mslxdff 0.1.238 → 0.1.240

package/src/multi-ip-pool/tunnel.js

@@ -0,0 +1,280 @@
+// multi-ip-pool · 一槽一条 openvpn 子进程 + 一条独立策略路由表。
+//
+// 为什么这么装（照参照实现 aimili-vpngate 的必要动作，但这里每槽各一套）：
+//   openvpn 起来后内核多一个 tunX 设备，VPNGate 推给它的内网地址就是**本槽的源地址**；
+//   把「源地址 = <tunX 地址> 的包」整表引到「默认路由 = tunX」的策略表里，
+//   该槽的出站（含 undici 的 connect.localAddress 绑定）就只会从这条隧道出去。
+//   ⇒ 一块网卡上 N 条隧道、N 个真实出口，互不干扰（参照实现一次只挂 1 条）。
+//
+// 平台纪律：只有 Linux 能干（tun + `ip rule`）；其它平台由调用方**诚实跳过一行**，不做半吊子。
+import { spawn } from "node:child_process";
+import { devNameFor, tableFor } from "./config.js";
+import { tailReason } from "../warp-pool/revive.js";
+import { fmtExit, fmtRpf, fmtRuleFail, fmtSpawn, fmtTunAddrFail } from "./report.js";
+
+/** openvpn 就绪标志（配置文件里可能出现别的 "Sequence"，必须整串匹配）。 */
+export const READY_PATTERN = /Initialization Sequence Completed/;
+
+/** 策略路由表号 → 规则优先级：落在 main(32766) 之前，且多槽之间固定可复现。 */
+export const RULE_PRIORITY_BASE = 20_000;
+
+export function rulePriorityFor(i) {
+  return RULE_PRIORITY_BASE + i;
+}
+
+/** 只有 Linux 支持：tun 设备 + `ip rule`/`ip route`。 */
+export function isSupportedPlatform(platform = process.platform) {
+  return platform === "linux";
+}
+
+export function isRoot(getuid = process.getuid?.bind(process)) {
+  try {
+    return typeof getuid === "function" ? getuid() === 0 : true; // 取不到 uid 的平台上由平台门先拦
+  } catch {
+    return true;
+  }
+}
+
+/**
+ * openvpn 命令行。**dev 与路由一律走命令行覆盖**（命令行优先于 config 文件）：
+ * `--route-nopull` + `--pull-filter ignore redirect-gateway` 保证它绝不碰主路由表——
+ * 主路由表被改 = 整台机器的流量（含 daemon 自己打上游）都被拽进隧道，那是灾难。
+ */
+export function buildOpenvpnArgs({ conf, dev, authFile, logFile = "", verb = 3 }) {
+  return [
+    "--config", conf,
+    "--dev", dev,
+    "--auth-user-pass", authFile,
+    "--route-nopull",
+    "--pull-filter", "ignore", "redirect-gateway",
+    "--verb", String(verb),
+    ...(logFile ? ["--log", logFile] : []),
+  ];
+}
+
+/** 从 `ip -4 addr show dev <dev>` 输出里取 tun 地址（VPNGate 推的是 10.x 内网地址）。 */
+export function parseTunAddr(text) {
+  const m = /inet\s+(\d+\.\d+\.\d+\.\d+)/.exec(String(text || ""));
+  return m ? m[1] : "";
+}
+
+/** 该槽要装的策略路由（纯函数）：源地址定表 → 表里默认走隧道。 */
+export function tunnelUpCommands({ tunIp, table, dev, priority }) {
+  return [
+    ["ip", "rule", "add", "from", `${tunIp}/32`, "lookup", String(table), "priority", String(priority)],
+    ["ip", "route", "replace", "default", "dev", dev, "table", String(table)],
+  ];
+}
+
+/** 拆槽时按相反顺序撤（先撤表、再撤规则）。 */
+export function tunnelDownCommands({ tunIp, table }) {
+  return [
+    ["ip", "route", "flush", "table", String(table)],
+    ["ip", "rule", "del", "from", `${tunIp}/32`, "lookup", String(table)],
+  ];
+}
+
+/** `ip rule` 的优先级和表号都可能是别人先占的——失败要能一眼看出「占了什么」。 */
+export function rpFilterPaths() {
+  return [
+    "/proc/sys/net/ipv4/conf/all/rp_filter",
+    "/proc/sys/net/ipv4/conf/default/rp_filter",
+  ];
+}
+
+/** 逐行跑命令；超时 SIGKILL（绝不让一个卡住的 ip 调用把启动挂死）。 */
+export function runCmd(cmd, args = [], { timeoutMs = 10_000, spawnFn = spawn } = {}) {
+  return new Promise((resolve) => {
+    let out = "";
+    let err = "";
+    let child;
+    try {
+      child = spawnFn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+    } catch (e) {
+      resolve({ code: -1, stdout: "", stderr: String(e?.message || e) });
+      return;
+    }
+    const timer = setTimeout(() => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+        /* 已经退了 */
+      }
+    }, timeoutMs);
+    child.stdout?.on("data", (b) => { out += String(b); });
+    child.stderr?.on("data", (b) => { err += String(b); });
+    child.once("error", (e) => { clearTimeout(timer); resolve({ code: -1, stdout: out, stderr: `${err}${e.message}` }); });
+    child.once("exit", (code) => { clearTimeout(timer); resolve({ code: code ?? -1, stdout: out, stderr: err }); });
+  });
+}
+
+/** 本机到底有没有 openvpn（没有就别装了，诚实跳过）。 */
+export async function checkOpenvpn(bin, { runCmdFn = runCmd } = {}) {
+  const r = await runCmdFn(bin, ["--version"], { timeoutMs: 8_000 });
+  const text = `${r.stdout}${r.stderr}`;
+  if (r.code === 0 && /openvpn/i.test(text)) return { ok: true, version: (text.split(/\r?\n/)[0] || "").trim() };
+  return { ok: false, why: r.stderr.trim() || `退出码 ${r.code}` };
+}
+
+/**
+ * 起一条隧道并等它就绪。返回句柄；`ready` reject 表示这槽本轮不可用（调用方换下一个节点）。
+ * tail 保留末 20 行：真机排障时"openvpn 为什么退"全在这几行里。
+ */
+export function startTunnel({ bin, args, timeoutMs = 25_000, spawnFn = spawn, log = () => {}, onExit = null, dev = "" } = {}) {
+  let child;
+  try {
+    child = spawnFn(bin, args, { stdio: ["ignore", "pipe", "pipe"] });
+  } catch (e) {
+    return { pid: 0, ready: Promise.reject(new Error(`拉不起 ${bin}：${String(e?.message || e)}`)), tail: () => "", stop: () => {} };
+  }
+  const tail = [];
+  const t0 = Date.now();
+  let settled = false;
+  let stopping = false;
+  const push = (buf) => {
+    for (const line of String(buf).split(/\r?\n/)) {
+      const s = line.trim();
+      if (!s) continue;
+      tail.push(s);
+      if (tail.length > 20) tail.shift();
+    }
+  };
+  const lastTail = () => tailReason(tail.join("\n"));
+  const ready = new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      try { child.kill("SIGTERM"); } catch { /* 已退 */ }
+      reject(new Error(`等 ${Math.round(timeoutMs / 1000)}s 没等到「Initialization Sequence Completed」（隧道没起来）：${lastTail()}`));
+    }, timeoutMs);
+    const onChunk = (buf) => {
+      push(buf);
+      if (settled || !READY_PATTERN.test(tail.join("\n"))) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ pid: child.pid });
+    };
+    child.stdout?.on("data", onChunk);
+    child.stderr?.on("data", onChunk);
+    child.once("exit", (code, signal) => {
+      const aliveMs = Date.now() - t0;
+      if (!settled) {
+        settled = true;
+        clearTimeout(timer);
+        reject(new Error(`openvpn 提前退出（code=${code} signal=${signal}）：${lastTail()}`));
+      }
+      // 主动关掉的隧道不算"意外退出"：收摊日志只该出现在真出事时（否则每次换槽都刷一行假警报）
+      if (!stopping) log(fmtExit({ dev, code, signal, pid: child.pid, aliveMs, tail: lastTail() }));
+      if (onExit) { try { onExit({ code, signal, tail: lastTail() }); } catch { /* 回调失败不影响退出 */ } }
+    });
+    child.once("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(new Error(`拉不起 ${bin}：${String(err?.message || err)}`));
+    });
+  });
+  return { child, pid: child.pid, ready, tail: lastTail, stop: () => { stopping = true; try { child.kill("SIGTERM"); } catch { /* 已退 */ } } };
+}
+
+/** 等 tun 地址出现（VPNGate 的 ifconfig 是随隧道建立推送的，通常一两百毫秒内就位）。 */
+export async function waitTunAddr({ dev, runCmdFn = runCmd, wait = (ms) => new Promise((r) => setTimeout(r, ms)), tries = 10, gapMs = 300 } = {}) {
+  let last = "";
+  for (let i = 0; i < tries; i++) {
+    const r = await runCmdFn("ip", ["-4", "addr", "show", "dev", dev], { timeoutMs: 5_000 });
+    last = `${r.stdout}${r.stderr}`.trim();
+    const ip = parseTunAddr(r.stdout);
+    if (ip) return { ip, out: last };
+    if (i < tries - 1) await wait(gapMs);
+  }
+  return { ip: "", out: last };
+}
+
+/**
+ * 放宽 rp_filter（严格反向路径过滤会丢「从 tun 出去、从 eth 回来」的不对称包 ⇒ 隧道看起来活着但请求全挂住）。
+ * 默认开；MSLXDFF_MULTI_IP_SYSCTL=0 关。改的是内核参数，日志必须写清楚改了什么、怎么还原。
+ */
+export async function relaxRpf({ enabled = true, readFile, writeFile, log = () => {} } = {}) {
+  if (!enabled) {
+    log(fmtRpf({ skipped: true }));
+    return { ok: true, changed: [] };
+  }
+  const paths = rpFilterPaths();
+  const changed = [];
+  try {
+    const fs = await import("node:fs");
+    const read = readFile || fs.readFileSync;
+    const write = writeFile || fs.writeFileSync;
+    for (const p of paths) {
+      const before = String(read(p, "utf8")).trim();
+      if (before === "2") continue;
+      write(p, "2");
+      changed.push({ path: p, from: before, to: "2" });
+    }
+    log(fmtRpf({ ok: true, changed }));
+    return { ok: true, changed };
+  } catch (e) {
+    log(fmtRpf({ ok: false, error: String(e?.message || e), changed }));
+    return { ok: false, changed, error: String(e?.message || e) };
+  }
+}
+
+/**
+ * 起槽全流程：spawn openvpn → 等就绪 → 读 tun 地址 → 放宽 rp_filter → 装策略路由。
+ * @returns {Promise<{dev, table, priority, tunIp, pid, stop, tail}>}
+ */
+export async function bringUpTunnel({ cfg, slotIndex, node, deps = {} } = {}) {
+  const dev = devNameFor(cfg.devPrefix, slotIndex);
+  const table = tableFor(cfg.baseTable, slotIndex);
+  const priority = rulePriorityFor(slotIndex);
+  const runCmdFn = deps.runCmdFn || runCmd;
+  const wait = deps.wait || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const log = deps.log || (() => {});
+  const t = startTunnel({
+    bin: cfg.openvpnBin,
+    args: buildOpenvpnArgs({ conf: node.conf, dev, authFile: deps.authFile, logFile: deps.openvpnLog || "" }),
+    timeoutMs: cfg.connectTimeoutMs,
+    spawnFn: deps.spawnFn,
+    log,
+    dev,
+    onExit: deps.onExit,
+  });
+  try {
+    await t.ready;
+  } catch (e) {
+    t.stop();
+    throw e;
+  }
+  log(fmtSpawn({ dev, pid: t.pid, host: node.host, port: node.port, country: node.countryShort || "", table }));
+  const addr = await waitTunAddr({ dev, runCmdFn, wait, tries: deps.addrTries ?? 10 });
+  if (!addr.ip) {
+    t.stop();
+    throw new Error(fmtTunAddrFail({ dev, out: addr.out }));
+  }
+  await relaxRpf({ enabled: cfg.sysctl !== false, log, readFile: deps.readFile, writeFile: deps.writeFile });
+  for (const cmd of tunnelUpCommands({ tunIp: addr.ip, table, dev, priority })) {
+    const r = await runCmdFn(cmd[0], cmd.slice(1), { timeoutMs: 8_000 });
+    if (r.code !== 0) {
+      t.stop();
+      throw new Error(fmtRuleFail({ dev, cmd: cmd.join(" "), error: `${r.stderr || r.stdout}`.trim() }));
+    }
+  }
+  return { dev, table, priority, tunIp: addr.ip, pid: t.pid, stop: t.stop, tail: t.tail };
+}
+
+/** 拆槽：先撤策略路由（否则表里留着已消失设备的默认路由），再关子进程。 */
+export async function tearDownTunnel({ slot, runCmdFn = runCmd, log = () => {} } = {}) {
+  if (!slot) return;
+  for (const cmd of tunnelDownCommands(slot)) {
+    try {
+      await runCmdFn(cmd[0], cmd.slice(1), { timeoutMs: 5_000 });
+    } catch (e) {
+      log(`[multi-ip-pool] 撤策略路由失败（${cmd.join(" ")}）：${String(e?.message || e)}`);
+    }
+  }
+  try {
+    slot.stop?.();
+  } catch {
+    /* 已经退了 */
+  }
+}

package/src/providers/codearts/checkin.js

@@ -0,0 +1,198 @@
+// codearts 每日签到领积分（`/v1/ops/*`）—— 与 `claimBenefit` 的「模型 Token 福利」是**两本账**。
+// 协议三方交叉验证：HITZY2002/codearts2api `internal/upstream/checkin.go`（Go）、
+// L0NE-6/CodeArts-Daily `codearts_daily.py`（青龙）、anye-99·gurio-wine `src/codearts-credits.ts`（TS）。
+// 现网取证 2026-10-24：`GET /v1/ops/delivery?channel=IDE` → 4 个活动，`#1 USER_LOGIN` 每日 1000 积分。
+// 字段坑：`campaignId` 是**数字**、积分字段叫 **`benefitAmount`**、不可领取时 `status` 是 **`null`**。
+import { SNAP_BASE } from "./const.js";
+import { compatFetch, timeoutSignal } from "../../compat.js";
+import { signRequest } from "./sign.js";
+
+/** 活动列表/领取/确认的渠道标识（声明请求来自 IDE 形态；官方文档与两个参考实现同值）。 */
+export const OPS_CHANNEL = "IDE";
+/** ops 路由需要的 Agent-Type；值错会 `TM.00001001`（空→未找到合法可路由 api）。 */
+export const OPS_AGENT_TYPE = "PromptCenter";
+export const EP_OPS_DELIVERY = "/v1/ops/delivery";
+export const EP_OPS_CLAIM = "/v1/ops/claim";
+export const EP_OPS_CONFIRM = "/v1/ops/confirm";
+export const EP_PACKAGE_INFO = "/snap-manager/v1/statistics/plugin";
+export const snapBase = () => SNAP_BASE;
+
+/** 只领这两类：每日签到 + 新用户注册礼（INVITE_USER / STUDENT_CERTIFIED 不是每日任务，不碰）。 */
+const DAILY_TYPES = new Set(["USER_LOGIN", "NEW_USER_REGISTER"]);
+/** 已到账态：这几个状态下绝不 claim（幂等只靠活动列表预检，上游没有业务码兜底）。 */
+const DONE_STATUSES = new Set(["CONFIRMED", "CONSUMED"]);
+
+/**
+ * 解析活动列表。业务码非 0 或缺 `data.items` → 空表（不臆造契约）。
+ * @returns {Array<{id:number,type:string,title:string,credit:number,unit:string,claimable:boolean,status:string}>}
+ */
+export function parseCreditCampaigns(payload) {
+  const items = payload?.data?.items;
+  if (!Array.isArray(items)) return [];
+  const out = [];
+  for (const it of items) {
+    const id = Number(it?.campaignId);
+    if (!Number.isFinite(id)) continue; // campaignId 缺失的条目没法回传，丢掉
+    out.push({
+      id,
+      type: String(it?.type || ""),
+      title: String(it?.title || ""),
+      // 对齐参考实现：`res.Credits = pendingTotalAmount || benefitAmount`（待结算优先，缺则取活动额）
+      credit: Number(it?.pendingTotalAmount) || Number(it?.benefitAmount) || 0,
+      unit: String(it?.benefitUnit || ""),
+      claimable: it?.claimable === true,
+      status: it?.status == null ? "" : String(it.status),
+    });
+  }
+  return out;
+}
+
+/**
+ * 由活动列表推出本次要做的写操作（纯函数，便于单测）。
+ * 判据：只有 `claimable===true` 才 claim；`status==="CLAIMED"` 只补 confirm；已到账态零动作。
+ * @returns {Array<{kind:"claim"|"confirm", id:number, credit:number, title:string}>}
+ */
+export function planCreditActions(campaigns) {
+  const out = [];
+  for (const c of Array.isArray(campaigns) ? campaigns : []) {
+    if (!DAILY_TYPES.has(c?.type)) continue;
+    if (c.unit && c.unit !== "CREDIT") continue; // 非积分账本不碰
+    if (!Number.isFinite(c.id) || c.id <= 0) continue;
+    if (c.status === "CLAIMED") { out.push({ kind: "confirm", id: c.id, credit: c.credit, title: c.title }); continue; }
+    if (DONE_STATUSES.has(c.status)) continue;
+    // 只有 ELIGIBLE + claimable 才 claim（参考实现：status 空 = 未获得活动资格；未知状态不臆造）
+    if (c.status === "ELIGIBLE" && c.claimable) out.push({ kind: "claim", id: c.id, credit: c.credit, title: c.title });
+  }
+  return out;
+}
+
+// ─────────────────────────── HTTP 层（签名 + 写操作） ───────────────────────────
+
+function credOf(account) {
+  return { accessKeyId: account?.accessKeyId, secretAccessKey: account?.secretAccessKey, securityToken: account?.securityToken };
+}
+
+/**
+ * 签名 ops 请求。只把 `content-type`（+ `sign.js` 自己加的 host/x-sdk-*）送进 canonical；
+ * `agent-type` 与 `x-language` 必须**签名后追加**（参考实现口径：进 canonical 会 401）。
+ */
+async function opsRequest({ account, path, method = "GET", body, fetchImpl, baseUrl, timeoutMs = 20_000 } = {}) {
+  const url = `${baseUrl || snapBase()}${path}`;
+  const payload = body === undefined ? "" : JSON.stringify(body);
+  const { headers: signedHeaders } = signRequest({
+    method, url, headers: { "content-type": "application/json" }, body: payload, cred: credOf(account),
+  });
+  signedHeaders["agent-type"] = OPS_AGENT_TYPE;
+  signedHeaders["x-language"] = "zh-cn";
+  const doFetch = fetchImpl || compatFetch;
+  let res;
+  try {
+    res = await doFetch(url, { method, headers: signedHeaders, ...(body === undefined ? {} : { body: payload }), signal: timeoutSignal(timeoutMs) });
+  } catch (e) {
+    return { status: 0, json: null, text: "", error: String(e?.message || e).slice(0, 200) };
+  }
+  const text = await res.text().catch(() => "");
+  let json = null;
+  if (text) { try { json = JSON.parse(text); } catch { /* 非 JSON：沿用 text 给调用方看 */ } }
+  return { status: res.status, json, text };
+}
+
+/** 上游业务码非 0 即失败（`{code:4000,message:"invalid channel, group not found"}` 这种）。 */
+const bizFailed = (r) => Boolean(r?.json) && r.json.code != null && Number(r.json.code) !== 0;
+const errOf = (r) => r.error
+  || (bizFailed(r) ? String(r.json.message || `code=${r.json.code}`).slice(0, 180)
+    : (r.status === 200 ? "" : String(r.text || "").slice(0, 180)));
+
+/** 读活动列表（只读）。 */
+export async function fetchCreditCampaigns(opts = {}) {
+  const r = await opsRequest({ ...opts, path: `${EP_OPS_DELIVERY}?channel=${OPS_CHANNEL}` });
+  if (r.status !== 200) return { ok: false, status: r.status, campaigns: [], error: errOf(r), code: r.json?.code };
+  if (bizFailed(r)) return { ok: false, status: 200, campaigns: [], error: errOf(r), code: r.json.code };
+  return { ok: true, status: 200, campaigns: parseCreditCampaigns(r.json), error: "" };
+}
+
+/** 领取：`{campaignId, channel, idempotentKey}`（幂等键带毫秒时间戳，与参考实现同形状）。 */
+export async function claimCreditCampaign({ campaignId, now = Date.now, ...opts } = {}) {
+  const body = { campaignId, channel: OPS_CHANNEL, idempotentKey: `claim_${campaignId}_${now()}` };
+  const r = await opsRequest({ ...opts, path: EP_OPS_CLAIM, method: "POST", body });
+  return { ok: r.status === 200 && !bizFailed(r), status: r.status, json: r.json, error: errOf(r) };
+}
+
+/** 确认到账：`{campaignId}`。claim 之后无条件补这一步，否则状态停在 CLAIMED 不算到账。 */
+export async function confirmCreditCampaign({ campaignId, ...opts } = {}) {
+  const r = await opsRequest({ ...opts, path: EP_OPS_CONFIRM, method: "POST", body: { campaignId } });
+  return { ok: r.status === 200 && !bizFailed(r), status: r.status, json: r.json, error: errOf(r) };
+}
+
+/**
+ * 单账号签到：列表 → (claim → confirm) → **重读列表复查**。
+ * 到账只认复查后的状态（raccoon/traework 同款纪律：只信回执就会谎报到账）。
+ */
+export async function runCheckin({ account, fetchImpl, baseUrl, timeoutMs, dry = false, now = Date.now } = {}) {
+  const common = { account, fetchImpl, baseUrl, timeoutMs };
+  const r = { account: account?.userId || null, ok: false, status: "error", dry: false, claimed: 0, credits: 0, actions: [], writes: [], campaigns: [], message: "" };
+  const first = await fetchCreditCampaigns(common);
+  r.campaigns = first.campaigns;
+  if (!first.ok) { r.message = `查询活动失败 HTTP ${first.status || "-"}${first.error ? `：${first.error}` : ""}`; return r; }
+
+  const actions = planCreditActions(first.campaigns);
+  r.actions = actions;
+  if (!actions.length) {
+    const done = first.campaigns.some((c) => DAILY_TYPES.has(c.type) && DONE_STATUSES.has(c.status));
+    r.ok = true;
+    r.status = done ? "already" : "nothing";
+    r.message = done ? "今日已领取（零写操作）" : "无可用签到活动";
+    return r;
+  }
+  if (dry) {
+    r.ok = true; r.dry = true; r.status = "claimable";
+    r.message = `干跑：${actions.length} 项待领，未发写请求`;
+    return r;
+  }
+
+  for (const a of actions) {
+    if (a.kind === "claim") {
+      const c1 = await claimCreditCampaign({ ...common, campaignId: a.id, now });
+      r.writes.push({ kind: "claim", id: a.id, ok: c1.ok, status: c1.status, error: c1.error });
+      if (!c1.ok) continue; // claim 失败则不 confirm（对齐参考实现：claim 错即返回）
+    }
+    const c2 = await confirmCreditCampaign({ ...common, campaignId: a.id });
+    r.writes.push({ kind: "confirm", id: a.id, ok: c2.ok, status: c2.status, error: c2.error });
+  }
+
+  const after = await fetchCreditCampaigns(common);
+  if (after.ok) r.campaigns = after.campaigns;
+  const landed = (after.campaigns || []).filter((c) => actions.some((a) => a.id === c.id) && DONE_STATUSES.has(c.status));
+  r.claimed = landed.length;
+  r.credits = landed.reduce((s, c) => s + (c.credit || 0), 0);
+  if (landed.length) {
+    r.ok = true; r.status = "claimed";
+    r.message = `签到到账 +${r.credits} 积分（${landed.length} 项：${landed.map((c) => `#${c.id}`).join(" ")}）`;
+  } else {
+    const bad = r.writes.find((w) => !w.ok);
+    r.status = "not-landed";
+    r.message = `写请求已发但复查仍未到账（不许当今天签过）：${bad ? `${bad.kind} HTTP ${bad.status || "-"} ${bad.error || ""}` : "重读活动列表后状态未变"}`.slice(0, 220);
+  }
+  return r;
+}
+
+/** 积分账本：取 `usageTotalPackageCredit` 的总额/已用/剩余（分类明细单列，**不累加**）。 */
+export async function fetchCreditBalance(opts = {}) {
+  const r = await opsRequest({ ...opts, path: EP_PACKAGE_INFO });
+  if (r.status !== 200) return { ok: false, status: r.status, error: errOf(r) };
+  const metrics = Array.isArray(r.json?.metrics) ? r.json.metrics : [];
+  const num = (v) => Number(v) || 0;
+  const pick = (name) => metrics.find((m) => m?.name === name);
+  const creditOf = (m) => (m ? { total: num(m.package_credit_amount), used: num(m.package_credit_used), remain: num(m.package_credit_remain) } : null);
+  const totalM = pick("usageTotalPackageCredit");
+  const tokenM = pick("usageTokenChatMessages");
+  return {
+    ok: true, status: 200,
+    total: num(totalM?.package_credit_amount), used: num(totalM?.package_credit_used), remain: num(totalM?.package_credit_remain),
+    basic: creditOf(pick("usageBasicPackageCredit")),
+    bonus: creditOf(pick("usageBonusPackageCredit")),
+    onDemand: creditOf(pick("useOnDemandPackageCredit")) || creditOf(pick("usageOnDemandPackageCredit")),
+    tokenUsage: num(tokenM?.usage_token_num), tokenPackages: num(tokenM?.package_token_amount),
+    isCreditPackage: Boolean(totalM),
+  };
+}

package/src/runtime/bootstrap.js

@@ -68,6 +68,11 @@ export async function startDaemonMain(VERSION) {
     try { logs.appendEvent({ ts: Date.now(), type: "raccoon-checkin-setup-failed", error: String(e?.message || e).slice(0, 200) }); } catch {}
   });
 
+  const { setupCodeartsCheckin } = await import("./codearts-checkin.js");
+  void setupCodeartsCheckin({ bus, logs }).catch((e) => {
+    try { logs.appendEvent({ ts: Date.now(), type: "codearts-checkin-setup-failed", error: String(e?.message || e).slice(0, 200) }); } catch {}
+  });
+
   const { setupWorkbuddyGrowth } = await import("./workbuddy-growth.js");
   void setupWorkbuddyGrowth({ bus, logs }).catch((e) => {
     try { logs.appendEvent({ ts: Date.now(), type: "workbuddy-growth-setup-failed", error: String(e?.message || e).slice(0, 200) }); } catch {}

package/src/runtime/codearts-checkin.js

@@ -0,0 +1,115 @@
+/**
+ * codearts 每日签到领积分（daemon 内置），仿 src/runtime/qoder-checkin.js。
+ * 开关：MSLXDFF_CODEARTS_CHECKIN=0 关闭（默认开）；时间：MSLXDFF_CODEARTS_CHECKIN_HOUR（默认 9 点）。
+ * 账号源：providerConfigs.codearts.keys 的凭据 blob —— 复用 createCodeartsProvider 的 authPool，
+ * 刷新轮转换号**原位写回**（自己写 saveFn 会与 chat 路径的写回逻辑分叉）。
+ * 该上游对并发极敏感 → 逐号**串行**；ops 是独立端点，不占 chat 的并发闸（3 会话上限不受影响）。
+ * 记账：state.codeartsCheckin {date, at, ok, total, credits, accounts:[…]}（qoder/workbuddy 同款）。
+ */
+import { todayKey, nextRunDelayMs, shouldCatchUp } from "./workbuddy-checkin.js";
+
+export function isCheckinEnabled(env = process.env) {
+  const v = String(env.MSLXDFF_CODEARTS_CHECKIN ?? "1").trim().toLowerCase();
+  return !["0", "false", "off", "no"].includes(v);
+}
+
+export function getCheckinHour(env = process.env) {
+  const h = Number(env.MSLXDFF_CODEARTS_CHECKIN_HOUR);
+  return Number.isInteger(h) && h >= 0 && h <= 23 ? h : 9;
+}
+
+export async function setupCodeartsCheckin({ bus, logs, deps = {} } = {}) {
+  const env = deps.env || process.env;
+  function emit(type, data = {}) {
+    const entry = { ts: Date.now(), type, ...data };
+    try { bus?.emit(entry); } catch { /* 事件不阻断签到 */ }
+    try { logs?.appendEvent?.(entry); } catch { /* 同上 */ }
+    try { console.log(`[codearts-checkin] ${type} ${JSON.stringify(data)}`.slice(0, 500)); } catch { /* 同上 */ }
+  }
+  if (!isCheckinEnabled(env)) {
+    console.log("[codearts-checkin] disabled (set MSLXDFF_CODEARTS_CHECKIN=1 to enable)");
+    emit("codearts-checkin-disabled");
+    return { enabled: false };
+  }
+  const hour = getCheckinHour(env);
+  console.log(`[codearts-checkin] enabled: daily ${String(hour).padStart(2, "0")}:00 local, multi-account serial`);
+  emit("codearts-checkin-enabled", { hour });
+
+  const stateMod = await import("../state.js");
+
+  /** 取号：deps.accounts 优先（测试注入，零网络）；否则走 provider 的 authPool（缺省带写回）。 */
+  async function loadAccounts() {
+    if (Array.isArray(deps.accounts)) return { accounts: deps.accounts, close: null };
+    const { createCodeartsProvider } = await import("../providers/codearts/index.js");
+    const provider = deps.provider || createCodeartsProvider({ fetchImpl: deps.fetchImpl });
+    const pool = provider._pool;
+    const accounts = [];
+    let candidates = [];
+    try { candidates = pool.aliveAccounts() || []; } catch { candidates = []; }
+    for (const cand of candidates) {
+      try { accounts.push(await pool.getCredential(cand.blob)); } catch { /* 死号跳过，别拖垮整轮 */ }
+    }
+    return { accounts, close: () => { try { provider.close?.(); } catch { /* ignore */ } } };
+  }
+
+  let running = false;
+  async function runOnce(reason) {
+    if (running) return { skipped: "already-running" };
+    running = true;
+    let cleanup = null;
+    try {
+      const loaded = await loadAccounts();
+      cleanup = loaded.close;
+      const accounts = loaded.accounts;
+      if (!accounts.length) {
+        emit("codearts-checkin-no-accounts", { reason });
+        return { ok: false, reason: "no-accounts" };
+      }
+      const { runCheckin } = await import("../providers/codearts/checkin.js");
+      const rows = [];
+      for (const account of accounts) { // 逐号串行：该上游对并发极敏感
+        const uid = String(account?.userId || "").slice(0, 8);
+        try {
+          const r = await runCheckin({ account, fetchImpl: deps.fetchImpl });
+          rows.push({ uid, ok: r.ok, status: r.status, claimed: r.claimed, credits: r.credits, msg: String(r.message || "").slice(0, 140) });
+        } catch (e) {
+          rows.push({ uid, ok: false, status: "error", claimed: 0, credits: 0, msg: String(e?.message || e).slice(0, 140) });
+        }
+      }
+      const okCount = rows.filter((r) => r.ok).length;
+      const credits = rows.reduce((s, r) => s + (r.credits || 0), 0);
+      const date = todayKey();
+      try {
+        stateMod.writeStateImmediate(stateMod.defaultStateFile(), {
+          codeartsCheckin: { date, at: Date.now(), ok: okCount, total: rows.length, credits, accounts: rows },
+        });
+      } catch { /* 落盘失败不影响本次结果 */ }
+      for (const r of rows) emit("codearts-checkin-account", { ...r, reason });
+      emit("codearts-checkin-done", { date, ok: okCount, total: rows.length, credits, reason });
+      return { ok: okCount > 0, okCount, total: rows.length, rows };
+    } catch (e) {
+      emit("codearts-checkin-failed", { error: String(e?.message || e).slice(0, 200), reason });
+      return { ok: false, error: String(e?.message || e).slice(0, 200) };
+    } finally {
+      try { cleanup?.(); } catch { /* ignore */ }
+      running = false;
+    }
+  }
+
+  // 启动补跑：已过今日计划点、且（从没签过 或 上次不是今天）
+  try {
+    const lastDate = stateMod.readState(stateMod.defaultStateFile())?.codeartsCheckin?.date || "";
+    if (shouldCatchUp({ lastDate, hour })) {
+      setTimeout(() => { runOnce("catch-up").catch(() => {}); }, 90_000).unref?.();
+      console.log(`[codearts-checkin] catch-up scheduled (last=${lastDate || "never"})`);
+    }
+  } catch { /* 读 state 失败就不补跑，等定时 */ }
+  function arm() {
+    const delay = nextRunDelayMs(new Date(), hour);
+    setTimeout(() => {
+      runOnce("daily").catch(() => {}).finally(arm);
+    }, delay).unref?.();
+  }
+  arm();
+  return { enabled: true, hour, runOnce };
+}

package/src/v6pool/index.js

@@ -14,6 +14,7 @@ import { probeFrom } from "./probe.js";
 import { randomAddress } from "./prefix.js";
 import { fmtClose, fmtConfig, fmtDetect, fmtDisabled, fmtPool, fmtPoolEmpty, fmtProbe, fmtReadyFail, fmtSkip } from "./report.js";
 import { createWarpDispatcher } from "../warp-pool/index.js";
+import { createMultiIpDispatcher } from "../multi-ip-pool/index.js";
 
 /** 每槽 Agent 的连接池参数。注入 dispatcher 后 transport 不建自带池（transport/index.js L28），所以必须自带。 */
 export const AGENT_OPTIONS = { connections: 4, pipelining: 1, keepAliveTimeout: 30_000, keepAliveMaxTimeout: 60_000 };
@@ -139,13 +140,17 @@ export function createV6Pool({ env = process.env, baseUrl = "https://opencode.ai
 }
 
 /**
- * 出口池二选一（唯一接线点用）：v6 池可用就用它，否则退回 WARP 池。
- * 两者都只产出一个 dispatcher 对象，注入点与契约完全一致（见 MODULES.md §1）。
+ * 出口池三选一（唯一接线点用）：v6 池 → 多出口池 → WARP 池。
+ * 三者都只产出一个 dispatcher 对象，注入点与契约完全一致（见 MODULES.md §1）。
  * 放在这里而不是 providers-setup：那里是 10KB 硬门下的文件，多一行都是风险。
  */
 export function createPreferredDispatcher({ baseUrl = "https://opencode.ai", env = process.env, log, deps = {} } = {}) {
   const pool = createV6Pool({ env, baseUrl, log, deps });
   if (pool) return pool.dispatcher;
+  // 次选：多出口池（VPNGate 免费 OpenVPN 节点当出口，只组长/单机建）——它给的是**另一批真实出口 IP**，
+  // 而 v6 只是本机自带的那段地址，所以 v6 优先、它次之。任一不可用都安静跳过（各自打自己的日志）。
+  const multi = createMultiIpDispatcher({ env, baseUrl, log, deps: deps.multiIp });
+  if (multi) return multi;
   // 单向依赖：warp-pool 不 import v6pool（见 MODULES.md §2「已知耦合」）。
   return createWarpDispatcher({ baseUrl, env, log });
 }