diff --git a/.gitignore b/.gitignore
index 356fb010..bc42a227 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,10 +3,23 @@ dist/
.dev/
node_modules/
/config.json
+# ClawBot 微信推送的扫码凭证（含 bot token），严禁提交
+/clawbot-auth.json
+# 运行时配置/账号文件可能被放到 src/ 下（Load.ts 的查找路径之一），防止误提交
+/src/config.json
+/src/accounts.json
+/src/accounts.dev.json
/.vscode
/diagnostics
note
.DS_Store
.playwright-chromium-installed
.stfolder/
-.env
\ No newline at end of file
+.envlogs/
+/logs
+# 本地私密配置与编辑器工作目录，严禁提交
+/.env
+/.zcode/
+
+# dynamic accounts (credentials)
+/config/accounts.extra.json
diff --git a/Dockerfile b/Dockerfile
index a9268a22..89be3cf2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,8 @@
###############################################################################
# Stage 1: Builder
###############################################################################
-FROM node:24-slim AS builder
+# 国内镜像源加速拉取（m.daocloud.io 代理 Docker Hub）；海外环境可改回 node:24-slim
+FROM m.daocloud.io/docker.io/library/node:24-slim AS builder
WORKDIR /usr/src/microsoft-rewards-script
@@ -25,7 +26,7 @@ RUN rm -rf node_modules \
###############################################################################
# Stage 2: Runtime
###############################################################################
-FROM node:24-slim AS runtime
+FROM m.daocloud.io/docker.io/library/node:24-slim AS runtime
WORKDIR /usr/src/microsoft-rewards-script
@@ -37,13 +38,19 @@ ENV NODE_ENV=production \
NODE_OPTIONS=--disable-warning=ExperimentalWarning
# Install minimal system libraries required for Chromium headless to run,
-# plus jq (for config generation/patching) and gettext-base (for envsubst)
+# plus jq (for config generation/patching) and gettext-base (for envsubst).
+# xvfb/x11vnc/novnc/websockify power the dashboard's in-browser manual login
+# (headed browser under a virtual display, viewed through noVNC).
RUN apt-get update && apt-get install -y --no-install-recommends \
cron \
gettext-base \
jq \
tzdata \
ca-certificates \
+ xvfb \
+ x11vnc \
+ novnc \
+ websockify \
libglib2.0-0 \
libdbus-1-3 \
libexpat1 \
@@ -83,10 +90,11 @@ COPY --from=builder /usr/src/microsoft-rewards-script/dist ./dist
COPY --from=builder /usr/src/microsoft-rewards-script/package*.json ./
COPY --from=builder /usr/src/microsoft-rewards-script/node_modules ./node_modules
-# Install patchright's stealth-patched Chromium headless shell.
-# The container is headless-only so the full browser isn't needed; then clean up
+# Install patchright's stealth-patched Chromium. The full browser is required
+# (not just the headless shell) because the dashboard's manual-login feature
+# runs the browser headed under Xvfb; clean up apt lists afterwards.
RUN set -eux; \
- npx patchright install --with-deps --only-shell chromium; \
+ npx patchright install --with-deps chromium; \
rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
# Copy config example into the image so entrypoint can use it as a fallback
@@ -103,8 +111,12 @@ COPY config.example.json ./config.example.json
COPY --chmod=755 scripts/docker/run_daily.sh ./scripts/docker/run_daily.sh
COPY --chmod=755 scripts/docker/healthcheck.sh ./scripts/docker/healthcheck.sh
COPY --chmod=755 scripts/api/ ./scripts/api/
+COPY --chmod=755 scripts/main/ ./scripts/main/
+COPY --chmod=644 scripts/utils.js ./scripts/utils.js
COPY --chmod=644 scripts/env.js ./scripts/env.js
COPY --chmod=644 scripts/package.json ./scripts/package.json
+# Embedded web dashboard (zero-dependency Node; started by entrypoint when DASHBOARD_ENABLED)
+COPY --chmod=644 dashboard/ ./dashboard/
COPY --chmod=644 src/crontab.template /etc/cron.d/microsoft-rewards-cron.template
COPY --chmod=755 scripts/docker/entrypoint.sh /usr/local/bin/entrypoint.sh
diff --git a/README.md b/README.md
index fab229e9..bcae16eb 100644
--- a/README.md
+++ b/README.md
@@ -1,475 +1,574 @@
-[](https://discord.gg/8BxYbV4pkj)
-[](https://github.com/TheNetsky/Microsoft-Rewards-Script/actions/workflows/auto-release.yml)
-[](https://github.com/TheNetsky/Microsoft-Rewards-Script/pkgs/container/microsoft-rewards-script)
+
-> [!TIP]
-> This version supports the **new, modern Bing Rewards dashboard only** - it does **not** support the legacy dashboard.
-> If your account still uses the old dashboard, use the [v3 branch](https://github.com/TheNetsky/Microsoft-Rewards-Script/tree/v3) and v3.x releases instead!
+# 微软奖励脚本（V4-china）
+
+[](./package.json)
+[](./LICENSE)
+[](./package.json)
+[](#-同步与致谢)
+[](https://github.com/TheNetsky/Microsoft-Rewards-Script)
+
+**基于 TypeScript · Patchright(Playwright) 的新一代架构 · 微软奖励自动化脚本**
+
+针对国内用户深度本地化：✅ 中国热搜查询源（百度/头条/抖音/微博/知乎） · ✅ 日志中文化 · ✅ PushPlus / 微信 ClawBot 推送 · ✅ Docker 镜像加速
+
+
+
+> ℹ️ **分支选择建议**
>
-> Use at your own risk - some features may not work as expected.
+> - **`main` 分支（v3，稳定版）**：已兼容微软新版 UI，实测未发现明显异常，可放心日常使用。
+> - **`V4-china` 分支（v4 新架构，基本可用，本分支）**：搜索、活动、签到、Read-to-Earn、微信推送（PushPlus / ClawBot）等核心功能已实测通过（2026-08），**可以切换日常使用**；新架构仍在迭代，偶发小问题属正常，追求稳定可继续留在 `main` 分支。
+>
+> 两分支配置文件结构不同，**互不兼容**；本分支账号改用 `.env` 环境变量配置（不再使用 `accounts.json`），从 v3 迁移请按本文档重新配置 `.env` / `config.json`。
+
+> [!TIP]
+> 本分支仅支持**新版（modern）Bing Rewards 面板**，不支持旧版面板。账户还在旧版面板的请使用本仓库 [`main` 分支](https://github.com/chiihero/Microsoft-Rewards-Script/tree/main)（v3）。
+
+---
---
-## Table of Contents
-
-- [Table of Contents](#table-of-contents)
-- [Quick Setup](#quick-setup)
- - [Bare metal](#bare-metal)
- - [Get the script](#get-the-script)
-- [Account Setup](#account-setup)
-- [Config Setup](#config-setup)
- - [Build and run the script (bare metal version)](#build-and-run-the-script-bare-metal-version)
-- [Docker](#docker)
-- [Control API and Dashboard](#control-api-and-dashboard)
-- [Nix Setup](#nix-setup)
-- [Configuration Options](#configuration-options)
- - [Core](#core)
- - [Workers](#workers)
- - [Activities](#activities)
- - [Search Settings](#search-settings)
- - [Query sources](#query-sources)
- - [Experimental](#experimental)
- - [Activity source layout](#activity-source-layout)
- - [Logging](#logging)
- - [Proxy](#proxy)
- - [Webhooks](#webhooks)
-- [Troubleshooting](#troubleshooting)
- - [Manual login](#manual-login)
- - [Session management](#session-management)
-- [Disclaimer](#disclaimer)
+## 📑 目录
+
+- [✨ 核心特性](#-核心特性)
+- [🚀 快速开始](#-快速开始)
+- [📦 Windows 部署](#-windows-部署)
+- [🐳 Docker 部署](#-docker-部署)
+- [🖥️ 控制 API 与面板](#️-控制-api-与面板)
+- [⚙️ 配置参考](#️-配置参考)
+- [🔔 通知渠道](#-通知渠道)
+- [❓ 常见问题](#-常见问题)
+- [⚠️ 注意事项](#-注意事项)
+- [📜 同步与致谢](#-同步与致谢)
+- [⚠️ 免责声明](#-免责声明)
---
-## Quick Setup
+## ✨ 核心特性
-### Bare metal
+**账户管理**
-**Requirements:** Node.js >= 24 and Git
-Works on Windows, Linux, macOS, and WSL.
+- ✅ 多账户支持（`.env` 中 `ACCOUNT_N_*` 环境变量，编号无需连续）
+- ✅ 会话存储与持久化（`sessions/`，含指纹持久化）
+- ✅ 2FA 支持（TOTP 自动生成并填入验证码）
+- ✅ 无密码登录支持
+- ✅ 每账户独立代理（HTTP/HTTPS/SOCKS4/SOCKS5）
-#### Get the script
+**自动化与控制**
-```bash
-git clone https://github.com/TheNetsky/Microsoft-Rewards-Script.git
-cd Microsoft-Rewards-Script
-```
+- ✅ 无头浏览器操作（Patchright 反检测内核）
+- ✅ 集群支持（同时多个账户）
+- ✅ 可配置任务开关
+- ✅ 控制 API + Web 面板（启动/停止/日志/积分/调度管理）
+- ✅ 自动调度（Docker 内置 cron）
-Or, download the latest release ZIP and extract it.
+**搜索与活动**
-## Account Setup
+- ✅ 桌面与移动搜索（配额独立跟踪，互不阻塞）
+- ✅ 加成搜索（超过上限后继续刷，可选）
+- ✅ 每日集 / 更多促销 / 打卡 / App 活动 / 每日签到 / 阅读赚取（Read-to-Earn）
+- ✅ 搜索加成 perk 激活（"再搜 N 次得积分"）/ 视觉搜索（可选）
+- ✅ 连击保护 & 自动领取 dashboard 奖励积分
+- ✅ 模拟滚动与随机点击，降低风控风险
-- Copy and rename [`env.example`](env.example) to `.env` and add your account credentials:
+**搜索词来源（国内推荐 china + local）**
-```env
-ACCOUNT_1_EMAIL=email@example.com
-# ACCOUNT_1_PASSWORD=your_password
-```
+- ✅ 中国热搜（百度/头条/抖音/微博/知乎，gmya.net 聚合，多源随机 + 限流退避）
+- ✅ 本地查询词兜底（`search-queries.json` 中文词库）
+- ✅ Bing 建议聚类扩展（`clusterSearch`，每个主词扩展一组相关词再搜索）
+- ✅ 亦可选 google / wikipedia / reddit / hackernews / RSS 源（国内需代理）
-> [!NOTE]
-> `ACCOUNT_N_PASSWORD` is optional. Set it when password sign-in should be available; leave it unset for passwordless/Authenticator-only accounts.
->
-> Add one `ACCOUNT_N_*` block per account. Account slots do not need to be contiguous: `ACCOUNT_2` or `ACCOUNT_4` can be configured even when earlier slots are missing. Accounts run in ascending slot order. Optional per-account fields cover recovery email, locale, language, proxy, and fingerprint persistence - see [`env.example`](env.example) for all of them.
+**通知与监控**
-`ACCOUNT_N_LANG_CODE` accepts a BCP 47 language tag such as `nl`, `it`, or `pt-BR`. `ACCOUNT_N_GEO_LOCALE` accepts a two-letter country code or defaults to `auto`. The selected language and country are applied consistently to browser fingerprints, `Accept-Language`, Microsoft Rewards app headers, and market-specific requests. In `auto` mode, the country reported by the Microsoft profile is cached after the first successful dashboard request; changing either locale setting automatically replaces an incompatible saved fingerprint.
+- ✅ PushPlus 微信推送（国内推荐，无需翻墙）
+- ✅ 微信 ClawBot 推送（腾讯官方 iLink 直连，免费无第三方服务）
+- ✅ Discord / Telegram / ntfy 推送
+- ✅ 全面日志记录（日志过滤 + 落盘 `logs/` 按天分文件，自动清理 90 天前旧日志）
-> [!TIP]
-> For 2FA accounts, set `ACCOUNT_N_TOTP_SECRET` and the script will generate and enter the 6-digit code automatically. To get the secret: in your Microsoft Security settings open 'Manage how you sign in', add an Authenticator app, and when the QR code appears choose 'enter code manually' - use that code as the value in your `.env`.
+---
+
+## 🚀 快速开始
+
+本脚本支持两种部署方式，**按你的场景二选一即可**：
+
+| 维度 | 📦 Windows 直跑 | 🐳 Docker |
+| -------------- | ------------------------------------- | ---------------------------------------------------- |
+| **配置方式** | `.env`（账号）+ `config.json`（行为） | `.env`（账号）+ `compose.yaml` 的 `CONFIG_*`（行为） |
+| **调度** | 手动 / 计划任务 | 内置 cron + API 改调度 |
+| **headless** | 可选（可见窗口） | 强制 `true`（无显示器） |
+| **数据持久化** | `sessions/` 目录 | `./config/` + `./sessions/` 挂载 |
+| **升级方式** | `git pull` + `npm run build` | `docker compose up -d --build` |
+| **前置要求** | Node.js 24+ | Docker + Docker Compose |
+
+> ⚠️ 与 v3（`main` 分支）不同：**账号统一在 `.env` 中配置**（`ACCOUNT_1_EMAIL` 等），不再使用 `accounts.json`；行为配置仍在 `config.json`（Docker 下用 `CONFIG_*` 环境变量）。
+
+---
+
+## 📦 Windows 部署
+
+> ⚠️ 本项目所有改动基于 Win11 系统测试，其他系统请参考[原项目](https://github.com/TheNetsky/Microsoft-Rewards-Script)相关配置。
+
+
+🔧 自动设置（推荐，一键部署）
+
+1. 下载或克隆源代码：
-> [!WARNING]
-> You must rebuild your script after making any changes to the `.env`.
+ ```bash
+ git clone -b V4-china https://github.com/chiihero/Microsoft-Rewards-Script.git
+ ```
-## Config Setup
+ > 国内无法直连 GitHub 时可用镜像加速：在 URL 前加 `https://gh-proxy.com/`，或在本仓库页面 "Code → Download ZIP" 下载。
-> [!WARNING]
-> Do **not** skip this step if you are running the script bare metal.
+2. 双击运行 `setup.bat`：自动安装 Node.js 24、生成 `.env` 与 `config.json`、安装依赖并构建
+3. 编辑 `.env`，填入账户信息（`ACCOUNT_1_EMAIL` / `ACCOUNT_1_PASSWORD` 等）
+4. 按需修改 `config.json`
+5. 运行 `run.bat` 或执行 `npm start` 启动脚本
-- **Bare metal:** Copy or rename `config.example.json` to `config.json` (in the project root) and customize your preferences.
-- **Docker:** A valid `config.json` is automatically created on first run and saved locally to `./config/`. You can optionally manually create a `config.json` (e.g., if you need to specify regex values) using the provided `config.example.json`
+
-> [!CAUTION]
-> Prior versions of accounts.json and config.json are not compatible with current release.
+
+🛠 手动设置（自动设置失败时使用）
-### Build and run the script (bare metal version)
+1. 克隆源代码（同上）
+2. 安装 Node.js 24+
+3. 安装依赖包：
+
+ ```bash
+ npm install
+ ```
+
+4. 若出现 `Error: browserType.launch: Executable doesn't exist` 报错，执行：
+
+ ```bash
+ npx patchright install chromium
+ ```
+
+5. 复制 `env.example` 为 `.env`，填入账户信息；国内账号推荐保留默认的 `ACCOUNT_1_LANG_CODE=zh-CN`、`ACCOUNT_1_GEO_LOCALE=CN`
+6. 复制 `config.example.json` 为 `config.json`（项目根目录），按需修改
+7. 预构建（安装依赖与浏览器）：
+
+ ```bash
+ npm run pre-build
+ ```
+
+8. 构建：
+
+ ```bash
+ npm run build
+ ```
+
+9. 启动：
+
+ ```bash
+ npm start
+ ```
+
+> 💡 调试时可直接源码运行：`npm run dev`（带 `-dev` 参数输出 DEBUG 日志）。
+
+
+
+---
+
+## 🐳 Docker 部署
+
+
+部署步骤
+
+> [!IMPORTANT]
+> 本仓库 `compose.yaml` 默认 `build: .` 本地构建（运行本分支代码）。**不要**改回 `ghcr.io/thenetsky/...` 官方镜像——那是原作者的原版代码，不含中国热搜 / PushPlus 等国内适配。
+
+### 1. 准备账号文件（.env）
```bash
-npm run pre-build
-npm run build
-npm run start
+cp env.example .env
```
-## Docker
+编辑 `.env`，至少填一个账号：
-- Copy the sample [`compose.yaml`](compose.yaml)
-- Copy and rename [`env.example`](env.example) to `.env` and add your account credentials:
-
-```env
-ACCOUNT_1_EMAIL=email@example.com
-# ACCOUNT_1_PASSWORD=your_password
+```dotenv
+ACCOUNT_1_EMAIL=you@example.com
+ACCOUNT_1_PASSWORD=your_password
```
-`ACCOUNT_N_PASSWORD` is optional; omit it for passwordless/Authenticator-only accounts.
+> 多账号按 `ACCOUNT_2_*`、`ACCOUNT_3_*` 递增（编号无需连续，按编号升序运行）。完整字段见 `env.example`。
-- Review `compose.yaml` to adjust scheduling, timezone, and config options.
+### 2. 编辑 compose.yaml（可选）
-> [!NOTE]
-> A valid `config.json` is auto-generated on first run using default values, and saved locally to `./config/`.
-> Optionally, use `CONFIG_*` variables in the `environment:` section of the `compose.yaml` to customise your options (e.g., clusters, webhook, etc.).
-> A full list of available options are in the [table below](#configuration-options).
-> `CONFIG_*` variables are applied on every startup and always take precedence over `./config/config.json`.
+默认配置开箱即用，如需调整取消对应行注释即可：
-> [!TIP]
-> If a new image adds config options you're missing, a warning will appear in the container logs.
-> To update, delete `./config/config.json` and restart - a fresh one will be generated from the latest example, with your `compose.yaml` overrides re-applied.
+- `TZ`：时区（默认 `Asia/Shanghai`）
+- `CRON_SCHEDULE`：调度（默认 `0 7 * * *`，每天 7 点）
+- `RUN_ON_START`：容器启动时是否立即跑一次（默认 `true`）
+- `CONFIG_SEARCH_QUERY_ENGINES`：查询源，国内推荐 `china,local`
+- `CONFIG_CHINA_API_APPKEY`：gmya.net appkey，解除免费档限流（留空走免费档）
+- `CONFIG_PUSHPLUS_*` / `CONFIG_CLAWBOT_*`：微信推送
-- Start the container: `docker compose up -d`
+> 完整的 `CONFIG_*` 环境变量列表见[配置参考](#️-配置参考)各表格。`CONFIG_*` 每次启动都会覆盖 `./config/config.json`。
-> [!TIP]
-> Monitor logs with `docker logs microsoft-rewards-script`, useful for viewing passwordless login codes or diagnosing issues.
-> You can also enable a webhook in `compose.yaml` for notifications.
+### 3. 构建并启动
----
+```bash
+docker compose up -d --build
+```
+
+> **重要**：改了代码或 Dockerfile 后必须加 `--build` 重建镜像，否则跑的还是旧镜像。
+
+### 4. 数据持久化
+
+容器挂载了两个目录，重建容器不丢数据：
+
+- `./config/`：配置文件（首次运行自动生成 `config.json`）
+- `./sessions/`：登录会话（首次登录后 cookie 存这里，后续自动复用）
+
+> 💡 使用微信 ClawBot 推送时，建议先在本地跑一次完成扫码，再把生成的 `clawbot-auth.json` 挂载进容器（或配合 `API_MODE` 在容器内完成扫码）。
-## Control API and Dashboard
-
-The optional Control API lets a local dashboard or another trusted tool monitor
-and control the script over HTTP. See the [complete Control API
-documentation](scripts/api/README.md) for setup, authentication, every endpoint,
-request fields, response examples, and security guidance.
-
-Common uses include:
-
-- checking API health and the current run state with `GET /health` and
- `GET /status`;
-- reading live points, logs, errors, account summaries, run history, and error
- diagnostics;
-- listing safe stored-session metadata and deleting the mobile/desktop sessions
- for one account;
-- starting all accounts with `POST /start` and an empty JSON body;
-- running only one account with `POST /start` and `{"accountIndex":2}`;
-- running all accounts except selected slots with `POST /start` and
- `{"excludedAccountIndexes":[2,4]}`;
-- stopping or restarting a run with `POST /stop` or `POST /restart`;
-- streaming live logs and status updates from `GET /events` using
- Server-Sent Events (SSE);
-- reading the active configuration and schedule, with config and schedule
- changes available only when their explicit `API_ALLOW_*` options are enabled.
-
-For example, start only `ACCOUNT_2` with cURL:
+### 常用命令
```bash
-curl --request POST \
- --url http://127.0.0.1:3010/start \
- --header 'Authorization: Bearer YOUR_API_TOKEN' \
- --header 'Content-Type: application/json' \
- --data '{"accountIndex":2}'
+docker compose up -d --build # 构建+启动
+docker compose logs -f # 查看日志
+docker compose down # 停止并删除容器
+docker compose restart # 重启（不重建）
```
-For a ready-made web interface, use the supported and endorsed
-[Rewards Dashboard](https://github.com/mgrimace/rewards-dashboard). It connects
-to this Control API to manage runs, accounts, schedules, logs, points, and
-related script settings.
+
---
-## Nix Setup
+## 🖥️ 控制 API 与面板
-If using Nix: `bash scripts/nix/run.sh`
+可选的控制 API 允许本地面板或其他受信工具通过 HTTP 监控和控制脚本（`API_MODE=true` + `API_TOKEN` 开启）：
----
+- 查询健康状态 / 运行状态 / 实时积分 / 日志 / 账户摘要 / 运行历史
+- `POST /start` 启动全部或指定账户，`POST /stop`、`POST /restart` 控制
+- `GET /events` SSE 实时日志流；会话查询与删除
+- 完整文档见 [`scripts/api/README.md`](scripts/api/README.md)
-## Configuration Options
-
-Edit `config.json` to customize behavior, or set `CONFIG_*` environment variables in `compose.yaml` (Docker). Below are all currently available options.
-
-> [!WARNING]
-> Rebuild the script (bare metal), or recreate the container (Docker) after all config changes.
-
-### Core
-
-| Setting | Type | Default | Description | Docker environment variable |
-| --------------------------- | ------- | ------------ | ------------------------------------------------------------------ | ------------------------------------- |
-| `sessionPath` | string | `"sessions"` | Directory to store browser sessions | |
-| `headless` | boolean | `false` | Run browser invisibly | Always `true` in Docker |
-| `clusters` | number | `1` | Number of concurrent account clusters | `CONFIG_CLUSTERS` |
-| `errorDiagnostics` | boolean | `false` | Save error and unknown-login page diagnostics under `diagnostics/` | `CONFIG_ERROR_DIAGNOSTICS` |
-| `ensureStreakProtection` | boolean | `true` | Ensure streak protection is enabled | `CONFIG_ENSURE_STREAK_PROTECTION` |
-| `autoClaimPunchcardRewards` | boolean | `false` | Auto-claim completed punchcard rewards | `CONFIG_AUTO_CLAIM_PUNCHCARD_REWARDS` |
-| `contintueOnBotWarning` | boolean | `false` | Continue despite the Microsoft bot-score warning (not recommended) | `CONFIG_CONTINTUE_ON_BOT_WARNING` |
-| `skipNonPointTasks` | boolean | `true` | Skip tasks that award no points | `CONFIG_SKIP_NON_POINT_TASKS` |
-| `accountDelay.min` | string | `"1min"` | Minimum delay before starting the next configured account | `CONFIG_ACCOUNT_DELAY_MIN` |
-| `accountDelay.max` | string | `"3min"` | Maximum delay before starting the next configured account | `CONFIG_ACCOUNT_DELAY_MAX` |
-| `searchOnBingLocalQueries` | boolean | `false` | Use the local query list for ExploreOnBing | `CONFIG_SEARCH_ON_BING_LOCAL` |
-| `globalTimeout` | string | `"30sec"` | Timeout for all actions | `CONFIG_GLOBAL_TIMEOUT` |
-
-### Workers
-
-| Setting | Type | Default | Description | Docker environment variable |
-| ------------------------------ | ------- | ------- | -------------------------------------------------------------------------- | ------------------------------------ |
-| `workers.doDailySet` | boolean | `true` | Complete daily set | `CONFIG_WORKER_DAILY_SET` |
-| `workers.doClaimBonusPoints` | boolean | `true` | Claim bonus points | `CONFIG_WORKER_CLAIM_BONUS_POINTS` |
-| `workers.doMorePromotions` | boolean | `true` | Complete "more activities" | `CONFIG_WORKER_MORE_PROMOTIONS` |
-| `workers.doPunchCards` | boolean | `true` | Complete punchcards | `CONFIG_WORKER_PUNCH_CARDS` |
-| `workers.doAppPromotions` | boolean | `true` | Complete app promotions | `CONFIG_WORKER_APP_PROMOTIONS` |
-| `workers.doDesktopSearch` | boolean | `true` | Perform desktop searches | `CONFIG_WORKER_DESKTOP_SEARCH` |
-| `workers.doMobileSearch` | boolean | `true` | Perform mobile searches | `CONFIG_WORKER_MOBILE_SEARCH` |
-| `workers.doBonusSearches` | boolean | `false` | Farm bonus searches beyond the cap | `CONFIG_WORKER_BONUS_SEARCHES` |
-| `workers.doDailyCheckIn` | boolean | `true` | Complete daily check-in | `CONFIG_WORKER_DAILY_CHECKIN` |
-| `workers.doReadToEarn` | boolean | `true` | Complete Read-to-Earn | `CONFIG_WORKER_READ_TO_EARN` |
-| `workers.doActivateSearchPerk` | boolean | `true` | Activate the "search Nx more" perk when present (runs after the daily set) | `CONFIG_WORKER_ACTIVATE_SEARCH_PERK` |
-| `workers.doVisualSearch` | boolean | `false` | Activate the visual-search streak and perform visual searches | `CONFIG_WORKER_VISUAL_SEARCH` |
-
-### Activities
-
-| Setting | Type | Default | Description | Docker environment variable |
-| ------------------------- | ------- | ------- | ------------------------------ | -------------------------------- |
-| `activities.urlReward` | boolean | `true` | Complete URL reward activities | `CONFIG_ACTIVITY_URL_REWARD` |
-| `activities.searchOnBing` | boolean | `true` | Complete ExploreOnBing offers | `CONFIG_ACTIVITY_SEARCH_ON_BING` |
-
-### Search Settings
-
-| Setting | Type | Default | Description | Docker environment variable |
-| -------------------------------------- | -------- | ----------------------------------- | --------------------------------------------------------- | ---------------------------------- |
-| `searchSettings.scrollRandomResults` | boolean | `false` | Scroll randomly on results | `CONFIG_SEARCH_SCROLL_RANDOM` |
-| `searchSettings.clickRandomResults` | boolean | `false` | Click random links | `CONFIG_SEARCH_CLICK_RANDOM` |
-| `searchSettings.runOnZeroPoints` | boolean | `false` | Run searches even when no search points remain | `CONFIG_SEARCH_RUN_ON_ZERO_POINTS` |
-| `searchSettings.maxBonusSearches` | number | `110` | Max bonus searches per run (when `doBonusSearches` is on) | `CONFIG_SEARCH_MAX_BONUS_SEARCHES` |
-| `searchSettings.parallelSearching` | boolean | `true` | Run searches in parallel | `CONFIG_SEARCH_PARALLEL` |
-| `searchSettings.clusterSearch` | boolean | `true` | Cluster each main topic with Bing suggestions | `CONFIG_SEARCH_CLUSTER` |
-| `searchSettings.queryEngines` | string[] | see [Query sources](#query-sources) | Sources used to build the search query pool | `CONFIG_SEARCH_QUERY_ENGINES` \* |
-| `searchSettings.searchResultVisitTime` | string | `"10sec"` | Time to spend on each search result | `CONFIG_SEARCH_VISIT_TIME` |
-| `searchSettings.searchDelay.min` | string | `"30sec"` | Minimum delay between searches | `CONFIG_SEARCH_DELAY_MIN` |
-| `searchSettings.searchDelay.max` | string | `"1min"` | Maximum delay between searches | `CONFIG_SEARCH_DELAY_MAX` |
-| `searchSettings.readDelay.min` | string | `"30sec"` | Minimum delay for reading | `CONFIG_SEARCH_READ_DELAY_MIN` |
-| `searchSettings.readDelay.max` | string | `"1min"` | Maximum delay for reading | `CONFIG_SEARCH_READ_DELAY_MAX` |
-
-Desktop and mobile search quotas are tracked independently from the dashboard counters. All `mobileSearch` entries are combined for the mobile quota, while all `pcSearch` entries are combined for desktop execution; a counter explicitly identified as Edge is also shown separately for diagnostics. The script skips only the completed platform, so a completed `60/60` mobile quota does not prevent an incomplete desktop quota from running. With `parallelSearching` enabled, both incomplete quotas can run concurrently in their own browser contexts.
+配套 Web 面板推荐 [Rewards Dashboard](https://github.com/mgrimace/rewards-dashboard)，可管理运行、账户、调度、日志、积分。
-> [!NOTE]
-> \* Docker `CONFIG_*` array values are comma-separated strings e.g. `"error,warn"`. Regex patterns must be set directly in `config.json`.
-
-#### Query sources
-
-`searchSettings.queryEngines` controls where the main search topics come from. Pick any combination; topics from all selected sources are pooled and de-duplicated. When `searchSettings.clusterSearch` is enabled, each main topic is expanded on demand with Bing suggestions, that topic cluster is shuffled and completed, and only then does searching move to the next main topic.
-
-Core sources:
-
-| Selector | Source |
-| ------------ | ------------------------------------------------ |
-| `google` | Google Trends (trending searches) |
-| `wikipedia` | Wikipedia most-read articles (previous day) |
-| `wikirandom` | Random Wikipedia articles |
-| `hackernews` | Hacker News front-page stories |
-| `reddit` | Reddit r/popular post titles |
-| `local` | Bundled `src/functions/search-queries.json` list |
-
-RSS feeds use a dotted path - `rss` for every feed, `rss.` for a whole site, or `rss..` for a single feed:
-
-| Selector | Feeds |
-| ------------------ | -------------------------------------------------------------- |
-| `rss.googleTrends` | Google Trends RSS (`gb`, `us`) |
-| `rss.googleNews` | Google News (`gb`, `us`, `world`, `technology`, `business`) |
-| `rss.bbc` | BBC News (`top`, `world`, `technology`, `business`, `science`) |
-| `rss.guardian` | The Guardian (`international`, `world`, `technology`) |
-| `rss.theVerge` | The Verge (`all`) |
-| `rss.arsTechnica` | Ars Technica (`all`) |
-| `rss.reddit` | Reddit listing feeds (`popular`, `worldnews`, `technology`) |
-
-Add your own feeds in `src/constants/rssFeeds.ts`.
-
-Default:
-
-```json
-[
- "google",
- "wikipedia",
- "wikirandom",
- "hackernews",
- "reddit",
- "local",
- "rss.googleTrends",
- "rss.googleNews",
- "rss.bbc",
- "rss.guardian.world",
- "rss.theVerge.all"
-]
+---
+
+## ⚙️ 配置参考
+
+> 编辑 `config.json`（Windows）或通过 `CONFIG_*` 环境变量（Docker）自定义行为。数组类 `CONFIG_*` 值用逗号分隔（如 `"china,local"`）；正则类只能写在 `config.json`。
+> 下面按功能分组，**点击各 summary 展开详情**。
+
+
+🔵 Core / 核心配置
+
+| 设置 | 描述 | 默认值 | Docker 环境变量 |
+| --------------------------- | ----------------------------------- | --------------- | ------------------------------------- |
+| `sessionPath` | 存储浏览器会话的目录 | `sessions` | — |
+| `headless` | 在后台运行浏览器 | `false`（可见） | Docker 强制 `true` |
+| `clusters` | 并发账户集群数 | `1` | `CONFIG_CLUSTERS` |
+| `errorDiagnostics` | 出错时保存诊断信息到 `diagnostics/` | `false` | `CONFIG_ERROR_DIAGNOSTICS` |
+| `ensureStreakProtection` | 确保连击保护已开启 | `true` | `CONFIG_ENSURE_STREAK_PROTECTION` |
+| `autoClaimPunchcardRewards` | 自动领取已完成的打卡奖励 | `false` | `CONFIG_AUTO_CLAIM_PUNCHCARD_REWARDS` |
+| `skipNonPointTasks` | 跳过无积分奖励的任务 | `true` | `CONFIG_SKIP_NON_POINT_TASKS` |
+| `accountDelay.min` / `.max` | 下一账户开始前的延迟 | `1min` - `3min` | `CONFIG_ACCOUNT_DELAY_MIN` / `_MAX` |
+| `searchOnBingLocalQueries` | ExploreOnBing 活动使用本地词库 | `false` | `CONFIG_SEARCH_ON_BING_LOCAL` |
+| `globalTimeout` | 所有操作的超时时间 | `30sec` | `CONFIG_GLOBAL_TIMEOUT` |
+
+
+
+
+🗂 Workers / 任务开关
+
+| 设置 | 描述 | 默认值 | Docker 环境变量 |
+| ------------------------------ | ---------------------------- | ------- | ------------------------------------ |
+| `workers.doDailySet` | 完成每日集活动 | `true` | `CONFIG_WORKER_DAILY_SET` |
+| `workers.doClaimBonusPoints` | 领取 dashboard 奖励积分 | `true` | `CONFIG_WORKER_CLAIM_BONUS_POINTS` |
+| `workers.doMorePromotions` | 完成更多促销活动 | `true` | `CONFIG_WORKER_MORE_PROMOTIONS` |
+| `workers.doPunchCards` | 完成打卡活动 | `true` | `CONFIG_WORKER_PUNCH_CARDS` |
+| `workers.doAppPromotions` | 完成 App 端活动 | `true` | `CONFIG_WORKER_APP_PROMOTIONS` |
+| `workers.doDesktopSearch` | 执行桌面搜索 | `true` | `CONFIG_WORKER_DESKTOP_SEARCH` |
+| `workers.doMobileSearch` | 执行移动搜索 | `true` | `CONFIG_WORKER_MOBILE_SEARCH` |
+| `workers.doBonusSearches` | 超过上限后继续刷加成搜索 | `false` | `CONFIG_WORKER_BONUS_SEARCHES` |
+| `workers.doDailyCheckIn` | 完成每日签到 | `true` | `CONFIG_WORKER_DAILY_CHECKIN` |
+| `workers.doReadToEarn` | 完成阅读赚取（Read-to-Earn） | `true` | `CONFIG_WORKER_READ_TO_EARN` |
+| `workers.doActivateSearchPerk` | 激活"再搜 N 次"加成 perk | `true` | `CONFIG_WORKER_ACTIVATE_SEARCH_PERK` |
+| `workers.doVisualSearch` | 视觉搜索连击与搜索 | `false` | `CONFIG_WORKER_VISUAL_SEARCH` |
+
+| 设置（activities） | 描述 | 默认值 | Docker 环境变量 |
+| ------------------------- | ----------------------- | ------ | -------------------------------- |
+| `activities.urlReward` | 完成 URL 奖励活动 | `true` | `CONFIG_ACTIVITY_URL_REWARD` |
+| `activities.searchOnBing` | 完成 ExploreOnBing 活动 | `true` | `CONFIG_ACTIVITY_SEARCH_ON_BING` |
+
+
+
+
+🔍 Search / 搜索配置
+
+| 设置 | 描述 | 默认值 | Docker 环境变量 |
+| ----------------------------------------- | --------------------------------- | -------------------- | --------------------------------------- |
+| `searchSettings.scrollRandomResults` | 随机滚动搜索结果 | `true` | `CONFIG_SEARCH_SCROLL_RANDOM` |
+| `searchSettings.clickRandomResults` | 点击随机结果链接 | `true` | `CONFIG_SEARCH_CLICK_RANDOM` |
+| `searchSettings.runOnZeroPoints` | 无剩余搜索积分时仍执行搜索 | `false` | `CONFIG_SEARCH_RUN_ON_ZERO_POINTS` |
+| `searchSettings.maxBonusSearches` | 单次运行最多加成搜索数 | `110` | `CONFIG_SEARCH_MAX_BONUS_SEARCHES` |
+| `searchSettings.parallelSearching` | 桌面/移动搜索并行执行 | `false` | `CONFIG_SEARCH_PARALLEL` |
+| `searchSettings.clusterSearch` | Bing 建议聚类扩展主词 | `true` | `CONFIG_SEARCH_CLUSTER` |
+| `searchSettings.queryEngines` | 查询源数组 | `["china", "local"]` | `CONFIG_SEARCH_QUERY_ENGINES` |
+| `searchSettings.searchResultVisitTime` | 搜索结果页停留时间 | `20sec` | `CONFIG_SEARCH_VISIT_TIME` |
+| `searchSettings.searchDelay.min` / `.max` | 搜索之间的延迟 | `6min` - `12min` | `CONFIG_SEARCH_DELAY_MIN` / `_MAX` |
+| `searchSettings.readDelay.min` / `.max` | 阅读赚取的阅读间隔 | `6min` - `11min` | `CONFIG_SEARCH_READ_DELAY_MIN` / `_MAX` |
+| `searchSettings.chinaApi.appkey` | gmya.net appkey（解除免费档限流） | `""` | `CONFIG_CHINA_API_APPKEY` |
+
+> 📌 **注**：以上默认值为本仓库 `config.example.json` 的国内防风控调优值（官方上游默认更激进：30sec-1min 间隔、并行开启）。
+
+#### 国内推荐配置
+
+```jsonc
+// config.json 关键项（.env 中账号 LANG_CODE=zh-CN、GEO_LOCALE=CN）
+{
+ "searchSettings": {
+ "queryEngines": ["china", "local"],
+ "chinaApi": { "appkey": "" } // 留空走免费档；填 appkey 解除限流
+ }
+}
```
-### Experimental
+
-Opt-in features that may change. Disabled by default.
+
+🌐 queryEngines 查询源说明（含国内可用性）
-| Setting | Type | Default | Description | Docker environment variable |
-| ------------------------------ | ------- | ------- | ----------------------------------------------------------------------- | ---------------------------------------- |
-| `experimental.apiSearch` | boolean | `false` | Perform Bing searches over HTTP instead of driving a browser page | `CONFIG_EXPERIMENTAL_API_SEARCH` |
-| `experimental.apiSearchOnBing` | boolean | `false` | Complete ExploreOnBing offers over HTTP instead of the browser | `CONFIG_EXPERIMENTAL_API_SEARCH_ON_BING` |
-| `experimental.blockMedia` | boolean | `false` | Block post-login browser `image` and `media` requests to reduce traffic | `CONFIG_EXPERIMENTAL_BLOCK_MEDIA` |
-| `experimental.edgeBrowsing` | boolean | `false` | Report the 30-minute Edge browsing activity as a background HTTP task | `CONFIG_EXPERIMENTAL_EDGE_BROWSING` |
+`searchSettings.queryEngines` 决定搜索主词来源，多源词池合并去重；开启 `clusterSearch` 时每个主词再经 Bing 建议扩展成一组，完成一组才进入下一主词。
-When `experimental.blockMedia` is enabled, the automated flow activates it only after authentication has been
-verified and the session has been saved. The manual-login flow keeps media enabled throughout; `npm run open-session` still
-applies the configured blocker immediately because it opens an already-saved session.
+**核心源：**
-When `experimental.edgeBrowsing` is enabled, the task starts before the normal activity sequence and runs as a separate Promise alongside Daily Set, promotions, app activities, and searches. If foreground work finishes first, the account remains open until this Promise settles. Accounts without the promotion, an access token, or remaining Edge work are skipped immediately.
+| 值 | 来源 | 国内可用性 |
+| ------------ | ---------------------------------------------- | ------------- |
+| `china` | 中国热搜（gmya.net：百度/头条/抖音/微博/知乎） | ✅ 直连，推荐 |
+| `local` | 本地查询词（`search-queries.json` 中文词库） | ✅ 离线 |
+| `google` | Google Trends 热搜 | ❌ 需代理 |
+| `wikipedia` | 维基百科热门条目 | ❌ 需代理 |
+| `wikirandom` | 随机维基百科条目 | ❌ 需代理 |
+| `hackernews` | Hacker News 首页 | ❌ 需代理 |
+| `reddit` | Reddit r/popular | ❌ 需代理 |
-#### Activity source layout
+**RSS 源**（点分路径：`rss` 全部 / `rss.` 站点 / `rss..` 单源）：
-Standard activities live under `src/functions/activities`, grouped by responsibility:
+| 值 | 内容 |
+| ---------------------------------- | ----------------------------------------------------------- |
+| `rss.googleTrends` | Google Trends（`gb`、`us`） |
+| `rss.googleNews` | Google News（`gb`/`us`/`world`/`technology`/`business`） |
+| `rss.bbc` | BBC News（`top`/`world`/`technology`/`business`/`science`） |
+| `rss.guardian` | The Guardian（`international`/`world`/`technology`） |
+| `rss.theVerge` / `rss.arsTechnica` | The Verge / Ars Technica 全部 |
+| `rss.reddit` | Reddit 列表源（`popular`/`worldnews`/`technology`） |
-- `rewards`: Daily Set, More Promotions, Punch Cards, and shared promotion dispatch
-- `api`: individual Rewards API actions
-- `app`: individual mobile-app activities and App Promotions orchestration
-- `search`: browser search flows, search tracking, and shared SearchOnBing behavior
-- `visualSearch`: the visual-search activity and its browser transport
-- `experimental`: API Search, API SearchOnBing, Edge Browsing, and their supporting transports
+自定义 RSS 源在 `src/constants/rssFeeds.ts` 中添加。
-Experimental activities live with the other activities under `src/functions/activities/experimental`. The browser-only media blocker lives at `src/browser/MediaBlocker.ts`. `BrowserFunc` contains shared Rewards/browser/session transport only, rather than individual search or visual-search implementations.
+**china 源策略：**
-> [!NOTE]
-> [Playwright documents](https://playwright.dev/docs/api/class-browsercontext#browser-context-route) that request routing disables the browser HTTP cache while routing is active. Image-heavy pages will usually transfer substantially less data with media blocking enabled, but cache-heavy sites are not guaranteed to use less total bandwidth or load faster. Keep this option disabled if a site depends on image/media load events.
+- 随机选取热榜源聚合（免费档 1 个、配置 appkey 2 个），单源失败自动 fallback 到其余源
+- 命中免费档限流（403）时自动退避，并提示配置 `chinaApi.appkey`
+- 主源优先：主源原始词累计达 20 即停止请求后续源；主源不足时后续源随机抽样 50 条补充
> [!NOTE]
-> The API paths are faster but depend on the modern dashboard's endpoints. If an ExploreOnBing offer ever fails to be credited, turn `apiSearchOnBing` off to fall back to the browser path.
+> `google` / `wikipedia` / `reddit` / `hackernews` 源及多数 RSS 源在国内网络不可直连，选了也会静默失败降级到其他源；无代理环境直接用 `china,local` 即可。
-Regardless of the experimental search settings, normal Rewards actions use the cookies and action data captured during bootstrap without refreshing the visible page. The browser remains idle until a browser-backed search starts. A failed or unacknowledged URL-reward request triggers one context refresh and one retry; successful requests use the balance returned by the server action.
+
-### Logging
+
+🧪 Experimental / 实验特性（默认关闭，可能变化）
-| Setting | Type | Default | Description | Docker environment variable |
-| -------------------------------- | -------- | ---------------------- | --------------------------------- | ------------------------------- |
-| `debugLogs` | boolean | `false` | Enable debug logging | `CONFIG_DEBUG_LOGS` |
-| `consoleLogFilter.enabled` | boolean | `false` | Enable console log filtering | `CONFIG_LOG_FILTER_ENABLED` |
-| `consoleLogFilter.mode` | string | `"whitelist"` | Filter mode (whitelist/blacklist) | `CONFIG_LOG_FILTER_MODE` |
-| `consoleLogFilter.levels` | string[] | `["error", "warn"]` | Log levels to filter | `CONFIG_LOG_FILTER_LEVELS` \* |
-| `consoleLogFilter.keywords` | string[] | `["starting account"]` | Keywords to filter | `CONFIG_LOG_FILTER_KEYWORDS` \* |
-| `consoleLogFilter.regexPatterns` | string[] | `[]` | Regex patterns for filtering | |
+| 设置 | 描述 | 默认值 | Docker 环境变量 |
+| ------------------------------ | ------------------------------------ | ------- | ---------------------------------------- |
+| `experimental.apiSearch` | 用 HTTP 请求代替浏览器执行 Bing 搜索 | `false` | `CONFIG_EXPERIMENTAL_API_SEARCH` |
+| `experimental.apiSearchOnBing` | 用 HTTP 完成 ExploreOnBing 活动 | `false` | `CONFIG_EXPERIMENTAL_API_SEARCH_ON_BING` |
+| `experimental.blockMedia` | 拦截浏览器图片/媒体请求省流量 | `false` | `CONFIG_EXPERIMENTAL_BLOCK_MEDIA` |
+| `experimental.edgeBrowsing` | 后台 HTTP 上报 30 分钟 Edge 浏览活动 | `false` | `CONFIG_EXPERIMENTAL_EDGE_BROWSING` |
-> [!NOTE]
-> \* Docker `CONFIG_*` array values are comma-separated strings e.g. `"error,warn"`. Regex patterns must be set directly in `config.json`.
-
-### Proxy
-
-| Setting | Type | Default | Description | Docker environment variable |
-| ------------------------------- | ------- | ------- | ------------------------------------------------------------------ | ---------------------------------------- |
-| `proxy.queryEngine` | boolean | `true` | Proxy query engine requests | `CONFIG_PROXY_QUERY_ENGINE` |
-| `proxy.ignoreCertificateErrors` | boolean | `false` | Disable browser TLS certificate verification for intercept proxies | `CONFIG_PROXY_IGNORE_CERTIFICATE_ERRORS` |
-
-Leave `proxy.ignoreCertificateErrors` disabled for normal HTTP(S)/SOCKS proxies. Enabling it weakens TLS protection for the entire browser context and should only be used when a trusted intercepting proxy cannot otherwise present a valid certificate.
-
-`proxy.queryEngine` controls whether query-source HTTP requests use the account HTTP proxy. Set the corresponding `ACCOUNT_N_PROXY_HTTP=true` (and configure `ACCOUNT_N_PROXY_*`) for those HTTP requests to have a proxy available; browser traffic uses `ACCOUNT_N_PROXY_URL` independently.
-
-Account browser proxies support `http://`, `https://`, `socks4://`, and `socks5://` (a bare hostname is treated as HTTP). HTTP(S) proxies may use `ACCOUNT_N_PROXY_USERNAME` and `ACCOUNT_N_PROXY_PASSWORD`; Patchright does not support browser authentication for SOCKS4/SOCKS5 proxies. Invalid protocols, ports, partial credentials, and authenticated SOCKS proxy configurations are rejected during account validation before the browser starts.
-
-### Webhooks
-
-| Setting | Type | Default | Description | Docker environment variable |
-| ---------------------------------------- | -------- | ---------------------------------------------------- | --------------------------------- | --------------------------------------- |
-| `webhook.discord.enabled` | boolean | `false` | Enable Discord webhook | `CONFIG_DISCORD_ENABLED` |
-| `webhook.discord.url` | string | `""` | Discord webhook URL | `CONFIG_DISCORD_URL` |
-| `webhook.telegram.enabled` | boolean | `false` | Enable Telegram webhook | `CONFIG_TELEGRAM_ENABLED` |
-| `webhook.telegram.botToken` | string | `""` | Telegram bot token | `CONFIG_TELEGRAM_BOTTOKEN` |
-| `webhook.telegram.chatId` | string | `""` | Telegram chat id | `CONFIG_TELEGRAM_CHATID` |
-| `webhook.ntfy.enabled` | boolean | `false` | Enable ntfy notifications | `CONFIG_NTFY_ENABLED` |
-| `webhook.ntfy.url` | string | `""` | ntfy server URL | `CONFIG_NTFY_URL` |
-| `webhook.ntfy.topic` | string | `""` | ntfy topic | `CONFIG_NTFY_TOPIC` |
-| `webhook.ntfy.token` | string | `""` | ntfy authentication token | `CONFIG_NTFY_TOKEN` |
-| `webhook.ntfy.title` | string | `"Microsoft-Rewards-Script"` | Notification title | `CONFIG_NTFY_TITLE` |
-| `webhook.ntfy.tags` | string[] | `["bot", "notify"]` | Notification tags | `CONFIG_NTFY_TAGS` \* |
-| `webhook.ntfy.priority` | number | `3` | Notification priority (1-5) | `CONFIG_NTFY_PRIORITY` |
-| `webhook.webhookLogFilter.enabled` | boolean | `false` | Enable webhook log filtering | `CONFIG_WEBHOOK_LOG_FILTER_ENABLED` |
-| `webhook.webhookLogFilter.mode` | string | `"whitelist"` | Filter mode (whitelist/blacklist) | `CONFIG_WEBHOOK_LOG_FILTER_MODE` |
-| `webhook.webhookLogFilter.levels` | string[] | `["error"]` | Log levels to send | `CONFIG_WEBHOOK_LOG_FILTER_LEVELS` \* |
-| `webhook.webhookLogFilter.keywords` | string[] | `["starting account", "select number", "collected"]` | Keywords to filter | `CONFIG_WEBHOOK_LOG_FILTER_KEYWORDS` \* |
-| `webhook.webhookLogFilter.regexPatterns` | string[] | `[]` | Regex patterns for filtering | |
+> 💡 API 路径更快但依赖新版面板接口；若 ExploreOnBing 活动积分未到账，关闭 `apiSearchOnBing` 回退浏览器路径。
-> [!NOTE]
-> \* Docker `CONFIG_*` array values are comma-separated strings e.g. `"error,warn"`. Regex patterns must be set directly in `config.json`.
+
+
+
+📝 Logging / 日志
+
+| 设置 | 描述 | 默认值 | Docker 环境变量 |
+| -------------------------------- | ----------------------------------- | ---------------------- | ---------------------------- |
+| `debugLogs` | 输出 DEBUG 级别日志 | `false` | `CONFIG_DEBUG_LOGS` |
+| `consoleLogFilter.enabled` | 启用控制台日志过滤 | `false` | `CONFIG_LOG_FILTER_ENABLED` |
+| `consoleLogFilter.mode` | 过滤模式（`whitelist`/`blacklist`） | `whitelist` | `CONFIG_LOG_FILTER_MODE` |
+| `consoleLogFilter.levels` | 过滤的日志级别 | `["error", "warn"]` | `CONFIG_LOG_FILTER_LEVELS` |
+| `consoleLogFilter.keywords` | 过滤关键词 | `["starting account"]` | `CONFIG_LOG_FILTER_KEYWORDS` |
+| `consoleLogFilter.regexPatterns` | 过滤正则 | `[]` | 仅 config.json |
+
+> 📌 日志默认全量写入 `logs/YYYY-MM-DD.log`（按本地日期分文件），进程启动时自动清理 90 天前的旧文件（`src/logging/Logger.ts` 中的 `LOG_RETENTION_DAYS` 可调整）。
+
+
+
+
+🌍 Proxy / 代理
+
+| 设置 | 描述 | 默认值 | Docker 环境变量 |
+| ------------------------------- | ----------------------------------- | ------- | ---------------------------------------- |
+| `proxy.queryEngine` | 查询源 HTTP 请求走账户代理 | `true` | `CONFIG_PROXY_QUERY_ENGINE` |
+| `proxy.ignoreCertificateErrors` | 关闭浏览器 TLS 校验（拦截型代理用） | `false` | `CONFIG_PROXY_IGNORE_CERTIFICATE_ERRORS` |
+
+**账户级代理**（`.env` 中按账号配置）：
+
+- 浏览器代理：`ACCOUNT_N_PROXY_URL`（支持 `http://`、`https://`、`socks4://`、`socks5://`，裸主机名视为 HTTP）
+- HTTP 代理认证：`ACCOUNT_N_PROXY_USERNAME` / `ACCOUNT_N_PROXY_PASSWORD`（Patchright 不支持 SOCKS 浏览器认证）
+- 查询源请求代理：`ACCOUNT_N_PROXY_HTTP=true` 并配置 `ACCOUNT_N_PROXY_*`
-> [!WARNING]
-> **NTFY** users set the `webhookLogFilter` to `enabled`, or you will receive push notifications for _all_ logs.
-> When enabled, only account start, 2FA codes, and account completion summaries are delivered as push notifications.
-> Customize which notifications you receive with the `keywords` options.
+> ⚠️ `ignoreCertificateErrors` 会削弱整个浏览器上下文的 TLS 保护，仅在受信拦截代理无法出示有效证书时开启。
+
+
---
-## Troubleshooting
+## 🔔 通知渠道
-> [!TIP]
-> Most login issues can be fixed by deleting your /sessions folder, and redeploying the script
+均在 `webhook` 对象下，**可同时开启多个**：
-### Manual login
+| 设置 | 描述 | 默认值 | Docker 环境变量 |
+| --------------------------------------------------------------------------- | ----------------------------------------------- | ------- | --------------------------------------------------- |
+| `webhook.discord.enabled` / `.url` | Discord 推送 | `false` | `CONFIG_DISCORD_ENABLED` / `_URL` |
+| `webhook.telegram.enabled` / `.botToken` / `.chatId` | Telegram 推送 | `false` | `CONFIG_TELEGRAM_ENABLED` / `_BOTTOKEN` / `_CHATID` |
+| `webhook.ntfy.enabled` / `.url` / `.topic` / `.token` 等 | ntfy 推送 | `false` | `CONFIG_NTFY_*` |
+| `webhook.pushplus.enabled` / `.token` / `.title` / `.template` / `.channel` | PushPlus 微信推送 | `false` | `CONFIG_PUSHPLUS_*` |
+| `webhook.clawbot.enabled` / `.authFile` | 微信 ClawBot 推送 | `false` | `CONFIG_CLAWBOT_ENABLED` / `_AUTHFILE` |
+| `webhook.webhookLogFilter.*` | Webhook 逐条日志过滤（结构同 consoleLogFilter） | `false` | `CONFIG_WEBHOOK_LOG_FILTER_*` |
-Use the manual-login command when an account needs an interactive Microsoft sign-in. It opens the same bundled
-patched Chromium browser in headful mode and does not invoke the automated login handler. After you finish signing
-in, the command waits until the browser remains on `rewards.bing.com` for five continuous seconds, saves the session,
-and closes the browser automatically.
+> 💡 **国内推荐**：**PushPlus** 或 **微信 ClawBot**（均直达微信，无需翻墙）。Discord / Telegram / ntfy 需要能访问对应服务。
+> 运行结束的中文积分摘要会一次性推送（不逐条推日志）。
-```bash
-# Create or refresh the mobile session used at the start of automated runs
-npm run manual-login -- --email user@example.com
+
+🤖 微信 ClawBot 推送（V4-china 特有）
-# Create or refresh only the desktop session
-npm run manual-login -- --email user@example.com --platform desktop
+基于腾讯官方微信 ClawBot（iLink 灰度接口）直连推送，**免费、无第三方服务、消息直达微信聊天列表**。需要你的微信号有 ClawBot 灰度资格（微信 → 我 → 设置 → 插件）。
-# Create mobile and desktop sessions sequentially
-npm run manual-login -- --email user@example.com --platform both
+使用只需三步：
-# Ignore existing cookies and perform a clean sign-in
-npm run manual-login -- --email user@example.com --fresh
-```
+1. `config.json` 中开启：`"webhook": { "clawbot": { "enabled": true } }`
+2. 正常启动脚本（如 `npm start`）——检测到未登录时，终端会**自动弹出二维码**，手机微信扫码确认（等待 5 分钟，超时则本次跳过推送，任务照常运行）
+3. 登录后终端提示激活时，在手机微信里给「微信 ClawBot」**发送一条任意消息**（等待 2 分钟）——脚本会自动抓取激活凭证并回发一条"✅ 通知已接通"
-The email must match an `ACCOUNT_N_EMAIL` entry in `.env`. Existing cookies are restored by default, while `--fresh`
-starts without them but retains a compatible saved fingerprint when fingerprint persistence is enabled. The command
-uses the selected account's language, region, proxy, proxy credentials, and fingerprint settings from `.env`. For
-consistent device identity between the manual and automated browser, enable `ACCOUNT_N_SAVE_FINGERPRINT_MOBILE=true`
-and/or
-`ACCOUNT_N_SAVE_FINGERPRINT_DESKTOP=true` for the platforms you use.
+之后每次运行结束，积分摘要会自动推送到你的微信。凭证保存在项目根 `clawbot-auth.json`（已加入 .gitignore），多台机器可直接复制该文件共用。也可用 `npm run clawbot:login` 手动完成登录+激活。凭证过期（服务端 -14）时自动清除、下次运行重新扫码；推送上下文失效（-2）时下次运行会重新等待激活消息。
-The session path, global timeout, media-blocking option, and proxy TLS option come from `config.json`. The corresponding
-`CONFIG_GLOBAL_TIMEOUT`, `CONFIG_EXPERIMENTAL_BLOCK_MEDIA`, and
-`CONFIG_PROXY_IGNORE_CERTIFICATE_ERRORS` environment overrides are also applied after `.env` is loaded. Manual login
-forces a visible browser and defers media blocking for the entire interactive authentication flow, even when
-`experimental.blockMedia` is enabled. Automated runs resume the configured blocker only after login verification and
-session saving, so authentication SVGs, QR codes, and videos cannot be blocked by this option.
+
-Run this command directly on a computer with a graphical desktop and a full Patchright Chromium installation. The
-default Docker image contains only the headless browser shell and cannot display this interactive window.
+---
+
+## ❓ 常见问题
-### Session management
+
+报错 Error: browserType.launch: Executable doesn't exist 怎么办？
-The session utility requires an explicit command, so running it without an
-argument only displays help and never deletes anything.
+Chromium 没装上，手动安装：
```bash
-# List stored mobile and desktop sessions
-npm run clear-sessions -- list
+npx patchright install chromium
+```
-# Delete the sessions belonging to one account
-npm run clear-sessions -- email user@example.com
+
-# Delete every stored session
-npm run clear-sessions -- all
+
+登录失败 / 卡住 / 每次都要重新登录？
+
+首次运行时请**手动完成网页登录**一次，等待脚本自动接管剩余流程。登录后的 cookie 会保存到 `sessions/` 目录，后续运行会自动复用。
+
+⚠️ `sessions/` 目录**需要多备份**，丢了就要重新登录。
+
+也可用会话管理命令查看/清理：
+
+```bash
+npm run clear-sessions -- list # 列出所有账户会话
+npm run clear-sessions -- email user@example.com # 删除指定账户会话
+npm run clear-sessions -- all # 删除全部会话
```
+
+
+
+修改 .env / config.json 后怎么生效？
+
+- **Win 环境**：`.env` 在脚本启动时读取，改完重新 `npm start` 即可；`config.json` 改完建议 `npm run build` 后再启动
+- **Docker 环境**：改 `.env` 或 `compose.yaml` 后用 `docker compose up -d --build` 生效；不要手动改容器内配置文件
+
+
+
+
+Docker 改了配置为什么不生效？
+
+改完 `compose.yaml` 或代码后，必须加 `--build` 重建镜像：
+
```bash
-# List safe session metadata
-curl --request GET \
- --url http://127.0.0.1:3010/sessions \
- --header 'Authorization: Bearer YOUR_API_TOKEN'
-
-# Delete only user@example.com's mobile and desktop sessions
-curl --request DELETE \
- --url http://127.0.0.1:3010/sessions/user%40example.com \
- --header 'Authorization: Bearer YOUR_API_TOKEN'
+docker compose up -d --build
```
-See the [Control API session documentation](scripts/api/README.md#session-management)
-for response data, Axios examples, and error behavior.
+不加 `--build` 跑的是旧镜像。
+
+
+
+
+国内查询词被限流（403）怎么办？
+
+gmya.net 免费档对连续请求有频率限制。解决方法：
+
+到 [gmya.net](https://gmya.net) 申请 appkey，填入 `searchSettings.chinaApi.appkey`（Docker 用 `CONFIG_CHINA_API_APPKEY` 环境变量），即可解除限流。
+
+
+
+
+v3 的 accounts.json / config.json 能直接用吗？
+
+不能。本分支与 v3 及更早版本**均不兼容**：
+
+- 账号迁移到 `.env`（`ACCOUNT_1_EMAIL` 等，参考 `env.example`）
+- 配置文件基于本分支 `config.example.json` 重新生成
+
+
+
+
+ClawBot 推送没收到 / 提示凭证过期？
+
+- 确认微信号有 ClawBot 灰度资格（微信 → 我 → 设置 → 插件），且首次扫码后给「微信 ClawBot」发过一条消息激活
+- 凭证过期（服务端 -14）会自动清除，下次运行重新扫码；或手动 `npm run clawbot:login`
+- iLink 服务端限频约 7 条 / 5 分钟，摘要为一次性推送，一般不会触发
+
+
+
+---
+
+## ⚠️ 注意事项
+
+- `.env` 含账户密码，**严禁提交或分享**（已加入 `.gitignore`）；`clawbot-auth.json` 含推送凭证，同样勿提交。
+- 如果出现无法自动登录的情况，请在代码执行登录过程中**手动完成网页登录**，等待代码自动完成剩余流程。登录信息保存在 `sessions/` 目录（需要多备份）。
+- **Win 环境**：复制或重命名 `config.example.json` 为 `config.json`（项目根目录）并自定义偏好；修改后运行 `npm run build` 重新构建。
+- **Docker 环境**：账号和行为配置通过 `.env` 和 `compose.yaml` 传入；`CONFIG_*` 每次启动都会覆盖 `./config/config.json`。
+- 之前的 `accounts.json` 和旧版 `config.json` 与本分支不兼容。
+
+---
+
+## 📜 同步与致谢
+
+本项目 fork 自 [TheNetsky/Microsoft-Rewards-Script](https://github.com/TheNetsky/Microsoft-Rewards-Script)，`V4-china` 分支基于上游 **v4 分支**（新版 dashboard 架构）做国内本地化：
+
+- 中国热搜查询源（gmya.net 聚合百度/头条/抖音/微博/知乎，多源随机 + 限流退避 + appkey 解限流）
+- PushPlus / 微信 ClawBot 微信推送渠道
+- 国内默认值调优（china+local 引擎、搜索间隔 6-12min、防风控默认项）
+- 中文词库（`search-queries.json`）与全量日志中文化
+- Docker 基础镜像走 m.daocloud.io 加速；浏览器版本接口不可达时自动回退内置版本
+
+若有侵权请联系删除。
+
+**本项目所有改动基于 Win11 系统测试。其他系统未测试，请根据原项目相关配置设置。**
+
+| 项目 | 信息 |
+| ------------ | --------------------------------------------------------------------------------------------------------- |
+| 上游仓库 | [TheNetsky/Microsoft-Rewards-Script](https://github.com/TheNetsky/Microsoft-Rewards-Script)（v4 分支） |
+| 本仓库 | [chiihero/Microsoft-Rewards-Script](https://github.com/chiihero/Microsoft-Rewards-Script) `V4-china` 分支 |
+| 当前版本 | 4.3.0 |
+| 最后同步上游 | 2026-08-16 |
---
-## Disclaimer
+## ⚠️ 免责声明
+
+**风险自负！** 使用自动化脚本时，您的 Microsoft Rewards 账户可能会被暂停或禁止。
-Use at your own risk.
-Automation of Microsoft Rewards may lead to account suspension or bans.
-This software is provided for educational purposes only.
-The authors are not responsible for any actions taken by Microsoft.
+此脚本仅供教育目的。作者对 Microsoft 采取的任何账户操作不承担责任。
diff --git a/compose.yaml b/compose.yaml
index d0ccc729..bd10bf57 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -1,9 +1,10 @@
services:
microsoft-rewards-script:
- image: ghcr.io/thenetsky/microsoft-rewards-script:4
- # To build locally instead of pulling the prebuilt image, use the build section below.
- #build:
- # context: .
+ # 本地构建本项目代码（V4-china 国内适配版）。
+ # ghcr.io/thenetsky/... 是原作者 TheNetsky 的官方镜像，跑的是原版代码，
+ # 不含本项目的国内适配（中国热搜 / PushPlus 等）。
+ build: .
+ image: microsoft-rewards-script:china
container_name: microsoft-rewards-script
restart: unless-stopped
volumes:
@@ -14,7 +15,7 @@ services:
- path: .env
environment:
# ── Scheduler ──────────────────────────────────────
- TZ: 'America/Toronto'
+ TZ: 'Asia/Shanghai' # Set your timezone for proper scheduling
NODE_ENV: 'production'
# CRON_SCHEDULE is the *initial* default. It will run as default unless changed by the API
# API schedule changes are saved to ./config/schedule.json, delete
@@ -36,6 +37,12 @@ services:
#API_ALLOW_CONFIG_REVEAL: 'true'
#API_ALLOW_CONFIG_WRITE: 'true'
+ # ── Embedded dashboard (dashboard/server.js) ──────────────────────────────────────
+ # Started automatically in API mode; web UI on :8300 (LAN, no auth - keep it internal).
+ # Its data (push-config/state) persists under ./config/dashboard/.
+ #DASHBOARD_ENABLED: 'true'
+ #DASHBOARD_PORT: '8300'
+
# ── Configuration ──────────────────────────────────────
# Uncomment to override defaults, a full list of configuration options are in the README.
#CONFIG_CLUSTERS: '1'
@@ -51,10 +58,30 @@ services:
#CONFIG_PROXY_IGNORE_CERTIFICATE_ERRORS: 'false'
#... add additional configuration overrides as needed
+ # ── API mode + dashboard port mapping ──────────────────────────────────────
+ # Uncomment when API_MODE=true. 3010 should stay loopback-only (token-bearing API);
+ # 8300 is the embedded dashboard web UI (LAN, no auth).
+ # ── 国内特性（V4-china）──────────────────────────────────
+ # 查询源：中国热搜(gmya.net) + 本地词兜底；国内推荐，无需代理
+ #CONFIG_SEARCH_QUERY_ENGINES: 'china,local'
+ # gmya.net appkey，填入解除免费档限流（留空走免费档，有频率限制）
+ #CONFIG_CHINA_API_APPKEY: ''
+ # PushPlus 微信推送（国内推荐，无需翻墙）：
+ #CONFIG_PUSHPLUS_ENABLED: 'true'
+ #CONFIG_PUSHPLUS_TOKEN: 'your_pushplus_token'
+ #CONFIG_PUSHPLUS_TITLE: 'Microsoft-Rewards-Script'
+ #CONFIG_PUSHPLUS_TEMPLATE: 'txt' # txt / html / markdown
+ #CONFIG_PUSHPLUS_CHANNEL: '' # 默认微信；可选其他 channel
+ # 微信 ClawBot 推送（官方 iLink 直连，免费；需容器内完成一次扫码，
+ # 建议配合 API_MODE/tty 使用，或本地登录后把 clawbot-auth.json 挂载进容器）：
+ #CONFIG_CLAWBOT_ENABLED: 'true'
+ #CONFIG_CLAWBOT_AUTHFILE: '' # 凭证路径，默认项目根 clawbot-auth.json
+
# ── API mode port mapping ──────────────────────────────────────
# Uncomment when API_MODE=true
#ports:
- # - '3010:3010'
+ # - '127.0.0.1:3010:3010'
+ # - '8300:8300'
healthcheck:
test: ['CMD-SHELL', 'scripts/docker/healthcheck.sh']
diff --git a/config.example.json b/config.example.json
index 32c96499..0bb6efa2 100644
--- a/config.example.json
+++ b/config.example.json
@@ -30,35 +30,29 @@
"searchOnBing": true
},
"searchOnBingLocalQueries": false,
- "globalTimeout": "30sec",
+ "globalTimeout": "50sec",
"searchSettings": {
- "scrollRandomResults": false,
- "clickRandomResults": false,
+ "scrollRandomResults": true,
+ "clickRandomResults": true,
"runOnZeroPoints": false,
"maxBonusSearches": 110,
- "parallelSearching": true,
+ "parallelSearching": false,
"clusterSearch": true,
"queryEngines": [
- "google",
- "wikipedia",
- "wikirandom",
- "hackernews",
- "reddit",
- "local",
- "rss.googleTrends",
- "rss.googleNews",
- "rss.bbc",
- "rss.guardian.world",
- "rss.theVerge.all"
+ "china",
+ "local"
],
- "searchResultVisitTime": "10sec",
+ "searchResultVisitTime": "20sec",
"searchDelay": {
- "min": "30sec",
- "max": "1min"
+ "min": "6min",
+ "max": "12min"
},
"readDelay": {
- "min": "30sec",
- "max": "1min"
+ "min": "6min",
+ "max": "11min"
+ },
+ "chinaApi": {
+ "appkey": ""
}
},
"experimental": {
@@ -67,7 +61,7 @@
"blockMedia": false,
"edgeBrowsing": false
},
- "debugLogs": false,
+ "debugLogs": true,
"consoleLogFilter": {
"enabled": false,
"mode": "whitelist",
@@ -76,7 +70,7 @@
"regexPatterns": []
},
"proxy": {
- "queryEngine": true,
+ "queryEngine": false,
"ignoreCertificateErrors": false
},
"webhook": {
@@ -89,6 +83,17 @@
"botToken": "",
"chatId": ""
},
+ "pushplus": {
+ "enabled": false,
+ "token": "",
+ "title": "Microsoft-Rewards-Script",
+ "template": "txt",
+ "channel": ""
+ },
+ "clawbot": {
+ "enabled": false,
+ "authFile": ""
+ },
"ntfy": {
"enabled": false,
"url": "",
diff --git a/dashboard/README.md b/dashboard/README.md
new file mode 100644
index 00000000..6e083281
--- /dev/null
+++ b/dashboard/README.md
@@ -0,0 +1,46 @@
+# 内嵌积分看板 (dashboard)
+
+与脚本**同容器**运行的 Web 看板(零第三方依赖,纯 Node 内置模块),替代原宿主机 systemd 桥接方案。
+
+## 功能
+
+- 账号积分总览表格(余额 / 今日获得 / 状态 / 错误原因),打开即见、无需等运行
+- 「今日获得」按天持久化(Asia/Shanghai 跨天自动归零),失败账号保留上次已知余额
+- 多选账号批量运行(勾选 → 只跑选中;不选 → 全量),经 control API `excludedAccountIndexes` 实现
+- 订阅 control API `/events` SSE,按事件开关推送钉钉(在线可配,含去重)
+- 自动刷新间隔可调(关闭/5/15/30/60 秒,localStorage 记忆)
+- 🩺 **登录体检**:每行按钮,无头恢复已保存会话 → 验证 Rewards 可达 → 读取实时余额 → 回写刷新 cookie,
+ 结果直接更新账号余额/状态(无需为此跑一次全量任务)
+- 🔑 **人工登录**:每行按钮,容器内拉起有头浏览器(Xvfb + noVNC),在内网页面里直接完成微软
+ 身份验证(如 identity/confirm 卡点),停留在 Rewards 页面 5 秒自动保存会话;noVNC 经看板
+ `:8300` 以一次性 token 代理(HTTP + WebSocket),不额外暴露端口,同一时间仅一个会话,20 分钟自动超时
+
+## 运行方式
+
+`entrypoint.sh` 在 `API_MODE=true` 且 `DASHBOARD_ENABLED`(默认开)时,以守护子进程拉起 `dashboard/server.js`,
+崩溃 5 秒后自动重启;`healthcheck.sh` 会同时探测 control API 与看板。
+
+| 环境变量 | 默认 | 说明 |
+|---|---|---|
+| `DASHBOARD_ENABLED` | `true` | 是否随容器启动看板 |
+| `DASHBOARD_PORT` | `8300` | 看板监听端口(建议映射到 LAN) |
+| `DASHBOARD_DATA_DIR` | `$SCRIPT_DIR/config/dashboard` | push-config.json / state.json 存放目录(config 卷内,持久化) |
+| `API_PORT` | `3010` | 本容器 control API 端口(看板内部访问用) |
+| `API_TOKEN` | - | control API Bearer token(由环境注入) |
+
+## 端口与安全
+
+- `8300` 看板 Web UI:**无鉴权**,仅限内网访问,不要暴露公网;人工登录的 noVNC 通道由一次性随机
+ token 门禁且仅存活于会话期间
+- `3010` control API:带 token,建议只绑宿主回环(`127.0.0.1:3010:3010`)
+
+## 数据迁移(自旧宿主机版)
+
+旧版(宿主机 systemd + `/opt/docker/ms-rewards-dashboard`)的数据在:
+
+```
+/opt/docker/ms-rewards-dashboard/config/push-config.json # 钉钉推送配置
+/opt/docker/ms-rewards-dashboard/config/state.json # 账号余额/今日获得/历史
+```
+
+复制到挂载卷的 `config/dashboard/` 下即可无缝继承(格式兼容,含 v2 一次性迁移)。
diff --git a/dashboard/server.js b/dashboard/server.js
new file mode 100644
index 00000000..7b3b4434
--- /dev/null
+++ b/dashboard/server.js
@@ -0,0 +1,1681 @@
+#!/usr/bin/env node
+/**
+ * MS-Rewards 积分仪表盘(容器内嵌版) + 钉钉推送
+ *
+ * 与脚本同容器运行(entrypoint 在 API_MODE 下拉起本进程, 崩溃自动重启):
+ * - 消费本容器 control API (127.0.0.1:$API_PORT, Bearer token 由环境注入)
+ * - 订阅其 /events SSE, 按在线可配的事件开关推送钉钉
+ * - 自身提供 Web UI (:8300, 内网无鉴权): 账号积分总览 / 批量运行 / 推送配置弹窗 / 运行历史
+ * - 数据(push-config/state)落在 $DASHBOARD_DATA_DIR(默认 config/dashboard/), 随宿主卷持久化
+ *
+ * 零第三方依赖, 仅用 Node 内置模块。
+ */
+'use strict';
+
+const http = require('http');
+const https = require('https');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+const net = require('net');
+
+// ============ 常量 ============
+const BASE_DIR = __dirname;
+// 数据目录: 容器内指向脚本 config/ 同卷子目录(持久化); 本地开发默认 dashboard/config
+const CONFIG_DIR = process.env.DASHBOARD_DATA_DIR || path.join(BASE_DIR, 'config');
+const PUSH_CONFIG_FILE = path.join(CONFIG_DIR, 'push-config.json');
+const STATE_FILE = path.join(CONFIG_DIR, 'state.json');
+
+const PORT = Number(process.env.DASHBOARD_PORT || 8300);
+const API_PORT = Number(process.env.API_PORT || 3010);
+const API_BASE = 'http://127.0.0.1:' + API_PORT;
+const SSE_RECONNECT_MS = 5000;
+const HISTORY_KEEP = 30; // dashboard 侧持久化的运行历史条数
+
+// ============ 容器 API token(由容器环境注入) ============
+let API_TOKEN = process.env.API_TOKEN || null;
+
+// ============ 推送配置(在线可改) ============
+function defaultPushConfig() {
+ return {
+ dingtalk: {
+ enabled: true,
+ accessToken: '',
+ secret: '',
+ keyword: 'MS-Rewards',
+ },
+ events: {
+ runStart: { enabled: true, label: '🚀 开始运行' },
+ runEnd: { enabled: true, label: '✅ 全部完成' },
+ accountEnd: { enabled: true, label: '👤 账号完成' },
+ error: { enabled: true, label: '❌ 错误' },
+ loginFail: { enabled: true, label: '⚠️ 登录/风控异常' },
+ dailySummary: { enabled: false, label: '📊 运行摘要' },
+ },
+ dedupSeconds: 10,
+ updatedAt: null,
+ };
+}
+
+let pushConfig = null;
+function loadPushConfig() {
+ try {
+ pushConfig = JSON.parse(fs.readFileSync(PUSH_CONFIG_FILE, 'utf8'));
+ } catch (e) {
+ pushConfig = defaultPushConfig();
+ savePushConfig();
+ }
+}
+function savePushConfig() {
+ pushConfig.updatedAt = new Date().toISOString();
+ try {
+ if (!fs.existsSync(CONFIG_DIR)) fs.mkdirSync(CONFIG_DIR, { recursive: true });
+ fs.writeFileSync(PUSH_CONFIG_FILE, JSON.stringify(pushConfig, null, 2));
+ return true;
+ } catch (e) {
+ log('ERROR', '保存推送配置失败: ' + e.message);
+ return false;
+ }
+}
+
+// ============ 运行状态缓存(state.json 持久化) ============
+let state = { accounts: {}, runs: [] };
+function loadState() {
+ try { state = JSON.parse(fs.readFileSync(STATE_FILE, 'utf8')); } catch (e) {
+ state = { accounts: {}, runs: [] };
+ }
+ if (!state.accounts) state.accounts = {};
+ if (!state.runs) state.runs = [];
+ // v2 一次性迁移: 旧格式 { collected, lastUpdateTs, success } → 新字段
+ // (旧记录发生在今天才把 collected 计入今日获得; 迁移后删除旧字段, 保证只应用一次)
+ if (state.v !== 2) {
+ const t = todayStr();
+ for (const em of Object.keys(state.accounts)) {
+ const a = state.accounts[em];
+ if (!a || typeof a !== 'object') continue;
+ if (a.collected != null && a.lastUpdateTs) {
+ const sameDay = new Date(a.lastUpdateTs + 8 * 3600e3).toISOString().slice(0, 10) === t;
+ if (sameDay && !a.todayCollected) a.todayCollected = a.collected;
+ }
+ if (a.lastStatus == null && a.success != null) a.lastStatus = a.success ? 'success' : 'failed';
+ delete a.collected;
+ delete a.lastUpdateTs;
+ delete a.success;
+ }
+ state.v = 2;
+ saveState();
+ }
+}
+function saveState() {
+ try {
+ if (!fs.existsSync(CONFIG_DIR)) fs.mkdirSync(CONFIG_DIR, { recursive: true });
+ fs.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
+ } catch (e) { /* ignore */ }
+}
+
+// 今日(以 Asia/Shanghai 日期为准)获得的积分按账号持久化, 打开页面即见, 无需等运行
+function todayStr() {
+ return new Date(Date.now() + 8 * 3600e3).toISOString().slice(0, 10);
+}
+function ensureAccount(email) {
+ let a = state.accounts[email];
+ if (!a || typeof a !== 'object') a = state.accounts[email] = { email };
+ if (a.todayDate !== todayStr()) { a.todayDate = todayStr(); a.todayCollected = 0; }
+ return a;
+}
+// 日志消息中提取邮箱(去掉尾部标点, 如 "xxx@qq.com:")
+function extractEmail(message, fallback) {
+ const m = String(message || '').match(/(\S+@\S+)/);
+ const em = String(m ? m[1] : (fallback || '')).replace(/[.:,;，。；]+$/, '');
+ return em || null;
+}
+
+// ============ 日志 ============
+function log(level, msg) {
+ const line = `[${new Date().toLocaleString('zh-CN')}] [${level}] ${msg}`;
+ console.log(line);
+}
+
+// ============ 钉钉发送 ============
+function buildDingUrl(cfg) {
+ let u = `https://oapi.dingtalk.com/robot/send?access_token=${cfg.accessToken}`;
+ if (cfg.secret) {
+ const ts = Date.now();
+ const sign = crypto.createHmac('sha256', cfg.secret)
+ .update(`${ts}\n${cfg.secret}`).digest('base64');
+ u += `×tamp=${ts}&sign=${encodeURIComponent(sign)}`;
+ }
+ return u;
+}
+
+function sendDingTalk(content) {
+ if (!pushConfig.dingtalk.enabled || !pushConfig.dingtalk.accessToken) {
+ return Promise.resolve({ ok: false, error: '钉钉未启用或缺少 accessToken' });
+ }
+ const data = JSON.stringify({
+ msgtype: 'text',
+ text: { content: content.slice(0, 1800) }, // 钉钉 text 上限 2000
+ });
+ const url = new URL(buildDingUrl(pushConfig.dingtalk));
+ const opts = {
+ hostname: url.hostname,
+ path: url.pathname + url.search,
+ method: 'POST',
+ headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
+ timeout: 10000,
+ };
+ return new Promise((resolve) => {
+ const req = https.request(opts, (res) => {
+ let b = '';
+ res.on('data', (c) => (b += c));
+ res.on('end', () => {
+ const ok = /"errcode":\s*0/.test(b);
+ resolve({ ok, resp: b });
+ });
+ });
+ req.on('error', (e) => resolve({ ok: false, resp: 'NETWORK_ERR: ' + e.message }));
+ req.on('timeout', () => { req.destroy(); resolve({ ok: false, resp: 'TIMEOUT' }); });
+ req.write(data);
+ req.end();
+ });
+}
+
+// ============ 推送去重 ============
+const lastSentAt = {};
+function shouldSend(key) {
+ const now = Date.now();
+ const dedup = (pushConfig.dedupSeconds || 10) * 1000;
+ if (lastSentAt[key] && now - lastSentAt[key] < dedup) return false;
+ lastSentAt[key] = now;
+ return true;
+}
+
+// ============ 日志事件 → 推送 ============
+// SSE log 事件: { id, ts, user, level, platform, title, message, ... } (title/message 按 logParser 结构)
+function extractField(msg, re) {
+ const m = String(msg || '').match(re);
+ return m ? m[1] : null;
+}
+
+function pushForEntry(entry) {
+ const ev = pushConfig.events || {};
+ const title = (entry.title || '').toUpperCase();
+ const level = (entry.level || '').toLowerCase();
+ const message = String(entry.message || '');
+ // 优先从消息中提取邮箱(日志里邮箱形如 xxx@yyy.com), 兜底用日志 user 字段
+ const email = (message.match(/(\S+@\S+)/) || [])[1] || entry.user || '';
+
+ let key = null;
+ let lines = null;
+
+ if (title === 'RUN-START' && ev.runStart.enabled) {
+ key = 'runStart';
+ lines = [`🚀 开始运行`, `微软积分脚本开始执行（账号数见日志）`];
+ } else if (title === 'RUN-END' && ev.runEnd.enabled) {
+ key = 'runEnd';
+ const accounts = extractField(message, /(?:accountsProcessed|处理账户数)=(\d+)/);
+ const gained = extractField(message, /(?:pointsGained|获得积分)=(-?\d+)/);
+ const balance = extractField(message, /(?:currentBalance|现余额)=(\d+)/);
+ const runtime = extractField(message, /(?:runtimeMinutes|运行分钟数)=([\d.]+)/);
+ lines = [
+ `✅ 全部完成`,
+ `账号: ${accounts ?? '-'} | 本次获得: ${gained ?? '-'} 分`,
+ `当前总余额: ${balance ?? '-'} | 耗时: ${runtime ?? '-'} 分钟`,
+ ];
+ } else if (title === 'ACCOUNT-END' && ev.accountEnd.enabled) {
+ key = 'accountEnd';
+ const gained = extractField(message, /(?:pointsGained|获得积分)=(-?\d+)/);
+ const balance = extractField(message, /(?:currentBalance|现余额)=(\d+)/);
+ lines = [`👤 账号完成`, `${email || '账号'}: 本次 +${gained ?? '-'} 分 | 余额 ${balance ?? '-'}`];
+ } else if ((/ERROR/.test(title) || level === 'error') && ev.error.enabled) {
+ key = 'error';
+ lines = [`❌ 错误`, (email ? `账号 ${email}\n` : '') + message.slice(0, 300) || message.slice(0, 300)];
+ } else if ((/LOGIN/.test(title) && /fail|失败|denied|error/i.test(message)) || /BOT-WARNING/.test(title)) {
+ if (ev.loginFail.enabled) {
+ key = 'loginFail';
+ lines = [`⚠️ 登录/风控异常`, (email ? `账号 ${email}\n` : '') + message.slice(0, 300) || message.slice(0, 300)];
+ }
+ }
+
+ if (key && lines && shouldSend(key)) {
+ const kw = pushConfig.dingtalk.keyword || 'MS-Rewards';
+ sendDingTalk(`[${kw}] ${lines.join('\n')}`).then((r) => {
+ log('INFO', `${r.ok ? '✓' : '✗'} 推送 ${key} -> ${r.resp ? r.resp.slice(0, 100) : 'ok'}`);
+ });
+ }
+}
+
+// ============ 运行状态收集(从日志事件) ============
+function recordEntry(entry) {
+ const title = (entry.title || '').toUpperCase();
+ const level = (entry.level || '').toLowerCase();
+ const message = String(entry.message || '');
+
+ if (title === 'ACCOUNT-END') {
+ // 中英双语兼容: 上游英文版 "Completed account: x | pointsGained=.." / 中文化分支 "账户完成: x | 获得积分=.."
+ const email = extractField(message, /(?:Completed account|账户完成)[:：]\s*(\S+)/) || extractEmail(message, entry.user) || '未知';
+ const gained = parseInt(extractField(message, /(?:pointsGained|获得积分)=(-?\d+)/) || '0', 10);
+ const balance = parseInt(extractField(message, /(?:currentBalance|现余额)=(\d+)/) || '0', 10);
+ const a = ensureAccount(email);
+ // 失败过的账号也保留上次已知余额, 仅在成功完成时刷新
+ a.balance = balance;
+ a.balanceTs = Date.now();
+ a.todayCollected = (a.todayCollected || 0) + gained;
+ a.lastStatus = 'success';
+ a.lastError = null;
+ a.lastRunTs = Date.now();
+ if (state.currentRun) {
+ state.currentRun.accounts.push({ email, gained, balance });
+ state.currentRun.collected += gained;
+ }
+ saveState();
+ } else if (title === 'ACCOUNT-START') {
+ const email = extractField(message, /(?:Starting account|开始处理账户)[:：]\s*(\S+)/) || extractEmail(message, entry.user);
+ if (email) {
+ const a = ensureAccount(email);
+ a.lastStatus = 'running';
+ a.lastRunTs = Date.now();
+ a.lastError = null;
+ saveState();
+ }
+ } else if (title === 'RUN-START') {
+ state.currentRun = { startedAt: Date.now(), accounts: [], collected: 0, finished: false };
+ saveState();
+ } else if (title === 'RUN-END') {
+ // 收尾: 仍处于 running 的账号视为未完成(登录失败被跳过等), 保留其余额仅标记状态
+ for (const em of Object.keys(state.accounts)) {
+ const a = state.accounts[em];
+ if (a && a.lastStatus === 'running') {
+ a.lastStatus = 'failed';
+ a.lastError = a.lastError || '运行结束但未收到该账号完成事件';
+ }
+ }
+ if (state.currentRun) {
+ state.currentRun.finished = true;
+ state.currentRun.endedAt = Date.now();
+ state.currentRun.totalCollected = parseInt(extractField(message, /(?:pointsGained|获得积分)=(-?\d+)/) || '0', 10);
+ state.currentRun.totalBalance = parseInt(extractField(message, /(?:currentBalance|现余额)=(\d+)/) || '0', 10);
+ state.runs.unshift({
+ startedAt: state.currentRun.startedAt,
+ endedAt: state.currentRun.endedAt,
+ accounts: state.currentRun.accounts,
+ collected: state.currentRun.collected,
+ totalCollected: state.currentRun.totalCollected,
+ totalBalance: state.currentRun.totalBalance,
+ });
+ if (state.runs.length > HISTORY_KEEP) state.runs.length = HISTORY_KEEP;
+ state.currentRun = null;
+ }
+ saveState();
+ } else if (level === 'error' || title.indexOf('ERROR') >= 0) {
+ // 错误事件: 关联到具体账号则标记失败并记录原因(不动余额)
+ if (title.indexOf('RUN') < 0) {
+ const email = extractEmail(message, entry.user);
+ if (email && email.indexOf('@') > 0) {
+ const a = ensureAccount(email);
+ a.lastStatus = 'failed';
+ a.lastError = message.slice(0, 200);
+ saveState();
+ }
+ }
+ }
+}
+
+// ============ SSE 客户端(订阅容器 API /events) ============
+function handleFrame(frame) {
+ const lines = frame.split('\n');
+ let event = null;
+ const datas = [];
+ for (const l of lines) {
+ if (l.startsWith('event:')) event = l.slice(6).trim();
+ else if (l.startsWith('data:')) datas.push(l.slice(5).trim());
+ else if (l.startsWith('id:')) { /* ignore */ }
+ }
+ if (!datas.length) return;
+ let data;
+ try { data = JSON.parse(datas.join('\n')); } catch (e) { return; }
+
+ if (event === 'log') {
+ pushForEntry(data);
+ recordEntry(data);
+ } else if (event === 'hello') {
+ log('INFO', 'SSE 连接成功(hello 快照收到)');
+ } else if (event === 'status') {
+ // 状态变化, 页面通过轮询 /points 反映, 此处无需处理
+ }
+}
+
+function connectSSE() {
+ if (!API_TOKEN) {
+ log('WARN', '未读取到 API_TOKEN, 无法订阅容器事件, 10s 后重试');
+ setTimeout(connectSSE, 10000);
+ return;
+ }
+ const url = `${API_BASE}/events?token=${encodeURIComponent(API_TOKEN)}&replay=200`;
+ const req = http.get(url, (res) => {
+ if (res.statusCode !== 200) {
+ res.resume();
+ log('WARN', `SSE 连接返回 ${res.statusCode}, ${SSE_RECONNECT_MS}ms 后重连`);
+ setTimeout(connectSSE, SSE_RECONNECT_MS);
+ return;
+ }
+ log('INFO', 'SSE 已连接: ' + url.replace(/token=.*$/, 'token=***'));
+ let buf = '';
+ res.on('data', (chunk) => {
+ buf += chunk.toString();
+ let idx;
+ while ((idx = buf.indexOf('\n\n')) >= 0) {
+ const frame = buf.slice(0, idx);
+ buf = buf.slice(idx + 2);
+ handleFrame(frame);
+ }
+ });
+ res.on('end', () => { log('WARN', 'SSE 连接断开, 重连中'); setTimeout(connectSSE, SSE_RECONNECT_MS); });
+ res.on('error', () => { setTimeout(connectSSE, SSE_RECONNECT_MS); });
+ });
+ req.on('error', () => { setTimeout(connectSSE, SSE_RECONNECT_MS); });
+ req.setTimeout(60000, () => { req.destroy(); });
+}
+
+// ============ 容器 API 代理 ============
+function proxyContainerApi(reqPath, method, body, res) {
+ if (!API_TOKEN) {
+ res.writeHead(502, { 'Content-Type': 'application/json' });
+ res.end(JSON.stringify({ error: '未配置 API_TOKEN' }));
+ return;
+ }
+ const data = body ? JSON.stringify(body) : null;
+ const options = {
+ hostname: '127.0.0.1',
+ port: API_PORT,
+ path: reqPath,
+ method: method || 'GET',
+ headers: {
+ Authorization: 'Bearer ' + API_TOKEN,
+ Accept: 'application/json',
+ },
+ timeout: 60000, // start 可能长
+ };
+ if (data) {
+ options.headers['Content-Type'] = 'application/json';
+ options.headers['Content-Length'] = Buffer.byteLength(data);
+ }
+ const req = http.request(options, (r) => {
+ let b = '';
+ r.on('data', (c) => (b += c));
+ r.on('end', () => {
+ try {
+ res.writeHead(r.statusCode, { 'Content-Type': 'application/json' });
+ res.end(b || '{}');
+ } catch (e) { /* ignore */ }
+ });
+ });
+ req.on('error', (e) => {
+ res.writeHead(502, { 'Content-Type': 'application/json' });
+ res.end(JSON.stringify({ error: '容器 API 不可达: ' + e.message }));
+ });
+ if (data) req.write(data);
+ req.end();
+}
+
+// ============ 登录体检(无头会话检查 + 实时余额) ============
+// 复用 scripts/main/loginCheck.js(与主脚本同一会话存取逻辑), 后台任务化并轮询结果
+const PROJECT_ROOT = path.join(BASE_DIR, '..');
+const LOGIN_CHECK_TIMEOUT_MS = 180000;
+const loginCheckJobs = new Map(); // id -> job
+
+function startLoginCheck(accountIndex, email) {
+ for (const job of loginCheckJobs.values()) {
+ if (job.status === 'running') return { error: '已有登录体检在进行中,请稍候', code: 'BUSY' };
+ }
+ const id = crypto.randomBytes(8).toString('hex');
+ const job = { id, accountIndex, email, status: 'running', startedAt: Date.now(), result: null, logs: [] };
+ loginCheckJobs.set(id, job);
+ for (const key of loginCheckJobs.keys()) {
+ if (loginCheckJobs.size > 6) loginCheckJobs.delete(key);
+ }
+ let buf = '';
+ const onLine = (line) => {
+ const t = line.trim();
+ if (!t) return;
+ job.logs.push(t);
+ if (job.logs.length > 60) job.logs.shift();
+ const m = t.match(/LOGINCHECK_RESULT (\{.*\})/);
+ if (m) {
+ try { job.result = JSON.parse(m[1]); } catch (e) { /* 忽略解析失败 */ }
+ }
+ };
+ const child = spawn('node',
+ [path.join(PROJECT_ROOT, 'scripts/main/loginCheck.js'), '--email', email, '--platform', 'both'],
+ { cwd: PROJECT_ROOT, env: process.env, stdio: ['ignore', 'pipe', 'pipe'] });
+ const feed = (c) => {
+ buf += c.toString();
+ let idx;
+ while ((idx = buf.indexOf('\n')) >= 0) {
+ onLine(buf.slice(0, idx));
+ buf = buf.slice(idx + 1);
+ }
+ };
+ child.stdout.on('data', feed);
+ child.stderr.on('data', feed);
+ const timer = setTimeout(() => {
+ try { child.kill('SIGKILL'); } catch (e) { /* ignore */ }
+ job.status = job.result ? 'done' : 'error';
+ job.error = job.error || '体检超时';
+ }, LOGIN_CHECK_TIMEOUT_MS);
+ child.on('exit', (code) => {
+ clearTimeout(timer);
+ job.exitCode = code;
+ job.finishedAt = Date.now();
+ job.status = job.result ? 'done' : 'error';
+ if (!job.result) job.error = job.error || ('进程退出 code=' + code);
+ if (job.result) {
+ // 体检结果直接落到账号状态(余额/体检时间), 前端刷新即可见
+ try {
+ const a = ensureAccount(job.result.email);
+ if (job.result.balance != null) { a.balance = job.result.balance; a.balanceTs = Date.now(); }
+ const first = Object.values(job.result.platforms || {})[0] || {};
+ a.lastStatus = job.result.loggedIn ? 'success' : 'failed';
+ a.lastError = job.result.loggedIn ? null : ('登录体检未通过: ' + (first.reason || 'unknown'));
+ a.lastCheckTs = Date.now();
+ saveState();
+ } catch (e) { /* ignore */ }
+ }
+ });
+ return { ok: true, id, email };
+}
+
+function loginCheckStatus() {
+ const jobs = [...loginCheckJobs.values()].sort((a, b) => b.startedAt - a.startedAt).slice(0, 6);
+ return {
+ jobs: jobs.map(j => ({
+ id: j.id, accountIndex: j.accountIndex, email: j.email, status: j.status,
+ startedAt: j.startedAt, finishedAt: j.finishedAt || null,
+ error: j.error || null, result: j.result || null,
+ lastLog: j.logs.length ? j.logs[j.logs.length - 1] : null,
+ })),
+ running: jobs.some(j => j.status === 'running'),
+ };
+}
+
+// ============ 人工登录(Xvfb + x11vnc + websockify + 上游 manualLogin) ============
+// 无头容器里拉起有头浏览器, 经 noVNC(带一次性 token 代理)让用户在内网页面里完成微软验证
+const ML_DISPLAY = ':99';
+const ML_VNC_PORT = 5999;
+const ML_WS_PORT = 6080;
+const ML_NOVNC_WEB = '/usr/share/novnc';
+const ML_WATCHDOG_MS = 20 * 60 * 1000;
+let manualLoginSession = null;
+
+function mlPushLog(session, text) {
+ for (const line of String(text).split('\n')) {
+ const t = line.trim();
+ if (!t) continue;
+ session.logs.push(t);
+ }
+ if (session.logs.length > 60) session.logs.splice(0, session.logs.length - 60);
+}
+
+function mlCleanupProcs(session) {
+ for (const key of ['runner', 'websockify', 'x11vnc', 'xvfb']) {
+ const p = session.procs[key];
+ if (!p) continue;
+ try { p.kill('SIGKILL'); } catch (e) { /* ignore */ }
+ session.procs[key] = null;
+ }
+}
+
+function mlStop(session, reason) {
+ if (!session || session.stopped) return;
+ session.stopped = true;
+ session.stopReason = reason || null;
+ clearTimeout(session.watchdog);
+ try { session.procs.runner && session.procs.runner.kill('SIGTERM'); } catch (e) { /* ignore */ }
+ setTimeout(() => mlCleanupProcs(session), 2500);
+}
+
+async function startManualLogin(accountIndex) {
+ if (manualLoginSession && !manualLoginSession.done && !manualLoginSession.stopped) {
+ return { error: '已有人工登录会话进行中(同一时间仅支持一个)', code: 'BUSY' };
+ }
+ const accs = await fetchJson('/accounts');
+ const acc = (((accs || {}).accounts) || []).find(a => a.index === accountIndex);
+ if (!acc) return { error: '未知账号序号: ' + accountIndex, code: 'BAD_REQUEST' };
+ const email = acc.email;
+
+ const procs = {};
+ const session = manualLoginSession = {
+ token: crypto.randomBytes(16).toString('hex'),
+ accountIndex, email, startedAt: Date.now(),
+ logs: [], procs, stopped: false, done: false,
+ };
+ // 上次会话若被强杀会残留 X 锁文件, 导致 Xvfb 起不来("Server is already active")
+ for (const stale of ['/tmp/.X99-lock', '/tmp/.X11-unix/X99']) {
+ try { fs.rmSync(stale, { force: true }); } catch (e) { /* ignore */ }
+ }
+ procs.xvfb = spawn('Xvfb', [ML_DISPLAY, '-screen', '0', '1280x900x24', '-nolisten', 'tcp'], { env: process.env });
+ await new Promise(r => setTimeout(r, 1200));
+ procs.x11vnc = spawn('x11vnc',
+ ['-display', ML_DISPLAY, '-rfbport', String(ML_VNC_PORT), '-listen', '127.0.0.1', '-nopw', '-forever', '-shared', '-quiet'],
+ { env: process.env });
+ procs.websockify = spawn('websockify',
+ ['--web', ML_NOVNC_WEB, '127.0.0.1:' + ML_WS_PORT, '127.0.0.1:' + ML_VNC_PORT],
+ { env: process.env });
+ procs.runner = spawn('node',
+ [path.join(PROJECT_ROOT, 'scripts/main/manualLogin.js'), '--email', email, '--platform', 'both'],
+ { cwd: PROJECT_ROOT, env: Object.assign({}, process.env, { DISPLAY: ML_DISPLAY }) });
+
+ session.watchdog = setTimeout(() => {
+ mlPushLog(session, '[dashboard] 会话超时(20 分钟), 自动结束');
+ mlStop(session, 'timeout');
+ }, ML_WATCHDOG_MS);
+ for (const name of ['xvfb', 'x11vnc', 'websockify']) {
+ procs[name].on('exit', (code) => mlPushLog(session, '[dashboard] ' + name + ' 退出 code=' + code));
+ }
+ const feed = (c) => mlPushLog(session, c.toString());
+ procs.runner.stdout.on('data', feed);
+ procs.runner.stderr.on('data', feed);
+ procs.runner.on('exit', (code) => {
+ session.done = true;
+ session.runnerExit = code;
+ mlPushLog(session, '[dashboard] manualLogin 退出 code=' + code + (code === 0 ? '(会话已保存)' : '(未保存完整登录)'));
+ if (code !== 0) {
+ // 找出 runner 的报错行, 透出到状态接口方便定位
+ const errLine = [...session.logs].reverse().find(l => /ERROR|error|Failed|failed|doesn't exist|not found/i.test(l));
+ session.failLog = errLine || session.logs[session.logs.length - 2] || null;
+ }
+ setTimeout(() => { mlCleanupProcs(session); }, 2000);
+ });
+ log('INFO', '人工登录会话启动: ' + email + ' (token=' + session.token.slice(0, 8) + '...)');
+ return { ok: true, token: session.token, email };
+}
+
+function manualLoginStatus() {
+ const s = manualLoginSession;
+ if (!s) return { active: false };
+ const active = !s.done && !s.stopped;
+ return {
+ active,
+ done: s.done,
+ stopped: s.stopped,
+ email: s.email,
+ startedAt: s.startedAt,
+ token: active ? s.token : null,
+ runnerExit: s.runnerExit != null ? s.runnerExit : null,
+ failLog: s.failLog || null,
+ lastLog: s.logs.length ? s.logs[s.logs.length - 1] : null,
+ };
+}
+
+function handleNovncHttp(req, res) {
+ const url = new URL(req.url, 'http://localhost');
+ const m = url.pathname.match(/^\/manual-vnc\/([0-9a-f]{32})(\/.*)?$/);
+ if (!m || !manualLoginSession || manualLoginSession.token !== m[1] || manualLoginSession.stopped || manualLoginSession.done) {
+ res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+ return res.end('无有效人工登录会话');
+ }
+ const suffix = (m[2] || '/vnc.html') + (url.search || '');
+ const up = http.request(
+ { hostname: '127.0.0.1', port: ML_WS_PORT, path: suffix, method: req.method, headers: Object.assign({}, req.headers, { host: '127.0.0.1:' + ML_WS_PORT }) },
+ (r) => { res.writeHead(r.statusCode, r.headers); r.pipe(res); });
+ up.on('error', () => {
+ try { res.writeHead(502, { 'Content-Type': 'text/plain; charset=utf-8' }); res.end('noVNC 未就绪'); } catch (e) { /* ignore */ }
+ });
+ req.pipe(up);
+}
+
+function handleUpgrade(req, socket, head) {
+ try {
+ const url = new URL(req.url, 'http://localhost');
+ const m = url.pathname.match(/^\/manual-vnc\/([0-9a-f]{32})\/websockify$/);
+ if (!m || !manualLoginSession || manualLoginSession.token !== m[1] || manualLoginSession.stopped || manualLoginSession.done) {
+ socket.destroy();
+ return;
+ }
+ const upstream = net.connect(ML_WS_PORT, '127.0.0.1', () => {
+ const prefix = '/manual-vnc/' + m[1];
+ const lines = [req.method + ' ' + url.pathname.slice(prefix.length) + ' HTTP/1.1'];
+ for (let i = 0; i < req.rawHeaders.length; i += 2) lines.push(req.rawHeaders[i] + ': ' + req.rawHeaders[i + 1]);
+ socket.setTimeout(0);
+ socket.setNoDelay(true);
+ upstream.write(lines.join('\r\n') + '\r\n\r\n');
+ if (head && head.length) upstream.write(head);
+ upstream.pipe(socket);
+ socket.pipe(upstream);
+ });
+ upstream.on('error', () => socket.destroy());
+ socket.on('error', () => upstream.destroy());
+ } catch (e) {
+ try { socket.destroy(); } catch (e2) { /* ignore */ }
+ }
+}
+
+// ============ 账号管理(动态账号, config/accounts.extra.json) ============
+// 与 fork 的动态账号源同文件: 添加/删除后, 下一次运行(cron 或手动)自动生效, 无需重建容器
+const EXTRA_ACCOUNTS_FILE = process.env.EXTRA_ACCOUNTS_FILE || path.join(CONFIG_DIR, '..', 'accounts.extra.json');
+
+function readExtraFile() {
+ try {
+ if (!fs.existsSync(EXTRA_ACCOUNTS_FILE)) return [];
+ const parsed = JSON.parse(fs.readFileSync(EXTRA_ACCOUNTS_FILE, 'utf8'));
+ return Array.isArray(parsed) ? parsed : [];
+ } catch (e) {
+ log('ERROR', '读取动态账号文件失败: ' + e.message);
+ return [];
+ }
+}
+
+function writeExtraFile(list) {
+ try {
+ fs.writeFileSync(EXTRA_ACCOUNTS_FILE, JSON.stringify(list, null, 2), { mode: 0o600 });
+ try { fs.chmodSync(EXTRA_ACCOUNTS_FILE, 0o600); } catch (e) { /* ignore */ }
+ return true;
+ } catch (e) {
+ log('ERROR', '写入动态账号文件失败: ' + e.message);
+ return false;
+ }
+}
+
+// ============ HTTP 服务(8300) ============
+function json(res, code, obj) {
+ res.writeHead(code, { 'Content-Type': 'application/json; charset=utf-8' });
+ res.end(JSON.stringify(obj));
+}
+
+function readBody(req) {
+ return new Promise((resolve, reject) => {
+ let b = '';
+ req.on('data', (c) => {
+ b += c;
+ if (b.length > 1024 * 1024) { req.destroy(); reject(new Error('body too large')); }
+ });
+ req.on('end', () => { try { resolve(b ? JSON.parse(b) : {}); } catch (e) { reject(e); } });
+ req.on('error', reject);
+ });
+}
+
+const server = http.createServer(async (req, res) => {
+ const url = new URL(req.url, 'http://localhost');
+ const p = url.pathname.replace(/\/+$/, '') || '/';
+
+ try {
+ // ---- API ----
+ if (p === '/api/points') return proxyContainerApi('/points', 'GET', null, res);
+ if (p === '/api/accounts') return proxyContainerApi('/accounts', 'GET', null, res);
+ if (p === '/api/schedule') return proxyContainerApi('/schedule', 'GET', null, res);
+ if (p === '/api/status') return proxyContainerApi('/status', 'GET', null, res);
+ if (p === '/api/history') {
+ // 合并容器 history 与 dashboard 自身持久化 runs
+ const container = await new Promise((resolve) => {
+ if (!API_TOKEN) return resolve(null);
+ const req2 = http.get({ hostname: '127.0.0.1', port: API_PORT, path: '/history', headers: { Authorization: 'Bearer ' + API_TOKEN } }, (r) => {
+ let b = '';
+ r.on('data', (c) => (b += c));
+ r.on('end', () => { try { resolve(JSON.parse(b)); } catch (e) { resolve(null); } });
+ });
+ req2.on('error', () => resolve(null));
+ });
+ return json(res, 200, {
+ dashboard: state.runs,
+ container: container,
+ containerInMemory: container ? container.inMemoryOnly : true,
+ });
+ }
+
+ if (p === '/api/push-config' && req.method === 'GET') {
+ return json(res, 200, pushConfig);
+ }
+ if (p === '/api/push-config' && req.method === 'PUT') {
+ const body = await readBody(req);
+ const merged = Object.assign(defaultPushConfig(), pushConfig, {
+ dingtalk: Object.assign({}, pushConfig.dingtalk, body.dingtalk),
+ events: Object.assign({}, pushConfig.events, body.events),
+ dedupSeconds: body.dedupSeconds != null ? body.dedupSeconds : pushConfig.dedupSeconds,
+ });
+ pushConfig = merged;
+ savePushConfig();
+ return json(res, 200, { ok: true, config: pushConfig });
+ }
+ if (p === '/api/push-test' && req.method === 'POST') {
+ const r = await sendDingTalk(`[${pushConfig.dingtalk.keyword || 'MS-Rewards'}] 🧪 测试推送\n仪表盘推送配置测试成功 ✅\n(${new Date().toLocaleString('zh-CN')})`);
+ return json(res, 200, r);
+ }
+ if (p === '/api/start' && req.method === 'POST') {
+ // body: {} = 全部账号 | { accountIndex: N } = 单账号 | { indexes: [..] } = 选中账号(转换为排除未选)
+ let body = {};
+ try { body = await readBody(req); } catch (e) { body = {}; }
+ let payload = {};
+ if (Array.isArray(body.indexes) && body.indexes.length) {
+ const sel = [...new Set(body.indexes.map(Number))].filter(i => Number.isSafeInteger(i) && i >= 1);
+ if (!sel.length) return json(res, 400, { error: 'indexes 无效' });
+ const accs = await fetchJson('/accounts');
+ const all = (((accs || {}).accounts) || []).map(a => a.index).sort((a, b) => a - b);
+ if (!all.length) return json(res, 502, { error: '无法读取账号列表' });
+ const unknown = sel.filter(i => !all.includes(i));
+ if (unknown.length) return json(res, 400, { error: '未知账号序号: ' + unknown.join(',') });
+ if (sel.length >= all.length) payload = {}; // 全选 = 全量
+ else payload = { excludedAccountIndexes: all.filter(i => !sel.includes(i)) };
+ } else {
+ const idx = Number(body.accountIndex);
+ if (Number.isSafeInteger(idx) && idx >= 1) payload = { accountIndex: idx };
+ }
+ return proxyContainerApi('/start', 'POST', payload, res);
+ }
+ if (p === '/api/stop' && req.method === 'POST') {
+ return proxyContainerApi('/stop', 'POST', {}, res);
+ }
+ if (p === '/api/overview') {
+ // 聚合概览: 一次返回前端所需的全部数据(账号/余额/今日获得/运行状态/调度/历史)
+ // 容器 API 不可达时仍回退 state.json, 保证打开页面即可见上次已知数据
+ const [points, accounts, schedule] = await Promise.all([
+ fetchJson('/points'),
+ fetchJson('/accounts'),
+ fetchJson('/schedule'),
+ ]);
+ // 实时余额同步进 state(仅变化时写盘)
+ let dirty = false;
+ const liveAccounts = (points && points.accounts) || [];
+ for (const la of liveAccounts) {
+ if (!la.email || la.balance == null) continue;
+ const a = ensureAccount(la.email);
+ if (a.balance !== la.balance) { a.balance = la.balance; a.balanceTs = Date.now(); dirty = true; }
+ }
+ if (dirty) saveState();
+ const mapStatus = (st, live, runningNow) => {
+ if (runningNow) return 'running';
+ if (st.lastStatus) return st.lastStatus;
+ if (st.success === true) return 'success';
+ if (st.success === false) return 'failed';
+ if (live && live.done && live.success === true) return 'success';
+ if (live && live.done && live.success === false) return 'failed';
+ return 'pending';
+ };
+ const build = (index, email, st, live) => {
+ st = st || {};
+ live = live || {};
+ const runningNow = !!(points && points.running && points.currentAccount === email);
+ return {
+ index: index,
+ email: email,
+ balance: st.balance != null ? st.balance : (live.balance != null ? live.balance : null),
+ balanceTs: st.balanceTs || null,
+ todayCollected: st.todayCollected || 0,
+ liveCollected: (points && points.running && live.collected != null) ? live.collected : null,
+ status: mapStatus(st, live, runningNow),
+ lastError: st.lastError || live.error || null,
+ lastRunTs: st.lastRunTs || null,
+ };
+ };
+ let all;
+ if (accounts && accounts.accounts && accounts.accounts.length) {
+ all = accounts.accounts.map(acc => Object.assign(
+ build(acc.index, acc.email, state.accounts[acc.email], liveAccounts.find(x => x.email === acc.email)),
+ { extra: Boolean(acc.extra) }
+ ));
+ } else {
+ // 容器 API 不可达: 用持久化 state 兜底
+ all = Object.keys(state.accounts)
+ .filter(em => em && em.indexOf('@') > 0)
+ .map((em, i) => build(i + 1, em, state.accounts[em], null));
+ }
+ const summary = {
+ count: all.length,
+ totalBalance: all.reduce((s, a) => s + (a.balance || 0), 0),
+ totalToday: all.reduce((s, a) => s + (a.todayCollected || 0), 0),
+ };
+ return json(res, 200, {
+ today: todayStr(),
+ serverTime: Date.now(),
+ run: points ? {
+ state: points.state, running: points.running,
+ currentAccount: points.currentAccount, startedAt: points.startedAt,
+ collected: points.collected, finished: points.finished,
+ accountsTotal: points.accountsTotal,
+ } : null,
+ accounts: all,
+ summary: summary,
+ schedule: schedule,
+ history: state.runs.slice(0, 10),
+ });
+ }
+
+ if (p === '/api/login-check' && req.method === 'POST') {
+ let body = {};
+ try { body = await readBody(req); } catch (e) { body = {}; }
+ const index = Number(body.accountIndex);
+ if (!Number.isSafeInteger(index) || index < 1) return json(res, 400, { error: 'accountIndex 无效' });
+ const accs = await fetchJson('/accounts');
+ const acc = (((accs || {}).accounts) || []).find(a => a.index === index);
+ if (!acc) return json(res, 400, { error: '未知账号序号: ' + index });
+ const r = startLoginCheck(index, acc.email);
+ if (r.error) return json(res, r.code === 'BUSY' ? 409 : 400, r);
+ return json(res, 202, r);
+ }
+ if (p === '/api/login-check/status' && req.method === 'GET') {
+ return json(res, 200, loginCheckStatus());
+ }
+ if (p === '/api/manual-login' && req.method === 'POST') {
+ let body = {};
+ try { body = await readBody(req); } catch (e) { body = {}; }
+ const index = Number(body.accountIndex);
+ if (!Number.isSafeInteger(index) || index < 1) return json(res, 400, { error: 'accountIndex 无效' });
+ const r = await startManualLogin(index);
+ if (r.error) return json(res, r.code === 'BUSY' ? 409 : 400, r);
+ return json(res, 202, r);
+ }
+ if (p === '/api/manual-login/status' && req.method === 'GET') {
+ return json(res, 200, manualLoginStatus());
+ }
+ if (p === '/api/manual-login/stop' && req.method === 'POST') {
+ if (!manualLoginSession) return json(res, 409, { error: '无进行中的人工登录会话' });
+ mlStop(manualLoginSession, 'user-stopped');
+ return json(res, 202, { stopping: true });
+ }
+ if (p.startsWith('/manual-vnc/')) {
+ return handleNovncHttp(req, res);
+ }
+
+ if (p === '/api/accounts-manage' && req.method === 'GET') {
+ return json(res, 200, {
+ accounts: readExtraFile().map(e => ({
+ email: e.email,
+ geoLocale: e.geoLocale || 'auto',
+ hasPassword: Boolean(e.password),
+ hasTotp: Boolean(e.totpSecret),
+ })),
+ });
+ }
+ if (p === '/api/accounts-manage' && req.method === 'POST') {
+ let body = {};
+ try { body = await readBody(req); } catch (e) { body = {}; }
+ const email = String(body.email || '').trim().toLowerCase();
+ const password = String(body.password || '');
+ const geoLocale = String(body.geoLocale || 'gb').trim() || 'gb';
+ const totpSecret = String(body.totpSecret || '').trim();
+ if (!/^\S+@\S+\.\S+$/.test(email)) return json(res, 400, { error: '邮箱格式不正确' });
+ if (!password) return json(res, 400, { error: '密码不能为空' });
+ const list = readExtraFile();
+ if (list.some(e => String(e.email || '').toLowerCase() === email)) {
+ return json(res, 409, { error: '该账号已在动态列表中' });
+ }
+ const accs = await fetchJson('/accounts');
+ const envEmails = (((accs || {}).accounts) || []).map(a => String(a.email || '').toLowerCase());
+ if (envEmails.includes(email)) return json(res, 409, { error: '该账号已作为固定账号(环境变量)配置' });
+ list.push({ email, password, geoLocale, langCode: 'en', totpSecret });
+ if (!writeExtraFile(list)) return json(res, 500, { error: '写入失败' });
+ return json(res, 200, { ok: true, count: list.length });
+ }
+ if (p === '/api/accounts-manage/delete' && req.method === 'POST') {
+ let body = {};
+ try { body = await readBody(req); } catch (e) { body = {}; }
+ const email = String(body.email || '').trim().toLowerCase();
+ const list = readExtraFile();
+ const next = list.filter(e => String(e.email || '').toLowerCase() !== email);
+ if (next.length === list.length) return json(res, 404, { error: '未找到该动态账号' });
+ if (!writeExtraFile(next)) return json(res, 500, { error: '写入失败' });
+ return json(res, 200, { ok: true, count: next.length });
+ }
+
+ // ---- 前端页面 ----
+ if (p === '/') {
+ res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+ return res.end(HTML);
+ }
+ if (p === '/favicon.ico') {
+ res.writeHead(204); return res.end();
+ }
+
+ return json(res, 404, { error: 'not found' });
+ } catch (e) {
+ return json(res, 500, { error: e.message });
+ }
+});
+
+function fetchJson(apiPath) {
+ return new Promise((resolve) => {
+ if (!API_TOKEN) return resolve(null);
+ const req = http.get(
+ { hostname: '127.0.0.1', port: API_PORT, path: apiPath, headers: { Authorization: 'Bearer ' + API_TOKEN } },
+ (r) => {
+ let b = '';
+ r.on('data', (c) => (b += c));
+ r.on('end', () => { try { resolve(JSON.parse(b)); } catch (e) { resolve(null); } });
+ }
+ );
+ req.on('error', () => resolve(null));
+ req.setTimeout(8000, () => { req.destroy(); resolve(null); }); // 防容器 API 挂起导致页面永久"连接中"
+ });
+}
+
+// ============ 前端页面 ============
+// 注意: 本 HTML 位于反引号模板字符串内 —— 内联 JS 禁用反引号/模板插值/${ 与反斜杠转义(含正则与 \n),
+// 否则会被模板字面量二次解释导致下发页面语法错误(曾因此整页 JS 失效)。
+const HTML = `
+
+
+
+
+MS-Rewards 积分看板
+
+
+
+