account ${acc.userId || "?"} dead: ${acc.lastError || "re-login required"} — run: mslxdff -provider codearts login`);
+    const now = clock();
+    const needRefresh = !acc.securityToken || !acc.accessKeyId
+      || (acc.expiresAtMs > 0 && now >= acc.expiresAtMs - skewMs);
+    if (needRefresh && !acc.refreshInflight) {
+      acc.refreshInflight = doRefresh(acc).finally(() => { acc.refreshInflight = null; });
+    }
+    if (acc.refreshInflight) await acc.refreshInflight;
+    if (acc.dead) throw new Error(`codearts account ${acc.userId || "?"} dead: ${acc.lastError || "re-login required"} — run: mslxdff -provider codearts login`);
+    return acc;
+  }
+
+  /** 强制下次刷新（401 后调用；清掉缓存的 STS 临时凭证）。 */
+  function invalidate(blob) {
+    const acc = findByBlob(blob);
+    if (!acc) return;
+    acc.securityToken = "";
+    acc.accessKeyId = "";
+    acc.secretAccessKey = "";
+    acc.expiresAtMs = 0;
+  }
+
+  function markDead(blob, reason) {
+    const acc = findByBlob(blob);
+    if (!acc) return;
+    acc.dead = true;
+    acc.lastError = reason || acc.lastError;
+  }
+
+  /** ring 轮转写回后的重排（saveFn 成功后由 index 调用；saveFn 已处理则幂等）。 */
+  function replace(oldBlob, newBlob) {
+    const acc = accounts.get(oldBlob);
+    if (!acc || oldBlob === newBlob) return;
+    accounts.delete(oldBlob);
+    acc.blob = newBlob;
+    accounts.set(newBlob, acc);
+  }
+
+  return { findByBlob, aliveAccounts, pickPrimary, getCredential, invalidate, markDead, replace, accounts: () => [...accounts.values()] };
+}

package/src/providers/codearts/chat.js

@@ -0,0 +1,176 @@
+// CodeArts 聊天服务：上游 body/头组装 + SDK-HMAC-SHA256 签名 + 401 刷新重试 + 环形切号。
+// 上游恒 stream:true（chatBodyV2 契约）；流式客户端转 OpenAI SSE，非流式聚合回 JSON。
+import crypto from "node:crypto";
+import { joinUrl } from "../base.js";
+import { createTransport } from "../../transport/index.js";
+import { SNAP_BASE, EP_CHAT_V2, chatBaseHeaders, MAAS_TYPE_HEADER, MAAS_BENEFIT } from "./const.js";
+import { signRequest } from "./sign.js";
+import { newChatId, preflightResponse, sseToOpenAIResponse, aggregateToCompletion, UpstreamEventError } from "./stream.js";
+
+const MODEL_RULES = [
+  { match: (m) => String(m || "").toLowerCase().includes("deepseek"), scope: "all" },
+  { match: (m) => /(^kimi-|kimi)/i.test(String(m || "")), scope: "toolCalls" },
+];
+
+// DeepSeek 系思考模式要求 assistant 消息回传 reasoning_content，缺失补 " " 占位（ADR-0001 同款）。
+export function injectReasoningPlaceholder(messages, model) {
+  const rule = MODEL_RULES.find((r) => r.match(model));
+  if (!rule || !Array.isArray(messages)) return messages;
+  return messages.map((m) => {
+    if (m?.role !== "assistant") return m;
+    if (typeof m.reasoning_content === "string" && m.reasoning_content.length) return m;
+    if (rule.scope === "toolCalls" && !(Array.isArray(m.tool_calls) && m.tool_calls.length)) return m;
+    return { ...m, reasoning_content: " " };
+  });
+}
+
+const PASSTHROUGH_KEYS = ["temperature", "top_p", "max_tokens", "max_completion_tokens", "reasoning_effort", "tools", "tool_choice", "stop", "presence_penalty", "frequency_penalty", "response_format", "user", "n", "seed"];
+
+export function buildUpstreamBody(body, { chatId, upstreamModel }) {
+  const out = {
+    model: upstreamModel,
+    stream: true, // v2 端点契约：恒流式，非流式由本层聚合
+    messages: injectReasoningPlaceholder(body?.messages || [], upstreamModel),
+    prompt_cache_key: chatId,
+    tool_stream: true,
+    chat_id: chatId,
+  };
+  for (const k of PASSTHROUGH_KEYS) {
+    if (body?.[k] !== undefined && body?.[k] !== null) out[k] = body[k];
+  }
+  return out;
+}
+
+// Session-Id：由 chatId 派生的稳定会话标识（prompt cache 亲和，对齐 Go sessionIDFor）。
+function sessionIdFor(chatId) {
+  return crypto.createHash("sha256").update(`codearts-session:${chatId}`, "utf8").digest("hex").slice(0, 32);
+}
+
+function stripOwnPrefix(model, providerId) {
+  const s = String(model || "");
+  const i = s.indexOf("/");
+  if (i <= 0) return s;
+  return s.slice(0, i).toLowerCase() === String(providerId || "").toLowerCase() ? s.slice(i + 1) : s;
+}
+
+export function createChatService({
+  id = "codearts",
+  baseUrl = SNAP_BASE,
+  chatPath = EP_CHAT_V2,
+  fetchImpl,
+  dispatcher,
+  authPool,
+  catalog,
+  connectTimeoutMs = 30_000,
+  clock = Date.now,
+  } = {}) {
+  const resolvedBase = String(baseUrl).trim().replace(/\/+$/, "") || SNAP_BASE;
+  const transport = createTransport({ fetchImpl, dispatcher, keepAlive: !!dispatcher, timeoutMs: connectTimeoutMs, retry: {} });
+
+  async function sendOnce({ bodyStr, account, benefit, chatId, sessionId, traceId }) {
+    const url = joinUrl(resolvedBase, chatPath);
+    const h = chatBaseHeaders(account.securityToken, traceId);
+    if (benefit) h[MAAS_TYPE_HEADER] = MAAS_BENEFIT;
+    const { headers } = signRequest({ method: "POST", url, headers: h, body: bodyStr, cred: account });
+    // Chat-Id / Session-Id 在签名之后追加（对齐官方客户端：不进 SignedHeaders）。
+    headers["chat-id"] = chatId;
+    headers["session-id"] = sessionId;
+    return transport.request({ url, method: "POST", headers, body: bodyStr, stream: true, timeoutMs: connectTimeoutMs });
+  }
+
+  function errRes(status, msg, code) {
+    return new Response(JSON.stringify({ error: { message: msg, type: "upstream_error", ...(code ? { code } : {}) } }), {
+      status,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  function withTiming(res, t0) {
+    try { res._t = { attempts: [], waitMs: 0, totalMs: Math.round(clock() - t0) }; } catch {}
+    return res;
+  }
+
+  /**
+   * 跑一次对话。body.model 已由 dispatcher 剥前缀（容忍自带前缀）。
+   * @returns {Promise<Response>} 流式 → OpenAI SSE；非流式 → chat.completion JSON
+   */
+  async function runChat(body, activeRing, opts = {}) {
+    const t0 = clock();
+    const requestedModel = String(body?.model || "");
+    const rawModel = stripOwnPrefix(requestedModel, id);
+    const upstreamModel = catalog?.canonical(rawModel) || rawModel;
+    const chatId = newChatId(body, opts);
+    const sessionId = sessionIdFor(chatId);
+    const upstreamBody = buildUpstreamBody(body, { chatId, upstreamModel });
+    const bodyStr = JSON.stringify(upstreamBody);
+    const isStream = body?.stream === true;
+    let lastErr = null;
+
+    const maxTries = Math.max(1, activeRing.size || 1);
+    for (let attempt = 0; attempt < maxTries; attempt++) {
+      const blob = activeRing.next();
+      if (!blob) break;
+      let account;
+      try {
+        account = await authPool.getCredential(blob);
+      } catch (err) {
+        try { activeRing.onError(blob); } catch {}
+        lastErr = err;
+        continue; // 死号/不在池：换下一个账号
+      }
+      const benefit = catalog?.isBenefit ? catalog.isBenefit(account.userId, upstreamModel) : false;
+      const traceId = crypto.randomBytes(8).toString("hex") + String(clock());
+      let res;
+      try {
+        res = await sendOnce({ bodyStr, account, benefit, chatId, sessionId, traceId });
+      } catch (err) {
+        try { activeRing.onError(blob); } catch {}
+        lastErr = err;
+        continue;
+      }
+      if (res.status === 401 || res.status === 403) {
+        // STS 临时凭证失效：强制刷新重试一次，仍 401/403 换号
+        authPool.invalidate(blob);
+        let account2 = null;
+        try { account2 = await authPool.getCredential(blob); } catch { /* 死号 → 换号 */ }
+        if (account2) {
+          const traceId2 = crypto.randomBytes(8).toString("hex") + String(clock());
+          try { res = await sendOnce({ bodyStr, account: account2, benefit, chatId, sessionId, traceId: traceId2 }); } catch (err2) { lastErr = err2; try { activeRing.onError(blob); } catch {} continue; }
+          if (res.status === 401 || res.status === 403) {
+            try { await res.text(); } catch {}
+            try { activeRing.onError(blob); } catch {}
+            lastErr = new Error(`codearts auth still failing after refresh (http ${res.status})`);
+            continue;
+          }
+        } else {
+          try { activeRing.onError(blob); } catch {}
+          continue;
+        }
+      }
+      if (res.status >= 400) {
+        const txt = await res.text().catch(() => "");
+        if (res.status === 429 || res.status >= 500) try { activeRing.onError(blob); } catch {}
+        return withTiming(errRes(res.status, `codearts upstream http ${res.status}: ${String(txt).slice(0, 300)}`), t0);
+      }
+      try {
+        const pre = await preflightResponse(res); // HTTP 200 内嵌错误（排队/未注册/福利未领）→ 抛 UpstreamEventError
+        if (isStream) return withTiming(sseToOpenAIResponse(pre, { model: requestedModel || upstreamModel, id: `chatcmpl-${chatId.slice(0, 12)}` }), t0);
+        const data = await aggregateToCompletion(pre, { model: requestedModel || upstreamModel, id: `chatcmpl-${chatId.slice(0, 12)}` });
+        return withTiming(new Response(JSON.stringify(data), { status: 200, headers: { "Content-Type": "application/json" } }), t0);
+      } catch (err) {
+        if (err instanceof UpstreamEventError) {
+          if (err.status === 429 || err.status >= 500) try { activeRing.onError(blob); } catch {}
+          return withTiming(errRes(err.status, `codearts upstream: ${err.message}`, err.code), t0);
+        }
+        try { activeRing.onError(blob); } catch {}
+        lastErr = err;
+        continue;
+      }
+    }
+    throw Object.assign(lastErr || new Error("codearts: all accounts unavailable"), {
+      _t: { attempts: [], waitMs: 0, totalMs: Math.round(clock() - t0) },
+    });
+  }
+
+  return { runChat, buildUpstreamBody, injectReasoningPlaceholder, _sendOnce: sendOnce };
+}