opencode-lobster-auth 0.1.1 → 0.2.0

package/lib/auth-login.mjs

@@ -1,131 +1,154 @@
-// 浏览器登录，走 LobsterAI 桌面端自己的通道。
-//
-// portal 的 auth 模块允许把授权码回调到任意
-// http://127.0.0.1:<port>/auth/callback（条件是 http + 127.0.0.1 +
-// /auth/callback + 有端口），因此插件可以自带登录，不依赖桌面端。
-// 参数必须追加到登录页的 hash query，不是 URL query；且必须带
-// source=electron，否则 portal 不会带上 redirect_uri。
-
-import { createServer } from "node:http"
-import { randomBytes } from "node:crypto"
-import { API, LOGIN_URL } from "./constants.mjs"
-import { jwtExp, accountOf } from "./jwt.mjs"
-
-const TIMEOUT_MS = 5 * 60 * 1000
-
-export function authorizeUrl(loginUrl, callbackUrl, state) {
-  const base = loginUrl || LOGIN_URL
-  const hashAt = base.indexOf("#")
-  const head = hashAt === -1 ? base : base.slice(0, hashAt)
-  const hash = hashAt === -1 ? "" : base.slice(hashAt + 1)
-  const [route, query = ""] = hash.split("?")
-  const q = new URLSearchParams(query)
-  q.set("source", "electron")
-  q.set("redirect_uri", callbackUrl)
-  q.set("state", state)
-  return `${head}#${route}?${q.toString()}`
-}
-
-// 起一个只监听 127.0.0.1 的临时服务；端口由系统分配（listen 0）。
-// 返回 { port, result(ms), close() }，把「等回调」和「关服务」分开，
-// 这样调用方可以先拿到端口拼 URL，再去等结果。
-function listenOnce() {
-  return new Promise((resolve, reject) => {
-    let deliver = () => {}
-    const got = new Promise((r) => { deliver = r })
-    let timer = null
-    const server = createServer((req, res) => {
-      const u = new URL(req.url, "http://127.0.0.1")
-      if (u.pathname !== "/auth/callback") { res.writeHead(404).end(); return }
-      const code = u.searchParams.get("code")
-      const state = u.searchParams.get("state")
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" })
-      res.end(code
-        ? "<h2>登录成功，可以关闭此页面。</h2>"
-        : "<h2>登录失败：没有拿到授权码。</h2>")
-      deliver({ code, state })
-    })
-    server.on("error", reject)
-    server.listen(0, "127.0.0.1", () => {
-      const { port } = server.address()
-      resolve({
-        port,
-        close() {
-          if (timer) clearTimeout(timer)
-          try { server.close() } catch {}
-        },
-        result(ms) {
-          const late = new Promise((r) => {
-            timer = setTimeout(() => r({ error: new Error("登录超时（5 分钟）") }), ms)
-          })
-          return Promise.race([got, late]).then((v) => {
-            if (v?.error) throw v.error
-            return v
-          })
-        },
-      })
-    })
-  })
-}
-
-async function exchangeCode(code) {
-  const res = await fetch(`${API}/auth/exchange`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ authCode: code, firstKeyfrom: "official", latestKeyfrom: "official" }),
-    signal: AbortSignal.timeout(30_000),
-  })
-  const text = await res.text()
-  let v
-  try { v = JSON.parse(text) } catch { throw new Error(`LobsterAI 的登录响应无法解析：${text.slice(0, 200)}`) }
-  // /api/* 用 {code, message, data} 信封，业务错误也是 HTTP 200
-  if (v?.code !== 0 || !v?.data) {
-    throw new Error(`LobsterAI 拒绝了登录：${v?.message || `code ${v?.code}`}`)
-  }
-  return v.data
-}
-
-// beginSignIn 起回调服务并拼出授权地址，然后把「等回调并换 token」交给
-// finish()。分成两半是因为由 magpie 负责打开 authorize 返回的 url ——
-// 插件自己再开一次就会开两个标签页。
-export async function beginSignIn({ timeoutMs = TIMEOUT_MS } = {}) {
-  const state = randomBytes(24).toString("base64url")
-  const listening = await listenOnce()
-  const callbackUrl = `http://127.0.0.1:${listening.port}/auth/callback`
-  const url = authorizeUrl(LOGIN_URL, callbackUrl, state)
-
-  const finish = async () => {
-    try {
-      const got = await listening.result(timeoutMs)
-      if (got.state !== state) throw new Error("登录回调的 state 不匹配，已忽略")
-      const data = await exchangeCode(got.code)
-      const access = String(data.accessToken ?? "")
-      if (!access) throw new Error("LobsterAI 没有返回 accessToken")
-      const who = accountOf(access)
-      return {
-        type: "success",
-        refresh: String(data.refreshToken ?? ""),
-        access,
-        expires: jwtExp(access) || Date.now() + 30 * 24 * 3600 * 1000,
-        accountId: who.yid ?? (who.id !== undefined ? String(who.id) : undefined),
-      }
-    } finally {
-      listening.close()
-    }
-  }
-
-  return { url, finish, close: () => listening.close() }
-}
-
-// signIn 是 beginSignIn 的「自己开浏览器」封装：给命令行与测试用。
-// open 可注入，因此测试里不必真的弹浏览器。
-export async function signIn({ open, timeoutMs = TIMEOUT_MS } = {}) {
-  const pending = await beginSignIn({ timeoutMs })
-  try {
-    await open(pending.url)
-    return await pending.finish()
-  } catch (e) {
-    pending.close()
-    throw e
-  }
-}
+// 浏览器登录，走 LobsterAI 桌面端自己的通道。
+//
+// portal 的 auth 模块允许把授权码回调到任意
+// http://127.0.0.1:<port>/auth/callback（条件是 http + 127.0.0.1 +
+// /auth/callback + 有端口），因此插件可以自带登录，不依赖桌面端。
+// 参数必须追加到登录页的 hash query，不是 URL query；且必须带
+// source=electron，否则 portal 不会带上 redirect_uri。
+
+import { createServer } from "node:http"
+import { randomBytes } from "node:crypto"
+import { API, LOGIN_URL } from "./constants.mjs"
+import { jwtExp, accountOf } from "./jwt.mjs"
+
+const TIMEOUT_MS = 5 * 60 * 1000
+
+// announce 把回调地址同时放进普通 query（hash 里那份是 portal 要的）。
+// portal 只读 hash，多这一个参数不影响登录——实测带与不带取回的页面字节
+// 完全相同。宿主 Magpie 却只从普通 query 里找 loopback 端口
+// （pluginsignin_paste.go 的 loopbackPorts），找到才为这次登录提供
+// 「回调 URL」输入框：浏览器在另一台机器上时，粘贴登录后落在地址栏的
+// 地址就能完成登录，不用别的通道。
+export function authorizeUrl(loginUrl, callbackUrl, state, { announce = false } = {}) {
+  const base = loginUrl || LOGIN_URL
+  const hashAt = base.indexOf("#")
+  const head = hashAt === -1 ? base : base.slice(0, hashAt)
+  const hash = hashAt === -1 ? "" : base.slice(hashAt + 1)
+  const [route, query = ""] = hash.split("?")
+  const q = new URLSearchParams(query)
+  q.set("source", "electron")
+  q.set("redirect_uri", callbackUrl)
+  q.set("state", state)
+  if (!announce) return `${head}#${route}?${q.toString()}`
+  const at = head.indexOf("?")
+  const plain = new URLSearchParams(at === -1 ? "" : head.slice(at + 1))
+  plain.set("redirect_uri", callbackUrl)
+  const path = at === -1 ? head : head.slice(0, at)
+  return `${path}?${plain.toString()}#${route}?${q.toString()}`
+}
+
+// 起一个只监听 127.0.0.1 的临时服务；端口由系统分配（listen 0）。
+// 返回 { port, result(ms), close() }，把「等回调」和「关服务」分开，
+// 这样调用方可以先拿到端口拼 URL，再去等结果。
+function listenOnce() {
+  return new Promise((resolve, reject) => {
+    let deliver = () => {}
+    const got = new Promise((r) => { deliver = r })
+    let timer = null
+    const server = createServer((req, res) => {
+      const u = new URL(req.url, "http://127.0.0.1")
+      if (u.pathname !== "/auth/callback") { res.writeHead(404).end(); return }
+      const code = u.searchParams.get("code")
+      const state = u.searchParams.get("state")
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" })
+      res.end(code
+        ? "<h2>登录成功，可以关闭此页面。</h2>"
+        : "<h2>登录失败：没有拿到授权码。</h2>")
+      deliver({ code, state })
+    })
+    server.on("error", reject)
+    server.listen(0, "127.0.0.1", () => {
+      const { port } = server.address()
+      resolve({
+        port,
+        close() {
+          if (timer) clearTimeout(timer)
+          try { server.close() } catch {}
+        },
+        result(ms) {
+          const late = new Promise((r) => {
+            timer = setTimeout(() => r({ error: new Error("登录超时（5 分钟）") }), ms)
+          })
+          return Promise.race([got, late]).then((v) => {
+            if (v?.error) throw v.error
+            return v
+          })
+        },
+      })
+    })
+  })
+}
+
+async function exchangeCode(code) {
+  const res = await fetch(`${API}/auth/exchange`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ authCode: code, firstKeyfrom: "official", latestKeyfrom: "official" }),
+    signal: AbortSignal.timeout(30_000),
+  })
+  const text = await res.text()
+  let v
+  try { v = JSON.parse(text) } catch { throw new Error(`LobsterAI 的登录响应无法解析：${text.slice(0, 200)}`) }
+  // /api/* 用 {code, message, data} 信封，业务错误也是 HTTP 200
+  if (v?.code !== 0 || !v?.data) {
+    throw new Error(`LobsterAI 拒绝了登录：${v?.message || `code ${v?.code}`}`)
+  }
+  return v.data
+}
+
+// beginSignIn 起回调服务并拼出授权地址，然后把「等回调并换 token」交给
+// finish()。分成两半是因为由 magpie 负责打开 authorize 返回的 url ——
+// 插件自己再开一次就会开两个标签页。
+//
+// announce 见 authorizeUrl：让宿主知道这次登录的回调端口，它才会提供一个
+// 粘贴回调地址的输入框（浏览器在另一台机器上时用它完成登录）。
+export async function beginSignIn({ timeoutMs = TIMEOUT_MS, announce = false } = {}) {
+  const state = randomBytes(24).toString("base64url")
+  const listening = await listenOnce()
+  const callbackUrl = `http://127.0.0.1:${listening.port}/auth/callback`
+  const url = authorizeUrl(LOGIN_URL, callbackUrl, state, { announce })
+
+  const finish = async () => {
+    try {
+      const got = await listening.result(timeoutMs)
+      if (got.state !== state) throw new Error("登录回调的 state 不匹配，已忽略")
+      const data = await exchangeCode(got.code)
+      const access = String(data.accessToken ?? "")
+      if (!access) throw new Error("LobsterAI 没有返回 accessToken")
+      const who = accountOf(access)
+      return {
+        type: "success",
+        refresh: String(data.refreshToken ?? ""),
+        access,
+        expires: jwtExp(access) || Date.now() + 30 * 24 * 3600 * 1000,
+        accountId: who.yid ?? (who.id !== undefined ? String(who.id) : undefined),
+      }
+    } finally {
+      listening.close()
+    }
+  }
+
+  return { url, finish, close: () => listening.close() }
+}
+
+// beginSignInAnnounced 是给远程（NAS / Docker）用的 beginSignIn：回调服务
+// 照常起在本机 127.0.0.1 上，登录地址额外在普通 query 里写明这个端口。
+// 宿主 Magpie 看到它，就会在登录页旁给出「回调 URL」输入框——浏览器在
+// 另一台机器上时，把登录后地址栏里的完整地址粘回去，Magpie 在本机把请求
+// 送到这个端口，回调照常抵达。没有这一步，浏览器只能和插件在同一台机器上。
+export async function beginSignInAnnounced(opts = {}) {
+  return beginSignIn({ ...opts, announce: true })
+}
+
+// signIn 是 beginSignIn 的「自己开浏览器」封装：给命令行与测试用。
+// open 可注入，因此测试里不必真的弹浏览器。
+export async function signIn({ open, timeoutMs = TIMEOUT_MS } = {}) {
+  const pending = await beginSignIn({ timeoutMs })
+  try {
+    await open(pending.url)
+    return await pending.finish()
+  } catch (e) {
+    pending.close()
+    throw e
+  }
+}

package/lib/checkin.mjs

@@ -0,0 +1,240 @@
+// 每日积分礼（签到）的领取逻辑。
+//
+// 上游接口（2026-11-02 实测）：
+//   GET  /api/client-activities/slot?placement=desktop_sidebar&clientVersion=…&…
+//        → { slotState: "available", activity: { activityCode, configRevision } }
+//   GET  /api/client-activities/<code>/context?configRevision=<rev>
+//        → { state: { claimedToday, claimedDays, rewardCredits, claimedCredits }, actions: [] }
+//   POST /api/client-activities/<code>/actions/check_in
+//        体 { configRevision, idempotencyKey, payload: {} }
+//        → code 0 领取成功；code 51104「活动奖励已领取」（幂等，重复发不重复给）
+//
+// 判据取 context 的 actions：已领时是 []，未领时才有 check_in。
+// 领完必须复核（再读一次 context），接口 200 不等于真的到账。
+//
+// 这里只搬活动那一半。原脚本（技术方案调研/lobsterai-checkin）里取 token、
+// 调 /api/auth/refresh、把 token 缓存到磁盘的部分**不搬** —— 那会把桌面端
+// 踢下线，是本插件明确不碰的（见 README「不做的事」）。
+
+const BASE = "https://lobsterai-server.youdao.com"
+const UPDATE_URL = "https://api-overmind.youdao.com/openapi/get/luna/hardware/lobsterai/prod/update"
+const PLACEMENT = "desktop_sidebar"
+// 实测 macOS 上也认 win32，别按本机平台改
+const PLATFORM = "win32"
+
+// magpie 只认这几个 outcome，其它值会被改写成 failed
+export const OUTCOMES = ["claimed", "done", "ineligible", "inactive", "captcha", "failed"]
+
+const timeout = (ms) => AbortSignal.timeout(ms)
+
+async function call(method, path, token, body, version) {
+  const headers = { authorization: `Bearer ${token}`, accept: "application/json" }
+  if (version) headers["User-Agent"] = `LobsterAI/${version}`
+  if (body !== undefined) headers["content-type"] = "application/json"
+  const res = await fetch(BASE + path, {
+    method, headers,
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: timeout(20_000),
+  })
+  const text = await res.text()
+  let json = null
+  try { json = JSON.parse(text) } catch {}
+  return { status: res.status, json, text }
+}
+
+// 当前客户端版本。活动位是否投放跟版本号有关，版本过旧会拿不到活动。
+export async function clientVersion() {
+  try {
+    const res = await fetch(UPDATE_URL, { signal: timeout(8_000) })
+    if (!res.ok) throw new Error(`版本查询 HTTP ${res.status}`)
+    const j = await res.json()
+    const v = j?.data?.value?.version
+    if (typeof v === "string" && /^\d{4}\.\d/.test(v)) return { version: v, known: true }
+  } catch {}
+  // 兜底：拿不到版本时用一个已知能用的值。known=false 让上层能把「可能是版本问题」
+  // 如实报出来，而不是假装活动没投放。
+  return { version: "2026.10.30", known: false }
+}
+
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+const isRevision = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0
+
+// 供应商的「一天」何时翻篇：下一个北京零点（活动 ctx 的 state.timezone 是
+// Asia/Shanghai）。magpie 靠这个字段决定下次什么时候再问：
+//   有 until -> 它知道今天确实过去了，下次按 until 来；
+//   没 until -> 它无法判断，只能把结果标成 `again`（稍后再问），
+//               界面上就显示成「暂不可签到」而不是「今日已签到」。
+// 实测 qoder 的签到记录就带着 until（它的积分 10:00 UTC+8 开门）。
+const BEIJING_MS = 8 * 3600 * 1000
+export function nextDayTurn(now = Date.now()) {
+  const shifted = now + BEIJING_MS
+  const nextMidnight = Math.floor(shifted / 86400000) * 86400000 + 86400000
+  return new Date(nextMidnight - BEIJING_MS).toISOString()
+}
+
+// 本日奖励：活动 state 里的 rewardCredits。实测 100。
+const rewardOf = (state) => {
+  const n = Number(state?.rewardCredits)
+  return Number.isFinite(n) && n > 0 ? n : 0
+}
+
+
+function envelope(r) {
+  const msg = typeof r.json?.message === "string" ? r.json.message : ""
+  if (r.status === 401 || r.status === 403) return { expired: true, message: msg || "登录已失效" }
+  if (r.status < 200 || r.status >= 300) {
+    return { bad: true, message: `HTTP ${r.status}${msg ? `：${msg}` : ""}` }
+  }
+  // HTTP 成功和合法业务信封都需要。缺少 code 绝不能被当成“没有错误”。
+  if (!isObject(r.json) || !Number.isSafeInteger(r.json.code)) {
+    return { bad: true, message: `签到响应缺少有效业务 code${msg ? `：${msg}` : ""}` }
+  }
+  if (r.json.code === 0) {
+    return isObject(r.json.data)
+      ? { data: r.json.data }
+      : { bad: true, message: "签到成功响应缺少有效 data" }
+  }
+  if (/未登录|登录已失效|token/i.test(msg)) return { expired: true, message: msg }
+  return { code: r.json.code, message: msg || `code ${r.json.code}` }
+}
+
+function validContext(data) {
+  return isObject(data?.state) && typeof data.state.claimedToday === "boolean" &&
+    Array.isArray(data.actions) && data.actions.every((action) => typeof action === "string") &&
+    (data.configRevision === undefined || isRevision(data.configRevision))
+}
+
+// 读活动位 + 上下文，返回领不领得动、以及要用的判据
+export async function readState(token, { version } = {}) {
+  const v = version ?? (await clientVersion())
+  const slotPath = `/api/client-activities/slot?${new URLSearchParams({
+    placement: PLACEMENT, clientVersion: v.version, containerApiVersion: "2", platform: PLATFORM,
+  })}`
+  const slot = envelope(await call("GET", slotPath, token, undefined, v.version))
+  if (slot.expired) return { outcome: "failed", reason: slot.message, version: v }
+  if (slot.bad) return { outcome: "failed", reason: slot.message, version: v }
+  if (slot.code !== undefined) return { outcome: "failed", reason: slot.message || `code ${slot.code}`, version: v }
+
+  const activity = slot.data.activity
+  const slotState = slot.data.slotState
+  if (typeof slotState !== "string" || !slotState.trim()) {
+    return { outcome: "failed", reason: "活动位响应缺少有效 slotState", version: v }
+  }
+  if (slotState !== "available") {
+    // 版本是现取的 → 上游就是没投放；版本是兜底值 → 可能是版本过旧，值得当天重试
+    return {
+      outcome: v.known ? "inactive" : "failed",
+      reason: v.known ? "" : "拿不到当前客户端版本，无法确认活动是否投放",
+      slotState, version: v,
+    }
+  }
+
+  if (!isObject(activity) || typeof activity.activityCode !== "string" || !activity.activityCode.trim() || !isRevision(activity.configRevision)) {
+    return { outcome: "failed", reason: "活动位响应缺少有效活动或 configRevision", version: v }
+  }
+  const code = activity.activityCode
+  const rev = activity.configRevision
+  const ctx = envelope(await call("GET", `/api/client-activities/${encodeURIComponent(code)}/context?configRevision=${rev}`, token, undefined, v.version))
+  if (ctx.expired || ctx.bad || ctx.code !== undefined) return { outcome: "failed", reason: ctx.message, version: v }
+  if (!validContext(ctx.data)) return { outcome: "failed", reason: "签到上下文缺少有效 state/actions", version: v }
+
+  const actions = ctx.data.actions.map((a) => a.toLowerCase().trim())
+  return {
+    outcome: null, code, rev: ctx.data.configRevision ?? rev, state: ctx.data.state, actions, version: v,
+  }
+}
+
+// 领一次并复核。返回 magpie 的 outcome 形状。
+export async function claim(token, state, { idempotencyKey } = {}) {
+  const { code, rev, actions } = state
+  // 今天已经领过：报 done，但要带上 credit 和 until ——
+  // 缺 until 时 magpie 会把它当成「今天可能还没过去」而标记 again，
+  // 界面上就变成「暂不可签到」；缺 credit 则看不到今天拿到多少。
+  if (state.state?.claimedToday === true) {
+    const out = { outcome: "done", until: nextDayTurn() }
+    const reward = rewardOf(state.state)
+    if (reward > 0) out.credit = reward
+    return out
+  }
+  if (!actions.includes("check_in")) return { outcome: "ineligible" }
+
+  const body = {
+    configRevision: rev,
+    idempotencyKey: idempotencyKey ?? crypto.randomUUID(),
+    payload: {},
+  }
+  const r = envelope(await call("POST", `/api/client-activities/${encodeURIComponent(code)}/actions/check_in`, token, body, state.version?.version))
+  // 51104 = 活动奖励已领取。并发的另一路已经领过，算 done
+  if (r.code === 51104) {
+    const out = { outcome: "done", until: nextDayTurn() }
+    const reward = rewardOf(state.state)
+    if (reward > 0) out.credit = reward
+    return out
+  }
+  if (r.expired || r.code !== undefined || r.bad) return { outcome: "failed", reason: r.message ?? "领取失败" }
+
+  const granted = Number(r.data?.creditsGranted ?? r.data?.rewardCredits ?? r.data?.result?.rewardCredits) || 0
+
+  // 复核：接口 200 不等于到账。
+  // 判据只能是**观察到的状态变化**：复核里 claimedToday 必须为真。
+  // 绝不能因为 POST 自己说 creditsGranted>0 就报 claimed —— 那是拿请求的回显当证据，
+  // 响应说发了、状态没落地时会假报成功。
+  let after
+  try {
+    const c = envelope(await call("GET", `/api/client-activities/${encodeURIComponent(code)}/context?configRevision=${rev}`, token, undefined, state.version?.version))
+    if (c.expired || c.bad || c.code !== undefined) {
+      return { outcome: "failed", reason: `领取后复核失败：${c.message}` }
+    }
+    if (!validContext(c.data)) return { outcome: "failed", reason: "领取后复核响应缺少有效 state/actions" }
+    after = c.data.state
+  } catch (e) {
+    return { outcome: "failed", reason: `领取后复核请求失败：${e?.message ?? String(e)}` }
+  }
+
+  if (!after.claimedToday) {
+    return { outcome: "failed", reason: "领取后复核未通过（服务端仍显示今日未领取）" }
+  }
+
+  const out = { outcome: "claimed", until: nextDayTurn() }
+  // 发放额优先用 POST 的回显；回显没有（或为 0）时用复核里的本日奖励
+  const grantedNow = granted > 0 ? granted : Number(after.rewardCredits) || 0
+  if (grantedNow > 0) out.credit = grantedNow
+  // 不填 streak：claimedDays 是活动开始以来的累计天数，不是连签天数，
+  // magpie 会把 streak 显示成「连续 N 天」。
+  return out
+}
+
+// auth.checkin 的实现：读状态 → 该领就领。
+// 任何失败都返回 outcome + message，**绝不抛** —— 抛异常 magpie 也记成 failed，
+// 但丢失原因；而且两次读都走网络，超时/断网是常态不是异常。
+export async function checkinWith(token, { version, idempotencyKey } = {}) {
+  if (!token) return { outcome: "failed", message: "尚未登录" }
+  let state
+  try {
+    state = await readState(token, { version })
+  } catch (e) {
+    return { outcome: "failed", message: e?.message ?? String(e) }
+  }
+  if (state.outcome) {
+    const out = { outcome: state.outcome }
+    // magpie 的 `message` 就是给人看的原因；内部统一用 reason，出口转一次
+    if (state.reason) out.message = state.reason
+    return out
+  }
+  let r
+  try {
+    r = await claim(token, state, { idempotencyKey })
+  } catch (e) {
+    return { outcome: "failed", message: e?.message ?? String(e) }
+  }
+  const out = { outcome: r.outcome }
+  if (r.credit) out.credit = r.credit
+  // until 必须带出去：magpie 靠它判断供应商的「一天」何时翻篇。
+  // 丢了它，「今天已签」会被当成「可能还没过去」而标记 again，
+  // 界面就从「今日已签到」退化成「暂不可签到」。
+  if (r.until) out.until = r.until
+  if (r.reason) out.message = r.reason
+  return out
+}
+
+export { PLACEMENT, PLATFORM, UPDATE_URL }

package/lib/constants.mjs

@@ -1,41 +1,67 @@
-// LobsterAI（有道龙虾）的固定事实：地址、客户端标识、未登录时的兜底模型表。
-// 兜底表只在没登录时显示；登录后由 /api/models/available 的实时结果替换。
-
-export const PROVIDER = "lobster"
-export const NAME = "LobsterAI"
-export const BASE = "https://lobsterai-server.youdao.com"
-export const API = BASE + "/api"
-export const CHAT_BASE = BASE + "/api/proxy/v1"
-export const NPM = "@ai-sdk/openai-compatible"
-
-export const LOGIN_URL = "https://lobsterai.youdao.com/portal#/login"
-export const ICON = "https://lobsterai.youdao.com/portal/lobsterai-logo.png"
-
-// 桌面端 2026.9.23 发的标识头；上游不强制，但可能影响特性开关
-export const CLIENT_VERSION = "2026.9.23"
-export const CAPABILITIES = "kimi-k3-agentic-v1,thinking-level-control-v1"
-
-// 接口不提供输出上限，取一个保守值（见设计文档 §8）
-export const DEFAULT_OUTPUT = 32000
-export const DEFAULT_CONTEXT = 1000000
-
-export function configModel({ name, context, output, reasoning, image }) {
-  const input = ["text"]
-  if (image) input.push("image")
-  return {
-    name,
-    limit: { context: context || DEFAULT_CONTEXT, output: output || DEFAULT_OUTPUT },
-    reasoning: !!reasoning,
-    tool_call: true,
-    modalities: { input, output: ["text"] },
-  }
-}
-
-// 兜底：未登录时让用户看到 provider 存在。字段来自实测的模型目录。
-export const FALLBACK_MODELS = {
-  "deepseek-v4-pro": configModel({ name: "DeepSeek V4 Pro", reasoning: true }),
-  "deepseek-flash": configModel({ name: "DeepSeek Flash", reasoning: true }),
-  "glm-5.3": configModel({ name: "GLM-5.3", reasoning: true }),
-  "kimi-k3": configModel({ name: "Kimi K3", reasoning: true, image: true }),
-  "qwen3.8-max": configModel({ name: "Qwen3.8 Max", reasoning: true }),
-}
+// LobsterAI（有道龙虾）的固定事实：地址、客户端标识、未登录时的兜底模型表。
+// 兜底表只在没登录时显示；登录后由 /api/models/available 的实时结果替换。
+
+export const PROVIDER = "lobster"
+export const NAME = "LobsterAI"
+export const BASE = "https://lobsterai-server.youdao.com"
+export const API = BASE + "/api"
+export const CHAT_BASE = BASE + "/api/proxy/v1"
+export const NPM = "@ai-sdk/openai-compatible"
+
+export const LOGIN_URL = "https://lobsterai.youdao.com/portal#/login"
+export const ICON = "https://lobsterai.youdao.com/portal/lobsterai-logo.png"
+
+// 桌面端 2026.9.23 发的标识头；上游不强制，但可能影响特性开关
+export const CLIENT_VERSION = "2026.9.23"
+export const CAPABILITIES = "kimi-k3-agentic-v1,thinking-level-control-v1"
+
+// 输出上限。接口的 maxTokens 字段恒为 null，所以靠实测：
+// 2026-11-02 逐模型打 max_tokens=131072，18 个可用模型全部通过；glm-5.3 自己
+// 报的上限就是 [1, 131072]。524288 才 HTTP 500。原来的 32000 会把长回答截掉，
+// 而 magpie 会把这个数当 max_output_tokens 广告给 agent。
+export const DEFAULT_OUTPUT = 131072
+export const DEFAULT_CONTEXT = 1000000
+
+// 没有 thinkingConfig 的模型：上游照样认 reasoning_effort，但**每个模型接受的
+// 档位不一样**，2026-11-02 逐模型实测（十模型 × 七档，见设计文档 §5 补测）：
+//   MiniMax-M3.1-Flash 拒收 none（"requires adaptive thinking"）
+//   qwen3.7-max        拒收 max（只到 xhigh）
+//   qwen3.7-plus       max 偶发 500
+//   MiniMax-M3         思考写在 content 的 <think> 里，reasoning_content 恒 0，
+//                      上游不分档，只有「关 / 开」
+// 只列**实测接受且确实有区别**的档位。没列进来的模型一律不声明（显示成
+// 「thinks, no levels」），宁少不多：声明了却选不动，用户以为能控，实际被忽略或 400。
+export const MEASURED_LEVELS = {
+  "kimi-k3.1-pro": ["none", "low", "medium", "high", "xhigh", "max"],
+  "kimi-k2.8-preview": ["none", "low", "medium", "high", "xhigh", "max"],
+  "qwen3.8-max": ["none", "low", "medium", "high", "xhigh", "max"],
+  "qwen3.8-flash": ["none", "low", "medium", "high", "xhigh", "max"],
+  "qwen3.8-omni-flash": ["none", "low", "medium", "high", "xhigh", "max"],
+  "doubao-seed-2-1-pro-260915": ["none", "low", "medium", "high", "xhigh", "max"],
+  "MiniMax-M3.1-Flash": ["medium", "high", "xhigh", "max"],
+  "qwen3.7-max": ["none", "low", "medium", "high", "xhigh"],
+  "qwen3.7-plus": ["none", "low", "medium", "high", "xhigh"],
+  // 只有「关」与「开」两种真实状态
+  "MiniMax-M3": ["none", "max"],
+}
+
+export function configModel({ name, context, output, reasoning, image }) {
+  const input = ["text"]
+  if (image) input.push("image")
+  return {
+    name,
+    limit: { context: context || DEFAULT_CONTEXT, output: output || DEFAULT_OUTPUT },
+    reasoning: !!reasoning,
+    tool_call: true,
+    modalities: { input, output: ["text"] },
+  }
+}
+
+// 兜底：未登录时让用户看到 provider 存在。字段来自实测的模型目录。
+export const FALLBACK_MODELS = {
+  "deepseek-v4-pro": configModel({ name: "DeepSeek V4 Pro", reasoning: true }),
+  "deepseek-flash": configModel({ name: "DeepSeek Flash", reasoning: true }),
+  "glm-5.3": configModel({ name: "GLM-5.3", reasoning: true }),
+  "kimi-k3": configModel({ name: "Kimi K3", reasoning: true, image: true }),
+  "qwen3.8-max": configModel({ name: "Qwen3.8 Max", reasoning: true }),
+}