mslxdff 0.1.237 → 0.1.239

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mslxdff",
-  "version": "0.1.237",
+  "version": "0.1.239",
   "description": "测试项目，请勿使用。",
   "type": "module",
   "bin": {

package/src/cli/commands/provider/codearts-checkin.js

@@ -0,0 +1,123 @@
+// mslxdff -provider codearts checkin|quota —— 每日签到领积分（snap-access 的 `/v1/ops/*`）。
+//
+// 子命令：
+//   checkin [--json] [--dry]        逐号补领今日积分（幂等：已到账零写操作；到账只认复查）
+//   quota|credits|balance [--json]  只读查积分余额（`/snap-manager/v1/statistics/plugin`）
+//
+// ⚠ 与 `-provider codearts models` 那条「福利」**不是一回事**：福利走 opengw 的 benefit/claim（模型 Token 账），
+//   积分走 snap-access 的 `/v1/ops/claim`（本文件）。两本账互不影响。
+// ⚠ 判据口径：到账只认「领取后重读活动列表」的状态，不信 claim 回执
+//   （raccoon 踩过「只信回执就谎报到账」，traework 同款纪律）。
+import { normalizeProviderId } from "../../../providers/model-id.js";
+
+const CHECKIN_SUBS = new Set(["checkin", "signin"]);
+const QUOTA_SUBS = new Set(["quota", "credits", "balance"]);
+
+function isCodearts(id) {
+  return (normalizeProviderId(id) || String(id || "").toLowerCase()) === "codearts";
+}
+const uid8 = (account) => String(account?.userId || "(无 uid)").slice(0, 8);
+
+/** 取号：deps.accounts 优先（测试注入，零网络）；否则 keys → provider 的 authPool（带刷新写回）。 */
+async function loadAccounts(deps) {
+  if (Array.isArray(deps.accounts)) return { accounts: deps.accounts, close: null };
+  const { createCodeartsProvider } = await import("../../../providers/codearts/index.js");
+  const provider = createCodeartsProvider({ fetchImpl: deps.fetchImpl });
+  const pool = provider._pool;
+  const accounts = [];
+  for (const cand of pool.aliveAccounts()) {
+    try { accounts.push(await pool.getCredential(cand.blob)); } catch { /* 死号跳过 */ }
+  }
+  return { accounts, close: () => { try { provider.close?.(); } catch { /* ignore */ } } };
+}
+
+/** 逐号补领今日积分。退出码：一个都没成 → 1（旧写法恒 0 会让人以为签好了）。 */
+export async function handleCodeartsCheckin(id, sub, rest = [], deps = {}) {
+  if (!isCodearts(id) || !CHECKIN_SUBS.has(String(sub || "").toLowerCase())) return false;
+  const log = deps.log || ((m) => console.log(m));
+  const exit = deps.exit || ((code) => process.exit(code));
+  const wantsJson = rest.includes("--json") || rest.includes("-json");
+  const dry = rest.includes("--dry") || rest.includes("--probe");
+
+  const { accounts, close } = await loadAccounts(deps);
+  try {
+    if (!accounts.length) {
+      if (wantsJson) log(JSON.stringify({ provider: "codearts", error: "no_accounts", hint: "mslxdff -provider codearts login" }));
+      else log("没有 codearts 账号，请先 mslxdff -provider codearts login");
+      exit(1);
+      return true;
+    }
+    const { runCheckin } = deps.checkinModule || (await import("../../../providers/codearts/checkin.js"));
+    const rows = [];
+    for (const account of accounts) {
+      let r;
+      try {
+        r = await runCheckin({ account, fetchImpl: deps.fetchImpl, dry });
+      } catch (e) {
+        r = { ok: false, status: "error", claimed: 0, credits: 0, message: String(e?.message || e).slice(0, 140) };
+      }
+      const row = { uid: uid8(account), ok: r.ok, status: r.status, claimed: r.claimed, credits: r.credits, msg: String(r.message || "").slice(0, 140) };
+      rows.push(row);
+      if (!wantsJson) {
+        const mark = r.ok ? (r.status === "already" ? "✓ 今日已领取" : r.status === "nothing" ? "－ 无可用签到活动" : `✓ ${r.message}`) : `✗ ${r.message}`;
+        log(`  [${row.uid}] ${mark}`);
+      }
+    }
+    const okCount = rows.filter((r) => r.ok).length;
+    const credits = rows.reduce((s, r) => s + (r.credits || 0), 0);
+    if (wantsJson) {
+      log(JSON.stringify({ provider: "codearts", dry: Boolean(dry), ok: okCount, total: rows.length, credits, accounts: rows }));
+    } else {
+      log("");
+      log(`codearts 签到：${okCount}/${rows.length} 号完成，本次到账 ${credits} 积分`);
+      if (dry) log("  （--dry 干跑：未发任何写请求）");
+    }
+    exit(okCount > 0 ? 0 : 1);
+    return true;
+  } finally {
+    try { close?.(); } catch { /* ignore */ }
+  }
+}
+
+/** 只读：逐号查积分余额（`usageTotalPackageCredit` 口径，分类明细单列不累加）。 */
+export async function handleCodeartsQuota(id, sub, rest = [], deps = {}) {
+  if (!isCodearts(id) || !QUOTA_SUBS.has(String(sub || "").toLowerCase())) return false;
+  const log = deps.log || ((m) => console.log(m));
+  const exit = deps.exit || ((code) => process.exit(code));
+  const wantsJson = rest.includes("--json") || rest.includes("-json");
+
+  const { accounts, close } = await loadAccounts(deps);
+  try {
+    if (!accounts.length) {
+      if (wantsJson) log(JSON.stringify({ provider: "codearts", error: "no_accounts", hint: "mslxdff -provider codearts login" }));
+      else log("没有 codearts 账号，请先 mslxdff -provider codearts login");
+      exit(1);
+      return true;
+    }
+    const { fetchCreditBalance } = deps.checkinModule || (await import("../../../providers/codearts/checkin.js"));
+    const rows = [];
+    for (const account of accounts) {
+      let r;
+      try { r = await fetchCreditBalance({ account, fetchImpl: deps.fetchImpl }); } catch (e) { r = { ok: false, error: String(e?.message || e).slice(0, 140) }; }
+      rows.push({ uid: uid8(account), ok: r.ok, total: r.total, used: r.used, remain: r.remain, tokenUsage: r.tokenUsage, error: r.ok ? "" : String(r.error || `HTTP ${r.status || "-"}`).slice(0, 140) });
+    }
+    const failed = rows.filter((r) => !r.ok).length;
+    const allBad = rows.length > 0 && failed === rows.length;
+    if (wantsJson) {
+      log(JSON.stringify({ provider: "codearts", ok: rows.length - failed, total: rows.length, note: "remain=余额；total 是总额非上限", accounts: rows }));
+      exit(allBad ? 1 : 0);
+      return true;
+    }
+    log(`codearts 积分 · 共 ${rows.length} 个号`);
+    for (const r of rows) {
+      if (!r.ok) { log(`  [${r.uid}] ❌ ${r.error}`); continue; }
+      log(`  [${r.uid}] 剩余 ${r.remain} / 共 ${r.total}（已用 ${r.used}）· token 用量 ${r.tokenUsage}`);
+    }
+    log("");
+    log("  每日签到: mslxdff -provider codearts checkin");
+    exit(allBad ? 1 : 0);
+    return true;
+  } finally {
+    try { close?.(); } catch { /* ignore */ }
+  }
+}

package/src/cli/commands/provider/index.js

@@ -42,6 +42,7 @@ export async function handleProvider(args) {
     console.error("            mslxdff -provider add myapi https://api.example.com/v1 sk-xxx --models-path /v1/models --chat-path /v1/chat/completions");
     console.error("            mslxdff -provider openrouter                      interactive hidden input (append)");
     console.error("            mslxdff -provider codearts login          华为云 CodeArts PKCE 授权（浏览器登录 → 凭证 blob 落盘，ADR-0027）");
+    console.error("            mslxdff -provider codearts checkin|quota [--json] [--dry]  每日签到领积分 / 查积分余额（snap-access /v1/ops/*；与 models 那条福利是两本账）");
     console.error("            mslxdff -provider qoder login [--region cn|global]   Qoder 设备授权（国际站默认，国内站 --region cn）");
     console.error("            mslxdff -provider qoder checkin [--json] [--region cn|global] [--any] [--dry]  每日签到领积分（cn=daily-check-in，global=campaigns）");
     console.error("            mslxdff -provider zcode login [--bigmodel]       ZCode 授权（智谱免费额度，Start/Coding Plan）");
@@ -80,6 +81,9 @@ export async function handleProvider(args) {
   if (await handleWorkbuddyQuota(id, sub, rest)) return true;
   const { handleCodeartsLogin } = await import("./codearts-login.js");
   if (await handleCodeartsLogin(id, sub, rest)) return true;
+  const { handleCodeartsCheckin, handleCodeartsQuota } = await import("./codearts-checkin.js");
+  if (await handleCodeartsCheckin(id, sub, rest)) return true;
+  if (await handleCodeartsQuota(id, sub, rest)) return true;
   const { handleTraeworkLogin } = await import("./traework-login.js");
   if (await handleTraeworkLogin(id, sub, rest)) return true;
   const { handleTraeworkCheckin, handleTraeworkQuota } = await import("./traework-checkin.js");

package/src/cli/commands/provider/keys-guard.js

@@ -10,6 +10,8 @@ import { AUTH_DOC_PROVIDER_IDS } from "../../../runtime/provider-gate.js";
 // 保留子命令：这些词归 provider/ 下别的 handler 管，掉到 keys 兜底 = 该 provider 没接线。
 // 名单 = 各 handler 实际比对的 sub 值全集（keys.js 自己认的 list/status/add/remove/clear 不在内）。
 // 新增 handler 时同步这里；漏收的后果是那个词能被当 key 写盘。
+/** 覆盖式写 keys 时，单个候选 token 的最小可信长度（闸 3 判据：真 key 都远长于此）。 */
+export const MIN_KEY_CHARS = 11;
 export const RESERVED_PROVIDER_SUBS = new Set([
   "login", "auth", "oauth", "checkin", "signin", "quota", "credits", "balance",
   "migrate", "free", "bench", "benchmark", "eval", "test",
@@ -17,6 +19,7 @@ export const RESERVED_PROVIDER_SUBS = new Set([
   "set-url", "set-models-path", "set-chat-path", "url", "seturl", "setmodelspath", "setchatpath",
   "allowlist", "allow", "allowed", "allowany", "allow-any", "allow_any", "whitelist",
   "del", "delete", "rm", "remove-provider", "del-provider", "import", "import-desktop", "from-desktop",
+  "help", "usage", "usage-all",
 ]);
 
 /**
@@ -46,5 +49,22 @@ export function keysWriteDenial(id, sub, rest = []) {
       `  确知自己在做什么 → 末尾加 --force 重跑`,
     ];
   }
+  // 闸 3：形状闸。2026-10-24 复现同类事故 —— `mslxdff -provider codearts help` 里 `help` 既不是
+  // 保留 verb（闸 1 名单里没有它），codearts 又不属于 auth 号型六家（闸 2 不管它），于是 `help` 一路
+  // 掉进「未知即当 key」的兜底分支，把 providerConfigs.codearts.keys 的 2 条真凭据整组覆盖成 "help"。
+  // 判据：真 key 的长度都远超 10 字符（openrouter ~73、traework accessToken 实测 1004、codearts blob
+  // 上千），而 ≤10 字符的裸词几乎必然是打错位置的子命令/模型名/文件名 —— 覆盖式 set 写进去就是当场废号。
+  // 逃生阀：`--force`，或改走只追加、不覆盖的 `add`。
+  const shortTokens = rest
+    .map((k) => String(k || "").trim())
+    .filter((k) => k && !k.startsWith("-") && k.length < MIN_KEY_CHARS);
+  if (shortTokens.length && !rest.includes("--force")) {
+    return [
+      `✗ -provider ${id} ${sub}：疑似把「${shortTokens.join("、")}」当 API key 覆盖 ${id} 现有 keys —— 已拒绝，配置未改动`,
+      `  拦截原因：key 长度不足 ${MIN_KEY_CHARS} 字符（真 key 都远长于此），多半是子命令/模型名打错了位置。`,
+      `  ${id} 支持什么：mslxdff -provider ${id} list`,
+      `  确知是短 key（自建桩服务）→ 末尾加 --force 重跑，或走只追加的 mslxdff -provider ${id} add <key>`,
+    ];
+  }
   return null;
 }

package/src/providers/codearts/checkin.js

@@ -0,0 +1,198 @@
+// codearts 每日签到领积分（`/v1/ops/*`）—— 与 `claimBenefit` 的「模型 Token 福利」是**两本账**。
+// 协议三方交叉验证：HITZY2002/codearts2api `internal/upstream/checkin.go`（Go）、
+// L0NE-6/CodeArts-Daily `codearts_daily.py`（青龙）、anye-99·gurio-wine `src/codearts-credits.ts`（TS）。
+// 现网取证 2026-10-24：`GET /v1/ops/delivery?channel=IDE` → 4 个活动，`#1 USER_LOGIN` 每日 1000 积分。
+// 字段坑：`campaignId` 是**数字**、积分字段叫 **`benefitAmount`**、不可领取时 `status` 是 **`null`**。
+import { SNAP_BASE } from "./const.js";
+import { compatFetch, timeoutSignal } from "../../compat.js";
+import { signRequest } from "./sign.js";
+
+/** 活动列表/领取/确认的渠道标识（声明请求来自 IDE 形态；官方文档与两个参考实现同值）。 */
+export const OPS_CHANNEL = "IDE";
+/** ops 路由需要的 Agent-Type；值错会 `TM.00001001`（空→未找到合法可路由 api）。 */
+export const OPS_AGENT_TYPE = "PromptCenter";
+export const EP_OPS_DELIVERY = "/v1/ops/delivery";
+export const EP_OPS_CLAIM = "/v1/ops/claim";
+export const EP_OPS_CONFIRM = "/v1/ops/confirm";
+export const EP_PACKAGE_INFO = "/snap-manager/v1/statistics/plugin";
+export const snapBase = () => SNAP_BASE;
+
+/** 只领这两类：每日签到 + 新用户注册礼（INVITE_USER / STUDENT_CERTIFIED 不是每日任务，不碰）。 */
+const DAILY_TYPES = new Set(["USER_LOGIN", "NEW_USER_REGISTER"]);
+/** 已到账态：这几个状态下绝不 claim（幂等只靠活动列表预检，上游没有业务码兜底）。 */
+const DONE_STATUSES = new Set(["CONFIRMED", "CONSUMED"]);
+
+/**
+ * 解析活动列表。业务码非 0 或缺 `data.items` → 空表（不臆造契约）。
+ * @returns {Array<{id:number,type:string,title:string,credit:number,unit:string,claimable:boolean,status:string}>}
+ */
+export function parseCreditCampaigns(payload) {
+  const items = payload?.data?.items;
+  if (!Array.isArray(items)) return [];
+  const out = [];
+  for (const it of items) {
+    const id = Number(it?.campaignId);
+    if (!Number.isFinite(id)) continue; // campaignId 缺失的条目没法回传，丢掉
+    out.push({
+      id,
+      type: String(it?.type || ""),
+      title: String(it?.title || ""),
+      // 对齐参考实现：`res.Credits = pendingTotalAmount || benefitAmount`（待结算优先，缺则取活动额）
+      credit: Number(it?.pendingTotalAmount) || Number(it?.benefitAmount) || 0,
+      unit: String(it?.benefitUnit || ""),
+      claimable: it?.claimable === true,
+      status: it?.status == null ? "" : String(it.status),
+    });
+  }
+  return out;
+}
+
+/**
+ * 由活动列表推出本次要做的写操作（纯函数，便于单测）。
+ * 判据：只有 `claimable===true` 才 claim；`status==="CLAIMED"` 只补 confirm；已到账态零动作。
+ * @returns {Array<{kind:"claim"|"confirm", id:number, credit:number, title:string}>}
+ */
+export function planCreditActions(campaigns) {
+  const out = [];
+  for (const c of Array.isArray(campaigns) ? campaigns : []) {
+    if (!DAILY_TYPES.has(c?.type)) continue;
+    if (c.unit && c.unit !== "CREDIT") continue; // 非积分账本不碰
+    if (!Number.isFinite(c.id) || c.id <= 0) continue;
+    if (c.status === "CLAIMED") { out.push({ kind: "confirm", id: c.id, credit: c.credit, title: c.title }); continue; }
+    if (DONE_STATUSES.has(c.status)) continue;
+    // 只有 ELIGIBLE + claimable 才 claim（参考实现：status 空 = 未获得活动资格；未知状态不臆造）
+    if (c.status === "ELIGIBLE" && c.claimable) out.push({ kind: "claim", id: c.id, credit: c.credit, title: c.title });
+  }
+  return out;
+}
+
+// ─────────────────────────── HTTP 层（签名 + 写操作） ───────────────────────────
+
+function credOf(account) {
+  return { accessKeyId: account?.accessKeyId, secretAccessKey: account?.secretAccessKey, securityToken: account?.securityToken };
+}
+
+/**
+ * 签名 ops 请求。只把 `content-type`（+ `sign.js` 自己加的 host/x-sdk-*）送进 canonical；
+ * `agent-type` 与 `x-language` 必须**签名后追加**（参考实现口径：进 canonical 会 401）。
+ */
+async function opsRequest({ account, path, method = "GET", body, fetchImpl, baseUrl, timeoutMs = 20_000 } = {}) {
+  const url = `${baseUrl || snapBase()}${path}`;
+  const payload = body === undefined ? "" : JSON.stringify(body);
+  const { headers: signedHeaders } = signRequest({
+    method, url, headers: { "content-type": "application/json" }, body: payload, cred: credOf(account),
+  });
+  signedHeaders["agent-type"] = OPS_AGENT_TYPE;
+  signedHeaders["x-language"] = "zh-cn";
+  const doFetch = fetchImpl || compatFetch;
+  let res;
+  try {
+    res = await doFetch(url, { method, headers: signedHeaders, ...(body === undefined ? {} : { body: payload }), signal: timeoutSignal(timeoutMs) });
+  } catch (e) {
+    return { status: 0, json: null, text: "", error: String(e?.message || e).slice(0, 200) };
+  }
+  const text = await res.text().catch(() => "");
+  let json = null;
+  if (text) { try { json = JSON.parse(text); } catch { /* 非 JSON：沿用 text 给调用方看 */ } }
+  return { status: res.status, json, text };
+}
+
+/** 上游业务码非 0 即失败（`{code:4000,message:"invalid channel, group not found"}` 这种）。 */
+const bizFailed = (r) => Boolean(r?.json) && r.json.code != null && Number(r.json.code) !== 0;
+const errOf = (r) => r.error
+  || (bizFailed(r) ? String(r.json.message || `code=${r.json.code}`).slice(0, 180)
+    : (r.status === 200 ? "" : String(r.text || "").slice(0, 180)));
+
+/** 读活动列表（只读）。 */
+export async function fetchCreditCampaigns(opts = {}) {
+  const r = await opsRequest({ ...opts, path: `${EP_OPS_DELIVERY}?channel=${OPS_CHANNEL}` });
+  if (r.status !== 200) return { ok: false, status: r.status, campaigns: [], error: errOf(r), code: r.json?.code };
+  if (bizFailed(r)) return { ok: false, status: 200, campaigns: [], error: errOf(r), code: r.json.code };
+  return { ok: true, status: 200, campaigns: parseCreditCampaigns(r.json), error: "" };
+}
+
+/** 领取：`{campaignId, channel, idempotentKey}`（幂等键带毫秒时间戳，与参考实现同形状）。 */
+export async function claimCreditCampaign({ campaignId, now = Date.now, ...opts } = {}) {
+  const body = { campaignId, channel: OPS_CHANNEL, idempotentKey: `claim_${campaignId}_${now()}` };
+  const r = await opsRequest({ ...opts, path: EP_OPS_CLAIM, method: "POST", body });
+  return { ok: r.status === 200 && !bizFailed(r), status: r.status, json: r.json, error: errOf(r) };
+}
+
+/** 确认到账：`{campaignId}`。claim 之后无条件补这一步，否则状态停在 CLAIMED 不算到账。 */
+export async function confirmCreditCampaign({ campaignId, ...opts } = {}) {
+  const r = await opsRequest({ ...opts, path: EP_OPS_CONFIRM, method: "POST", body: { campaignId } });
+  return { ok: r.status === 200 && !bizFailed(r), status: r.status, json: r.json, error: errOf(r) };
+}
+
+/**
+ * 单账号签到：列表 → (claim → confirm) → **重读列表复查**。
+ * 到账只认复查后的状态（raccoon/traework 同款纪律：只信回执就会谎报到账）。
+ */
+export async function runCheckin({ account, fetchImpl, baseUrl, timeoutMs, dry = false, now = Date.now } = {}) {
+  const common = { account, fetchImpl, baseUrl, timeoutMs };
+  const r = { account: account?.userId || null, ok: false, status: "error", dry: false, claimed: 0, credits: 0, actions: [], writes: [], campaigns: [], message: "" };
+  const first = await fetchCreditCampaigns(common);
+  r.campaigns = first.campaigns;
+  if (!first.ok) { r.message = `查询活动失败 HTTP ${first.status || "-"}${first.error ? `：${first.error}` : ""}`; return r; }
+
+  const actions = planCreditActions(first.campaigns);
+  r.actions = actions;
+  if (!actions.length) {
+    const done = first.campaigns.some((c) => DAILY_TYPES.has(c.type) && DONE_STATUSES.has(c.status));
+    r.ok = true;
+    r.status = done ? "already" : "nothing";
+    r.message = done ? "今日已领取（零写操作）" : "无可用签到活动";
+    return r;
+  }
+  if (dry) {
+    r.ok = true; r.dry = true; r.status = "claimable";
+    r.message = `干跑：${actions.length} 项待领，未发写请求`;
+    return r;
+  }
+
+  for (const a of actions) {
+    if (a.kind === "claim") {
+      const c1 = await claimCreditCampaign({ ...common, campaignId: a.id, now });
+      r.writes.push({ kind: "claim", id: a.id, ok: c1.ok, status: c1.status, error: c1.error });
+      if (!c1.ok) continue; // claim 失败则不 confirm（对齐参考实现：claim 错即返回）
+    }
+    const c2 = await confirmCreditCampaign({ ...common, campaignId: a.id });
+    r.writes.push({ kind: "confirm", id: a.id, ok: c2.ok, status: c2.status, error: c2.error });
+  }
+
+  const after = await fetchCreditCampaigns(common);
+  if (after.ok) r.campaigns = after.campaigns;
+  const landed = (after.campaigns || []).filter((c) => actions.some((a) => a.id === c.id) && DONE_STATUSES.has(c.status));
+  r.claimed = landed.length;
+  r.credits = landed.reduce((s, c) => s + (c.credit || 0), 0);
+  if (landed.length) {
+    r.ok = true; r.status = "claimed";
+    r.message = `签到到账 +${r.credits} 积分（${landed.length} 项：${landed.map((c) => `#${c.id}`).join(" ")}）`;
+  } else {
+    const bad = r.writes.find((w) => !w.ok);
+    r.status = "not-landed";
+    r.message = `写请求已发但复查仍未到账（不许当今天签过）：${bad ? `${bad.kind} HTTP ${bad.status || "-"} ${bad.error || ""}` : "重读活动列表后状态未变"}`.slice(0, 220);
+  }
+  return r;
+}
+
+/** 积分账本：取 `usageTotalPackageCredit` 的总额/已用/剩余（分类明细单列，**不累加**）。 */
+export async function fetchCreditBalance(opts = {}) {
+  const r = await opsRequest({ ...opts, path: EP_PACKAGE_INFO });
+  if (r.status !== 200) return { ok: false, status: r.status, error: errOf(r) };
+  const metrics = Array.isArray(r.json?.metrics) ? r.json.metrics : [];
+  const num = (v) => Number(v) || 0;
+  const pick = (name) => metrics.find((m) => m?.name === name);
+  const creditOf = (m) => (m ? { total: num(m.package_credit_amount), used: num(m.package_credit_used), remain: num(m.package_credit_remain) } : null);
+  const totalM = pick("usageTotalPackageCredit");
+  const tokenM = pick("usageTokenChatMessages");
+  return {
+    ok: true, status: 200,
+    total: num(totalM?.package_credit_amount), used: num(totalM?.package_credit_used), remain: num(totalM?.package_credit_remain),
+    basic: creditOf(pick("usageBasicPackageCredit")),
+    bonus: creditOf(pick("usageBonusPackageCredit")),
+    onDemand: creditOf(pick("useOnDemandPackageCredit")) || creditOf(pick("usageOnDemandPackageCredit")),
+    tokenUsage: num(tokenM?.usage_token_num), tokenPackages: num(tokenM?.package_token_amount),
+    isCreditPackage: Boolean(totalM),
+  };
+}

package/src/providers/codearts/const.js

@@ -44,12 +44,19 @@ export const MAAS_TYPE_HEADER = "maas_type";
 export const MAAS_BENEFIT = "benefit";
 
 // 冷启动种子：福利套餐轮换后新模型在首次发现前也按福利路由（宁多带不少带，少带即 404）。
-// 现网取证 2026-10-16（福利网关 /api/v1/gateway/config，error_code=0000）共 4 位：下列 4 个 id 逐字对齐上游。
-export const SEED_BENEFIT_MODELS = ["deepseek-v4-flash-0731", "deepseek-v4-pro-0813", "deepseek-v4.1-flash", "glm-5.3-flash"];
-// 内置模型种子（仅用于大小写归一，不标福利）。
+// 现网取证 2026-10-16（福利网关 /api/v1/gateway/config，error_code=0000）共 4 位：下列 id 逐字对齐上游。
+// 2026-10-24 再取证：`deepseek-v4.1-flash` 已转 builtin 正式模型（福利网关该号已空）。它留在福利种子里
+// 是有害的 —— preheat 未回来时带福利头 → InferHub.4004.200 benefit not found，不带才 200。故移出、转入正式表。
+export const SEED_BENEFIT_MODELS = ["deepseek-v4-flash-0731", "deepseek-v4-pro-0813", "glm-5.3-flash"];
+// 内置模型种子（仅用于大小写归一，不标福利）。id 一律写上游真正的 model_id 大小写：
+// `deepseek-v4.1-flash` 是全小写，`GLM-5.2` 就是混合大小写——猜错即 InferHub.002002009.404。
 export const SEED_KNOWN_MODELS = [
-  "GLM-5.2", "GLM-5.2-ArkTS-SPARK", "GLM-5.1", "GLM-4.7",
-  "OpenPangu-2.0-Pro", "OpenPangu-2.0-Flash",
+  // 现网取证 2026-10-24（builtin 路真 model_id 逐字）：这些就是全小写，展示名（OpenPangu-2.0-Pro /
+  // GLM-5.3 / Kimi-K3）出自 agent-center 的 model_name，当 id 发上去必 InferHub.002002009.404。
+  // 同名漂移记在 name 字段，不占用 id：GLM-5.2-ArkTS-SPARK 的真 id 是 glm-5.2-sft-harmony。
+  "deepseek-v4.1-flash", "glm-5.3", "kimi-k3", "openpangu-2.0-pro", "openpangu-2.0-flash",
+  "glm-5.2-sft-harmony", "kimi-k2.6-vl",
+  "GLM-5.2", "GLM-5.1", "GLM-4.7",
   "Qwen3-VL-235B", "Qwen3.5-397B-A17B-VL", "Qwen3.6-27B-VL",
 ];
 

package/src/providers/codearts/models.js

@@ -14,8 +14,19 @@ const lower = (s) => String(s || "").trim().toLowerCase();
 
 export function createCatalog() {
   const known = new Map(); // lower → 精确 ID（种子 + 已发现，大小写归一单点）
+  const knownReal = new Set(); // 该精确 ID 出自上游真正的 model_id（不是展示名兜底）
+
+  // id 权威性：真正的 model_id > 展示名（agent-center 无 model_id 时拿 model_name 顶包，
+  // 发上去必 InferHub.002002009.404）；同级才用历史规则「非小写的精确大小写覆盖小写」。
+  function noteKnown(key, id, byModelId) {
+    if (!known.has(key)) { known.set(key, id); if (byModelId) knownReal.add(key); return; }
+    if (byModelId && !knownReal.has(key)) { known.set(key, id); knownReal.add(key); return; }
+    if (!!byModelId === knownReal.has(key) && id !== key && known.get(key) === key) known.set(key, id);
+  }
+
   for (const id of [...SEED_KNOWN_MODELS, ...SEED_BENEFIT_MODELS]) {
-    if (!known.has(lower(id))) known.set(lower(id), id);
+    const key = lower(id);
+    if (key) noteKnown(key, id, false); // 种子按展示名记账：真 model_id 一发现就覆盖它
   }
   const accounts = new Map(); // userId → {models, benefit:Set, knows:Set, lastBenefit:Map, fetched}
 
@@ -28,7 +39,7 @@ export function createCatalog() {
       const key = lower(m.id);
       ac.knows.add(key);
       if (m.benefit) { ac.benefit.add(key); ac.lastBenefit.set(key, m); }
-      if (!known.has(key) || m.id !== key) known.set(key, m.id);
+      noteKnown(key, m.id, m.byModelId);
       ac.models.push(m);
     }
     if (keepBenefit) {
@@ -38,7 +49,7 @@ export function createCatalog() {
         ac.benefit.add(key);
         ac.knows.add(key);
         ac.models.push(mi);
-        if (!known.has(key) || mi.id !== key) known.set(key, mi.id);
+        noteKnown(key, mi.id, mi.byModelId);
       }
       ac.models.sort((a, b) => (lower(a.id) < lower(b.id) ? -1 : lower(a.id) > lower(b.id) ? 1 : (a.id < b.id ? -1 : 1)));
     }
@@ -72,7 +83,7 @@ export function createCatalog() {
   return { setAccount, isBenefit, canonical, accountModels, isStale };
 }
 
-/** 多路合并：按小写 ID 去重，福利标记取或，参数更全/精确大小写优先，按小写 ID 排序。 */
+/** 多路合并：按小写 ID 去重，福利标记取或，真 model_id 优先 > 参数更全 > 精确大小写，按小写 ID 排序。 */
 export function mergeModels(sets) {
   const merged = new Map();
   for (const set of sets || []) {
@@ -81,7 +92,11 @@ export function mergeModels(sets) {
       const key = lower(m.id);
       const cur = merged.get(key);
       if (!cur) { merged.set(key, { ...m }); continue; }
-      const keep = (m.contextWindow > 0 && !cur.contextWindow) || (m.id !== lower(m.id) && cur.id === lower(cur.id)) ? m : cur;
+      // 上游真正的 model_id 优先于展示名：agent-center 那份只有 model_name（DeepSeek-V4.1-Flash），
+      // builtin 那份才是可请求的 id（deepseek-v4.1-flash）；发错大小写 = InferHub.002002009.404。
+      const keep = !!m.byModelId !== !!cur.byModelId
+        ? (m.byModelId ? m : cur)
+        : ((m.contextWindow > 0 && !cur.contextWindow) || (m.id !== lower(m.id) && cur.id === lower(cur.id)) ? m : cur);
       const drop = keep === m ? cur : m;
       merged.set(key, {
         ...keep,
@@ -130,6 +145,9 @@ const toModelInfo = (m, { benefit = false } = {}) => {
   if (!id) return null;
   return {
     id: String(id),
+    // 出处记账：只有真正的 model_id 字段才敢当「发给上游的 id」；靠 model_name/modelAlias
+    // 兜底出来的是展示名，上游 InferHub 不认（现网 2026-10-24：DeepSeek-V4.1-Flash 必 404）。
+    byModelId: !!m?.model_id,
     name: String(m?.model_name || id),
     contextWindow: Number(m?.context_window) || 0,
     maxTokens: Number(m?.max_tokens) || 0,

package/src/runtime/bootstrap.js

@@ -68,6 +68,11 @@ export async function startDaemonMain(VERSION) {
     try { logs.appendEvent({ ts: Date.now(), type: "raccoon-checkin-setup-failed", error: String(e?.message || e).slice(0, 200) }); } catch {}
   });
 
+  const { setupCodeartsCheckin } = await import("./codearts-checkin.js");
+  void setupCodeartsCheckin({ bus, logs }).catch((e) => {
+    try { logs.appendEvent({ ts: Date.now(), type: "codearts-checkin-setup-failed", error: String(e?.message || e).slice(0, 200) }); } catch {}
+  });
+
   const { setupWorkbuddyGrowth } = await import("./workbuddy-growth.js");
   void setupWorkbuddyGrowth({ bus, logs }).catch((e) => {
     try { logs.appendEvent({ ts: Date.now(), type: "workbuddy-growth-setup-failed", error: String(e?.message || e).slice(0, 200) }); } catch {}

package/src/runtime/codearts-checkin.js

@@ -0,0 +1,115 @@
+/**
+ * codearts 每日签到领积分（daemon 内置），仿 src/runtime/qoder-checkin.js。
+ * 开关：MSLXDFF_CODEARTS_CHECKIN=0 关闭（默认开）；时间：MSLXDFF_CODEARTS_CHECKIN_HOUR（默认 9 点）。
+ * 账号源：providerConfigs.codearts.keys 的凭据 blob —— 复用 createCodeartsProvider 的 authPool，
+ * 刷新轮转换号**原位写回**（自己写 saveFn 会与 chat 路径的写回逻辑分叉）。
+ * 该上游对并发极敏感 → 逐号**串行**；ops 是独立端点，不占 chat 的并发闸（3 会话上限不受影响）。
+ * 记账：state.codeartsCheckin {date, at, ok, total, credits, accounts:[…]}（qoder/workbuddy 同款）。
+ */
+import { todayKey, nextRunDelayMs, shouldCatchUp } from "./workbuddy-checkin.js";
+
+export function isCheckinEnabled(env = process.env) {
+  const v = String(env.MSLXDFF_CODEARTS_CHECKIN ?? "1").trim().toLowerCase();
+  return !["0", "false", "off", "no"].includes(v);
+}
+
+export function getCheckinHour(env = process.env) {
+  const h = Number(env.MSLXDFF_CODEARTS_CHECKIN_HOUR);
+  return Number.isInteger(h) && h >= 0 && h <= 23 ? h : 9;
+}
+
+export async function setupCodeartsCheckin({ bus, logs, deps = {} } = {}) {
+  const env = deps.env || process.env;
+  function emit(type, data = {}) {
+    const entry = { ts: Date.now(), type, ...data };
+    try { bus?.emit(entry); } catch { /* 事件不阻断签到 */ }
+    try { logs?.appendEvent?.(entry); } catch { /* 同上 */ }
+    try { console.log(`[codearts-checkin] ${type} ${JSON.stringify(data)}`.slice(0, 500)); } catch { /* 同上 */ }
+  }
+  if (!isCheckinEnabled(env)) {
+    console.log("[codearts-checkin] disabled (set MSLXDFF_CODEARTS_CHECKIN=1 to enable)");
+    emit("codearts-checkin-disabled");
+    return { enabled: false };
+  }
+  const hour = getCheckinHour(env);
+  console.log(`[codearts-checkin] enabled: daily ${String(hour).padStart(2, "0")}:00 local, multi-account serial`);
+  emit("codearts-checkin-enabled", { hour });
+
+  const stateMod = await import("../state.js");
+
+  /** 取号：deps.accounts 优先（测试注入，零网络）；否则走 provider 的 authPool（缺省带写回）。 */
+  async function loadAccounts() {
+    if (Array.isArray(deps.accounts)) return { accounts: deps.accounts, close: null };
+    const { createCodeartsProvider } = await import("../providers/codearts/index.js");
+    const provider = deps.provider || createCodeartsProvider({ fetchImpl: deps.fetchImpl });
+    const pool = provider._pool;
+    const accounts = [];
+    let candidates = [];
+    try { candidates = pool.aliveAccounts() || []; } catch { candidates = []; }
+    for (const cand of candidates) {
+      try { accounts.push(await pool.getCredential(cand.blob)); } catch { /* 死号跳过，别拖垮整轮 */ }
+    }
+    return { accounts, close: () => { try { provider.close?.(); } catch { /* ignore */ } } };
+  }
+
+  let running = false;
+  async function runOnce(reason) {
+    if (running) return { skipped: "already-running" };
+    running = true;
+    let cleanup = null;
+    try {
+      const loaded = await loadAccounts();
+      cleanup = loaded.close;
+      const accounts = loaded.accounts;
+      if (!accounts.length) {
+        emit("codearts-checkin-no-accounts", { reason });
+        return { ok: false, reason: "no-accounts" };
+      }
+      const { runCheckin } = await import("../providers/codearts/checkin.js");
+      const rows = [];
+      for (const account of accounts) { // 逐号串行：该上游对并发极敏感
+        const uid = String(account?.userId || "").slice(0, 8);
+        try {
+          const r = await runCheckin({ account, fetchImpl: deps.fetchImpl });
+          rows.push({ uid, ok: r.ok, status: r.status, claimed: r.claimed, credits: r.credits, msg: String(r.message || "").slice(0, 140) });
+        } catch (e) {
+          rows.push({ uid, ok: false, status: "error", claimed: 0, credits: 0, msg: String(e?.message || e).slice(0, 140) });
+        }
+      }
+      const okCount = rows.filter((r) => r.ok).length;
+      const credits = rows.reduce((s, r) => s + (r.credits || 0), 0);
+      const date = todayKey();
+      try {
+        stateMod.writeStateImmediate(stateMod.defaultStateFile(), {
+          codeartsCheckin: { date, at: Date.now(), ok: okCount, total: rows.length, credits, accounts: rows },
+        });
+      } catch { /* 落盘失败不影响本次结果 */ }
+      for (const r of rows) emit("codearts-checkin-account", { ...r, reason });
+      emit("codearts-checkin-done", { date, ok: okCount, total: rows.length, credits, reason });
+      return { ok: okCount > 0, okCount, total: rows.length, rows };
+    } catch (e) {
+      emit("codearts-checkin-failed", { error: String(e?.message || e).slice(0, 200), reason });
+      return { ok: false, error: String(e?.message || e).slice(0, 200) };
+    } finally {
+      try { cleanup?.(); } catch { /* ignore */ }
+      running = false;
+    }
+  }
+
+  // 启动补跑：已过今日计划点、且（从没签过 或 上次不是今天）
+  try {
+    const lastDate = stateMod.readState(stateMod.defaultStateFile())?.codeartsCheckin?.date || "";
+    if (shouldCatchUp({ lastDate, hour })) {
+      setTimeout(() => { runOnce("catch-up").catch(() => {}); }, 90_000).unref?.();
+      console.log(`[codearts-checkin] catch-up scheduled (last=${lastDate || "never"})`);
+    }
+  } catch { /* 读 state 失败就不补跑，等定时 */ }
+  function arm() {
+    const delay = nextRunDelayMs(new Date(), hour);
+    setTimeout(() => {
+      runOnce("daily").catch(() => {}).finally(arm);
+    }, delay).unref?.();
+  }
+  arm();
+  return { enabled: true, hour, runOnce };
+}