mslxdff 0.1.197 → 0.1.199

package/src/cli/commands/provider/models.js

@@ -1,145 +1,145 @@
-import { join } from "node:path";
-import { defaultStateFile } from "../../../state.js";
-import { logDir } from "../../../logs.js";
-import { normalizeProviderId } from "../../../providers/model-id.js";
-
-export async function handleProviderModels(id, sub, args, rest) {
-  if (!(sub === "models" || sub === "show-models" || sub === "list-models" || sub === "ls")) return false;
-  // 供应商 id 归一（clinebot/cline-bot → cline）：老脚本 `-provider clinebot models` 仍走 cline 直查
-  id = normalizeProviderId(id);
-  const { loadProviderConfig, loadProviderKeys, isModelAllowed } = await import("../../../state.js");
-  const wantsJson = args.includes("--json") || args.includes("-json");
-  const cfg = loadProviderConfig(id);
-  if (id === "opencode" || id === "oc") {
-    try {
-      const cacheFile = join(logDir(), "models.json");
-      const { readFileSync } = await import("node:fs");
-      const raw = JSON.parse(readFileSync(cacheFile, "utf8"));
-      const ids = (raw.data || []).map((m) => m.id).filter((x) => !String(x).includes("/"));
-      if (wantsJson) {
-        console.log(JSON.stringify({ object: "list", data: ids.map((id) => ({ id, object: "model" })) }, null, 2));
-      } else {
-        console.log(`opencode models (${ids.length}):`);
-        for (const mid of ids) console.log(`  ${mid}`);
-      }
-    } catch (e) {
-      console.error(`could not read models cache: ${String(e?.message || e)}`);
-      process.exit(1);
-    }
-    process.exit(0);
-  }
-  try {
-    const { createGenericProvider } = await import("../../../providers/generic.js");
-    const { createWorkbuddyProvider } = await import("../../../providers/workbuddy.js");
-    const baseUrl = cfg?.baseUrl || (id === "workbuddy" ? "https://copilot.tencent.com" : "");
-    const keys = loadProviderKeys(id);
-    const auths = cfg?.auths || [];
-    let provider;
-    if (id === "workbuddy") {
-      provider = createWorkbuddyProvider({ baseUrl, apiKeys: keys, auths, file: defaultStateFile() });
-    } else if (id === "cline") {
-      // 与聚合目录同源：recommended-models 的 free（generic 的 /api/v1/models 是全量目录，含大量不可用条目）
-      const { createClineProvider } = await import("../../../providers/cline.js");
-      provider = createClineProvider({ id, baseUrl: baseUrl || undefined, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "codearts") {
-      const { createCodeartsProvider } = await import("../../../providers/codearts.js");
-      provider = createCodeartsProvider({ baseUrl: baseUrl || undefined, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "traework") {
-      const { createTraeworkProvider } = await import("../../../providers/traework.js");
-      provider = createTraeworkProvider({ baseUrl: baseUrl || undefined, apiKeys: keys, auths, file: defaultStateFile() });
-    } else if (id === "qoder") {
-      const { createQoderProvider } = await import("../../../providers/qoder/index.js");
-      provider = createQoderProvider({ id, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "qwenwork") {
-      const { createQwenworkProvider } = await import("../../../providers/qwenwork/index.js");
-      provider = createQwenworkProvider({ id, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "globalqwenwork") {
-      const { createGlobalQwenworkProvider } = await import("../../../providers/globalqwenwork/index.js");
-      provider = createGlobalQwenworkProvider({ id, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "zcode") {
-      const { createZcodeProvider } = await import("../../../providers/zcode/index.js");
-      provider = createZcodeProvider({ id, apiKeys: keys, file: defaultStateFile() });
-    } else if (id === "raccoon") {
-      const { createRaccoonProvider } = await import("../../../providers/raccoon/index.js");
-      provider = createRaccoonProvider({ id, apiKeys: keys, file: defaultStateFile() });
-    } else {
-      if (!baseUrl) {
-        console.error(`provider ${id}: missing baseUrl — set via: mslxdff -provider ${id} set-url <baseUrl>`);
-        process.exit(1);
-      }
-      provider = createGenericProvider({ id, baseUrl, apiKeys: keys, file: defaultStateFile() });
-    }
-    const all = await provider.listModels();
-    const markAllowed = (mid) => {
-      const raw = String(mid || "").includes("/") ? String(mid).split("/").slice(1).join("/") : String(mid);
-      const checkRaw = mid.startsWith(`${id}/`) ? mid.slice(id.length + 1) : raw;
-      return isModelAllowed(id, checkRaw);
-    };
-    if (wantsJson) {
-      const filtered = all.filter((m) => markAllowed(m.id));
-      console.log(JSON.stringify({ object: "list", data: filtered }, null, 2));
-    } else {
-      const allowedCount = all.filter((m) => markAllowed(m.id)).length;
-      console.log(`${id} models (${all.length} total, ${allowedCount} ✓ allowed${allowedCount !== all.length ? `, ${all.length - allowedCount} x blocked by allowlist` : ""}):`);
-      const fmtPrice = (m) => {
-        const c = String(m.credits || "").trim();
-        if (c) {
-          const m0 = c.match(/x\s*([\d.]+)/i);
-          if (m0) return `x${m0[1]}`;
-          return c.replace(/\s*credits\s*/gi, "").trim().replace(/\s+/g, " ");
-        }
-        if (m.pricing && typeof m.pricing === "object") {
-          const p = m.pricing.prompt ?? m.pricing.input ?? m.pricing.completion ?? "";
-          if (p) return String(p);
-        }
-        if (m.price_factor != null && String(m.price_factor).trim() !== "") return `x${m.price_factor}`;
-        if (m.price != null && String(m.price).trim()) return String(m.price).trim();
-        if (String(m.id).endsWith("/auto")) return "浮动";
-        return "—";
-      };
-      const fmtBadge = (m) => {
-        const tags = Array.isArray(m.tags) ? m.tags : [];
-        const b = tags.find((t) => String(t).includes("限时免费") || String(t).toLowerCase().includes("free"));
-        if (!b) return "";
-        const part = String(b).split(":")[1];
-        return part ? ` [${part}]` : ` [${b}]`;
-      };
-      // 能力列：上下文 k + 📷识图 🧠推理 🔧工具调用（workbuddy 原生字段；其他供应商无这些字段则显示 —）
-      const fmtCaps = (m) => {
-        const ctx = Number(m.maxInputTokens ?? m.context_length) || null;
-        const reasoning = m.supportsReasoning ?? m.is_reasoning;
-        const hasAny = ctx || m.supportsImages != null || reasoning != null || m.supportsToolCall != null;
-        if (!hasAny) return "—";
-        const parts = [];
-        if (ctx) parts.push(ctx >= 1_000_000 ? `${Math.round(ctx / 100000) / 10}M` : `${Math.round(ctx / 1000)}k`);
-        if (m.supportsImages && !m.disabledMultimodal) parts.push("📷");
-        if (reasoning) parts.push("🧠");
-        if (m.supportsToolCall) parts.push("🔧");
-        return parts.join(" ");
-      };
-      const idW = Math.max(22, ...all.map((m) => String(m.id).length)) + 2;
-      const priceW = Math.max(6, ...all.map((m) => fmtPrice(m).length)) + 2;
-      const capsW = Math.max(4, ...all.map((m) => fmtCaps(m).length)) + 2;
-      for (const m of all) {
-        const ok = markAllowed(m.id);
-        const price = fmtPrice(m);
-        const badge = fmtBadge(m);
-        const name = m.name ? ` ${m.name}` : "";
-        const blocked = ok ? "" : "  [blocked — allowlist]";
-        const line = `  ${ok ? "✓" : "x"} ${String(m.id).padEnd(idW)}${String(price).padEnd(priceW)}${fmtCaps(m).padEnd(capsW)}${name}${badge}${blocked}`;
-        console.log(line);
-      }
-      if (!all.length) console.log(`  (no models — check baseUrl/keys or try: curl ${baseUrl}/models)`);
-      else if (allowedCount === 0) console.log(`  tip: all blocked — mslxdff -provider ${id} allowAny on  或  allowlist set <model...>`);
-      else if (allowedCount !== all.length) console.log(`  tip: blocked 仅影响 /v1/chat 调用，展示已全量列出`);
-      if (id === "zcode") {
-        console.log(`  tip: 目录/额度/模型调用全通（上游 v3.14.4 起模型请求免验证码，docs/adr/0038）；额度耗尽返回 429 quota_exhausted，按日窗口重置`);
-      }
-    }
-    try { await provider.close?.(); } catch {}
-  } catch (e) {
-    console.error(`could not list ${id} models: ${String(e?.message || e)}`);
-    process.exit(1);
-  }
-  process.exit(0);
-}
+import { join } from "node:path";
+import { defaultStateFile } from "../../../state.js";
+import { logDir } from "../../../logs.js";
+import { normalizeProviderId } from "../../../providers/model-id.js";
+
+export async function handleProviderModels(id, sub, args, rest) {
+  if (!(sub === "models" || sub === "show-models" || sub === "list-models" || sub === "ls")) return false;
+  // 供应商 id 归一（clinebot/cline-bot → cline）：老脚本 `-provider clinebot models` 仍走 cline 直查
+  id = normalizeProviderId(id);
+  const { loadProviderConfig, loadProviderKeys, isModelAllowed } = await import("../../../state.js");
+  const wantsJson = args.includes("--json") || args.includes("-json");
+  const cfg = loadProviderConfig(id);
+  if (id === "opencode" || id === "oc") {
+    try {
+      const cacheFile = join(logDir(), "models.json");
+      const { readFileSync } = await import("node:fs");
+      const raw = JSON.parse(readFileSync(cacheFile, "utf8"));
+      const ids = (raw.data || []).map((m) => m.id).filter((x) => !String(x).includes("/"));
+      if (wantsJson) {
+        console.log(JSON.stringify({ object: "list", data: ids.map((id) => ({ id, object: "model" })) }, null, 2));
+      } else {
+        console.log(`opencode models (${ids.length}):`);
+        for (const mid of ids) console.log(`  ${mid}`);
+      }
+    } catch (e) {
+      console.error(`could not read models cache: ${String(e?.message || e)}`);
+      process.exit(1);
+    }
+    process.exit(0);
+  }
+  try {
+    const { createGenericProvider } = await import("../../../providers/generic.js");
+    const { createWorkbuddyProvider } = await import("../../../providers/workbuddy.js");
+    const baseUrl = cfg?.baseUrl || (id === "workbuddy" ? "https://copilot.tencent.com" : "");
+    const keys = loadProviderKeys(id);
+    const auths = cfg?.auths || [];
+    let provider;
+    if (id === "workbuddy") {
+      provider = createWorkbuddyProvider({ baseUrl, apiKeys: keys, auths, file: defaultStateFile() });
+    } else if (id === "cline") {
+      // 与聚合目录同源：recommended-models 的 free（generic 的 /api/v1/models 是全量目录，含大量不可用条目）
+      const { createClineProvider } = await import("../../../providers/cline.js");
+      provider = createClineProvider({ id, baseUrl: baseUrl || undefined, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "codearts") {
+      const { createCodeartsProvider } = await import("../../../providers/codearts.js");
+      provider = createCodeartsProvider({ baseUrl: baseUrl || undefined, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "traework") {
+      const { createTraeworkProvider } = await import("../../../providers/traework.js");
+      provider = createTraeworkProvider({ baseUrl: baseUrl || undefined, apiKeys: keys, auths, file: defaultStateFile() });
+    } else if (id === "qoder") {
+      const { createQoderProvider } = await import("../../../providers/qoder/index.js");
+      provider = createQoderProvider({ id, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "qwenwork") {
+      const { createQwenworkProvider } = await import("../../../providers/qwenwork/index.js");
+      provider = createQwenworkProvider({ id, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "globalqwenwork") {
+      const { createGlobalQwenworkProvider } = await import("../../../providers/globalqwenwork/index.js");
+      provider = createGlobalQwenworkProvider({ id, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "zcode") {
+      const { createZcodeProvider } = await import("../../../providers/zcode/index.js");
+      provider = createZcodeProvider({ id, apiKeys: keys, file: defaultStateFile() });
+    } else if (id === "raccoon") {
+      const { createRaccoonProvider } = await import("../../../providers/raccoon/index.js");
+      provider = createRaccoonProvider({ id, apiKeys: keys, file: defaultStateFile() });
+    } else {
+      if (!baseUrl) {
+        console.error(`provider ${id}: missing baseUrl — set via: mslxdff -provider ${id} set-url <baseUrl>`);
+        process.exit(1);
+      }
+      provider = createGenericProvider({ id, baseUrl, apiKeys: keys, file: defaultStateFile() });
+    }
+    const all = await provider.listModels();
+    const markAllowed = (mid) => {
+      const raw = String(mid || "").includes("/") ? String(mid).split("/").slice(1).join("/") : String(mid);
+      const checkRaw = mid.startsWith(`${id}/`) ? mid.slice(id.length + 1) : raw;
+      return isModelAllowed(id, checkRaw);
+    };
+    if (wantsJson) {
+      const filtered = all.filter((m) => markAllowed(m.id));
+      console.log(JSON.stringify({ object: "list", data: filtered }, null, 2));
+    } else {
+      const allowedCount = all.filter((m) => markAllowed(m.id)).length;
+      console.log(`${id} models (${all.length} total, ${allowedCount} ✓ allowed${allowedCount !== all.length ? `, ${all.length - allowedCount} x blocked by allowlist` : ""}):`);
+      const fmtPrice = (m) => {
+        const c = String(m.credits || "").trim();
+        if (c) {
+          const m0 = c.match(/x\s*([\d.]+)/i);
+          if (m0) return `x${m0[1]}`;
+          return c.replace(/\s*credits\s*/gi, "").trim().replace(/\s+/g, " ");
+        }
+        if (m.pricing && typeof m.pricing === "object") {
+          const p = m.pricing.prompt ?? m.pricing.input ?? m.pricing.completion ?? "";
+          if (p) return String(p);
+        }
+        if (m.price_factor != null && String(m.price_factor).trim() !== "") return `x${m.price_factor}`;
+        if (m.price != null && String(m.price).trim()) return String(m.price).trim();
+        if (String(m.id).endsWith("/auto")) return "浮动";
+        return "—";
+      };
+      const fmtBadge = (m) => {
+        const tags = Array.isArray(m.tags) ? m.tags : [];
+        const b = tags.find((t) => String(t).includes("限时免费") || String(t).toLowerCase().includes("free"));
+        if (!b) return "";
+        const part = String(b).split(":")[1];
+        return part ? ` [${part}]` : ` [${b}]`;
+      };
+      // 能力列：上下文 k + 📷识图 🧠推理 🔧工具调用（workbuddy 原生字段；其他供应商无这些字段则显示 —）
+      const fmtCaps = (m) => {
+        const ctx = Number(m.maxInputTokens ?? m.context_length) || null;
+        const reasoning = m.supportsReasoning ?? m.is_reasoning;
+        const hasAny = ctx || m.supportsImages != null || reasoning != null || m.supportsToolCall != null;
+        if (!hasAny) return "—";
+        const parts = [];
+        if (ctx) parts.push(ctx >= 1_000_000 ? `${Math.round(ctx / 100000) / 10}M` : `${Math.round(ctx / 1000)}k`);
+        if (m.supportsImages && !m.disabledMultimodal) parts.push("📷");
+        if (reasoning) parts.push("🧠");
+        if (m.supportsToolCall) parts.push("🔧");
+        return parts.join(" ");
+      };
+      const idW = Math.max(22, ...all.map((m) => String(m.id).length)) + 2;
+      const priceW = Math.max(6, ...all.map((m) => fmtPrice(m).length)) + 2;
+      const capsW = Math.max(4, ...all.map((m) => fmtCaps(m).length)) + 2;
+      for (const m of all) {
+        const ok = markAllowed(m.id);
+        const price = fmtPrice(m);
+        const badge = fmtBadge(m);
+        const name = m.name ? ` ${m.name}` : "";
+        const blocked = ok ? "" : "  [blocked — allowlist]";
+        const line = `  ${ok ? "✓" : "x"} ${String(m.id).padEnd(idW)}${String(price).padEnd(priceW)}${fmtCaps(m).padEnd(capsW)}${name}${badge}${blocked}`;
+        console.log(line);
+      }
+      if (!all.length) console.log(`  (no models — check baseUrl/keys or try: curl ${baseUrl}/models)`);
+      else if (allowedCount === 0) console.log(`  tip: all blocked — mslxdff -provider ${id} allowAny on  或  allowlist set <model...>`);
+      else if (allowedCount !== all.length) console.log(`  tip: blocked 仅影响 /v1/chat 调用，展示已全量列出`);
+      if (id === "zcode") {
+        console.log(`  tip: 目录/额度/模型调用全通（上游 v3.14.4 起模型请求免验证码，docs/adr/0038）；额度耗尽返回 429 quota_exhausted，按日窗口重置`);
+      }
+    }
+    try { await provider.close?.(); } catch {}
+  } catch (e) {
+    console.error(`could not list ${id} models: ${String(e?.message || e)}`);
+    process.exit(1);
+  }
+  process.exit(0);
+}

package/src/cli/commands/provider/qwenwork-login.js

@@ -1,119 +1,119 @@
-// mslxdff -provider qwenwork login — 千问办公设备授权（PKCE + poll），对齐 qoder-login。
-// 授权后落盘 auths/qwenwork-<uid>.json + state 双写，默认 allowAny=false 并种 3 个实测模型（ADR-0037）。
-import { compatFetch } from "../../../compat.js";
-import { normalizeProviderId } from "../../../providers/model-id.js";
-import { newDeviceFlow, pollGrant, userInfo, accountContext, expiryUnix } from "../../../providers/qwenwork/upstream.js";
-
-const POLL_MS = 3000;
-const POLL_TIMEOUT_MS = 10 * 60 * 1000;
-
-export async function handleQwenworkLogin(id, sub, rest = [], deps = {}) {
-  if (normalizeProviderId(id) !== "qwenwork") return false;
-  if (sub !== "login" && sub !== "auth" && sub !== "oauth") return false;
-  const fetchImpl = deps.fetchImpl || compatFetch;
-  const log = deps.log || ((m) => console.log(m));
-
-  const flow = await newDeviceFlow();
-  log("=".repeat(60));
-  log("  千问办公（QwenWork）登录");
-  log("=".repeat(60));
-  log("");
-  log("  1. 在浏览器打开下面链接，用已登录千问办公的账号确认授权");
-  log("  2. 授权成功后会自动完成，不要关闭本终端");
-  log("");
-  log(`  ${flow.url}`);
-  log("");
-  log("🔄 等待你授权（自动轮询，每 3 秒，最多 10 分钟）...");
-
-  const deadline = Date.now() + POLL_TIMEOUT_MS;
-  let grant = null;
-  for (;;) {
-    if (Date.now() > deadline) {
-      console.error("\n❌ 授权超时（10 分钟），请重新运行 mslxdff -provider qwenwork login");
-      process.exit(1);
-    }
-    let outcome;
-    try {
-      outcome = await pollGrant(flow.nonce, flow.verifier, fetchImpl);
-    } catch (e) {
-      console.error(`\n❌ 轮询失败: ${e.message}`);
-      process.exit(1);
-    }
-    if (!outcome.pending) { grant = outcome.grant; break; }
-    try { process.stdout.write("."); } catch {}
-    await new Promise((r) => setTimeout(r, POLL_MS));
-  }
-  const accessToken = grant.token || grant.device_token;
-  const refreshToken = grant.refresh_token || "";
-  if (!accessToken) {
-    console.error("\n❌ 未获取到 token");
-    process.exit(1);
-  }
-  log(`\n✅ 授权成功！token=${String(accessToken).slice(0, 12)}...`);
-  if (refreshToken) log(`    refreshToken=${String(refreshToken).slice(0, 12)}...`);
-
-  let uid = String(grant.user_id || "");
-  let name = String(grant.user_name || "");
-  let email = "";
-  try {
-    const info = await userInfo(accessToken, fetchImpl);
-    if (info?.id) uid = String(info.id);
-    if (info?.name) name = String(info.name);
-    if (info?.email) email = String(info.email);
-    log(`    UID: ${uid}  昵称: ${name || "(空)"}  邮箱: ${email || "(空)"}`);
-  } catch (e) {
-    log(`    ⚠️ userinfo 失败: ${e.message}（用 grant 兜底）`);
-    if (!uid) uid = String(accessToken).slice(0, 8);
-  }
-  if (!uid) {
-    console.error("❌ 无法获取用户标识");
-    process.exit(1);
-  }
-
-  const { saveQwenworkAccount } = await import("../../../providers/qwenwork/account-store.js");
-  const save = deps.saveAccount || saveQwenworkAccount;
-  const saved = await save({
-    uid,
-    accessToken,
-    refreshToken,
-    expiresAt: expiryUnix(grant),
-    name,
-    email,
-  });
-
-  log("");
-  log("=".repeat(60));
-  log("✅ 登录完成！");
-  log(`   UID: ${uid}`);
-  log(`   账号数: ${saved.accounts}${saved.updated ? "（旧号凭证已更新）" : ""}`);
-  log(`   数据文件: ${saved.file}`);
-  log("=".repeat(60));
-  // 安全默认：allowAny 关 + 只放 3 个实测模型（与 qoder 惯例故意不同，见 ADR-0037）
-  try {
-    const { saveProviderAllowAnyModels, saveProviderAllowedModels } = await import("../../../state.js");
-    saveProviderAllowAnyModels("qwenwork", false);
-    saveProviderAllowedModels("qwenwork", ["flash", "pro", "qwen3.8-max-preview"]);
-    log("   allowAnyModels=off + allowlist 已种 flash/pro/qwen3.8-max-preview（额度池供应商，防 auto 烧分）");
-  } catch {}
-  // 额度展示
-  try {
-    const ctx = await accountContext(accessToken, fetchImpl);
-    const plan = ctx?.plan || {};
-    const quota = ctx?.quota || {};
-    if (plan?.name || quota?.remaining !== undefined) {
-      log(`   套餐: ${plan?.name || "-"}  积分剩余: ${quota?.remaining ?? "-"}`);
-    }
-  } catch {
-    log("   额度查询失败，不影响使用");
-  }
-
-  log("下一步：");
-  log("  mslxdff -provider qwenwork models                  列模型列表");
-  log("  mslxdff -restart（用户终端跑）                       重启网关使新账号生效");
-  log("  然后 curl http://localhost:8989/v1/chat/completions -d '{\"model\":\"qwenwork/flash\",\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}'");
-  log("");
-  log("多账号：重复 `mslxdff -provider qwenwork login` 追加，每号独立 uid，对话自动轮换");
-
-  if (!deps.noExit) process.exit(0);
-  return true;
-}
+// mslxdff -provider qwenwork login — 千问办公设备授权（PKCE + poll），对齐 qoder-login。
+// 授权后落盘 auths/qwenwork-<uid>.json + state 双写，默认 allowAny=false 并种 3 个实测模型（ADR-0037）。
+import { compatFetch } from "../../../compat.js";
+import { normalizeProviderId } from "../../../providers/model-id.js";
+import { newDeviceFlow, pollGrant, userInfo, accountContext, expiryUnix } from "../../../providers/qwenwork/upstream.js";
+
+const POLL_MS = 3000;
+const POLL_TIMEOUT_MS = 10 * 60 * 1000;
+
+export async function handleQwenworkLogin(id, sub, rest = [], deps = {}) {
+  if (normalizeProviderId(id) !== "qwenwork") return false;
+  if (sub !== "login" && sub !== "auth" && sub !== "oauth") return false;
+  const fetchImpl = deps.fetchImpl || compatFetch;
+  const log = deps.log || ((m) => console.log(m));
+
+  const flow = await newDeviceFlow();
+  log("=".repeat(60));
+  log("  千问办公（QwenWork）登录");
+  log("=".repeat(60));
+  log("");
+  log("  1. 在浏览器打开下面链接，用已登录千问办公的账号确认授权");
+  log("  2. 授权成功后会自动完成，不要关闭本终端");
+  log("");
+  log(`  ${flow.url}`);
+  log("");
+  log("🔄 等待你授权（自动轮询，每 3 秒，最多 10 分钟）...");
+
+  const deadline = Date.now() + POLL_TIMEOUT_MS;
+  let grant = null;
+  for (;;) {
+    if (Date.now() > deadline) {
+      console.error("\n❌ 授权超时（10 分钟），请重新运行 mslxdff -provider qwenwork login");
+      process.exit(1);
+    }
+    let outcome;
+    try {
+      outcome = await pollGrant(flow.nonce, flow.verifier, fetchImpl);
+    } catch (e) {
+      console.error(`\n❌ 轮询失败: ${e.message}`);
+      process.exit(1);
+    }
+    if (!outcome.pending) { grant = outcome.grant; break; }
+    try { process.stdout.write("."); } catch {}
+    await new Promise((r) => setTimeout(r, POLL_MS));
+  }
+  const accessToken = grant.token || grant.device_token;
+  const refreshToken = grant.refresh_token || "";
+  if (!accessToken) {
+    console.error("\n❌ 未获取到 token");
+    process.exit(1);
+  }
+  log(`\n✅ 授权成功！token=${String(accessToken).slice(0, 12)}...`);
+  if (refreshToken) log(`    refreshToken=${String(refreshToken).slice(0, 12)}...`);
+
+  let uid = String(grant.user_id || "");
+  let name = String(grant.user_name || "");
+  let email = "";
+  try {
+    const info = await userInfo(accessToken, fetchImpl);
+    if (info?.id) uid = String(info.id);
+    if (info?.name) name = String(info.name);
+    if (info?.email) email = String(info.email);
+    log(`    UID: ${uid}  昵称: ${name || "(空)"}  邮箱: ${email || "(空)"}`);
+  } catch (e) {
+    log(`    ⚠️ userinfo 失败: ${e.message}（用 grant 兜底）`);
+    if (!uid) uid = String(accessToken).slice(0, 8);
+  }
+  if (!uid) {
+    console.error("❌ 无法获取用户标识");
+    process.exit(1);
+  }
+
+  const { saveQwenworkAccount } = await import("../../../providers/qwenwork/account-store.js");
+  const save = deps.saveAccount || saveQwenworkAccount;
+  const saved = await save({
+    uid,
+    accessToken,
+    refreshToken,
+    expiresAt: expiryUnix(grant),
+    name,
+    email,
+  });
+
+  log("");
+  log("=".repeat(60));
+  log("✅ 登录完成！");
+  log(`   UID: ${uid}`);
+  log(`   账号数: ${saved.accounts}${saved.updated ? "（旧号凭证已更新）" : ""}`);
+  log(`   数据文件: ${saved.file}`);
+  log("=".repeat(60));
+  // 安全默认：allowAny 关 + 只放 3 个实测模型（与 qoder 惯例故意不同，见 ADR-0037）
+  try {
+    const { saveProviderAllowAnyModels, saveProviderAllowedModels } = await import("../../../state.js");
+    saveProviderAllowAnyModels("qwenwork", false);
+    saveProviderAllowedModels("qwenwork", ["flash", "pro", "qwen3.8-max-preview"]);
+    log("   allowAnyModels=off + allowlist 已种 flash/pro/qwen3.8-max-preview（额度池供应商，防 auto 烧分）");
+  } catch {}
+  // 额度展示
+  try {
+    const ctx = await accountContext(accessToken, fetchImpl);
+    const plan = ctx?.plan || {};
+    const quota = ctx?.quota || {};
+    if (plan?.name || quota?.remaining !== undefined) {
+      log(`   套餐: ${plan?.name || "-"}  积分剩余: ${quota?.remaining ?? "-"}`);
+    }
+  } catch {
+    log("   额度查询失败，不影响使用");
+  }
+
+  log("下一步：");
+  log("  mslxdff -provider qwenwork models                  列模型列表");
+  log("  mslxdff -restart（用户终端跑）                       重启网关使新账号生效");
+  log("  然后 curl http://localhost:8989/v1/chat/completions -d '{\"model\":\"qwenwork/flash\",\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}'");
+  log("");
+  log("多账号：重复 `mslxdff -provider qwenwork login` 追加，每号独立 uid，对话自动轮换");
+
+  if (!deps.noExit) process.exit(0);
+  return true;
+}

package/src/cli/commands/provider/raccoon-login.js

@@ -27,6 +27,15 @@ const RELOGIN_HINT = "   （可重试：mslxdff -provider raccoon login）";
 export async function handleRaccoonLogin(id, sub, rest = [], deps = {}) {
   const pid = normalizeProviderId(id) || String(id || "").toLowerCase();
   if (pid !== "raccoon") return false;
+  // `login --password` 走手机号+密码（多账号免扫码）；无该旗标仍是扫码。分派必须在
+  // LOGIN_SUBS 判定之前，且只在此处转交 —— 扫码路径本身零改动。
+  if (LOGIN_SUBS.has(sub) && rest.some((x) => {
+    const s = String(x);
+    return s === "--password" || s.startsWith("--password=") || s === "-p" || s === "--phone" || s.startsWith("--phone=");
+  })) {
+    const { handleRaccoonPasswordLogin } = await import("./raccoon-password.js");
+    return handleRaccoonPasswordLogin(id, sub, rest, deps);
+  }
   if (!LOGIN_SUBS.has(sub)) return false;
 
   const fetchImpl = deps.fetchImpl || compatFetch;
@@ -93,7 +102,25 @@ export async function handleRaccoonLogin(id, sub, rest = [], deps = {}) {
     return true;
   }
 
-  const credential = out.credential;
+  return await finishRaccoonLogin({ credential: out.credential, fetchImpl, deps, log });
+}
+
+/**
+ * 登录成功后的收尾四步（**扫码与密码两条路共用，单一源**）：
+ * confirm 会话 → 取用户信息 → 落盘 + 补 allowlist → 领一次性登录奖励 → 打印回执。
+ *
+ * 抽出来的理由不只是省行数：这四步的顺序有硬约束（必须先 confirm 才能用 token；领奖必须在
+ * access_token 刚签发的窗口内），任何一条路径自己重写一遍都会漏掉其中一步且难以察觉。
+ *
+ * @param {object} a
+ * @param {object} a.credential 已签发的凭据（两种登录方式同形）
+ * @param {Function} a.fetchImpl
+ * @param {object} a.deps 与原 CLI 依赖注入同形（dir/file/deviceId/saveAccount/claimReward/skipReward/env）
+ * @param {Function} a.log
+ * @param {string} [a.methodNote] 登录方式说明行（如密码登录标注手机号），纯展示
+ * @returns {Promise<boolean>} 恒 true（表示「已处理」，交还 CLI 派发链）
+ */
+export async function finishRaccoonLogin({ credential, fetchImpl, deps = {}, log, methodNote = "" }) {
   // 新登录的会话是「未确认」状态：不先 POST /iam/confirm，此后所有业务端点（含下面的领奖励、
   // 以及 daemon 的 chat）都会撞 `400 code 200901 iam_confirm_required`。登录时当场确认一次，
   // 让落盘的凭据从一开始就是可用的；确认失败不阻断（chat.js 有懒重试兜底），只在末尾如实提示。
@@ -134,6 +161,7 @@ export async function handleRaccoonLogin(id, sub, rest = [], deps = {}) {
 
   log("");
   log(`✅ 登录成功！uid=${uid}  昵称=${info.name || "(空)"}  token=${raccoonTokenFingerprint(credential.access_token)}…`);
+  if (methodNote) log(methodNote);
   log(`   凭据: ${saved.file}`);
   if (!confirmed) log("   ⚠ 会话确认（iam/confirm）暂未成功 —— 不影响使用（调用时会自动重试确认），若持续报错请重跑 login");
   if (allow.added.length) log(`   allowlist 已补齐 ${allow.added.length} 个模型：${allow.added.join(", ")}`);