mslxdff 0.1.174 → 0.1.176

package/src/cli/commands/provider/keys-guard.js

@@ -0,0 +1,50 @@
+// 覆盖式写 provider keys 前的最后一道闸（单一判据来源，keys.js 只管调用）。
+//
+// 事故原型 2026-10-15：`mslxdff -provider traework quota` 当时 traework 没有 quota 处理器，
+// `quota` 一路掉进 keys.js 的「未知即当 key」兜底分支，把 providerConfigs.traework.keys[0]
+// 那个 1004 字符的 accessToken 整组覆盖成字符串 "quota" —— auth 号型的 keys 就是 accessToken 本身，
+// 等于当场废号；且 keys 与 auths 长度仍相等（1:1），绕过了 provider 侧「长度不配对才回填」的自愈判据。
+import { normalizeProviderId } from "../../../providers/model-id.js";
+import { AUTH_DOC_PROVIDER_IDS } from "../../../runtime/provider-gate.js";
+
+// 保留子命令：这些词归 provider/ 下别的 handler 管，掉到 keys 兜底 = 该 provider 没接线。
+// 名单 = 各 handler 实际比对的 sub 值全集（keys.js 自己认的 list/status/add/remove/clear 不在内）。
+// 新增 handler 时同步这里；漏收的后果是那个词能被当 key 写盘。
+export const RESERVED_PROVIDER_SUBS = new Set([
+  "login", "auth", "oauth", "checkin", "signin", "quota", "credits", "balance",
+  "migrate", "free", "bench", "benchmark", "eval", "test",
+  "models", "show-models", "list-models", "ls", "models-path", "chat-path",
+  "set-url", "set-models-path", "set-chat-path", "url", "seturl", "setmodelspath", "setchatpath",
+  "allowlist", "allow", "allowed", "allowany", "allow-any", "allow_any", "whitelist",
+  "del", "delete", "rm", "remove-provider", "del-provider", "import", "import-desktop", "from-desktop",
+]);
+
+/**
+ * 判断这次「把参数当 keys 整组覆盖」要不要拦。
+ * @returns null = 放行；string[] = 拒写，元素是给人看的报错行（调用方打印后 exit 1，且必须已改盘前退出）
+ */
+export function keysWriteDenial(id, sub, rest = []) {
+  const pid = normalizeProviderId(id) || String(id || "").toLowerCase();
+  const subLc = String(sub || "").toLowerCase();
+
+  // 闸 1：verb 一律不当 key（无 --force 逃生阀，真要写这个词走 `add`）
+  if (RESERVED_PROVIDER_SUBS.has(subLc)) {
+    return [
+      `✗ -provider ${id} ${sub}：该供应商没有这个子命令 —— 已拒绝写 keys，配置未改动`,
+      `  拦截原因：落到 keys 分支会把 "${sub}" 当成 API key 覆盖 ${id} 现有 keys。`,
+      `  ${id} 支持什么：mslxdff -provider ${id} list`,
+      `  真要把某个词当 key（罕见）：mslxdff -provider ${id} add ${sub}`,
+    ];
+  }
+  // 闸 2：auth 号型的 keys 由 login / account-store 派生、与 auths[] 按位序平行
+  // （raccoon 更由 syncRaccoonKeys 覆盖式同步），手填必错且下次登录即被冲掉 → 只留 --force 逃生阀。
+  if (AUTH_DOC_PROVIDER_IDS.includes(pid) && !rest.includes("--force")) {
+    return [
+      `✗ 已拒绝覆盖 ${pid} 的 keys（配置未改动）`,
+      `  ${pid} 是 auth 号型供应商：keys 存的是 login 落盘的 accessToken，与 auths[] 按位序成对，手填等于废号。`,
+      `  正确姿势: mslxdff -provider ${pid} login（登录后自动回填 keys/auths）`,
+      `  确知自己在做什么 → 末尾加 --force 重跑`,
+    ];
+  }
+  return null;
+}

package/src/cli/commands/provider/keys.js

@@ -1,3 +1,5 @@
+import { keysWriteDenial } from "./keys-guard.js";
+
 export async function handleProviderKeys(id, sub, rest, args) {
   if (sub === "list" || sub === "status") {
     const { loadProviderKeys, loadProviderConfig, loadProviderAllowedModels, loadProviderAllowAnyModels } = await import("../../../state.js");
@@ -108,6 +110,11 @@ export async function handleProviderKeys(id, sub, rest, args) {
     process.exit(0);
   }
   if (sub && !sub.startsWith("-")) {
+    const denial = keysWriteDenial(id, sub, rest);
+    if (denial) {
+      for (const l of denial) console.error(l);
+      process.exit(1);
+    }
     const { loadProviderKeys, loadProviderConfig, saveProviderConfig, saveProviderKeys, loadProviderConfigs } = await import("../../../state.js");
     const keys = rest.filter((k) => !k.startsWith("-"));
     if (!keys.length) {

package/src/cli/commands/provider/models.js

@@ -1,145 +1,145 @@
-import { join } from "node:path";
-import { defaultStateFile } from "../../../state.js";
-import { logDir } from "../../../logs.js";
-import { normalizeProviderId } from "../../../providers/model-id.js";
-
-export async function handleProviderModels(id, sub, args, rest) {
-  if (!(sub === "models" || sub === "show-models" || sub === "list-models" || sub === "ls")) return false;
-  // 供应商 id 归一（clinebot/cline-bot → cline）：老脚本 `-provider clinebot models` 仍走 cline 直查
-  id = normalizeProviderId(id);
-  const { loadProviderConfig, loadProviderKeys, isModelAllowed } = await import("../../../state.js");
-  const wantsJson = args.includes("--json") || args.includes("-json");
-  const cfg = loadProviderConfig(id);
-  if (id === "opencode" || id === "oc") {
-    try {
-      const cacheFile = join(logDir(), "models.json");
-      const { readFileSync } = await import("node:fs");
-      const raw = JSON.parse(readFileSync(cacheFile, "utf8"));
-      const ids = (raw.data || []).map((m) => m.id).filter((x) => !String(x).includes("/"));
-      if (wantsJson) {
-        console.log(JSON.stringify({ object: "list", data: ids.map((id) => ({ id, object: "model" })) }, null, 2));
-      } else {
-        console.log(`opencode models (${ids.length}):`);
-        for (const mid of ids) console.log(`  ${mid}`);
-      }
-    } catch (e) {
-      console.error(`could not read models cache: ${String(e?.message || e)}`);
-      process.exit(1);
-    }
-    process.exit(0);
-  }
-  try {
-    const { createGenericProvider } = await import("../../../providers/generic.js");
-    const { createWorkbuddyProvider } = await import("../../../providers/workbuddy.js");
-    const baseUrl = cfg?.baseUrl || (id === "workbuddy" ? "https://copilot.tencent.com" : "");
-    const keys = loadProviderKeys(id);
-    const auths = cfg?.auths || [];
-    let provider;
-    if (id === "workbuddy") {
-      provider = createWorkbuddyProvider({ baseUrl, apiKeys: keys, auths, file: defaultStateFile() });
-    } else if (id === "cline") {
-      // 与聚合目录同源：recommended-models 的 free（generic 的 /api/v1/models 是全量目录，含大量不可用条目）
-      const { createClineProvider } = await import("../../../providers/cline.js");
-      provider = createClineProvider({ id, baseUrl: baseUrl || undefined, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "codearts") {
-      const { createCodeartsProvider } = await import("../../../providers/codearts.js");
-      provider = createCodeartsProvider({ baseUrl: baseUrl || undefined, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "traework") {
-      const { createTraeworkProvider } = await import("../../../providers/traework.js");
-      provider = createTraeworkProvider({ baseUrl: baseUrl || undefined, apiKeys: keys, auths, file: defaultStateFile() });
-    } else if (id === "qoder") {
-      const { createQoderProvider } = await import("../../../providers/qoder/index.js");
-      provider = createQoderProvider({ id, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "qwenwork") {
-      const { createQwenworkProvider } = await import("../../../providers/qwenwork/index.js");
-      provider = createQwenworkProvider({ id, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "globalqwenwork") {
-      const { createGlobalQwenworkProvider } = await import("../../../providers/globalqwenwork/index.js");
-      provider = createGlobalQwenworkProvider({ id, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "zcode") {
-      const { createZcodeProvider } = await import("../../../providers/zcode/index.js");
-      provider = createZcodeProvider({ id, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "raccoon") {
-      const { createRaccoonProvider } = await import("../../../providers/raccoon/index.js");
-      provider = createRaccoonProvider({ id, apiKeys: keys, file: defaultStateFile() });
-    } else {
-      if (!baseUrl) {
-        console.error(`provider ${id}: missing baseUrl — set via: mslxdff -provider ${id} set-url <baseUrl>`);
-        process.exit(1);
-      }
-      provider = createGenericProvider({ id, baseUrl, apiKeys: keys, file: defaultStateFile() });
-    }
-    const all = await provider.listModels();
-    const markAllowed = (mid) => {
-      const raw = String(mid || "").includes("/") ? String(mid).split("/").slice(1).join("/") : String(mid);
-      const checkRaw = mid.startsWith(`${id}/`) ? mid.slice(id.length + 1) : raw;
-      return isModelAllowed(id, checkRaw);
-    };
-    if (wantsJson) {
-      const filtered = all.filter((m) => markAllowed(m.id));
-      console.log(JSON.stringify({ object: "list", data: filtered }, null, 2));
-    } else {
-      const allowedCount = all.filter((m) => markAllowed(m.id)).length;
-      console.log(`${id} models (${all.length} total, ${allowedCount} ✓ allowed${allowedCount !== all.length ? `, ${all.length - allowedCount} x blocked by allowlist` : ""}):`);
-      const fmtPrice = (m) => {
-        const c = String(m.credits || "").trim();
-        if (c) {
-          const m0 = c.match(/x\s*([\d.]+)/i);
-          if (m0) return `x${m0[1]}`;
-          return c.replace(/\s*credits\s*/gi, "").trim().replace(/\s+/g, " ");
-        }
-        if (m.pricing && typeof m.pricing === "object") {
-          const p = m.pricing.prompt ?? m.pricing.input ?? m.pricing.completion ?? "";
-          if (p) return String(p);
-        }
-        if (m.price_factor != null && String(m.price_factor).trim() !== "") return `x${m.price_factor}`;
-        if (m.price != null && String(m.price).trim()) return String(m.price).trim();
-        if (String(m.id).endsWith("/auto")) return "浮动";
-        return "—";
-      };
-      const fmtBadge = (m) => {
-        const tags = Array.isArray(m.tags) ? m.tags : [];
-        const b = tags.find((t) => String(t).includes("限时免费") || String(t).toLowerCase().includes("free"));
-        if (!b) return "";
-        const part = String(b).split(":")[1];
-        return part ? ` [${part}]` : ` [${b}]`;
-      };
-      // 能力列：上下文 k + 📷识图 🧠推理 🔧工具调用（workbuddy 原生字段；其他供应商无这些字段则显示 —）
-      const fmtCaps = (m) => {
-        const ctx = Number(m.maxInputTokens ?? m.context_length) || null;
-        const reasoning = m.supportsReasoning ?? m.is_reasoning;
-        const hasAny = ctx || m.supportsImages != null || reasoning != null || m.supportsToolCall != null;
-        if (!hasAny) return "—";
-        const parts = [];
-        if (ctx) parts.push(ctx >= 1_000_000 ? `${Math.round(ctx / 100000) / 10}M` : `${Math.round(ctx / 1000)}k`);
-        if (m.supportsImages && !m.disabledMultimodal) parts.push("📷");
-        if (reasoning) parts.push("🧠");
-        if (m.supportsToolCall) parts.push("🔧");
-        return parts.join(" ");
-      };
-      const idW = Math.max(22, ...all.map((m) => String(m.id).length)) + 2;
-      const priceW = Math.max(6, ...all.map((m) => fmtPrice(m).length)) + 2;
-      const capsW = Math.max(4, ...all.map((m) => fmtCaps(m).length)) + 2;
-      for (const m of all) {
-        const ok = markAllowed(m.id);
-        const price = fmtPrice(m);
-        const badge = fmtBadge(m);
-        const name = m.name ? ` ${m.name}` : "";
-        const blocked = ok ? "" : "  [blocked — allowlist]";
-        const line = `  ${ok ? "✓" : "x"} ${String(m.id).padEnd(idW)}${String(price).padEnd(priceW)}${fmtCaps(m).padEnd(capsW)}${name}${badge}${blocked}`;
-        console.log(line);
-      }
-      if (!all.length) console.log(`  (no models — check baseUrl/keys or try: curl ${baseUrl}/models)`);
-      else if (allowedCount === 0) console.log(`  tip: all blocked — mslxdff -provider ${id} allowAny on  或  allowlist set <model...>`);
-      else if (allowedCount !== all.length) console.log(`  tip: blocked 仅影响 /v1/chat 调用，展示已全量列出`);
-      if (id === "zcode") {
-        console.log(`  tip: 目录/额度/模型调用全通（上游 v3.14.4 起模型请求免验证码，docs/adr/0038）；额度耗尽返回 429 quota_exhausted，按日窗口重置`);
-      }
-    }
-    try { await provider.close?.(); } catch {}
-  } catch (e) {
-    console.error(`could not list ${id} models: ${String(e?.message || e)}`);
-    process.exit(1);
-  }
-  process.exit(0);
-}
+import { join } from "node:path";
+import { defaultStateFile } from "../../../state.js";
+import { logDir } from "../../../logs.js";
+import { normalizeProviderId } from "../../../providers/model-id.js";
+
+export async function handleProviderModels(id, sub, args, rest) {
+  if (!(sub === "models" || sub === "show-models" || sub === "list-models" || sub === "ls")) return false;
+  // 供应商 id 归一（clinebot/cline-bot → cline）：老脚本 `-provider clinebot models` 仍走 cline 直查
+  id = normalizeProviderId(id);
+  const { loadProviderConfig, loadProviderKeys, isModelAllowed } = await import("../../../state.js");
+  const wantsJson = args.includes("--json") || args.includes("-json");
+  const cfg = loadProviderConfig(id);
+  if (id === "opencode" || id === "oc") {
+    try {
+      const cacheFile = join(logDir(), "models.json");
+      const { readFileSync } = await import("node:fs");
+      const raw = JSON.parse(readFileSync(cacheFile, "utf8"));
+      const ids = (raw.data || []).map((m) => m.id).filter((x) => !String(x).includes("/"));
+      if (wantsJson) {
+        console.log(JSON.stringify({ object: "list", data: ids.map((id) => ({ id, object: "model" })) }, null, 2));
+      } else {
+        console.log(`opencode models (${ids.length}):`);
+        for (const mid of ids) console.log(`  ${mid}`);
+      }
+    } catch (e) {
+      console.error(`could not read models cache: ${String(e?.message || e)}`);
+      process.exit(1);
+    }
+    process.exit(0);
+  }
+  try {
+    const { createGenericProvider } = await import("../../../providers/generic.js");
+    const { createWorkbuddyProvider } = await import("../../../providers/workbuddy.js");
+    const baseUrl = cfg?.baseUrl || (id === "workbuddy" ? "https://copilot.tencent.com" : "");
+    const keys = loadProviderKeys(id);
+    const auths = cfg?.auths || [];
+    let provider;
+    if (id === "workbuddy") {
+      provider = createWorkbuddyProvider({ baseUrl, apiKeys: keys, auths, file: defaultStateFile() });
+    } else if (id === "cline") {
+      // 与聚合目录同源：recommended-models 的 free（generic 的 /api/v1/models 是全量目录，含大量不可用条目）
+      const { createClineProvider } = await import("../../../providers/cline.js");
+      provider = createClineProvider({ id, baseUrl: baseUrl || undefined, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "codearts") {
+      const { createCodeartsProvider } = await import("../../../providers/codearts.js");
+      provider = createCodeartsProvider({ baseUrl: baseUrl || undefined, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "traework") {
+      const { createTraeworkProvider } = await import("../../../providers/traework.js");
+      provider = createTraeworkProvider({ baseUrl: baseUrl || undefined, apiKeys: keys, auths, file: defaultStateFile() });
+    } else if (id === "qoder") {
+      const { createQoderProvider } = await import("../../../providers/qoder/index.js");
+      provider = createQoderProvider({ id, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "qwenwork") {
+      const { createQwenworkProvider } = await import("../../../providers/qwenwork/index.js");
+      provider = createQwenworkProvider({ id, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "globalqwenwork") {
+      const { createGlobalQwenworkProvider } = await import("../../../providers/globalqwenwork/index.js");
+      provider = createGlobalQwenworkProvider({ id, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "zcode") {
+      const { createZcodeProvider } = await import("../../../providers/zcode/index.js");
+      provider = createZcodeProvider({ id, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "raccoon") {
+      const { createRaccoonProvider } = await import("../../../providers/raccoon/index.js");
+      provider = createRaccoonProvider({ id, apiKeys: keys, file: defaultStateFile() });
+    } else {
+      if (!baseUrl) {
+        console.error(`provider ${id}: missing baseUrl — set via: mslxdff -provider ${id} set-url <baseUrl>`);
+        process.exit(1);
+      }
+      provider = createGenericProvider({ id, baseUrl, apiKeys: keys, file: defaultStateFile() });
+    }
+    const all = await provider.listModels();
+    const markAllowed = (mid) => {
+      const raw = String(mid || "").includes("/") ? String(mid).split("/").slice(1).join("/") : String(mid);
+      const checkRaw = mid.startsWith(`${id}/`) ? mid.slice(id.length + 1) : raw;
+      return isModelAllowed(id, checkRaw);
+    };
+    if (wantsJson) {
+      const filtered = all.filter((m) => markAllowed(m.id));
+      console.log(JSON.stringify({ object: "list", data: filtered }, null, 2));
+    } else {
+      const allowedCount = all.filter((m) => markAllowed(m.id)).length;
+      console.log(`${id} models (${all.length} total, ${allowedCount} ✓ allowed${allowedCount !== all.length ? `, ${all.length - allowedCount} x blocked by allowlist` : ""}):`);
+      const fmtPrice = (m) => {
+        const c = String(m.credits || "").trim();
+        if (c) {
+          const m0 = c.match(/x\s*([\d.]+)/i);
+          if (m0) return `x${m0[1]}`;
+          return c.replace(/\s*credits\s*/gi, "").trim().replace(/\s+/g, " ");
+        }
+        if (m.pricing && typeof m.pricing === "object") {
+          const p = m.pricing.prompt ?? m.pricing.input ?? m.pricing.completion ?? "";
+          if (p) return String(p);
+        }
+        if (m.price_factor != null && String(m.price_factor).trim() !== "") return `x${m.price_factor}`;
+        if (m.price != null && String(m.price).trim()) return String(m.price).trim();
+        if (String(m.id).endsWith("/auto")) return "浮动";
+        return "—";
+      };
+      const fmtBadge = (m) => {
+        const tags = Array.isArray(m.tags) ? m.tags : [];
+        const b = tags.find((t) => String(t).includes("限时免费") || String(t).toLowerCase().includes("free"));
+        if (!b) return "";
+        const part = String(b).split(":")[1];
+        return part ? ` [${part}]` : ` [${b}]`;
+      };
+      // 能力列：上下文 k + 📷识图 🧠推理 🔧工具调用（workbuddy 原生字段；其他供应商无这些字段则显示 —）
+      const fmtCaps = (m) => {
+        const ctx = Number(m.maxInputTokens ?? m.context_length) || null;
+        const reasoning = m.supportsReasoning ?? m.is_reasoning;
+        const hasAny = ctx || m.supportsImages != null || reasoning != null || m.supportsToolCall != null;
+        if (!hasAny) return "—";
+        const parts = [];
+        if (ctx) parts.push(ctx >= 1_000_000 ? `${Math.round(ctx / 100000) / 10}M` : `${Math.round(ctx / 1000)}k`);
+        if (m.supportsImages && !m.disabledMultimodal) parts.push("📷");
+        if (reasoning) parts.push("🧠");
+        if (m.supportsToolCall) parts.push("🔧");
+        return parts.join(" ");
+      };
+      const idW = Math.max(22, ...all.map((m) => String(m.id).length)) + 2;
+      const priceW = Math.max(6, ...all.map((m) => fmtPrice(m).length)) + 2;
+      const capsW = Math.max(4, ...all.map((m) => fmtCaps(m).length)) + 2;
+      for (const m of all) {
+        const ok = markAllowed(m.id);
+        const price = fmtPrice(m);
+        const badge = fmtBadge(m);
+        const name = m.name ? ` ${m.name}` : "";
+        const blocked = ok ? "" : "  [blocked — allowlist]";
+        const line = `  ${ok ? "✓" : "x"} ${String(m.id).padEnd(idW)}${String(price).padEnd(priceW)}${fmtCaps(m).padEnd(capsW)}${name}${badge}${blocked}`;
+        console.log(line);
+      }
+      if (!all.length) console.log(`  (no models — check baseUrl/keys or try: curl ${baseUrl}/models)`);
+      else if (allowedCount === 0) console.log(`  tip: all blocked — mslxdff -provider ${id} allowAny on  或  allowlist set <model...>`);
+      else if (allowedCount !== all.length) console.log(`  tip: blocked 仅影响 /v1/chat 调用，展示已全量列出`);
+      if (id === "zcode") {
+        console.log(`  tip: 目录/额度/模型调用全通（上游 v3.14.4 起模型请求免验证码，docs/adr/0038）；额度耗尽返回 429 quota_exhausted，按日窗口重置`);
+      }
+    }
+    try { await provider.close?.(); } catch {}
+  } catch (e) {
+    console.error(`could not list ${id} models: ${String(e?.message || e)}`);
+    process.exit(1);
+  }
+  process.exit(0);
+}

package/src/cli/commands/provider/qwenwork-login.js

@@ -1,119 +1,119 @@
-// mslxdff -provider qwenwork login — 千问办公设备授权（PKCE + poll），对齐 qoder-login。
-// 授权后落盘 auths/qwenwork-<uid>.json + state 双写，默认 allowAny=false 并种 3 个实测模型（ADR-0037）。
-import { compatFetch } from "../../../compat.js";
-import { normalizeProviderId } from "../../../providers/model-id.js";
-import { newDeviceFlow, pollGrant, userInfo, accountContext, expiryUnix } from "../../../providers/qwenwork/upstream.js";
-
-const POLL_MS = 3000;
-const POLL_TIMEOUT_MS = 10 * 60 * 1000;
-
-export async function handleQwenworkLogin(id, sub, rest = [], deps = {}) {
-  if (normalizeProviderId(id) !== "qwenwork") return false;
-  if (sub !== "login" && sub !== "auth" && sub !== "oauth") return false;
-  const fetchImpl = deps.fetchImpl || compatFetch;
-  const log = deps.log || ((m) => console.log(m));
-
-  const flow = await newDeviceFlow();
-  log("=".repeat(60));
-  log("  千问办公（QwenWork）登录");
-  log("=".repeat(60));
-  log("");
-  log("  1. 在浏览器打开下面链接，用已登录千问办公的账号确认授权");
-  log("  2. 授权成功后会自动完成，不要关闭本终端");
-  log("");
-  log(`  ${flow.url}`);
-  log("");
-  log("🔄 等待你授权（自动轮询，每 3 秒，最多 10 分钟）...");
-
-  const deadline = Date.now() + POLL_TIMEOUT_MS;
-  let grant = null;
-  for (;;) {
-    if (Date.now() > deadline) {
-      console.error("\n❌ 授权超时（10 分钟），请重新运行 mslxdff -provider qwenwork login");
-      process.exit(1);
-    }
-    let outcome;
-    try {
-      outcome = await pollGrant(flow.nonce, flow.verifier, fetchImpl);
-    } catch (e) {
-      console.error(`\n❌ 轮询失败: ${e.message}`);
-      process.exit(1);
-    }
-    if (!outcome.pending) { grant = outcome.grant; break; }
-    try { process.stdout.write("."); } catch {}
-    await new Promise((r) => setTimeout(r, POLL_MS));
-  }
-  const accessToken = grant.token || grant.device_token;
-  const refreshToken = grant.refresh_token || "";
-  if (!accessToken) {
-    console.error("\n❌ 未获取到 token");
-    process.exit(1);
-  }
-  log(`\n✅ 授权成功！token=${String(accessToken).slice(0, 12)}...`);
-  if (refreshToken) log(`    refreshToken=${String(refreshToken).slice(0, 12)}...`);
-
-  let uid = String(grant.user_id || "");
-  let name = String(grant.user_name || "");
-  let email = "";
-  try {
-    const info = await userInfo(accessToken, fetchImpl);
-    if (info?.id) uid = String(info.id);
-    if (info?.name) name = String(info.name);
-    if (info?.email) email = String(info.email);
-    log(`    UID: ${uid}  昵称: ${name || "(空)"}  邮箱: ${email || "(空)"}`);
-  } catch (e) {
-    log(`    ⚠️ userinfo 失败: ${e.message}（用 grant 兜底）`);
-    if (!uid) uid = String(accessToken).slice(0, 8);
-  }
-  if (!uid) {
-    console.error("❌ 无法获取用户标识");
-    process.exit(1);
-  }
-
-  const { saveQwenworkAccount } = await import("../../../providers/qwenwork/account-store.js");
-  const save = deps.saveAccount || saveQwenworkAccount;
-  const saved = await save({
-    uid,
-    accessToken,
-    refreshToken,
-    expiresAt: expiryUnix(grant),
-    name,
-    email,
-  });
-
-  log("");
-  log("=".repeat(60));
-  log("✅ 登录完成！");
-  log(`   UID: ${uid}`);
-  log(`   账号数: ${saved.accounts}${saved.updated ? "（旧号凭证已更新）" : ""}`);
-  log(`   数据文件: ${saved.file}`);
-  log("=".repeat(60));
-  // 安全默认：allowAny 关 + 只放 3 个实测模型（与 qoder 惯例故意不同，见 ADR-0037）
-  try {
-    const { saveProviderAllowAnyModels, saveProviderAllowedModels } = await import("../../../state.js");
-    saveProviderAllowAnyModels("qwenwork", false);
-    saveProviderAllowedModels("qwenwork", ["flash", "pro", "qwen3.8-max-preview"]);
-    log("   allowAnyModels=off + allowlist 已种 flash/pro/qwen3.8-max-preview（额度池供应商，防 auto 烧分）");
-  } catch {}
-  // 额度展示
-  try {
-    const ctx = await accountContext(accessToken, fetchImpl);
-    const plan = ctx?.plan || {};
-    const quota = ctx?.quota || {};
-    if (plan?.name || quota?.remaining !== undefined) {
-      log(`   套餐: ${plan?.name || "-"}  积分剩余: ${quota?.remaining ?? "-"}`);
-    }
-  } catch {
-    log("   额度查询失败，不影响使用");
-  }
-
-  log("下一步：");
-  log("  mslxdff -provider qwenwork models                  列模型列表");
-  log("  mslxdff -restart（用户终端跑）                       重启网关使新账号生效");
-  log("  然后 curl http://localhost:8989/v1/chat/completions -d '{\"model\":\"qwenwork/flash\",\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}'");
-  log("");
-  log("多账号：重复 `mslxdff -provider qwenwork login` 追加，每号独立 uid，对话自动轮换");
-
-  if (!deps.noExit) process.exit(0);
-  return true;
-}
+// mslxdff -provider qwenwork login — 千问办公设备授权（PKCE + poll），对齐 qoder-login。
+// 授权后落盘 auths/qwenwork-<uid>.json + state 双写，默认 allowAny=false 并种 3 个实测模型（ADR-0037）。
+import { compatFetch } from "../../../compat.js";
+import { normalizeProviderId } from "../../../providers/model-id.js";
+import { newDeviceFlow, pollGrant, userInfo, accountContext, expiryUnix } from "../../../providers/qwenwork/upstream.js";
+
+const POLL_MS = 3000;
+const POLL_TIMEOUT_MS = 10 * 60 * 1000;
+
+export async function handleQwenworkLogin(id, sub, rest = [], deps = {}) {
+  if (normalizeProviderId(id) !== "qwenwork") return false;
+  if (sub !== "login" && sub !== "auth" && sub !== "oauth") return false;
+  const fetchImpl = deps.fetchImpl || compatFetch;
+  const log = deps.log || ((m) => console.log(m));
+
+  const flow = await newDeviceFlow();
+  log("=".repeat(60));
+  log("  千问办公（QwenWork）登录");
+  log("=".repeat(60));
+  log("");
+  log("  1. 在浏览器打开下面链接，用已登录千问办公的账号确认授权");
+  log("  2. 授权成功后会自动完成，不要关闭本终端");
+  log("");
+  log(`  ${flow.url}`);
+  log("");
+  log("🔄 等待你授权（自动轮询，每 3 秒，最多 10 分钟）...");
+
+  const deadline = Date.now() + POLL_TIMEOUT_MS;
+  let grant = null;
+  for (;;) {
+    if (Date.now() > deadline) {
+      console.error("\n❌ 授权超时（10 分钟），请重新运行 mslxdff -provider qwenwork login");
+      process.exit(1);
+    }
+    let outcome;
+    try {
+      outcome = await pollGrant(flow.nonce, flow.verifier, fetchImpl);
+    } catch (e) {
+      console.error(`\n❌ 轮询失败: ${e.message}`);
+      process.exit(1);
+    }
+    if (!outcome.pending) { grant = outcome.grant; break; }
+    try { process.stdout.write("."); } catch {}
+    await new Promise((r) => setTimeout(r, POLL_MS));
+  }
+  const accessToken = grant.token || grant.device_token;
+  const refreshToken = grant.refresh_token || "";
+  if (!accessToken) {
+    console.error("\n❌ 未获取到 token");
+    process.exit(1);
+  }
+  log(`\n✅ 授权成功！token=${String(accessToken).slice(0, 12)}...`);
+  if (refreshToken) log(`    refreshToken=${String(refreshToken).slice(0, 12)}...`);
+
+  let uid = String(grant.user_id || "");
+  let name = String(grant.user_name || "");
+  let email = "";
+  try {
+    const info = await userInfo(accessToken, fetchImpl);
+    if (info?.id) uid = String(info.id);
+    if (info?.name) name = String(info.name);
+    if (info?.email) email = String(info.email);
+    log(`    UID: ${uid}  昵称: ${name || "(空)"}  邮箱: ${email || "(空)"}`);
+  } catch (e) {
+    log(`    ⚠️ userinfo 失败: ${e.message}（用 grant 兜底）`);
+    if (!uid) uid = String(accessToken).slice(0, 8);
+  }
+  if (!uid) {
+    console.error("❌ 无法获取用户标识");
+    process.exit(1);
+  }
+
+  const { saveQwenworkAccount } = await import("../../../providers/qwenwork/account-store.js");
+  const save = deps.saveAccount || saveQwenworkAccount;
+  const saved = await save({
+    uid,
+    accessToken,
+    refreshToken,
+    expiresAt: expiryUnix(grant),
+    name,
+    email,
+  });
+
+  log("");
+  log("=".repeat(60));
+  log("✅ 登录完成！");
+  log(`   UID: ${uid}`);
+  log(`   账号数: ${saved.accounts}${saved.updated ? "（旧号凭证已更新）" : ""}`);
+  log(`   数据文件: ${saved.file}`);
+  log("=".repeat(60));
+  // 安全默认：allowAny 关 + 只放 3 个实测模型（与 qoder 惯例故意不同，见 ADR-0037）
+  try {
+    const { saveProviderAllowAnyModels, saveProviderAllowedModels } = await import("../../../state.js");
+    saveProviderAllowAnyModels("qwenwork", false);
+    saveProviderAllowedModels("qwenwork", ["flash", "pro", "qwen3.8-max-preview"]);
+    log("   allowAnyModels=off + allowlist 已种 flash/pro/qwen3.8-max-preview（额度池供应商，防 auto 烧分）");
+  } catch {}
+  // 额度展示
+  try {
+    const ctx = await accountContext(accessToken, fetchImpl);
+    const plan = ctx?.plan || {};
+    const quota = ctx?.quota || {};
+    if (plan?.name || quota?.remaining !== undefined) {
+      log(`   套餐: ${plan?.name || "-"}  积分剩余: ${quota?.remaining ?? "-"}`);
+    }
+  } catch {
+    log("   额度查询失败，不影响使用");
+  }
+
+  log("下一步：");
+  log("  mslxdff -provider qwenwork models                  列模型列表");
+  log("  mslxdff -restart（用户终端跑）                       重启网关使新账号生效");
+  log("  然后 curl http://localhost:8989/v1/chat/completions -d '{\"model\":\"qwenwork/flash\",\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}'");
+  log("");
+  log("多账号：重复 `mslxdff -provider qwenwork login` 追加，每号独立 uid，对话自动轮换");
+
+  if (!deps.noExit) process.exit(0);
+  return true;
+}