mslxdff 0.1.203 → 0.1.208

package/src/cli/commands/provider/cline-free.js

@@ -1,99 +1,99 @@
-/**
- * mslxdff -provider cline free [sync] [--yes] [--json] [--keep-extra]
- * 只读：直查上游免费目录（公开接口，无凭据）并与当前 allowlist 求差；只有 `free sync --yes` 才写 allowlist。
- * allowlist 存裸 id（不带 cline/ 前缀），与 normalizeAllowedModel 语义一致；落盘走 saveProviderAllowedModels 保留 keys/baseUrl。
- */
-import { normalizeProviderId } from "../../../providers/model-id.js";
-import { fetchFreeCatalog, FALLBACK_FREE, FREE_CATALOG_PATH } from "../../../providers/cline/free-catalog.js";
-
-/** 上游不可达时退回内置兜底目录（标注 source=fallback，供人判断是否该落盘） */
-async function loadCatalog() {
-  const cat = await fetchFreeCatalog({});
-  if (cat.ok) return { ...cat, source: "upstream" };
-  return {
-    ...cat,
-    source: "fallback",
-    models: FALLBACK_FREE.map((m) => ({ ...m })),
-    ids: FALLBACK_FREE.map((m) => m.id),
-  };
-}
-
-function computeNext(current, freeIds, keepExtra) {
-  const next = keepExtra ? [...new Set([...current, ...freeIds])] : [...freeIds];
-  return {
-    next,
-    added: next.filter((m) => !current.includes(m)),
-    removed: current.filter((m) => !next.includes(m)),
-    kept: next.filter((m) => current.includes(m)),
-  };
-}
-
-function renderList(cat, current, next, plan) {
-  console.log(`cline free 目录（GET ${FREE_CATALOG_PATH} → free）：${cat.ids.length} 个${cat.source === "fallback" ? "（内置兜底，上游不可达）" : ""}`);
-  const w = Math.max(20, ...cat.ids.map((s) => s.length)) + 2;
-  for (const m of cat.models) console.log(`   + ${String(m.id).padEnd(w)}${m.name && m.name !== m.id ? m.name : ""}`);
-  console.log(`当前 allowlist：${current.length} 个`);
-  for (const id of current) console.log(`   ${next.includes(id) ? "✓" : "-"} ${id}${next.includes(id) ? "" : "          （不在 free 目录）"}`);
-  console.log(`结果：allowlist ${current.length} → ${next.length}（+${plan.added.length} 新增 / -${plan.removed.length} 移除 / ${plan.kept.length} 保留）`);
-}
-
-export async function handleClineFree(id, sub, rest = [], args = []) {
-  if (normalizeProviderId(id) !== "cline") return false;
-  if (String(sub || "").toLowerCase() !== "free") return false;
-  const isSync = String(rest[1] || "").toLowerCase() === "sync";
-  const wantsJson = args.includes("--json") || args.includes("-json");
-  const yes = args.includes("--yes") || args.includes("-y");
-  const keepExtra = args.includes("--keep-extra");
-
-  const { loadProviderAllowedModels, saveProviderAllowedModels } = await import("../../../state.js");
-  const cat = await loadCatalog();
-  const current = loadProviderAllowedModels("cline");
-  const plan = computeNext(current, cat.ids, keepExtra);
-  // 兜底常量不是上游真相（与 daemon auto-sync 同一口径，ADR-0033）：上游不可达时拒绝写盘，
-  // 否则会把内置 FALLBACK_FREE 落成白名单，且 full-replace 还会挤掉 auto-sync 并入的 clinePass 条目。
-  const fallbackRefused = isSync && yes && cat.source === "fallback";
-  const dryRun = !(isSync && yes) || fallbackRefused;
-  let written = [];
-  if (isSync && !dryRun) {
-    try {
-      written = saveProviderAllowedModels("cline", plan.next);
-    } catch (e) {
-      console.error(`❌ 写入 allowlist 失败: ${String(e?.message || e)}`);
-      process.exit(1);
-    }
-  }
-  const warning = cat.source === "fallback" ? `上游目录不可达（${cat.error || cat.status}），使用内置兜底目录，可能过期` : null;
-
-  if (wantsJson) {
-    console.log(JSON.stringify({
-      provider: "cline",
-      mode: isSync ? "sync" : "list",
-      source: cat.source,
-      url: cat.url,
-      free: cat.ids,
-      current,
-      next: plan.next,
-      added: plan.added,
-      removed: plan.removed,
-      kept: plan.kept,
-      dryRun,
-      written,
-      ...(warning ? { warning } : {}),
-    }, null, 2));
-    process.exit(0);
-  }
-
-  if (warning) console.error(`⚠️  ${warning}`);
-  renderList(cat, current, plan.next, plan);
-  if (!isSync) {
-    console.log(`\n预览（只读）。一键同步：mslxdff -provider cline free sync --yes   ·   只增不删：加 --keep-extra`);
-  } else if (dryRun) {
-    console.log(fallbackRefused
-      ? `\n⛔ 上游目录不可达（${cat.error || cat.status}），已拒绝把内置兜底目录写进白名单——兜底常量不是上游真相（与 daemon auto-sync 同一口径）。待上游恢复后重试；确需手填用：mslxdff -provider cline allowlist set <id...>`
-      : `\n预览模式，未写入。执行：mslxdff -provider cline free sync --yes${keepExtra ? " --keep-extra" : ""}`);
-  } else {
-    console.log(`\n✅ 已写入 allowlist：${written.length} 个（providerConfigs.cline.allowedModels）`);
-    console.log(`   生效：mslxdff -restart（daemon 的 /v1/models 聚合有 10 分钟缓存，重启即刷新）`);
-  }
-  process.exit(0);
-}
+/**
+ * mslxdff -provider cline free [sync] [--yes] [--json] [--keep-extra]
+ * 只读：直查上游免费目录（公开接口，无凭据）并与当前 allowlist 求差；只有 `free sync --yes` 才写 allowlist。
+ * allowlist 存裸 id（不带 cline/ 前缀），与 normalizeAllowedModel 语义一致；落盘走 saveProviderAllowedModels 保留 keys/baseUrl。
+ */
+import { normalizeProviderId } from "../../../providers/model-id.js";
+import { fetchFreeCatalog, FALLBACK_FREE, FREE_CATALOG_PATH } from "../../../providers/cline/free-catalog.js";
+
+/** 上游不可达时退回内置兜底目录（标注 source=fallback，供人判断是否该落盘） */
+async function loadCatalog() {
+  const cat = await fetchFreeCatalog({});
+  if (cat.ok) return { ...cat, source: "upstream" };
+  return {
+    ...cat,
+    source: "fallback",
+    models: FALLBACK_FREE.map((m) => ({ ...m })),
+    ids: FALLBACK_FREE.map((m) => m.id),
+  };
+}
+
+function computeNext(current, freeIds, keepExtra) {
+  const next = keepExtra ? [...new Set([...current, ...freeIds])] : [...freeIds];
+  return {
+    next,
+    added: next.filter((m) => !current.includes(m)),
+    removed: current.filter((m) => !next.includes(m)),
+    kept: next.filter((m) => current.includes(m)),
+  };
+}
+
+function renderList(cat, current, next, plan) {
+  console.log(`cline free 目录（GET ${FREE_CATALOG_PATH} → free）：${cat.ids.length} 个${cat.source === "fallback" ? "（内置兜底，上游不可达）" : ""}`);
+  const w = Math.max(20, ...cat.ids.map((s) => s.length)) + 2;
+  for (const m of cat.models) console.log(`   + ${String(m.id).padEnd(w)}${m.name && m.name !== m.id ? m.name : ""}`);
+  console.log(`当前 allowlist：${current.length} 个`);
+  for (const id of current) console.log(`   ${next.includes(id) ? "✓" : "-"} ${id}${next.includes(id) ? "" : "          （不在 free 目录）"}`);
+  console.log(`结果：allowlist ${current.length} → ${next.length}（+${plan.added.length} 新增 / -${plan.removed.length} 移除 / ${plan.kept.length} 保留）`);
+}
+
+export async function handleClineFree(id, sub, rest = [], args = []) {
+  if (normalizeProviderId(id) !== "cline") return false;
+  if (String(sub || "").toLowerCase() !== "free") return false;
+  const isSync = String(rest[1] || "").toLowerCase() === "sync";
+  const wantsJson = args.includes("--json") || args.includes("-json");
+  const yes = args.includes("--yes") || args.includes("-y");
+  const keepExtra = args.includes("--keep-extra");
+
+  const { loadProviderAllowedModels, saveProviderAllowedModels } = await import("../../../state.js");
+  const cat = await loadCatalog();
+  const current = loadProviderAllowedModels("cline");
+  const plan = computeNext(current, cat.ids, keepExtra);
+  // 兜底常量不是上游真相（与 daemon auto-sync 同一口径，ADR-0033）：上游不可达时拒绝写盘，
+  // 否则会把内置 FALLBACK_FREE 落成白名单，且 full-replace 还会挤掉 auto-sync 并入的 clinePass 条目。
+  const fallbackRefused = isSync && yes && cat.source === "fallback";
+  const dryRun = !(isSync && yes) || fallbackRefused;
+  let written = [];
+  if (isSync && !dryRun) {
+    try {
+      written = saveProviderAllowedModels("cline", plan.next);
+    } catch (e) {
+      console.error(`❌ 写入 allowlist 失败: ${String(e?.message || e)}`);
+      process.exit(1);
+    }
+  }
+  const warning = cat.source === "fallback" ? `上游目录不可达（${cat.error || cat.status}），使用内置兜底目录，可能过期` : null;
+
+  if (wantsJson) {
+    console.log(JSON.stringify({
+      provider: "cline",
+      mode: isSync ? "sync" : "list",
+      source: cat.source,
+      url: cat.url,
+      free: cat.ids,
+      current,
+      next: plan.next,
+      added: plan.added,
+      removed: plan.removed,
+      kept: plan.kept,
+      dryRun,
+      written,
+      ...(warning ? { warning } : {}),
+    }, null, 2));
+    process.exit(0);
+  }
+
+  if (warning) console.error(`⚠️  ${warning}`);
+  renderList(cat, current, plan.next, plan);
+  if (!isSync) {
+    console.log(`\n预览（只读）。一键同步：mslxdff -provider cline free sync --yes   ·   只增不删：加 --keep-extra`);
+  } else if (dryRun) {
+    console.log(fallbackRefused
+      ? `\n⛔ 上游目录不可达（${cat.error || cat.status}），已拒绝把内置兜底目录写进白名单——兜底常量不是上游真相（与 daemon auto-sync 同一口径）。待上游恢复后重试；确需手填用：mslxdff -provider cline allowlist set <id...>`
+      : `\n预览模式，未写入。执行：mslxdff -provider cline free sync --yes${keepExtra ? " --keep-extra" : ""}`);
+  } else {
+    console.log(`\n✅ 已写入 allowlist：${written.length} 个（providerConfigs.cline.allowedModels）`);
+    console.log(`   生效：mslxdff -restart（daemon 的 /v1/models 聚合有 10 分钟缓存，重启即刷新）`);
+  }
+  process.exit(0);
+}

package/src/cli/commands/provider/cline-login.js

@@ -1,218 +1,218 @@
-import { compatFetch, getUndici, timeoutSignal } from "../../../compat.js";
-import { normalizeProviderId } from "../../../providers/model-id.js";
-export async function handleClineLogin(id, sub) {
-  if (sub !== "login" && sub !== "auth" && sub !== "oauth") return false;
-  if (normalizeProviderId(id) !== "cline") return false;
-
-  const CLIENT_ID = "client_01K3A541FN8TA3EPPHTD2325AR";
-  const WORKOS_DEVICE = "https://api.workos.com/user_management/authorize/device";
-  const WORKOS_AUTH = "https://api.workos.com/user_management/authenticate";
-  const CLINE_REGISTER = "https://api.cline.bot/api/v1/auth/register";
-
-  // 网络层：支持代理（读环境变量）+ 超时 + 人话报错。
-  // 直连 api.workos.com 在部分网络下 TCP 会被墙（DNS 通但 443 超时），此时必须走代理。
-  const PROXY_URL = (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || "").trim();
-  let dispatcher = null;
-  if (PROXY_URL) {
-    try {
-      const { ProxyAgent } = getUndici();
-      dispatcher = new ProxyAgent(PROXY_URL);
-    } catch (e) {
-      console.error(`⚠️ 代理变量 ${PROXY_URL} 不可用（${e.message}），回退直连`);
-    }
-  }
-  function netHint(e, url) {
-    const host = (() => { try { return new URL(url).host; } catch { return url; } })();
-    const cause = e?.cause || e;
-    const code = cause?.code || cause?.name || "";
-    if (code === "ENOTFOUND" || code === "EAI_AGAIN") return `DNS 解析失败（${host}），检查 DNS/网络`;
-    if (code === "ECONNREFUSED") return `连接被拒（${host}），检查代理是否开启`;
-    if (code === "ETIMEDOUT" || code === "UND_ERR_CONNECT_TIMEOUT" || e?.name === "TimeoutError") return `连接 ${host} 超时（直连可能被墙），请开代理后重试：set HTTPS_PROXY=http://127.0.0.1:7890 再跑 login`;
-    if (!PROXY_URL && /workos\.com|cline\.bot/.test(host)) return `直连 ${host} 失败（${code || e.message}），疑似被墙，请开代理后重试`;
-    return `${code || e.message}`;
-  }
-  // 注意：dispatcher 为 null 时不能显式传给 fetch（undici 会断言失败），有代理才带。
-  const extraOpts = dispatcher ? { dispatcher } : {};
-  async function postForm(url, form) {
-    const body = new URLSearchParams(form).toString();
-    let res;
-    try {
-      res = await compatFetch(url, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body, ...extraOpts, signal: timeoutSignal(20000) });
-    } catch (e) { throw new Error(`连不上 WorkOS：${netHint(e, url)}`); }
-    const txt = await res.text();
-    try { return JSON.parse(txt); } catch { throw new Error(`WorkOS 返回非 JSON: ${txt.slice(0, 200)}`); }
-  }
-  async function postJson(url, obj) {
-    let res;
-    try {
-      res = await compatFetch(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(obj), ...extraOpts, signal: timeoutSignal(20000) });
-    } catch (e) { throw new Error(`连不上 Cline：${netHint(e, url)}`); }
-    const txt = await res.text();
-    try { return JSON.parse(txt); } catch { throw new Error(`Cline 返回非 JSON: ${txt.slice(0, 200)}`); }
-  }
-  if (PROXY_URL && dispatcher) console.log(`🌐 检测到代理：${PROXY_URL}\n`);
-
-  console.log("🚀 启动 Cline WorkOS 设备授权流程...\n");
-  let device;
-  try {
-    device = await postForm(WORKOS_DEVICE, { client_id: CLIENT_ID });
-  } catch (e) {
-    console.error(`❌ 获取设备码失败: ${e.message}`);
-    process.exit(1);
-  }
-  const device_code = device.device_code;
-  const user_code = device.user_code;
-  const auth_url = device.verification_uri_complete || device.verification_uri;
-  const interval = Math.max(Number(device.interval || 5), 5);
-  const expires_in = Number(device.expires_in || 300);
-  if (!device_code || !user_code || !auth_url) {
-    console.error("❌ WorkOS 返回不完整:", JSON.stringify(device).slice(0, 500));
-    process.exit(1);
-  }
-  console.log("=".repeat(60));
-  console.log("1️⃣  在浏览器打开下面这个链接：");
-  console.log(`    ${auth_url}`);
-  console.log("2️⃣  页面会要求输入设备码（可能已自动带好）：");
-  console.log(`    ${user_code}`);
-  console.log("3️⃣  用 Google / GitHub / 邮箱登录并授权");
-  console.log("=".repeat(60));
-  console.log(`\n🔄 等待你授权（自动轮询，每 ${interval}s，最多 ${expires_in}s）...`);
-  console.log("   （已授权后会自动继续，无需回车）\n");
-
-  const deadline = Date.now() + expires_in * 1000;
-  let workos = null;
-  while (Date.now() < deadline) {
-    await new Promise((r) => setTimeout(r, interval * 1000));
-    try {
-      const a = await postForm(WORKOS_AUTH, { grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code, client_id: CLIENT_ID });
-      if (a.access_token) { workos = a; break; }
-      const err = a.error;
-      if (err === "slow_down") { await new Promise((r) => setTimeout(r, 5000)); }
-      else if (err && err !== "authorization_pending") {
-        console.log(`   [${err}] ${a.error_description || ""}`);
-      } else {
-        process.stdout.write(".");
-      }
-    } catch (e) {
-      console.log(`\n   轮询出错: ${e.message}`);
-    }
-  }
-  if (!workos) {
-    console.error("\n❌ 授权超时，请重新运行 mslxdff -provider cline login");
-    process.exit(1);
-  }
-  console.log("\n✅ WorkOS 授权成功！\n🔗 用 WorkOS token 在 Cline 注册...");
-  let cline;
-  try {
-    cline = await postJson(CLINE_REGISTER, { accessToken: workos.access_token, refreshToken: workos.refresh_token });
-  } catch (e) {
-    console.error(`❌ Cline 注册失败: ${e.message}`);
-    process.exit(1);
-  }
-  const rt = cline?.data?.refreshToken || cline?.refreshToken;
-  const email = cline?.data?.userInfo?.email || cline?.data?.email || "unknown";
-  if (!rt) {
-    console.error("❌ 注册失败，未拿到 refreshToken:", JSON.stringify(cline).slice(0, 800));
-    process.exit(1);
-  }
-  console.log("=".repeat(60));
-  console.log(`✅ 登录成功! 账号: ${email}`);
-  console.log(`🔑 refreshToken: ${rt.slice(0, 8)}…${rt.slice(-8)} (${rt.length} 字符)`);
-  // 落盘到 state（供应商 id 恒为 cline；写盘前先跑一次性迁移，保证老用户不会再写出 clinebot）
-  // 同邮箱去重：refreshToken 每次 login 都换新串，裸串比对拦不住重复账号，必须按 email 归一。
-  // auths 存 uid=email 索引行（domain=cline.bot），keys 与 auths 双写；老 keys 无映射时用 refresh 反查兜底。
-  const { defaultStateFile, loadProviderKeys, saveProviderConfig, loadProviderConfig, loadProviderAuths } = await import("../../../state.js");
-  function normEmail(v) { return String(v || "").trim().toLowerCase(); }
-  function emailFromJson(j) {
-    try {
-      const d = j?.data && typeof j.data === "object" ? j.data : j;
-      const u = d?.userInfo && typeof d.userInfo === "object" ? d.userInfo : null;
-      const cand = u?.email || d?.email || d?.user?.email || u?.mail || d?.mail || "";
-      if (cand && String(cand).includes("@")) return normEmail(cand);
-      const m = String(JSON.stringify(j || {}).slice(0, 4000)).match(/[\w.+-]+@[\w-]+\.[\w.]+/);
-      return m ? normEmail(m[0]) : "";
-    } catch { return ""; }
-  }
-  async function resolveClineEmail(refreshToken) {
-    try {
-      const baseNoV1 = "https://api.cline.bot";
-      const res = await compatFetch(`${baseNoV1}/api/v1/auth/refresh`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ refreshToken, grantType: "refresh_token" }), ...extraOpts, signal: timeoutSignal(15000) });
-      if (!res.ok) return "";
-      return emailFromJson(await res.json().catch(() => null));
-    } catch { return ""; }
-  }
-  function upsertAuths(list, email, rt) {
-    const norm = normEmail(email);
-    if (!norm || norm === "unknown") return [...(list || [])];
-    const next = [...(list || [])];
-    const i = next.findIndex((a) => normEmail(a?.uid) === norm);
-    if (i >= 0) next[i] = { uid: next[i].uid, domain: "cline.bot", enterpriseId: "", refreshToken: rt };
-    else next.push({ uid: String(email).trim(), domain: "cline.bot", enterpriseId: "", refreshToken: rt });
-    return next;
-  }
-  try {
-    const { runStateMigrations } = await import("../../../state/migrations.js");
-    const mig = await runStateMigrations({ file: defaultStateFile() });
-    if (mig.applied.length) console.log(`   ℹ️ 已合并遗留供应商配置: ${mig.applied.join(", ")}`);
-  } catch {}
-  try {
-    const pid = "cline";
-    const cur = loadProviderKeys(pid);
-    const cfg = loadProviderConfig(pid) || { baseUrl: "", keys: [] };
-    const baseUrl = cfg.baseUrl || "https://api.cline.bot";
-    let auths = loadProviderAuths(pid) || [];
-    const norm = normEmail(email);
-    if (cur.includes(rt)) {
-      auths = upsertAuths(auths, email, rt);
-      saveProviderConfig(pid, { baseUrl, keys: cur, auths });
-      console.log(`   ℹ️ ${pid} 已存在相同 token，已补邮箱映射（现 ${cur.length} 个账号）`);
-    } else if (norm && norm !== "unknown") {
-      const ai = auths.findIndex((a) => normEmail(a?.uid) === norm);
-      if (ai >= 0) {
-        const oldRt = String(auths[ai]?.refreshToken || "");
-        const nextKeys = [...cur];
-        const at = oldRt ? nextKeys.indexOf(oldRt) : -1;
-        if (at >= 0) nextKeys[at] = rt;
-        else { const dup = nextKeys.indexOf(rt); if (dup < 0) nextKeys.push(rt); }
-        auths = upsertAuths(auths, email, rt);
-        saveProviderConfig(pid, { baseUrl, keys: [...new Set(nextKeys.filter(Boolean))], auths });
-        console.log(`   ℹ️ ${email} 已存在，token 已替换（仍 ${nextKeys.length} 个账号，未追加）`);
-      } else {
-        let dupIdx = -1;
-        const resolved = [];
-        for (let i = 0; i < cur.length; i++) {
-          const em = await resolveClineEmail(cur[i]);
-          resolved[i] = em;
-          if (em && em === norm) { dupIdx = i; break; }
-          await new Promise((r) => setTimeout(r, 300));
-        }
-        if (dupIdx >= 0) {
-          const nextKeys = [...cur]; nextKeys[dupIdx] = rt;
-          for (let i = 0; i < cur.length; i++) if (resolved[i]) auths = upsertAuths(auths, resolved[i], i === dupIdx ? rt : cur[i]);
-          auths = upsertAuths(auths, email, rt);
-          saveProviderConfig(pid, { baseUrl, keys: [...new Set(nextKeys.filter(Boolean))], auths });
-          console.log(`   ℹ️ ${email} 已存在（位置 ${dupIdx + 1}），token 已替换（仍 ${nextKeys.length} 个账号，未追加）`);
-        } else {
-          const nextKeys = [...new Set([...cur, rt].filter(Boolean))];
-          for (let i = 0; i < cur.length; i++) if (resolved[i]) auths = upsertAuths(auths, resolved[i], cur[i]);
-          auths = upsertAuths(auths, email, rt);
-          saveProviderConfig(pid, { baseUrl, keys: nextKeys, auths });
-          console.log(`   ✅ 已写入 ${pid}（现 ${nextKeys.length} 个账号）`);
-        }
-      }
-    } else {
-      const nextKeys = [...new Set([...(cfg.keys || cur), rt].filter(Boolean))];
-      saveProviderConfig(pid, { baseUrl, keys: nextKeys, auths });
-      console.log(`   ✅ 已写入 ${pid}（现 ${nextKeys.length} 个账号）`);
-    }
-  } catch (e) {
-    console.log(`   ⚠️ 写入 cline 失败: ${e.message}`);
-  }
-  console.log("=".repeat(60));
-  console.log("\n下一步：");
-  console.log("  mslxdff -restart                         重启网关使新账号生效");
-  console.log("  mslxdff -provider cline bench --json     测速 deepseek 是否 200");
-  console.log("  mslxdff -chat                             直接对话，模型选 deepseek/deepseek-v4-flash");
-  console.log("\n多账号：重复 `mslxdff -provider cline login` 追加（同邮箱自动替换不追加），二号自动做后备");
-  process.exit(0);
-}
+import { compatFetch, getUndici, timeoutSignal } from "../../../compat.js";
+import { normalizeProviderId } from "../../../providers/model-id.js";
+export async function handleClineLogin(id, sub) {
+  if (sub !== "login" && sub !== "auth" && sub !== "oauth") return false;
+  if (normalizeProviderId(id) !== "cline") return false;
+
+  const CLIENT_ID = "client_01K3A541FN8TA3EPPHTD2325AR";
+  const WORKOS_DEVICE = "https://api.workos.com/user_management/authorize/device";
+  const WORKOS_AUTH = "https://api.workos.com/user_management/authenticate";
+  const CLINE_REGISTER = "https://api.cline.bot/api/v1/auth/register";
+
+  // 网络层：支持代理（读环境变量）+ 超时 + 人话报错。
+  // 直连 api.workos.com 在部分网络下 TCP 会被墙（DNS 通但 443 超时），此时必须走代理。
+  const PROXY_URL = (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || "").trim();
+  let dispatcher = null;
+  if (PROXY_URL) {
+    try {
+      const { ProxyAgent } = getUndici();
+      dispatcher = new ProxyAgent(PROXY_URL);
+    } catch (e) {
+      console.error(`⚠️ 代理变量 ${PROXY_URL} 不可用（${e.message}），回退直连`);
+    }
+  }
+  function netHint(e, url) {
+    const host = (() => { try { return new URL(url).host; } catch { return url; } })();
+    const cause = e?.cause || e;
+    const code = cause?.code || cause?.name || "";
+    if (code === "ENOTFOUND" || code === "EAI_AGAIN") return `DNS 解析失败（${host}），检查 DNS/网络`;
+    if (code === "ECONNREFUSED") return `连接被拒（${host}），检查代理是否开启`;
+    if (code === "ETIMEDOUT" || code === "UND_ERR_CONNECT_TIMEOUT" || e?.name === "TimeoutError") return `连接 ${host} 超时（直连可能被墙），请开代理后重试：set HTTPS_PROXY=http://127.0.0.1:7890 再跑 login`;
+    if (!PROXY_URL && /workos\.com|cline\.bot/.test(host)) return `直连 ${host} 失败（${code || e.message}），疑似被墙，请开代理后重试`;
+    return `${code || e.message}`;
+  }
+  // 注意：dispatcher 为 null 时不能显式传给 fetch（undici 会断言失败），有代理才带。
+  const extraOpts = dispatcher ? { dispatcher } : {};
+  async function postForm(url, form) {
+    const body = new URLSearchParams(form).toString();
+    let res;
+    try {
+      res = await compatFetch(url, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body, ...extraOpts, signal: timeoutSignal(20000) });
+    } catch (e) { throw new Error(`连不上 WorkOS：${netHint(e, url)}`); }
+    const txt = await res.text();
+    try { return JSON.parse(txt); } catch { throw new Error(`WorkOS 返回非 JSON: ${txt.slice(0, 200)}`); }
+  }
+  async function postJson(url, obj) {
+    let res;
+    try {
+      res = await compatFetch(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(obj), ...extraOpts, signal: timeoutSignal(20000) });
+    } catch (e) { throw new Error(`连不上 Cline：${netHint(e, url)}`); }
+    const txt = await res.text();
+    try { return JSON.parse(txt); } catch { throw new Error(`Cline 返回非 JSON: ${txt.slice(0, 200)}`); }
+  }
+  if (PROXY_URL && dispatcher) console.log(`🌐 检测到代理：${PROXY_URL}\n`);
+
+  console.log("🚀 启动 Cline WorkOS 设备授权流程...\n");
+  let device;
+  try {
+    device = await postForm(WORKOS_DEVICE, { client_id: CLIENT_ID });
+  } catch (e) {
+    console.error(`❌ 获取设备码失败: ${e.message}`);
+    process.exit(1);
+  }
+  const device_code = device.device_code;
+  const user_code = device.user_code;
+  const auth_url = device.verification_uri_complete || device.verification_uri;
+  const interval = Math.max(Number(device.interval || 5), 5);
+  const expires_in = Number(device.expires_in || 300);
+  if (!device_code || !user_code || !auth_url) {
+    console.error("❌ WorkOS 返回不完整:", JSON.stringify(device).slice(0, 500));
+    process.exit(1);
+  }
+  console.log("=".repeat(60));
+  console.log("1️⃣  在浏览器打开下面这个链接：");
+  console.log(`    ${auth_url}`);
+  console.log("2️⃣  页面会要求输入设备码（可能已自动带好）：");
+  console.log(`    ${user_code}`);
+  console.log("3️⃣  用 Google / GitHub / 邮箱登录并授权");
+  console.log("=".repeat(60));
+  console.log(`\n🔄 等待你授权（自动轮询，每 ${interval}s，最多 ${expires_in}s）...`);
+  console.log("   （已授权后会自动继续，无需回车）\n");
+
+  const deadline = Date.now() + expires_in * 1000;
+  let workos = null;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, interval * 1000));
+    try {
+      const a = await postForm(WORKOS_AUTH, { grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code, client_id: CLIENT_ID });
+      if (a.access_token) { workos = a; break; }
+      const err = a.error;
+      if (err === "slow_down") { await new Promise((r) => setTimeout(r, 5000)); }
+      else if (err && err !== "authorization_pending") {
+        console.log(`   [${err}] ${a.error_description || ""}`);
+      } else {
+        process.stdout.write(".");
+      }
+    } catch (e) {
+      console.log(`\n   轮询出错: ${e.message}`);
+    }
+  }
+  if (!workos) {
+    console.error("\n❌ 授权超时，请重新运行 mslxdff -provider cline login");
+    process.exit(1);
+  }
+  console.log("\n✅ WorkOS 授权成功！\n🔗 用 WorkOS token 在 Cline 注册...");
+  let cline;
+  try {
+    cline = await postJson(CLINE_REGISTER, { accessToken: workos.access_token, refreshToken: workos.refresh_token });
+  } catch (e) {
+    console.error(`❌ Cline 注册失败: ${e.message}`);
+    process.exit(1);
+  }
+  const rt = cline?.data?.refreshToken || cline?.refreshToken;
+  const email = cline?.data?.userInfo?.email || cline?.data?.email || "unknown";
+  if (!rt) {
+    console.error("❌ 注册失败，未拿到 refreshToken:", JSON.stringify(cline).slice(0, 800));
+    process.exit(1);
+  }
+  console.log("=".repeat(60));
+  console.log(`✅ 登录成功! 账号: ${email}`);
+  console.log(`🔑 refreshToken: ${rt.slice(0, 8)}…${rt.slice(-8)} (${rt.length} 字符)`);
+  // 落盘到 state（供应商 id 恒为 cline；写盘前先跑一次性迁移，保证老用户不会再写出 clinebot）
+  // 同邮箱去重：refreshToken 每次 login 都换新串，裸串比对拦不住重复账号，必须按 email 归一。
+  // auths 存 uid=email 索引行（domain=cline.bot），keys 与 auths 双写；老 keys 无映射时用 refresh 反查兜底。
+  const { defaultStateFile, loadProviderKeys, saveProviderConfig, loadProviderConfig, loadProviderAuths } = await import("../../../state.js");
+  function normEmail(v) { return String(v || "").trim().toLowerCase(); }
+  function emailFromJson(j) {
+    try {
+      const d = j?.data && typeof j.data === "object" ? j.data : j;
+      const u = d?.userInfo && typeof d.userInfo === "object" ? d.userInfo : null;
+      const cand = u?.email || d?.email || d?.user?.email || u?.mail || d?.mail || "";
+      if (cand && String(cand).includes("@")) return normEmail(cand);
+      const m = String(JSON.stringify(j || {}).slice(0, 4000)).match(/[\w.+-]+@[\w-]+\.[\w.]+/);
+      return m ? normEmail(m[0]) : "";
+    } catch { return ""; }
+  }
+  async function resolveClineEmail(refreshToken) {
+    try {
+      const baseNoV1 = "https://api.cline.bot";
+      const res = await compatFetch(`${baseNoV1}/api/v1/auth/refresh`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ refreshToken, grantType: "refresh_token" }), ...extraOpts, signal: timeoutSignal(15000) });
+      if (!res.ok) return "";
+      return emailFromJson(await res.json().catch(() => null));
+    } catch { return ""; }
+  }
+  function upsertAuths(list, email, rt) {
+    const norm = normEmail(email);
+    if (!norm || norm === "unknown") return [...(list || [])];
+    const next = [...(list || [])];
+    const i = next.findIndex((a) => normEmail(a?.uid) === norm);
+    if (i >= 0) next[i] = { uid: next[i].uid, domain: "cline.bot", enterpriseId: "", refreshToken: rt };
+    else next.push({ uid: String(email).trim(), domain: "cline.bot", enterpriseId: "", refreshToken: rt });
+    return next;
+  }
+  try {
+    const { runStateMigrations } = await import("../../../state/migrations.js");
+    const mig = await runStateMigrations({ file: defaultStateFile() });
+    if (mig.applied.length) console.log(`   ℹ️ 已合并遗留供应商配置: ${mig.applied.join(", ")}`);
+  } catch {}
+  try {
+    const pid = "cline";
+    const cur = loadProviderKeys(pid);
+    const cfg = loadProviderConfig(pid) || { baseUrl: "", keys: [] };
+    const baseUrl = cfg.baseUrl || "https://api.cline.bot";
+    let auths = loadProviderAuths(pid) || [];
+    const norm = normEmail(email);
+    if (cur.includes(rt)) {
+      auths = upsertAuths(auths, email, rt);
+      saveProviderConfig(pid, { baseUrl, keys: cur, auths });
+      console.log(`   ℹ️ ${pid} 已存在相同 token，已补邮箱映射（现 ${cur.length} 个账号）`);
+    } else if (norm && norm !== "unknown") {
+      const ai = auths.findIndex((a) => normEmail(a?.uid) === norm);
+      if (ai >= 0) {
+        const oldRt = String(auths[ai]?.refreshToken || "");
+        const nextKeys = [...cur];
+        const at = oldRt ? nextKeys.indexOf(oldRt) : -1;
+        if (at >= 0) nextKeys[at] = rt;
+        else { const dup = nextKeys.indexOf(rt); if (dup < 0) nextKeys.push(rt); }
+        auths = upsertAuths(auths, email, rt);
+        saveProviderConfig(pid, { baseUrl, keys: [...new Set(nextKeys.filter(Boolean))], auths });
+        console.log(`   ℹ️ ${email} 已存在，token 已替换（仍 ${nextKeys.length} 个账号，未追加）`);
+      } else {
+        let dupIdx = -1;
+        const resolved = [];
+        for (let i = 0; i < cur.length; i++) {
+          const em = await resolveClineEmail(cur[i]);
+          resolved[i] = em;
+          if (em && em === norm) { dupIdx = i; break; }
+          await new Promise((r) => setTimeout(r, 300));
+        }
+        if (dupIdx >= 0) {
+          const nextKeys = [...cur]; nextKeys[dupIdx] = rt;
+          for (let i = 0; i < cur.length; i++) if (resolved[i]) auths = upsertAuths(auths, resolved[i], i === dupIdx ? rt : cur[i]);
+          auths = upsertAuths(auths, email, rt);
+          saveProviderConfig(pid, { baseUrl, keys: [...new Set(nextKeys.filter(Boolean))], auths });
+          console.log(`   ℹ️ ${email} 已存在（位置 ${dupIdx + 1}），token 已替换（仍 ${nextKeys.length} 个账号，未追加）`);
+        } else {
+          const nextKeys = [...new Set([...cur, rt].filter(Boolean))];
+          for (let i = 0; i < cur.length; i++) if (resolved[i]) auths = upsertAuths(auths, resolved[i], cur[i]);
+          auths = upsertAuths(auths, email, rt);
+          saveProviderConfig(pid, { baseUrl, keys: nextKeys, auths });
+          console.log(`   ✅ 已写入 ${pid}（现 ${nextKeys.length} 个账号）`);
+        }
+      }
+    } else {
+      const nextKeys = [...new Set([...(cfg.keys || cur), rt].filter(Boolean))];
+      saveProviderConfig(pid, { baseUrl, keys: nextKeys, auths });
+      console.log(`   ✅ 已写入 ${pid}（现 ${nextKeys.length} 个账号）`);
+    }
+  } catch (e) {
+    console.log(`   ⚠️ 写入 cline 失败: ${e.message}`);
+  }
+  console.log("=".repeat(60));
+  console.log("\n下一步：");
+  console.log("  mslxdff -restart                         重启网关使新账号生效");
+  console.log("  mslxdff -provider cline bench --json     测速 deepseek 是否 200");
+  console.log("  mslxdff -chat                             直接对话，模型选 deepseek/deepseek-v4-flash");
+  console.log("\n多账号：重复 `mslxdff -provider cline login` 追加（同邮箱自动替换不追加），二号自动做后备");
+  process.exit(0);
+}