u1s1-cli 1.14.4 → 1.14.6

package/dist/api.d.ts

@@ -26,6 +26,8 @@ export interface MeResponse {
     free_claim?: "first" | "renew" | null;
     /** 支付通道是否开放;老网关没有该字段,按开放处理(保留充值入口) */
     pay_enabled?: boolean;
+    /** 拉新收口:false = 收口后注册的账号,没有打卡等活动;老网关没有该字段,按可参与处理 */
+    incentives_eligible?: boolean;
 }
 export interface MePackage {
     id: number;

package/dist/api.js

@@ -1,5 +1,6 @@
 import { apiEndpointToCustom, loadEndpointsCache, saveEndpointsCache, setCustomEndpoints, VERSION, } from "./config.js";
 import { authorizedFetch } from "./device-auth.js";
+import { gatewayFetch } from "./gateway-route.js";
 import { tr } from "./i18n.js";
 const MAX_API_RESPONSE_BYTES = 8 * 1024 * 1024;
 const MAX_API_ERROR_BYTES = 64 * 1024;
@@ -123,7 +124,7 @@ export async function fetchModels(cfg) {
 export async function fetchLatestAnnouncement(cfg) {
     let resp;
     try {
-        resp = await fetch(new URL("/public/announcements/latest", cfg.baseUrl), {
+        resp = await gatewayFetch(new URL("/public/announcements/latest", cfg.baseUrl), {
             headers: { "x-u1s1-version": VERSION, Accept: "application/json" },
             signal: AbortSignal.timeout(15_000),
         });

package/dist/config.d.ts

@@ -94,7 +94,7 @@ export interface ModelDef {
  * 而 deepseek-flash 的窗口是 1M,会话逼近 100 万 token 才压缩——每轮 2 MB 请求体对渠道、
  * 时延、成本都是负担(近 7 天 >200K 的请求占 28% 却吃掉 54% 采购)。所以把注册给 pi 的
  * contextWindow 钉在 min(模型窗口, 预算),压缩、/context 百分比、溢出判定都随之按预算算。
- * 只影响自动压缩时机,不改模型能力。见 docs/dev-plan-long-session-auto-compact-2026-09-14.md。
+ * 只影响自动压缩时机,不改模型能力。
  */
 export declare const DEFAULT_COMPACTION_BUDGET_TOKENS = 200000;
 /**

package/dist/config.js

@@ -100,7 +100,7 @@ export const UNKNOWN_MODEL_COST = { input: 0, output: 0, cacheRead: 0, cacheWrit
  * 而 deepseek-flash 的窗口是 1M,会话逼近 100 万 token 才压缩——每轮 2 MB 请求体对渠道、
  * 时延、成本都是负担(近 7 天 >200K 的请求占 28% 却吃掉 54% 采购)。所以把注册给 pi 的
  * contextWindow 钉在 min(模型窗口, 预算),压缩、/context 百分比、溢出判定都随之按预算算。
- * 只影响自动压缩时机,不改模型能力。见 docs/dev-plan-long-session-auto-compact-2026-09-14.md。
+ * 只影响自动压缩时机,不改模型能力。
  */
 export const DEFAULT_COMPACTION_BUDGET_TOKENS = 200_000;
 /**

package/dist/device-auth.d.ts

@@ -1,6 +1,7 @@
 import { webcrypto } from "node:crypto";
 import { type IncomingMessage } from "node:http";
 import { type CliConfig } from "./config.js";
+import { type GatewayFetchFailure } from "./gateway-route.js";
 export declare function hasDeviceCredential(cfg: CliConfig): boolean;
 export declare function generateDeviceKeyPair(): Promise<{
     privateJwk: webcrypto.JsonWebKey;
@@ -53,21 +54,8 @@ interface SigningProxy {
 }
 /** Attach a fresh (self-healing) attestation header to an outbound proxy request. */
 export declare function attachAttestationHeader(holder: AttestationHolder, headers: Headers): Promise<void>;
-export type ClientSurface = "terminal" | "web" | "desktop" | "cloud";
-/** What a failed gateway fetch looked like at the socket level; never carries request content. */
-export interface GatewayFetchFailure {
-    /** Node/undici error code such as ECONNRESET or UND_ERR_CONNECT_TIMEOUT; "unknown" when absent. */
-    code: string;
-    /** One-line message for the user and the retry classifier, e.g. "fetch failed (ECONNRESET: read ECONNRESET)". */
-    detail: string;
-}
-/**
- * undici reports every transport failure as a bare "fetch failed" and puts the
- * real reason (reset, DNS, TLS, connect timeout) in `cause`, sometimes as an
- * AggregateError from happy eyeballs. Keep the original message first so the
- * agent's retry patterns still match.
- */
-export declare function describeFetchFailure(error: unknown): GatewayFetchFailure;
+export type ClientSurface = "terminal" | "web" | "desktop";
+export { describeFetchFailure, isConnectPhaseFailure, type GatewayFetchFailure } from "./gateway-route.js";
 /** One listener per process (telemetry); failures are reported only when the local caller is still waiting. */
 export declare function onGatewayFetchFailure(listener: ((failure: GatewayFetchFailure) => void) | undefined): void;
 /**
@@ -75,4 +63,3 @@ export declare function onGatewayFetchFailure(listener: ((failure: GatewayFetchF
  * replaces the local bearer credential with a fresh DPoP proof per request.
  */
 export declare function ensureSigningProxy(cfg: CliConfig, fallbackClient?: ClientSurface, attestationSource?: ClientAttestationSource): Promise<SigningProxy>;
-export {};

package/dist/device-auth.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes, randomUUID, webcrypto } from "node:crypto";
 import { createServer } from "node:http";
 import { VERSION } from "./config.js";
 import { tr } from "./i18n.js";
+import { describeFetchFailure, gatewayFetch, plainGatewaySender } from "./gateway-route.js";
 const enc = new TextEncoder();
 const SIGNING_PROXY_REQUEST_LIMIT_BYTES = 32 * 1024 * 1024;
 let cachedPrivate;
@@ -66,20 +67,22 @@ export async function dpopHeaders(cfg, method, url) {
 }
 /** Fetch a gateway route with a fresh proof; generic keys remain a read-only compatibility fallback. */
 export async function authorizedFetch(cfg, input, init = {}) {
-    const url = String(input);
-    const headers = new Headers(init.headers);
-    if (hasDeviceCredential(cfg)) {
-        const signed = await dpopHeaders(cfg, init.method ?? "GET", url);
-        for (const [name, value] of Object.entries(signed))
-            headers.set(name, value);
-    }
-    else if (cfg.apiKey) {
-        headers.set("authorization", `Bearer ${cfg.apiKey}`);
-    }
-    else {
+    if (!hasDeviceCredential(cfg) && !cfg.apiKey) {
         throw new Error(tr("还没有登录，请运行 u1s1 login", "Not signed in. Run u1s1 login."));
     }
-    return fetch(url, { ...init, headers });
+    // 中国站主域建连失败时会换到大陆加速入口重发(gateway-route.ts);DPoP 绑定 URL,每次按实际 URL 重签
+    return gatewayFetch(input, init, async (url, attemptInit, attempt) => {
+        const headers = new Headers(attemptInit.headers);
+        if (hasDeviceCredential(cfg)) {
+            const signed = await dpopHeaders(cfg, attemptInit.method ?? "GET", url);
+            for (const [name, value] of Object.entries(signed))
+                headers.set(name, value);
+        }
+        else {
+            headers.set("authorization", `Bearer ${cfg.apiKey}`);
+        }
+        return plainGatewaySender(url, { ...attemptInit, headers }, attempt);
+    });
 }
 /**
  * Headers to replay on the loopback response. fetch() has already decoded the
@@ -204,36 +207,12 @@ export async function attachAttestationHeader(holder, headers) {
 }
 function clientSurface(fallback) {
     const explicit = process.env["U1S1_CLIENT"];
-    if (explicit === "terminal" || explicit === "web" || explicit === "desktop" || explicit === "cloud") {
+    if (explicit === "terminal" || explicit === "web" || explicit === "desktop") {
         return explicit;
     }
     return process.versions.electron ? "desktop" : fallback;
 }
-/**
- * undici reports every transport failure as a bare "fetch failed" and puts the
- * real reason (reset, DNS, TLS, connect timeout) in `cause`, sometimes as an
- * AggregateError from happy eyeballs. Keep the original message first so the
- * agent's retry patterns still match.
- */
-export function describeFetchFailure(error) {
-    const message = error instanceof Error ? error.message : "signing proxy failed";
-    let cause = error instanceof Error ? error.cause : undefined;
-    if (cause instanceof AggregateError && cause.errors.length)
-        cause = cause.errors[0];
-    const causeRecord = typeof cause === "object" && cause !== null ? cause : {};
-    const code = typeof causeRecord.code === "string" && causeRecord.code
-        ? causeRecord.code
-        : typeof error?.code === "string"
-            ? error.code
-            : "unknown";
-    const causeMessage = typeof causeRecord.message === "string" ? causeRecord.message.split("\n")[0].slice(0, 200) : "";
-    if (!causeMessage && code === "unknown")
-        return { code, detail: message };
-    const reason = causeMessage && !causeMessage.includes(code) && code !== "unknown"
-        ? `${code}: ${causeMessage}`
-        : causeMessage || code;
-    return { code, detail: `${message} (${reason})` };
-}
+export { describeFetchFailure, isConnectPhaseFailure } from "./gateway-route.js";
 let gatewayFetchFailureListener;
 /** One listener per process (telemetry); failures are reported only when the local caller is still waiting. */
 export function onGatewayFetchFailure(listener) {
@@ -278,7 +257,7 @@ export async function ensureSigningProxy(cfg, fallbackClient = "terminal", attes
                 }
             };
             res.once("close", abortUpstream);
-            const target = new URL(`${localUrl.pathname}${localUrl.search}`, upstreamOrigin).toString();
+            const pathAndQuery = `${localUrl.pathname}${localUrl.search}`;
             try {
                 const body = await readSigningProxyRequestBody(req);
                 const outboundHeaders = requestHeaders(req.headers);
@@ -288,7 +267,8 @@ export async function ensureSigningProxy(cfg, fallbackClient = "terminal", attes
                 outboundHeaders.set("x-u1s1-version", VERSION);
                 outboundHeaders.set("x-u1s1-platform", `${process.platform}-${process.arch}`);
                 await attachAttestationHeader(attestation, outboundHeaders);
-                const upstream = await authorizedFetch(cfg, target, {
+                // 中国站主域建连失败时 authorizedFetch 会换到大陆加速入口,和启动时的请求共用选路状态
+                const upstream = await authorizedFetch(cfg, new URL(pathAndQuery, upstreamOrigin).toString(), {
                     method: req.method ?? "GET",
                     headers: outboundHeaders,
                     body,

package/dist/gateway-route.d.ts

@@ -0,0 +1,57 @@
+/**
+ * 中国站网关的「主域 ↔ 大陆加速入口」选路,整个进程共用一份状态。
+ *
+ * 国内有些网络连不上 api 主域(DNS 污染、黑洞、拒连),但能连 api-cn 加速入口(同一个网关)。
+ * 规则(沿用 1.14.5 签名代理的原则):
+ * - 只在建连阶段失败时换入口重发:那时请求还没发出去,重发不会重复扣费。请求已发出后的失败
+ *   (ECONNRESET、读超时、调用方超时/取消)一律照旧报错,不重发。
+ * - 本进程还没确认哪个入口能用时,主域用较短的建连超时(PRIMARY_CONNECT_TIMEOUT_MS)试一次,
+ *   不再等全局 30 秒;换过去成功的入口记住,之后的请求(模型列表、账户、签名代理……)直接走它。
+ * - 两个入口都建连失败时,用正常超时再连一次主域(海外用户解析不到 api-cn,主域只是慢)。
+ * - 只对中国站官方 API 域名生效;国际站和自定义地址原样直连。
+ */
+/** 一次请求失败在传输层长什么样;绝不带请求内容。 */
+export interface GatewayFetchFailure {
+    /** Node/undici error code such as ECONNRESET or UND_ERR_CONNECT_TIMEOUT; "unknown" when absent. */
+    code: string;
+    /** One-line message for the user and the retry classifier, e.g. "fetch failed (ECONNRESET: read ECONNRESET)". */
+    detail: string;
+}
+/**
+ * undici reports every transport failure as a bare "fetch failed" and puts the
+ * real reason (reset, DNS, TLS, connect timeout) in `cause`, sometimes as an
+ * AggregateError from happy eyeballs. Keep the original message first so the
+ * agent's retry patterns still match.
+ */
+export declare function describeFetchFailure(error: unknown): GatewayFetchFailure;
+export declare function isConnectPhaseFailure(failure: GatewayFetchFailure): boolean;
+/**
+ * 还没确认入口时,直连主域的建连超时(含 DNS + TCP + TLS)。
+ * 取舍:正常线路握手 1–2 秒;IPv6 不通时 happy eyeballs 要先耗 2 秒再换 IPv4,6 秒留足余量。
+ * 更慢的丢包线路(1.14.4 为它把全局建连超时放宽到 30 秒)会改走加速入口,本来也更快;
+ * 加速入口也连不上时仍会用全局超时再连一次主域,所以只是慢,不会因此连不上。
+ */
+export declare const PRIMARY_CONNECT_TIMEOUT_MS = 6000;
+export interface GatewayAttempt {
+    /** 只在「还没确认入口、先试主域」那一次给出;发送方要用它代替全局 dispatcher。 */
+    connectTimeoutMs?: number;
+}
+/** 真正发一次请求。签名请求要按每次的 URL 重新签 DPoP,所以由调用方提供。 */
+export type GatewaySender = (url: string, init: RequestInit, attempt: GatewayAttempt) => Promise<Response>;
+type Route = "primary" | "edge";
+/** 本进程对这个 origin 已经确认走的入口(测试和诊断用)。 */
+export declare function gatewayRouteFor(origin: string): Route | undefined;
+/** 测试用:清空选路状态,可换一套「主域 → 备用入口」映射(本地起假服务端)和更短的建连超时。 */
+export declare function resetGatewayRoutesForTests(resolver?: (origin: string) => string | null, connectTimeoutMs?: number): void;
+/**
+ * 默认发送方。短建连超时要靠自带的 undici dispatcher,而 dispatcher 必须交给同一份 undici 的 fetch
+ * (Node 自带 fetch 混用会出解压问题,见 pi 的 http-dispatcher.js)。CLI 启动时 pi 已把全局 fetch
+ * 换成这份 undici;没换(或被测试替换)时就用全局 fetch 的默认建连超时,选路规则不变。
+ */
+export declare const plainGatewaySender: GatewaySender;
+/**
+ * 发一个网关请求;是中国站官方 API 域名时按上面的规则在主域和加速入口之间选路。
+ * 请求体必须可重放(string / Buffer / undefined),流式 body 不要走这里的回退。
+ */
+export declare function gatewayFetch(input: string | URL, init?: RequestInit, send?: GatewaySender): Promise<Response>;
+export {};

package/dist/gateway-route.js

@@ -0,0 +1,157 @@
+import { EnvHttpProxyAgent, fetch as undiciFetch } from "undici";
+import { edgeFallbackOrigin } from "./site.js";
+/**
+ * undici reports every transport failure as a bare "fetch failed" and puts the
+ * real reason (reset, DNS, TLS, connect timeout) in `cause`, sometimes as an
+ * AggregateError from happy eyeballs. Keep the original message first so the
+ * agent's retry patterns still match.
+ */
+export function describeFetchFailure(error) {
+    const message = error instanceof Error ? error.message : "signing proxy failed";
+    let cause = error instanceof Error ? error.cause : undefined;
+    if (cause instanceof AggregateError && cause.errors.length)
+        cause = cause.errors[0];
+    const causeRecord = typeof cause === "object" && cause !== null ? cause : {};
+    const code = typeof causeRecord.code === "string" && causeRecord.code
+        ? causeRecord.code
+        : typeof error?.code === "string"
+            ? error.code
+            : "unknown";
+    const causeMessage = typeof causeRecord.message === "string" ? causeRecord.message.split("\n")[0].slice(0, 200) : "";
+    if (!causeMessage && code === "unknown")
+        return { code, detail: message };
+    const reason = causeMessage && !causeMessage.includes(code) && code !== "unknown"
+        ? `${code}: ${causeMessage}`
+        : causeMessage || code;
+    return { code, detail: `${message} (${reason})` };
+}
+/**
+ * 只认建连阶段的失败(请求还没发出去,换个入口重发不会重复扣费)。ECONNRESET / 读超时这类
+ * 可能发生在请求已送达之后,不重试,照旧报给用户。
+ */
+const CONNECT_PHASE_CODES = new Set([
+    "ECONNREFUSED", "ENOTFOUND", "EAI_AGAIN", "ENETUNREACH", "EHOSTUNREACH", "ETIMEDOUT", "UND_ERR_CONNECT_TIMEOUT",
+]);
+/** Node 在 TLS 握手完成前断开时的固定文案:此时一个 HTTP 字节都还没发,和拒连一样安全。 */
+const TLS_HANDSHAKE_RESET = "before secure TLS connection was established";
+export function isConnectPhaseFailure(failure) {
+    if (CONNECT_PHASE_CODES.has(failure.code))
+        return true;
+    return failure.code === "ECONNRESET" && failure.detail.includes(TLS_HANDSHAKE_RESET);
+}
+/**
+ * 还没确认入口时,直连主域的建连超时(含 DNS + TCP + TLS)。
+ * 取舍:正常线路握手 1–2 秒;IPv6 不通时 happy eyeballs 要先耗 2 秒再换 IPv4,6 秒留足余量。
+ * 更慢的丢包线路(1.14.4 为它把全局建连超时放宽到 30 秒)会改走加速入口,本来也更快;
+ * 加速入口也连不上时仍会用全局超时再连一次主域,所以只是慢,不会因此连不上。
+ */
+export const PRIMARY_CONNECT_TIMEOUT_MS = 6_000;
+/** key 是主域 origin;没有记录 = 本进程还没确认哪个入口能用。 */
+const routes = new Map();
+let fallbackResolver = edgeFallbackOrigin;
+/** 本进程对这个 origin 已经确认走的入口(测试和诊断用)。 */
+export function gatewayRouteFor(origin) {
+    return routes.get(origin);
+}
+let primaryConnectTimeoutMs = PRIMARY_CONNECT_TIMEOUT_MS;
+/** 测试用:清空选路状态,可换一套「主域 → 备用入口」映射(本地起假服务端)和更短的建连超时。 */
+export function resetGatewayRoutesForTests(resolver = edgeFallbackOrigin, connectTimeoutMs = PRIMARY_CONNECT_TIMEOUT_MS) {
+    routes.clear();
+    fallbackResolver = resolver;
+    primaryConnectTimeoutMs = connectTimeoutMs;
+}
+const shortConnectDispatchers = new Map();
+function shortConnectDispatcher(timeoutMs) {
+    let dispatcher = shortConnectDispatchers.get(timeoutMs);
+    if (dispatcher === undefined) {
+        try {
+            // 与 pi 的全局 dispatcher 同款(同样认 HTTP(S)_PROXY / NO_PROXY),只是建连超时更短
+            dispatcher = new EnvHttpProxyAgent({
+                allowH2: false,
+                proxyTunnel: true,
+                connect: { timeout: timeoutMs, autoSelectFamilyAttemptTimeout: 2_000 },
+            });
+        }
+        catch {
+            dispatcher = null;
+        }
+        shortConnectDispatchers.set(timeoutMs, dispatcher);
+    }
+    return dispatcher;
+}
+/**
+ * 默认发送方。短建连超时要靠自带的 undici dispatcher,而 dispatcher 必须交给同一份 undici 的 fetch
+ * (Node 自带 fetch 混用会出解压问题,见 pi 的 http-dispatcher.js)。CLI 启动时 pi 已把全局 fetch
+ * 换成这份 undici;没换(或被测试替换)时就用全局 fetch 的默认建连超时,选路规则不变。
+ */
+export const plainGatewaySender = (url, init, attempt) => {
+    const dispatcher = attempt.connectTimeoutMs && globalThis.fetch === undiciFetch
+        ? shortConnectDispatcher(attempt.connectTimeoutMs)
+        : null;
+    if (!dispatcher)
+        return fetch(url, init);
+    return undiciFetch(url, { ...init, dispatcher });
+};
+function withOrigin(url, origin) {
+    return new URL(`${url.pathname}${url.search}`, origin).toString();
+}
+function retryableAtConnect(error, init) {
+    if (init.signal?.aborted)
+        return false;
+    return isConnectPhaseFailure(describeFetchFailure(error));
+}
+/**
+ * 发一个网关请求;是中国站官方 API 域名时按上面的规则在主域和加速入口之间选路。
+ * 请求体必须可重放(string / Buffer / undefined),流式 body 不要走这里的回退。
+ */
+export async function gatewayFetch(input, init = {}, send = plainGatewaySender) {
+    const url = new URL(String(input));
+    const primary = url.origin;
+    const edge = fallbackResolver(primary);
+    if (!edge)
+        return send(url.toString(), init, {});
+    const primaryUrl = withOrigin(url, primary);
+    const edgeUrl = withOrigin(url, edge);
+    const route = routes.get(primary);
+    if (route === "edge") {
+        try {
+            return await send(edgeUrl, init, {});
+        }
+        catch (error) {
+            if (!retryableAtConnect(error, init))
+                throw error;
+            const resp = await send(primaryUrl, init, {});
+            routes.set(primary, "primary");
+            return resp;
+        }
+    }
+    // 已确认主域能用:正常超时直连;只有这次建连又失败了才去试加速入口
+    const firstAttempt = route === "primary" ? {} : { connectTimeoutMs: primaryConnectTimeoutMs };
+    let firstError;
+    try {
+        const resp = await send(primaryUrl, init, firstAttempt);
+        routes.set(primary, "primary");
+        return resp;
+    }
+    catch (error) {
+        if (!retryableAtConnect(error, init))
+            throw error;
+        firstError = error;
+    }
+    try {
+        const resp = await send(edgeUrl, init, {});
+        routes.set(primary, "edge");
+        return resp;
+    }
+    catch (error) {
+        if (!retryableAtConnect(error, init))
+            throw error;
+    }
+    // 两个入口都没连上:第一次用的是短超时时,再按全局超时给主域一次机会(海外慢线路)
+    if (firstAttempt.connectTimeoutMs) {
+        const resp = await send(primaryUrl, init, {});
+        routes.set(primary, "primary");
+        return resp;
+    }
+    throw firstError;
+}

package/dist/login.js

@@ -6,6 +6,7 @@ import { loadConfig, loadFileConfig, saveConfig } from "./config.js";
 import { generateDeviceKeyPair, hasDeviceCredential } from "./device-auth.js";
 import { isEnglish, tr } from "./i18n.js";
 import { isSiteUrl, parseSiteArg, siteLinks, siteOf, SITES } from "./site.js";
+import { gatewayFetch } from "./gateway-route.js";
 const require = createRequire(import.meta.url);
 const VERSION = require("../package.json").version;
 const MAX_DEVICE_AUTH_RESPONSE_BYTES = 64 * 1024;
@@ -46,7 +47,7 @@ export function apiOrigin(cfg) {
 export async function startDeviceLogin(origin, failure) {
     try {
         const pair = await generateDeviceKeyPair();
-        const resp = await fetch(`${origin}/auth/device/start`, {
+        const resp = await gatewayFetch(`${origin}/auth/device/start`, {
             method: "POST",
             headers: { "content-type": "application/json" },
             body: JSON.stringify({
@@ -102,7 +103,7 @@ export async function pollDeviceLogin(origin, start, outcome) {
     while (Date.now() < deadline) {
         await sleep(interval * 1000);
         try {
-            const resp = await fetch(`${origin}/auth/device/poll`, {
+            const resp = await gatewayFetch(`${origin}/auth/device/poll`, {
                 method: "POST",
                 headers: { "content-type": "application/json" },
                 body: JSON.stringify({ poll_secret: start.poll_secret }),

package/dist/search-tools.js

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { agentDir } from "./config.js";
+import { gatewayFetch } from "./gateway-route.js";
 import { tr } from "./i18n.js";
 /**
  * 预 seed pi 的搜索组件(fd / ripgrep)到 ~/.u1s1/agent/bin。
@@ -107,7 +108,7 @@ async function install(tool, baseUrl, binName) {
     if (!asset)
         throw new Error(tr(`不支持的平台 ${platform()}/${arch()}`, `Unsupported platform ${platform()}/${arch()}`));
     mkdirSync(binDir, { recursive: true });
-    const res = await fetch(new URL(`/tools/${asset}`, baseUrl), {
+    const res = await gatewayFetch(new URL(`/tools/${asset}`, baseUrl), {
         signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS),
     });
     if (!res.ok || !res.body)

package/dist/site.d.ts

@@ -27,6 +27,13 @@ export interface Site {
  * api.u1s1.io 由 migrateStoredBaseUrl 在下次保存时改写到新 apiBase。
  */
 export declare const CN_ORIGIN = "https://u1s1app.com";
+/**
+ * 中国站的大陆加速入口(EdgeOne → 同一个网关)。直连 api 主域在建连阶段就失败时,签名代理
+ * 换到这里重试一次,本进程之后都走它(device-auth.ts)。只在大陆有解析,海外解析不到也无妨。
+ */
+export declare const CN_EDGE_API_HOST = "api-cn.u1s1app.com";
+/** 这个网关 origin 连不上时可以换到的备用 origin;不是中国站官方 API 域名就没有备用。 */
+export declare function edgeFallbackOrigin(origin: string): string | null;
 /** origin → https://api.<host>/v1 */
 export declare function apiBaseForOrigin(origin: string): string;
 export declare const SITES: Readonly<Record<SiteId, Site>>;

package/dist/site.js

@@ -14,6 +14,25 @@
  */
 export const CN_ORIGIN = "https://u1s1app.com";
 const INTL_ORIGIN = "https://u1s1.dev";
+/**
+ * 中国站的大陆加速入口(EdgeOne → 同一个网关)。直连 api 主域在建连阶段就失败时,签名代理
+ * 换到这里重试一次,本进程之后都走它(device-auth.ts)。只在大陆有解析,海外解析不到也无妨。
+ */
+export const CN_EDGE_API_HOST = "api-cn.u1s1app.com";
+const CN_EDGE_FALLBACK_FROM = ["api.u1s1app.com", "api.u1s1.io"];
+/** 这个网关 origin 连不上时可以换到的备用 origin;不是中国站官方 API 域名就没有备用。 */
+export function edgeFallbackOrigin(origin) {
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== "https:" || url.port || !CN_EDGE_FALLBACK_FROM.includes(url.hostname.toLowerCase()))
+        return null;
+    return `https://${CN_EDGE_API_HOST}`;
+}
 /** origin → https://api.<host>/v1 */
 export function apiBaseForOrigin(origin) {
     const url = new URL(origin);
@@ -27,7 +46,7 @@ export const SITES = {
         releaseOrigin: CN_ORIGIN,
         // 邮件域已切到 u1s1app.com(2026-09-30);contact@u1s1.io 仍能收信,老版本照旧可用
         contactEmail: "contact@u1s1app.com",
-        hosts: ["u1s1.io", "www.u1s1.io", "api.u1s1.io", "u1s1app.com", "www.u1s1app.com", "api.u1s1app.com"],
+        hosts: ["u1s1.io", "www.u1s1.io", "api.u1s1.io", "u1s1app.com", "www.u1s1app.com", "api.u1s1app.com", CN_EDGE_API_HOST],
     },
     intl: {
         id: "intl",

package/dist/usage.d.ts

@@ -3,12 +3,14 @@ import { type Site } from "./site.js";
 /** 当前站点的充值深链(仪表盘充值卡片)。 */
 export declare function topupUrl(site?: Site): string;
 /**
- * 报告尾巴的两条行动入口:打卡/邀请领包与充值(撞线用户的直接出口,运营清单 A2)。
- * 08-25 起没有「每天自动恢复」的免费池,邀请包也和打卡包一样有有效期,别再写「永久加量」。
+ * 报告尾巴的两条行动入口:打卡领包与充值(撞线用户的直接出口,运营清单 A2)。
+ * 08-25 起没有「每天自动恢复」的免费池,打卡包有有效期,别再写「永久加量」。
+ * 2026-10-26 起邀请不再带来新奖励,不再提邀请;拉新收口后注册的账号(incentives_eligible=false)
+ * 也没有打卡,第一行只指仪表盘。
  * 支付通道关闭时充值是死路(仪表盘会报「支付通道未开放」),改说即将上线并指向
  * 仪表盘的加量包/打卡入口;老网关没有 pay_enabled 字段,按开放处理。
  */
-export declare function usageCtaLines(me?: Pick<MeResponse, "pay_enabled">, site?: Site): string[];
+export declare function usageCtaLines(me?: Pick<MeResponse, "pay_enabled" | "incentives_eligible">, site?: Site): string[];
 /** 额度报告正文(不含首尾空行),终端 `u1s1 usage` 和会话内 /usage 共用。 */
 export declare function usageReportLines(me: MeResponse, site?: Site): string[];
 /** 会话内 /usage 用:拉取额度并打包成 entry data,错误转成提示文字而不是抛出。 */

package/dist/usage.js

@@ -179,8 +179,10 @@ export function topupUrl(site = activeSite()) {
     return siteLinks(site).topup;
 }
 /**
- * 报告尾巴的两条行动入口:打卡/邀请领包与充值(撞线用户的直接出口,运营清单 A2)。
- * 08-25 起没有「每天自动恢复」的免费池,邀请包也和打卡包一样有有效期,别再写「永久加量」。
+ * 报告尾巴的两条行动入口:打卡领包与充值(撞线用户的直接出口,运营清单 A2)。
+ * 08-25 起没有「每天自动恢复」的免费池,打卡包有有效期,别再写「永久加量」。
+ * 2026-10-26 起邀请不再带来新奖励,不再提邀请;拉新收口后注册的账号(incentives_eligible=false)
+ * 也没有打卡,第一行只指仪表盘。
  * 支付通道关闭时充值是死路(仪表盘会报「支付通道未开放」),改说即将上线并指向
  * 仪表盘的加量包/打卡入口;老网关没有 pay_enabled 字段,按开放处理。
  */
@@ -188,7 +190,9 @@ export function usageCtaLines(me, site = activeSite()) {
     const payClosed = me?.pay_enabled === false;
     const { dashboard, topup } = siteLinks(site);
     return [
-        tr(`  每天到仪表盘打卡领免费包；邀请朋友双方都加量 → ${dashboard}`, `  Check in daily on the dashboard for free packs; invite friends and you both get more → ${dashboard}`),
+        me?.incentives_eligible === false
+            ? tr(`  用量包与充值记录在仪表盘 → ${dashboard}`, `  Packs and top-up history are on the dashboard → ${dashboard}`)
+            : tr(`  每天到仪表盘打卡领免费包 → ${dashboard}`, `  Check in daily on the dashboard for free packs → ${dashboard}`),
         payClosed
             ? tr(`  充值通道即将开放；额度不够先到仪表盘领加量包、每日打卡 → ${dashboard}`, `  Top-ups are coming soon; meanwhile grab extra packs and check in on the dashboard → ${dashboard}`)
             : tr(`  额度不够用?充值 → ${topup}`, `  Need more? Top up → ${topup}`),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u1s1-cli",
-  "version": "1.14.4",
+  "version": "1.14.6",
   "description": "u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。",
   "type": "module",
   "bin": {
@@ -49,7 +49,8 @@
     "@earendil-works/pi-mcp": "1.2.0",
     "@earendil-works/pi-telemetry": "1.2.0",
     "@earendil-works/pi-tui": "1.2.0",
-    "typebox": "1.3.7"
+    "typebox": "1.3.7",
+    "undici": "8.10.2"
   },
   "devDependencies": {
     "@types/node": "^22.20.1",