mslxdff 0.1.231 → 0.1.233

package/src/providers/qoder/wire-messages.js

@@ -0,0 +1,242 @@
+// qoder 线格式消息转换层：OpenAI/Anthropic messages → Qoder 原生 wire messages。
+// 从 payload.js 拆出（体积门 + 职责边界：这里只管"消息形状/配对/缓存标记/会话指纹"，不管请求体装配）。
+// 关键事实（2026-10-22 取证，对齐官方 qodercli + dsh-qoder-connect + magpie qoder 插件）：
+//  - messages 必须发 Qoder 原生形状（user 带 contents[]、assistant 回传 reasoning_content、tool 带 tool_call_id）；
+//  - 注入官方 Qoder agent 人格（缓存稳定种子）；末个可缓存块打 cache_control:ephemeral（Anthropic 系只缓存标记段）；
+//  - session_id 按对话稳定（同对话跨请求命中上游 prompt 缓存）；
+//  - tool 配对修复：上游对「孤儿 tool result」整体拒收，须补派生 id / 防抢占认领 / 降级不丢内容。
+import { createHash } from "node:crypto";
+
+export function blankResponseMeta() {
+  return {
+    id: "",
+    usage: {
+      prompt_tokens: 0, completion_tokens: 0, total_tokens: 0,
+      completion_tokens_details: { reasoning_tokens: 0 },
+      prompt_tokens_details: { cached_tokens: 0 },
+    },
+  };
+}
+
+// OpenAI user 消息 → Qoder contents 形状
+export function buildUserMessage(text) {
+  return {
+    role: "user", content: "",
+    contents: [{ type: "text", text: String(text || "") }],
+    response_meta: blankResponseMeta(),
+    reasoning_content_signature: "",
+  };
+}
+
+export function buildStructuredMessage(role, text) {
+  return { role, content: String(text || ""), response_meta: blankResponseMeta(), reasoning_content_signature: "" };
+}
+
+export function normalizeContent(content) {
+  if (typeof content === "string") return content;
+  if (content == null) return "";
+  if (Array.isArray(content)) {
+    let out = "";
+    for (const b of content) {
+      const t = typeof b === "object" && b ? b.text : b;
+      if (typeof t === "string") out += (out ? "\n\n" : "") + t;
+    }
+    return out;
+  }
+  return JSON.stringify(content);
+}
+
+// 单段 image → Qoder image_url part；拿不到可用 url 返回 null
+function imagePartToUrl(b) {
+  // OpenAI 形状 {type:'image_url', image_url:{url}}
+  const direct = typeof b.image_url === "string" ? b.image_url : b.image_url?.url;
+  if (typeof direct === "string" && direct) return { type: "image_url", image_url: { url: direct } };
+  // Anthropic 形状 {type:'image', source:{type:'base64'|'url', media_type, data|url}}
+  const src = b.source;
+  if (src && typeof src === "object") {
+    if (src.type === "url" && typeof src.url === "string" && src.url)
+      return { type: "image_url", image_url: { url: src.url } };
+    if (src.type === "base64" && src.data && src.media_type)
+      return { type: "image_url", image_url: { url: `data:${src.media_type};base64,${src.data}` } };
+  }
+  return null;
+}
+
+// 官方会话人格（对齐 qoder-agent-sdk：magpie 插件同款）：人格行前置、客户端 system 拼后。
+// 固定前缀让上游 prompt 缓存跨轮命中，也让模型身份口径稳定（不再自称别名）。
+const QODER_SYS = "You are a Qoder agent. Use the instructions below and the tools available to you to assist the user.";
+export function withQoderPersona(systemText) {
+  const s = String(systemText || "").trim();
+  return s ? `${QODER_SYS}\n\n${s}` : QODER_SYS;
+}
+
+// tool 配对修复（对齐 magpie #277/#290/#359，实测上游行为）：
+//  - 上游对「tool 行没有应答它前面 assistant 的某个 call」的请求整体拒绝
+//    （"Messages with role 'tool' must be a response to a preceding message with 'tool_calls'"），
+//    客户端丢 id / 上下文压缩截断都会造成孤儿 result → 整个 turn 被枪毙（表现为莫名的 400/空 turn）。
+//  - 修法：call 缺 id 按内容派生稳定 id（同 turn 内跨请求一致，不破坏上游缓存）；
+//    孤儿 result 认领「其后没有任何 result 点名的那个未应答 call」（防孤儿抢占合法点名），认领不到降级 user 文本。
+function callIdFor(at, k, c) {
+  const said = typeof c.function?.arguments === "string" ? c.function.arguments : JSON.stringify(c.function?.arguments ?? {});
+  return "call_" + createHash("sha256").update(`${at}\0${k}\0${c.function?.name ?? ""}\0${said}`).digest("hex").slice(0, 32);
+}
+
+// 从 from 起收集其后所有 result 行点名的 id（user 的 tool_result 数组形态与 tool 行都算），
+// 直到下一个 assistant/user 文本行为止——这是"合法点名预约表"，孤儿认领时须避开。
+function namedAhead(incoming, from) {
+  const names = new Set();
+  for (let j = from; j < incoming.length; j++) {
+    const m = incoming[j];
+    if (!m) continue;
+    if (m.role === "tool") { if (m.tool_call_id) names.add(String(m.tool_call_id)); continue; }
+    if (m.role === "user" && Array.isArray(m.content) && m.content[0]?.type === "tool_result") {
+      for (const b of m.content) if (b?.type === "tool_result" && b.tool_use_id) names.add(String(b.tool_use_id));
+      continue;
+    }
+    break; // 碰到别的角色（assistant 新 turn / user 真话）即停
+  }
+  return names;
+}
+
+// OpenAI messages → Qoder 原生 wire messages（官方形状：user=contents[]；assistant=content+tool_calls+reasoning_content）
+export function toQoderWireMessages(incoming) {
+  const msgs = incoming || [];
+  const out = [];
+  let pendingCallIds = []; // 最近一个 assistant 轮里尚未被 result 应答的 call ids（按发出顺序）
+  let systemText = "";
+  const claimOrDemote = (id, at) => {
+    const sid = String(id || "");
+    if (sid && pendingCallIds.includes(sid)) {
+      pendingCallIds = pendingCallIds.filter((p) => p !== sid);
+      return { ok: true, id: sid };
+    }
+    // 客户端丢了 id / 点名了对不上的 id：认领「后面没人点名」的第一个未应答 call
+    const reserved = namedAhead(msgs, at);
+    const freeAt = pendingCallIds.findIndex((p) => !reserved.has(p));
+    if (freeAt >= 0) return { ok: true, id: pendingCallIds.splice(freeAt, 1)[0] };
+    return { ok: false };
+  };
+  for (let i = 0; i < msgs.length; i++) {
+    const m = msgs[i];
+    if (!m || typeof m !== "object") continue;
+    const text = normalizeContent(m.content);
+    if (m.role === "system") {
+      if (text) systemText = systemText ? systemText + "\n\n" + text : text;
+      continue;
+    }
+    if (m.role === "user") {
+      pendingCallIds = [];
+      // Anthropic tool_result 数组形态 → tool 行（翻译层产物）
+      if (Array.isArray(m.content) && m.content[0]?.type === "tool_result") {
+        for (const b of m.content) {
+          if (b?.type !== "tool_result") continue;
+          const rt = normalizeContent(b.content);
+          const claimed = claimOrDemote(b.tool_use_id || "", i);
+          if (claimed.ok) out.push({ role: "tool", tool_call_id: claimed.id, content: rt });
+          else out.push(buildUserMessage(rt)); // 无路可认领 → 降级 user 文本，内容不丢
+        }
+        continue;
+      }
+      if (Array.isArray(m.content)) {
+        const parts = [];
+        for (const b of m.content) {
+          if (!b || typeof b !== "object") continue;
+          if (b.type === "text" && typeof b.text === "string" && b.text) { parts.push({ type: "text", text: b.text }); continue; }
+          if (b.type === "image" || b.type === "image_url") {
+            const p = imagePartToUrl(b);
+            if (p) { parts.push(p); continue; }
+          }
+          const t = typeof b.text === "string" ? b.text : null;
+          if (t) parts.push({ type: "text", text: t });
+        }
+        if (!parts.length && text) parts.push({ type: "text", text });
+        out.push({
+          role: "user", content: "",
+          contents: parts.length ? parts : [{ type: "text", text: "" }],
+          response_meta: blankResponseMeta(),
+          reasoning_content_signature: "",
+        });
+        continue;
+      }
+      out.push(buildUserMessage(text));
+      continue;
+    }
+    if (m.role === "assistant") {
+      const hasToolCalls = Array.isArray(m.tool_calls) && m.tool_calls.length > 0;
+      if (!text && !hasToolCalls && !m.reasoning_content) continue; // 空气泡不发
+      pendingCallIds = [];
+      const msg = buildStructuredMessage("assistant", text || " ");
+      if (hasToolCalls) {
+        msg.tool_calls = m.tool_calls.map((c, k) => (c?.id ? c : { ...c, id: callIdFor(i, k, c || {}) }));
+        pendingCallIds = msg.tool_calls.map((c) => c.id);
+      }
+      if (m.reasoning_content) msg.reasoning_content = String(m.reasoning_content);
+      out.push(msg);
+      continue;
+    }
+    if (m.role === "tool") {
+      const claimed = claimOrDemote(m.tool_call_id || "", i);
+      if (claimed.ok) {
+        const msg = buildStructuredMessage("tool", text);
+        msg.tool_call_id = claimed.id;
+        if (m.name) msg.name = m.name;
+        out.push(msg);
+      } else {
+        out.push(buildUserMessage(text)); // 孤儿 result → user 文本（上游会整体拒绝 tool 行）
+      }
+      continue;
+    }
+    if (text) out.push(buildStructuredMessage(m.role || "user", text));
+  }
+  // system 人格前置一条（客户端无 system 时也给官方人格，对齐上游客户端行为）
+  out.unshift(buildStructuredMessage("system", withQoderPersona(systemText)));
+  return out;
+}
+
+// 会话指纹（prompt 缓存亲和的关键，对齐 magpie #290）：同一对话（system + 首个 user 相同）
+// 恒定同名 → 上游命中会话缓存，首包显著变快；不同对话各不相同。客户端的 key 原文绝不出门。
+export function conversationSessionId(userId, modelKey, wireMessages) {
+  const sys = [];
+  let firstUser = "";
+  for (const m of wireMessages) {
+    if (m?.role === "system" && m.content) sys.push(String(m.content));
+    if (m?.role === "user") {
+      firstUser = JSON.stringify(m.contents || m.content || "");
+      break;
+    }
+  }
+  const h = createHash("sha256");
+  h.update("qoder-conv");
+  h.update("\0");
+  h.update(String(userId || ""));
+  h.update("\0");
+  h.update(String(modelKey || ""));
+  h.update("\0");
+  h.update(JSON.stringify([sys, firstUser]));
+  const hex = h.digest("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
+
+// cache_control 标记（对齐 qoder-agent-sdk 真值，magpie #290）：最后一个 user 轮里
+// 最后一个非工具块打 ephemeral；末轮是 tool 结果时不标。Anthropic 系模型只缓存标记段，
+// 不标 = 整段对话每次全价重算（慢且贵）。输入块原样不动，只加标记。
+const UNCACHED_TYPES = new Set(["thinking", "redacted_thinking", "tool_use", "tool_result"]);
+function findLastCacheable(blocks) {
+  for (let i = blocks.length - 1; i >= 0; i--) {
+    const t = blocks[i]?.type;
+    if (t && !UNCACHED_TYPES.has(t)) return i;
+  }
+  return -1;
+}
+export function cacheMark(wireMessages) {
+  const last = wireMessages[wireMessages.length - 1];
+  if (!last || last.role !== "user") return wireMessages;
+  const blocks = Array.isArray(last.contents) ? last.contents : null;
+  if (!blocks || !blocks.length) return wireMessages;
+  const idx = findLastCacheable(blocks);
+  if (idx < 0) return wireMessages;
+  const marked = blocks.slice();
+  marked[idx] = { ...marked[idx], cache_control: { type: "ephemeral" } };
+  wireMessages[wireMessages.length - 1] = { ...last, contents: marked };
+  return wireMessages;
+}

package/src/providers/qwenwork/account-store.js

@@ -1,133 +1,133 @@
-// qwenwork 账号落盘单一源：auths/qwenwork-<uid>.json（0600 tmp+rename）+ state.json 双写。
-// 照 src/providers/qwenwork/providers/qoder/account-store.js 的写法，命名空间独立（不得与 qoder 混）。
-import { writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync, readdirSync, readFileSync, chmodSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { tmpdir } from "node:os";
-import { isTestEnv, defaultStateFile } from "../../state/store.js";
-
-export function authDirFor({ explicit = "", testEnv = false, stateFile } = {}) {
-  if (explicit) return explicit;
-  if (testEnv) return join(tmpdir(), "mslxdff-test-auths");
-  return join(dirname(stateFile), "auths");
-}
-
-export function resolveAuthDir() {
-  return authDirFor({
-    explicit: process.env.QWENWORK_AUTH_DIR || "",
-    testEnv: isTestEnv(),
-    stateFile: defaultStateFile(),
-  });
-}
-
-export function resolveAuthDirs() {
-  const primary = resolveAuthDir();
-  const cwdDir = join(process.cwd(), "auths");
-  return primary === cwdDir ? [primary] : [primary, cwdDir];
-}
-
-export function listAccountDocs({ dirs } = {}) {
-  const out = [];
-  const seen = new Set();
-  for (const dir of dirs || resolveAuthDirs()) {
-    let files = [];
-    try {
-      if (!existsSync(dir)) continue;
-      files = readdirSync(dir).filter((f) => f.startsWith("qwenwork-") && f.endsWith(".json"));
-    } catch { continue; }
-    for (const f of files) {
-      try {
-        const doc = JSON.parse(readFileSync(join(dir, f), "utf8"));
-        const uid = doc?.account?.uid;
-        if (!uid || !doc?.auth?.accessToken) continue;
-        if (seen.has(String(uid))) continue;
-        seen.add(String(uid));
-        out.push({ uid: String(uid), file: join(dir, f), dir, doc });
-      } catch {}
-    }
-  }
-  return out;
-}
-
-function writeAccountFile({ uid, accessToken, refreshToken = "", expiresAt = 0, name = "", email = "" }) {
-  const authDir = resolveAuthDir();
-  mkdirSync(authDir, { recursive: true });
-  const doc = {
-    account: { uid, name, email },
-    auth: { accessToken, refreshToken, expiresAt },
-  };
-  const fp = join(authDir, `qwenwork-${uid}.json`);
-  const tmp = `${fp}.tmp`;
-  writeFileSync(tmp, JSON.stringify(doc, null, 2), { mode: 0o600 });
-  try {
-    if (existsSync(fp)) { try { chmodSync(fp, 0o600); } catch {} unlinkSync(fp); }
-    renameSync(tmp, fp);
-  } catch {
-    writeFileSync(fp, JSON.stringify(doc, null, 2), { mode: 0o600 });
-    try { unlinkSync(tmp); } catch {}
-  }
-  try { chmodSync(fp, 0o600); } catch {}
-  return fp;
-}
-
-// state 落盘：keys[i] 存 JSON blob（{device_token, refresh_token}，对齐家族形状），auths 存 uid 索引行。
-async function persistAccounts(accounts, file) {
-  const { loadProviderConfigs } = await import("../../state.js");
-  const { saveProviderConfig } = await import("../../state.js");
-  const cfg = (loadProviderConfigs(file ? { file } : {})?.qwenwork) || {};
-  const keys = [...(Array.isArray(cfg.keys) ? cfg.keys : [])];
-  const auths = [...(Array.isArray(cfg.auths) ? cfg.auths : [])];
-  let updated = 0;
-  for (const acc of accounts) {
-    if (!acc?.uid || !acc?.accessToken) continue;
-    const blob = JSON.stringify({ device_token: acc.accessToken, refresh_token: acc.refreshToken || "" });
-    const row = { uid: acc.uid, name: acc.name || "", refreshToken: acc.refreshToken || "" };
-    const idx = auths.findIndex((a) => String(a?.uid) === String(acc.uid));
-    if (idx >= 0) { keys[idx] = blob; auths[idx] = row; updated += 1; }
-    else { keys.push(blob); auths.push(row); }
-  }
-  // saveProviderConfig 起手保留 allowAnyModels（已在 state 层修复，见 ADR-0033 字段保留修复）
-  saveProviderConfig("qwenwork", { baseUrl: cfg.baseUrl || "", keys, auths }, file ? { file } : {});
-  return { keys, auths, updated };
-}
-
-export async function saveQwenworkAccount({ uid, accessToken, refreshToken = "", expiresAt = 0, name = "", email = "", file } = {}) {
-  if (!uid || !accessToken) throw new Error("saveQwenworkAccount: 缺少 uid/accessToken");
-  const fp = writeAccountFile({ uid, accessToken, refreshToken, expiresAt, name, email });
-  const st = await persistAccounts([{ uid, accessToken, refreshToken, name }], file);
-  return { file: fp, accounts: st.keys.length, updated: st.updated > 0 };
-}
-
-/** 回写刷新后的 token（上游每次 refresh 会轮换 refreshToken，必须落盘）。 */
-export async function updateQwenworkTokens({ uid, accessToken, refreshToken = "", expiresAt = 0, file } = {}) {
-  if (!uid || !accessToken) throw new Error("updateQwenworkTokens: 缺少 uid/accessToken");
-  const docs = listAccountDocs();
-  const hit = docs.find((d) => String(d.uid) === String(uid));
-  const prev = hit?.doc || {};
-  const fp = writeAccountFile({
-    uid,
-    accessToken,
-    refreshToken: refreshToken || prev?.auth?.refreshToken || "",
-    expiresAt: expiresAt || 0,
-    name: prev?.account?.name || "",
-    email: prev?.account?.email || "",
-  });
-  await persistAccounts([{ uid, accessToken, refreshToken: refreshToken || prev?.auth?.refreshToken || "", name: prev?.account?.name || "" }], file);
-  try {
-    const { invalidateSession } = await import("./cosy.js");
-    invalidateSession({ uid, accessToken: prev?.auth?.accessToken });
-  } catch {}
-  return { file: fp };
-}
-
-// 从 provider keys 的 blob 还原凭据（device_token/deviceToken 双形状兼容）
-export function accountFromBlob(blob) {
-  try {
-    const j = JSON.parse(String(blob || "{}"));
-    const accessToken = String(j.device_token || j.accessToken || "");
-    const refreshToken = String(j.refresh_token || j.refreshToken || "");
-    if (!accessToken) return null;
-    return { accessToken, refreshToken };
-  } catch {
-    return null;
-  }
-}
+// qwenwork 账号落盘单一源：auths/qwenwork-<uid>.json（0600 tmp+rename）+ state.json 双写。
+// 照 src/providers/qwenwork/providers/qoder/account-store.js 的写法，命名空间独立（不得与 qoder 混）。
+import { writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync, readdirSync, readFileSync, chmodSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { tmpdir } from "node:os";
+import { isTestEnv, defaultStateFile } from "../../state/store.js";
+
+export function authDirFor({ explicit = "", testEnv = false, stateFile } = {}) {
+  if (explicit) return explicit;
+  if (testEnv) return join(tmpdir(), "mslxdff-test-auths");
+  return join(dirname(stateFile), "auths");
+}
+
+export function resolveAuthDir() {
+  return authDirFor({
+    explicit: process.env.QWENWORK_AUTH_DIR || "",
+    testEnv: isTestEnv(),
+    stateFile: defaultStateFile(),
+  });
+}
+
+export function resolveAuthDirs() {
+  const primary = resolveAuthDir();
+  const cwdDir = join(process.cwd(), "auths");
+  return primary === cwdDir ? [primary] : [primary, cwdDir];
+}
+
+export function listAccountDocs({ dirs } = {}) {
+  const out = [];
+  const seen = new Set();
+  for (const dir of dirs || resolveAuthDirs()) {
+    let files = [];
+    try {
+      if (!existsSync(dir)) continue;
+      files = readdirSync(dir).filter((f) => f.startsWith("qwenwork-") && f.endsWith(".json"));
+    } catch { continue; }
+    for (const f of files) {
+      try {
+        const doc = JSON.parse(readFileSync(join(dir, f), "utf8"));
+        const uid = doc?.account?.uid;
+        if (!uid || !doc?.auth?.accessToken) continue;
+        if (seen.has(String(uid))) continue;
+        seen.add(String(uid));
+        out.push({ uid: String(uid), file: join(dir, f), dir, doc });
+      } catch {}
+    }
+  }
+  return out;
+}
+
+function writeAccountFile({ uid, accessToken, refreshToken = "", expiresAt = 0, name = "", email = "" }) {
+  const authDir = resolveAuthDir();
+  mkdirSync(authDir, { recursive: true });
+  const doc = {
+    account: { uid, name, email },
+    auth: { accessToken, refreshToken, expiresAt },
+  };
+  const fp = join(authDir, `qwenwork-${uid}.json`);
+  const tmp = `${fp}.tmp`;
+  writeFileSync(tmp, JSON.stringify(doc, null, 2), { mode: 0o600 });
+  try {
+    if (existsSync(fp)) { try { chmodSync(fp, 0o600); } catch {} unlinkSync(fp); }
+    renameSync(tmp, fp);
+  } catch {
+    writeFileSync(fp, JSON.stringify(doc, null, 2), { mode: 0o600 });
+    try { unlinkSync(tmp); } catch {}
+  }
+  try { chmodSync(fp, 0o600); } catch {}
+  return fp;
+}
+
+// state 落盘：keys[i] 存 JSON blob（{device_token, refresh_token}，对齐家族形状），auths 存 uid 索引行。
+async function persistAccounts(accounts, file) {
+  const { loadProviderConfigs } = await import("../../state.js");
+  const { saveProviderConfig } = await import("../../state.js");
+  const cfg = (loadProviderConfigs(file ? { file } : {})?.qwenwork) || {};
+  const keys = [...(Array.isArray(cfg.keys) ? cfg.keys : [])];
+  const auths = [...(Array.isArray(cfg.auths) ? cfg.auths : [])];
+  let updated = 0;
+  for (const acc of accounts) {
+    if (!acc?.uid || !acc?.accessToken) continue;
+    const blob = JSON.stringify({ device_token: acc.accessToken, refresh_token: acc.refreshToken || "" });
+    const row = { uid: acc.uid, name: acc.name || "", refreshToken: acc.refreshToken || "" };
+    const idx = auths.findIndex((a) => String(a?.uid) === String(acc.uid));
+    if (idx >= 0) { keys[idx] = blob; auths[idx] = row; updated += 1; }
+    else { keys.push(blob); auths.push(row); }
+  }
+  // saveProviderConfig 起手保留 allowAnyModels（已在 state 层修复，见 ADR-0033 字段保留修复）
+  saveProviderConfig("qwenwork", { baseUrl: cfg.baseUrl || "", keys, auths }, file ? { file } : {});
+  return { keys, auths, updated };
+}
+
+export async function saveQwenworkAccount({ uid, accessToken, refreshToken = "", expiresAt = 0, name = "", email = "", file } = {}) {
+  if (!uid || !accessToken) throw new Error("saveQwenworkAccount: 缺少 uid/accessToken");
+  const fp = writeAccountFile({ uid, accessToken, refreshToken, expiresAt, name, email });
+  const st = await persistAccounts([{ uid, accessToken, refreshToken, name }], file);
+  return { file: fp, accounts: st.keys.length, updated: st.updated > 0 };
+}
+
+/** 回写刷新后的 token（上游每次 refresh 会轮换 refreshToken，必须落盘）。 */
+export async function updateQwenworkTokens({ uid, accessToken, refreshToken = "", expiresAt = 0, file } = {}) {
+  if (!uid || !accessToken) throw new Error("updateQwenworkTokens: 缺少 uid/accessToken");
+  const docs = listAccountDocs();
+  const hit = docs.find((d) => String(d.uid) === String(uid));
+  const prev = hit?.doc || {};
+  const fp = writeAccountFile({
+    uid,
+    accessToken,
+    refreshToken: refreshToken || prev?.auth?.refreshToken || "",
+    expiresAt: expiresAt || 0,
+    name: prev?.account?.name || "",
+    email: prev?.account?.email || "",
+  });
+  await persistAccounts([{ uid, accessToken, refreshToken: refreshToken || prev?.auth?.refreshToken || "", name: prev?.account?.name || "" }], file);
+  try {
+    const { invalidateSession } = await import("./cosy.js");
+    invalidateSession({ uid, accessToken: prev?.auth?.accessToken });
+  } catch {}
+  return { file: fp };
+}
+
+// 从 provider keys 的 blob 还原凭据（device_token/deviceToken 双形状兼容）
+export function accountFromBlob(blob) {
+  try {
+    const j = JSON.parse(String(blob || "{}"));
+    const accessToken = String(j.device_token || j.accessToken || "");
+    const refreshToken = String(j.refresh_token || j.refreshToken || "");
+    if (!accessToken) return null;
+    return { accessToken, refreshToken };
+  } catch {
+    return null;
+  }
+}

package/src/providers/qwenwork/constants.js

@@ -1,67 +1,67 @@
-// qwenwork（千问办公 gateway.qwenwork.cn）上游技术常量。
-// 转译自 qwenwork2api-makers 的 edge-functions/_shared/config.js —— **禁止凭记忆改值**；
-// 要改先现网复测（客户端一升级这些快照就可能 403）。
-// Note: 为何独立 provider 而非 qoder 的新 region — 见 docs/adr/0037-qwenwork-independent-provider.md
-export const BASE = "https://gateway.qwenwork.cn";
-
-// OAuth 设备授权。client_id 与 qoder 恰好同值，但**不得 import qoder 常量**：
-// 同 client_id 不代表同租户（RSA 模数/模型池/额度池均不同，实测见 ADR-0037）。
-export const CLIENT_ID = "e883ade2-e6e3-4d6d-adf7-f92ceff5fdcb";
-export const REDIRECT_URI = "qwenwork-cn://";
-
-export const DEVICE_AUTH_URL = `${BASE}/device/selectAccounts`;
-export const POLL_URL = `${BASE}/api/v1/deviceToken/poll`;
-export const REFRESH_URL = `${BASE}/api/v1/deviceToken/refresh`;
-export const USERINFO_URL = `${BASE}/api/v1/userinfo`;
-// 额度/套餐：data.{user,plan,quota}，quota.remaining 即积分余量（实测新免费号 2099.277）
-export const ACCOUNT_CONTEXT_URL = `${BASE}/api/v1/adapter/user/account-context?include=user,plan,quota`;
-// 无 `Encode=1`：请求体走**纯 JSON**，不像 qoder 那样过自定义 base64 字母表
-export const CHAT_URL = `${BASE}/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common`;
-export const MODELS_URL = `${BASE}/algo/api/v2/model/list`;
-
-export function envStr(name, fallback) {
-  const v = process.env[name];
-  return typeof v === "string" && v.trim() ? v.trim() : fallback;
-}
-
-/** env 可覆盖，排障不必改代码（改后必须现网复测）。 */
-export const UA = envStr("MSLXDFF_QWENWORK_UA", "qoderwork/1.0.5");
-export const COSY_VERSION = envStr("MSLXDFF_QWENWORK_COSY_VERSION", "1.1.18");
-export const IDE_VERSION = envStr("MSLXDFF_QWENWORK_IDE_VERSION", "1.0.5");
-export const RELEASE_VERSION = envStr("MSLXDFF_QWENWORK_RELEASE_VERSION", "1.0.5-26090901");
-export const BUILD = envStr("MSLXDFF_QWENWORK_BUILD", "26090901");
-export const CLIENT_TYPE = "6";
-export const BUSINESS_PRODUCT = "qoder_work";
-export const BUSINESS_TYPE = "agent";
-export const SCENE = "qwork";
-export const MACHINE_OS = "x86_64_win32";
-
-// 上游 model/list 返回 11 个根切片，实测**只有 `qwork` 非空**（其余 n=0）：
-// chat/developer/assistant/inline/quest/nap/experts/qwake 全 0 —— 与 qoder 的 `chat` 切片零交集。
-export const MODEL_SLICE = "qwork";
-export const DEFAULT_MODEL = "flash";
-export const CONTEXT_LENGTH = 180000;
-export const MAX_TOKENS_DEFAULT = 32000;
-
-// 实测模型池（2026-09-29 真号取证）：flash price_factor=0.1 / pro=1 / qwen3.8-max-preview=1.8，
-// 三者均 is_reasoning=true、is_vl=true、context_config 1M(默认)/200K/400K。
-// 仅作取数失败时的兜底展示，真实目录以 /model/list 为准。
-export const KNOWN_MODELS = [
-  { key: "flash", name: "标准", priceFactor: 0.1 },
-  { key: "pro", name: "高级", priceFactor: 1 },
-  { key: "qwen3.8-max-preview", name: "Qwen3.8-Max", priceFactor: 1.8 },
-];
-
-// RSA-1024 模数（逐字符转译 _shared/crypto.js 的 RSA_N，勿改）
-export const RSA_MODULUS_HEX =
-  "c0f22307e5cd362e296bb04470f6de8fbf935ce24e8fcf511a0e2701329769c4" +
-  "a76e499bb938036a52af1eaf818cf79a2600620e3ce87e371d2ca6d85803606a" +
-  "1b3fa5e874643c9ed2db7e85673ef7227fca56e2e7c08f0927609bb896a9f24b" +
-  "e1782099a66016a5bfdc3f1ff756bfc9e88d7b5dc5be30bf45a0223a00ebcecf";
-export const RSA_EXPONENT = 65537;
-
-export const LOGIN_TTL_MS = 10 * 60 * 1000;
-export const COOLDOWN_MS = 30_000;
-export const QUOTA_COOLDOWN_MS = 60 * 60 * 1000;
-export const REFRESH_MARGIN_MS = 30 * 60 * 1000;
-export const MODELS_CACHE_MS = 10 * 60 * 1000;
+// qwenwork（千问办公 gateway.qwenwork.cn）上游技术常量。
+// 转译自 qwenwork2api-makers 的 edge-functions/_shared/config.js —— **禁止凭记忆改值**；
+// 要改先现网复测（客户端一升级这些快照就可能 403）。
+// Note: 为何独立 provider 而非 qoder 的新 region — 见 docs/adr/0037-qwenwork-independent-provider.md
+export const BASE = "https://gateway.qwenwork.cn";
+
+// OAuth 设备授权。client_id 与 qoder 恰好同值，但**不得 import qoder 常量**：
+// 同 client_id 不代表同租户（RSA 模数/模型池/额度池均不同，实测见 ADR-0037）。
+export const CLIENT_ID = "e883ade2-e6e3-4d6d-adf7-f92ceff5fdcb";
+export const REDIRECT_URI = "qwenwork-cn://";
+
+export const DEVICE_AUTH_URL = `${BASE}/device/selectAccounts`;
+export const POLL_URL = `${BASE}/api/v1/deviceToken/poll`;
+export const REFRESH_URL = `${BASE}/api/v1/deviceToken/refresh`;
+export const USERINFO_URL = `${BASE}/api/v1/userinfo`;
+// 额度/套餐：data.{user,plan,quota}，quota.remaining 即积分余量（实测新免费号 2099.277）
+export const ACCOUNT_CONTEXT_URL = `${BASE}/api/v1/adapter/user/account-context?include=user,plan,quota`;
+// 无 `Encode=1`：请求体走**纯 JSON**，不像 qoder 那样过自定义 base64 字母表
+export const CHAT_URL = `${BASE}/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common`;
+export const MODELS_URL = `${BASE}/algo/api/v2/model/list`;
+
+export function envStr(name, fallback) {
+  const v = process.env[name];
+  return typeof v === "string" && v.trim() ? v.trim() : fallback;
+}
+
+/** env 可覆盖，排障不必改代码（改后必须现网复测）。 */
+export const UA = envStr("MSLXDFF_QWENWORK_UA", "qoderwork/1.0.5");
+export const COSY_VERSION = envStr("MSLXDFF_QWENWORK_COSY_VERSION", "1.1.18");
+export const IDE_VERSION = envStr("MSLXDFF_QWENWORK_IDE_VERSION", "1.0.5");
+export const RELEASE_VERSION = envStr("MSLXDFF_QWENWORK_RELEASE_VERSION", "1.0.5-26090901");
+export const BUILD = envStr("MSLXDFF_QWENWORK_BUILD", "26090901");
+export const CLIENT_TYPE = "6";
+export const BUSINESS_PRODUCT = "qoder_work";
+export const BUSINESS_TYPE = "agent";
+export const SCENE = "qwork";
+export const MACHINE_OS = "x86_64_win32";
+
+// 上游 model/list 返回 11 个根切片，实测**只有 `qwork` 非空**（其余 n=0）：
+// chat/developer/assistant/inline/quest/nap/experts/qwake 全 0 —— 与 qoder 的 `chat` 切片零交集。
+export const MODEL_SLICE = "qwork";
+export const DEFAULT_MODEL = "flash";
+export const CONTEXT_LENGTH = 180000;
+export const MAX_TOKENS_DEFAULT = 32000;
+
+// 实测模型池（2026-09-29 真号取证）：flash price_factor=0.1 / pro=1 / qwen3.8-max-preview=1.8，
+// 三者均 is_reasoning=true、is_vl=true、context_config 1M(默认)/200K/400K。
+// 仅作取数失败时的兜底展示，真实目录以 /model/list 为准。
+export const KNOWN_MODELS = [
+  { key: "flash", name: "标准", priceFactor: 0.1 },
+  { key: "pro", name: "高级", priceFactor: 1 },
+  { key: "qwen3.8-max-preview", name: "Qwen3.8-Max", priceFactor: 1.8 },
+];
+
+// RSA-1024 模数（逐字符转译 _shared/crypto.js 的 RSA_N，勿改）
+export const RSA_MODULUS_HEX =
+  "c0f22307e5cd362e296bb04470f6de8fbf935ce24e8fcf511a0e2701329769c4" +
+  "a76e499bb938036a52af1eaf818cf79a2600620e3ce87e371d2ca6d85803606a" +
+  "1b3fa5e874643c9ed2db7e85673ef7227fca56e2e7c08f0927609bb896a9f24b" +
+  "e1782099a66016a5bfdc3f1ff756bfc9e88d7b5dc5be30bf45a0223a00ebcecf";
+export const RSA_EXPONENT = 65537;
+
+export const LOGIN_TTL_MS = 10 * 60 * 1000;
+export const COOLDOWN_MS = 30_000;
+export const QUOTA_COOLDOWN_MS = 60 * 60 * 1000;
+export const REFRESH_MARGIN_MS = 30 * 60 * 1000;
+export const MODELS_CACHE_MS = 10 * 60 * 1000;