feat(providers): add experimental Huawei Cloud CodeArts (码道) adapter

README.md

@@ -4,7 +4,7 @@
 
 **把你自己的登录态，变成一个本机 OpenAI 兼容 API**
 
-接入 **Qoder（国际版 / 国内版）**、**WorkBuddy（国际版 / 国内版）**、**Trae 国内版 Work**，以及实验性的 **Devin** 和 **Command Code**。
+接入 **Qoder（国际版 / 国内版）**、**WorkBuddy（国际版 / 国内版）**、**Trae 国内版 Work**，以及实验性的 **Devin**、**Command Code** 和 **华为云码道 CodeArts**。
 
 用 Docker 部署，在 Web 控制台管理账号，再通过兼容 API 接入客户端。
 
@@ -26,9 +26,10 @@
 - **兼容接口**：Chat Completions、Responses、Anthropic Messages 和模型列表，支持流式回复与函数工具调用。
 - **多账号调度**：轮询、加权轮询、顺序填满，以及可选的同供应商最早到期优先（FEFO）；保留自动选号、会话粘性、并发限制、冷却与故障切换。
 - **统一控制台**：管理账号、模型、客户端密钥、代理设置，查看额度和请求日志。
+- **华为云码道（实验性）**：OAuth PKCE 登录后直连 snap-access 的 OpenAI 兼容接口，支持流式、工具调用、按目录声明向视觉模型转发图片、按目录声明的 reasoning 档位，并读取套餐积分 / token 计量。
 - **Docker 运维**：持久化账号数据；可选安装宿主机更新器，在控制台下载更新、确认升级和回滚。
 
-Qoder 国内版、WorkBuddy、Trae 的适配代码已实现，真账号验收仍未完成；Devin 与 Command Code 为实验性接入，不承诺生产可用。托管更新的真实升级 / 回滚验收也尚未完成。Kimi Code（中国区）已完成单账号端到端验收：设备码登录、模型发现、三种接口的对话 / 流式 / 工具调用 / 视觉，以及额度读取；多账号行为只有自动化测试覆盖。
+Qoder 国内版、WorkBuddy、Trae 的适配代码已实现，真账号验收仍未完成；Devin、Command Code 与华为云码道 CodeArts 为实验性接入，不承诺生产可用。托管更新的真实升级 / 回滚验收也尚未完成。Kimi Code（中国区）已完成单账号端到端验收：设备码登录、模型发现、三种接口的对话 / 流式 / 工具调用 / 视觉，以及额度读取；多账号行为只有自动化测试覆盖。码道 CodeArts 已完成单账号端到端验收：OAuth 登录、模型发现与不可用模型剔除、Chat Completions / Anthropic Messages / Responses 的非流式与流式、工具调用、reasoning 透传、套餐额度读取和签到；双账号失败切换与会话粘性也已实测，额度耗尽切换仍待验收。
 
 ## 快速开始
 
@@ -63,7 +64,7 @@ API Key:  <在 API keys 页面创建的客户端密钥>
   <img src="./docs/assets/readme/architecture-zh.svg" width="100%" alt="CLI2API 架构：OpenAI 客户端经 Go 控制面路由到每账号独立运行时，再连接各 provider 上游">
 </p>
 
-Go 网关统一鉴权、调度和记录请求。Qoder 每个账号使用独立 Node 进程与 HOME；WorkBuddy、Trae、Devin、Command Code 使用 Go 进程内适配器，不为每次请求启动完整 CLI。
+Go 网关统一鉴权、调度和记录请求。Qoder 每个账号使用独立 Node 进程与 HOME；WorkBuddy、Trae、Devin、Command Code 使用 Go 进程内适配器，不为每次请求启动完整 CLI；码道 CodeArts 也走进程内适配器，直连华为云 snap-access 的 OpenAI 兼容网关，不拉起码道 CLI 或 IDE。
 
 ## 控制台
 
@@ -82,13 +83,13 @@ Go 网关统一鉴权、调度和记录请求。Qoder 每个账号使用独立 N
 - **只在同一供应商内排序**：先按供应商分组，再比较本组账号最近的积分包到期日；Qoder、WorkBuddy 等互不影响，跨供应商仍按原有轮询选择。
 - **只认实际可消费的积分包到期**：跳过余额为零、已过期或到期未知的包；同一 UTC+8 自然日到期的账号公平轮询。未知到期不猜测，作为该供应商的兜底候选，只有已知到期账号都不可用时才参与。
 - **额度与故障切换照旧**：额度耗尽、限流冷却、并发占满或被显式排除的账号先退出候选，恢复后自动回到排序。响应或流结束后异步刷新该账号额度并重新排序；缓存中的包自然过期也会触发额度探测。不会把订阅重置、令牌有效期或签到奖励当成积分包到期。
-- **数据缺口**：目前只有 WorkBuddy 个人账号的 `get-user-resource` 返回逐包 `CycleEndTime`。Qoder 的 `quota/usage` 只有订阅月度边界（`expiresAt`），Trae、Devin、Command Code、Codex 也只有重置窗口或总额度，因此这些供应商的账号在 FEFO 下按未知日期处理。WorkBuddy 企业/共享身份，以及结果达到 100 条的未确认列表，也不会获得 FEFO 优先级。升级后尚未刷新额度的旧缓存同样按未知日期处理，启动探测或手动刷新后才会带上包元数据。
+- **数据缺口**：目前只有 WorkBuddy 个人账号的 `get-user-resource` 返回逐包 `CycleEndTime`。Qoder 的 `quota/usage` 只有订阅月度边界（`expiresAt`），Trae、Devin、Command Code、Codex 也只有重置窗口或总额度，因此这些供应商的账号在 FEFO 下按未知日期处理。码道 CodeArts 的统计接口提供套餐积分与 token 计量，但不提供逐包到期日，同样按未知日期兜底，不伪造到期。WorkBuddy 企业/共享身份，以及结果达到 100 条的未确认列表，也不会获得 FEFO 优先级。升级后尚未刷新额度的旧缓存同样按未知日期处理，启动探测或手动刷新后才会带上包元数据。
 
 ## 使用限制
 
 - 只连接你自己的账号，不提供账号、额度或官方 API 服务。
 - 兼容接口不等于完整复刻官方 API。Messages / Responses 为无状态适配，不保存服务端会话，也不执行上游专属工具。
-- 图片能力取决于上游和模型，网关把上游声明的图片输入逐模型透出为 `supports_images`（`/v1/models` 与 `/api/models`）。WorkBuddy 的 DeepSeek V4 / V4.1、GLM、Kimi 等模型支持图片；Trae、Command、Zhipu 未声明图片输入。具体范围见 [部署说明](deploy/README.md)。
+- 图片能力取决于上游和模型，网关把上游声明的图片输入逐模型透出为 `supports_images`（`/v1/models` 与 `/api/models`）。WorkBuddy 的 DeepSeek V4 / V4.1、GLM、Kimi 等模型支持图片；码道的 Qwen3-VL-235B 与 Kimi K2.6 VL 支持图片，其余码道模型按文本处理；Trae、Command、Zhipu 未声明图片输入。具体范围见 [部署说明](deploy/README.md)。
 - 跨上游同名模型调度受系统开关、账号权限和地域约束；不是任意账号之间都能切换。
 - 上游协议变化可能影响兼容性；请求日志默认不保存提示词或回复正文。
 

README_EN.md

@@ -4,7 +4,7 @@
 
 **Turn your own logins into a local OpenAI-compatible API**
 
-Connect **Qoder (Global / CN)**, **WorkBuddy (Global / CN)**, **Trae CN Work**, and experimental **Devin** and **Command Code** accounts.
+Connect **Qoder (Global / CN)**, **WorkBuddy (Global / CN)**, **Trae CN Work**, and experimental **Devin**, **Command Code**, and **Huawei Cloud CodeArts (码道)** accounts.
 
 Deploy with Docker, manage accounts in the web console, and connect clients through compatible APIs.
 
@@ -26,9 +26,10 @@ Deploy with Docker, manage accounts in the web console, and connect clients thro
 - **Compatible APIs**: Chat Completions, Responses, Anthropic Messages, and model listing, with streaming and function tools.
 - **Multi-account routing**: round-robin, weighted round-robin, fill-first, and opt-in same-provider earliest-expiry-first (FEFO), with automatic selection, session affinity, concurrency limits, cooldowns, and failover.
 - **Web console**: manage accounts, models, client keys, and proxies; view quotas and request logs.
+- **Huawei Cloud CodeArts (experimental)**: OAuth PKCE sign-in followed by direct OpenAI-compatible calls to snap-access, with streaming, tools, image input for catalog-declared vision models, catalog-declared reasoning levels, and package-credit / token meters.
 - **Docker operations**: persistent account data; an optional host updater lets you download, confirm, and roll back updates from the console.
 
-Qoder CN, WorkBuddy, and Trae adapters are implemented, but live-account acceptance is still pending. Devin and Command Code are experimental, not production-ready. Live upgrade and rollback acceptance is also pending. The Kimi Code CN adapter has single-account end-to-end acceptance: device-code sign-in, model discovery, chat/streaming/tools/vision on all three APIs, and quota readout; multi-account behavior is covered by automated tests only.
+Qoder CN, WorkBuddy, and Trae adapters are implemented, but live-account acceptance is still pending. Devin, Command Code, and Huawei Cloud CodeArts are experimental, not production-ready. Live upgrade and rollback acceptance is also pending. The Kimi Code CN adapter has single-account end-to-end acceptance: device-code sign-in, model discovery, chat/streaming/tools/vision on all three APIs, and quota readout; multi-account behavior is covered by automated tests only. CodeArts has single-account end-to-end acceptance: OAuth sign-in, model discovery with unusable-model removal, non-streaming and streaming Chat Completions / Anthropic Messages / Responses, tool calls, reasoning passthrough, package-credit readout, and check-in; two-account failover and session affinity have also been verified live, while quota-exhaustion failover is still pending.
 
 ## Quick start
 
@@ -63,7 +64,7 @@ Get a model ID from **Access** or `/v1/models`. Routing is automatic and prefers
   <img src="./docs/assets/readme/architecture-en.svg" width="100%" alt="CLI2API architecture: OpenAI clients are routed by the Go control plane to one isolated runtime per account, then to the provider upstream">
 </p>
 
-The Go gateway handles authentication, routing, and request logging. Each Qoder account has its own Node process and HOME; WorkBuddy, Trae, Devin, and Command Code use Go in-process adapters. No full CLI is started per request.
+The Go gateway handles authentication, routing, and request logging. Each Qoder account has its own Node process and HOME; WorkBuddy, Trae, Devin, Command Code, and CodeArts use Go in-process adapters. No full CLI is started per request.
 
 ## Console
 
@@ -82,13 +83,13 @@ Select **Earliest expiry first (FEFO)** under **System → Account routing strat
 - **Rank only inside one provider.** Accounts are grouped by provider family before their nearest credit-package expiry is compared. Qoder, WorkBuddy, and other providers never compete with each other, and cross-provider selection keeps its existing rotation.
 - **Use only spendable package dates.** Depleted, expired, and undated packages are skipped. Accounts expiring on the same UTC+8 calendar day rotate fairly. Missing dates are never guessed: they form that provider's fallback cohort and participate only after every dated account is unavailable.
 - **Keep quota and failover semantics.** Exhausted, cooling, concurrency-saturated, or explicitly excluded accounts leave the candidate set and return to the ranking once they recover. Finishing a response or stream refreshes that account's quota asynchronously; a cached package expiring naturally also triggers a probe. Subscription resets, token lifetimes, and check-in rewards are never treated as package expiry.
-- **Data gaps.** Only WorkBuddy personal accounts currently return per-package `CycleEndTime` from `get-user-resource`. Qoder's `quota/usage` exposes only the subscription cycle boundary (`expiresAt`), while Trae, Devin, Command Code, and Codex expose reset windows or totals only, so their accounts remain in the unknown-date cohort under FEFO. WorkBuddy enterprise/shared identities and unconfirmed result sets capped at 100 also receive no FEFO priority. Cached quota snapshots written before this version remain undated until the boot probe or a manual refresh repopulates the package metadata.
+- **Data gaps.** Only WorkBuddy personal accounts currently return per-package `CycleEndTime` from `get-user-resource`. Qoder's `quota/usage` exposes only the subscription cycle boundary (`expiresAt`), while Trae, Devin, Command Code, and Codex expose reset windows or totals only, so their accounts remain in the unknown-date cohort under FEFO. CodeArts reports package credits and token meters but no per-package expiry, so it is treated as unknown rather than given a fabricated date. WorkBuddy enterprise/shared identities and unconfirmed result sets capped at 100 also receive no FEFO priority. Cached quota snapshots written before this version remain undated until the boot probe or a manual refresh repopulates the package metadata.
 
 ## Limitations
 
 - Bring your own accounts. CLI2API does not supply accounts, quotas, or an official API service.
 - Compatibility is not full API parity. Messages / Responses are stateless adapters, without server-side conversations or upstream-specific tool execution.
-- Image support depends on the upstream and model. The gateway surfaces each model's declared image input as `supports_images` on `/v1/models` and `/api/models`. WorkBuddy's DeepSeek V4 / V4.1, GLM, and Kimi models accept images; Trae, Command, and Zhipu do not declare image input. See the [deployment guide](deploy/README.md) for details.
+- Image support depends on the upstream and model. The gateway surfaces each model's declared image input as `supports_images` on `/v1/models` and `/api/models`. WorkBuddy's DeepSeek V4 / V4.1, GLM, and Kimi models accept images; CodeArts's Qwen3-VL-235B and Kimi K2.6 VL accept images, while its other models are text-only; Trae, Command, and Zhipu do not declare image input. See the [deployment guide](deploy/README.md) for details.
 - Cross-provider routing for shared model IDs follows system settings, key grants, and region constraints; failover is not unrestricted.
 - Upstream changes can break compatibility. Request logs do not store prompt or completion bodies by default.
 

changelog/unreleased/codearts-provider.md

@@ -0,0 +1,7 @@
+### English
+
+- Add the experimental Huawei Cloud CodeArts Agent (码道) provider: OAuth PKCE sign-in, direct OpenAI-compatible chat and SSE, catalog discovery with unusable-model removal, image input for catalog-declared vision models, catalog-declared reasoning levels, quota meters, and daily/new-user credit check-in. Single-account end-to-end acceptance and two-account failover/session affinity are complete; quota-exhaustion failover remains pending.
+
+### 中文
+
+- 新增实验性的华为云码道 CodeArts 供应商：OAuth PKCE 登录、直连 OpenAI 兼容对话与 SSE、模型目录并剔除账号不可用模型、按目录声明向视觉模型转发图片、按目录声明暴露 reasoning 档位、额度计量，以及每日 / 新用户积分签到。单账号端到端验收、双账号失败切换与会话粘性已完成；额度耗尽切换仍待验收。

docs/ARCHITECTURE_SUMMARY.md

@@ -6,7 +6,7 @@ status: canonical
 read-when: 需要快速理解后端分层、请求路径、运行时和 provider 扩展边界时
 summary: 面向贡献者和 AI 的精简架构摘要；详细协议、里程碑和本地运维资料不在本文维护。
 related: [AGENTS.md, CONTRIBUTING.md, docs/DESIGN.md, docs/REFACTORING.md, docs/NATIVE_PROTOCOL_REQUESTS.md]
-last-updated: 2026-09-24
+last-updated: 2026-10-29
 ---
 
 # CLI2API 架构摘要
@@ -20,7 +20,7 @@ CLI2API 是一个面向个人部署的 Go + Node 网关：
 
 - 对外提供 OpenAI Chat Completions、Anthropic Messages、OpenAI Responses 和 Models 兼容接口。
 - 管理多个上游账号，并按 provider、region、model、pin、会话粘性和冷却状态选号。
-- Qoder 登录、目录和配额仍使用每账号隔离的 Node child process；Qoder 聊天在 Go 进程内签名直连网关。WorkBuddy、Trae CN Work 和 Devin 使用 Go 进程内 adapter。
+- Qoder 登录、目录和配额仍使用每账号隔离的 Node child process；Qoder 聊天在 Go 进程内签名直连网关。WorkBuddy、Trae CN Work、Devin 和 CodeArts 使用 Go 进程内 adapter；CodeArts 直连华为云 snap-access 的 OpenAI 兼容网关，不启动 CLI。
 - 控制台负责账号、密钥、设置、目录、日志、登录、导入和更新操作。
 - 这是个人网关，不实现计费、Redis 槽位、多租户商业网关或公开暴露的管理端口。
 
@@ -75,6 +75,7 @@ cmd/server
 - Qoder 的 CLI / worker 兼容性版本固定在 `worker/src/compat.mjs`，不兼容时应明确失败。
 - Qoder 聊天改为在 Go 进程内使用 COSY 客户端签名直连网关（[`internal/providers/qoder/cosy.go`](../internal/providers/qoder/cosy.go)）。COSY 协议版本固定在 [`COSYVersion = "1.1.32"`](cosy.go:23)，支持中国区（`gateway.qoder.com.cn`）和全球区（`api1.qoder.sh`）双端点。
 - WorkBuddy、Trae CN Work、Devin 使用进程内 adapter，不复制 Qoder worker 生命周期。
+- CodeArts 使用进程内 adapter：OAuth PKCE 只用于换取短期 STS 凭据，聊天直连 `snap-access.cn-north-4.myhuaweicloud.com` 的 OpenAI 兼容端点；不得改为每请求启动码道 CLI。
 - provider 负责上游事实映射；executor 负责是否切号、冷却多久和是否 failover。
 - Provider 能力、模型目录和 reasoning level 必须以实际 catalog 声明为准，不凭空增加模型能力。
 

frontend/src/api/overview.ts

@@ -132,7 +132,7 @@ export function updateProviderMaxMode(provider: string, modelKey: string, maxMod
   })
 }
 
-export function updateProviderReasoning(provider: 'trae' | 'workbuddy' | 'kimi', modelKey: string, reasoningEffort: string) {
+export function updateProviderReasoning(provider: 'trae' | 'workbuddy' | 'kimi' | 'codearts', modelKey: string, reasoningEffort: string) {
   return api<{
     model: string
     provider: string