@@ -237,12 +237,12 @@ curl http://localhost:10081/v1/chat/completions \
 
 - **结果三态**：`success`（本次领到积分）/ `already`（今日已签）/ `skipped`（今天没有可签到活动）。真正的失败单独记为 `error`，并把原因写入 `last_checkin_msg`（悬停在「最近结果」上可见）。
 - **调度**：后台每分钟检查一次，到点后按账号 ID 抖动几秒，避免整池同时打接口。同一天已成功 / 已签 / 无活动的不再重试（`skipped` 属于有意不重试：活动未开放时反复请求没有意义）；失败的在 30 分钟内不重试，之后每轮检查都会再试一次（仍在当天内）。
-- **区域**：国内版用 COSY 会话令牌作 Bearer，国际版用 OpenAPI 令牌（自动换取并刷新）；遇到 401 会强制刷新后重试一次。
-- **设备指纹**：签到接口只对携带**真实桌面客户端指纹**的请求返回「每天领 100 Credits」活动，程序因此会从已安装的 Qoder 桌面 App 里读取 `umid/runtime-info` 生成的指纹（Windows：`%LOCALAPPDATA%\Programs\Qoder[ CN]\resources\umid\runtime-info.exe`；macOS：`/Applications/Qoder[ CN].app/Contents/Resources/umid/runtime-info`）。
+- **区域**：两区域的签到端点都使用 OpenAPI 令牌（`jt-`，自动换取并刷新）；遇到 401 会强制刷新后重试一次。
+- **设备指纹**：上游对机器头很敏感——携带一整套**派生**（非真实）机器头会被当作非官方客户端，「每天领 100 Credits」活动被静默过滤。因此程序只在能读到已安装 Qoder 桌面 App 的真实指纹时才发送六个机器头（Windows：`%LOCALAPPDATA%\Programs\Qoder[ CN]\resources\umid\runtime-info.exe`；macOS：`/Applications/Qoder[ CN].app/Contents/Resources/umid/runtime-info`）；读不到时一个机器头都不发，同样能领到每日积分。
 
 > 🕒 **时区**：签到时间按**服务器本地时间**解释，Docker 镜像默认 `TZ=Asia/Shanghai`。国际版账号若希望按本地「新的一天」签到，请把容器的 `TZ` 改成自己的时区。
 
-> ⚠️ **已知限制**：未安装 Qoder 桌面 App 的机器（典型是 Docker / Linux 服务器，目前没有 Linux 候选路径）拿不到真实指纹，退化为 PAT 派生指纹后，上游会把签到请求当作非官方客户端，活动被静默丢弃，结果通常恒为 `already` / `skipped`。此时可用 `QODER_RUNTIME_INFO` 指向一个可执行 helper，其标准输出为 `{"machineToken":"…","machineType":"…","machineCode":"…"}`。
+> ⚠️ **已知限制**：未安装 Qoder 桌面 App 的机器（典型是 Docker / Linux 服务器，目前没有 Linux 候选路径）拿不到真实指纹，此时签到不发送任何机器头，通用「每日领 100 Credits」活动可正常领取；仅设备定向活动是否受影响未验证。如需真实指纹，可用 `QODER_RUNTIME_INFO` 指向一个可执行 helper，其标准输出为 `{"machineToken":"…","machineType":"…","machineCode":"…"}`。
 
 ### 5. 思考强度与参数透传（verbatim 原则）
 
 
@@ -9,15 +9,16 @@ package auth
 //
 // A campaign is claimable when actionType == "CLAIM_BENEFIT" and
 // claimStatus == "CLAIMABLE"; an already-CLAIMED campaign means "今日已签到".
-// The request authenticates with the session's `securityOauthToken` as a Bearer
-// token (not the COSY-signed bearer used by the chat path) plus the machine
-// identity headers. Cosy-MachineToken/Type/Code come from the genuine desktop
-// fingerprint when available; Cosy-MachineId stays the session's own random
-// uuid, so the header set is NOT byte-identical to the desktop client's.
+// The request authenticates with a "jt-" OpenAPI bearer (minted via
+// /api/v1/jobToken/exchange in both regions) — the COSY securityOauthToken is
+// rejected on this endpoint. The six Cosy-Machine* headers are sent only when
+// the genuine desktop fingerprint is available: a full set of derived
+// (non-native) values marks the caller as an unofficial client and the
+// claimable activity is filtered out, so without a fingerprint none of them
+// are sent.
 
 import (
 	"context"
-	"crypto/md5"
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
@@ -104,34 +105,33 @@ func checkinEndpoint(region *RegionConfig) (base, origin string) {
 // caller is responsible for ensuring the session is fresh; a 401 returned here
 // is surfaced as *CheckinHTTPError so the bridge can force-refresh and retry.
 //
-// This variant sends the PAT-derived device fingerprint. The bridge uses
-// CheckinWithBearer to send the genuine desktop fingerprint, which the campaign
-// service requires to expose the daily credit activity.
-func Checkin(ctx context.Context, sess *SessionContext, pat string, region *RegionConfig) (CheckinResult, error) {
-	return CheckinWithRisk(ctx, sess, pat, region, nil)
+// This variant sends no machine headers (no genuine desktop fingerprint is
+// available). The bridge uses CheckinWithBearer with the desktop fingerprint
+// and the jt- OpenAPI bearer.
+func Checkin(ctx context.Context, sess *SessionContext, region *RegionConfig) (CheckinResult, error) {
+	return CheckinWithRisk(ctx, sess, region, nil)
 }
 
 // CheckinWithRisk is Checkin with an optional genuine device fingerprint. When
-// risk is valid, its machineToken/Type/Code replace the PAT-derived values, so
-// the campaign service treats the request as the official desktop client and
-// includes the claimable daily credit activity. When risk is nil or partial,
-// the derived identity is used instead.
+// risk is valid, the six machine headers carry its machineToken/Type/Code plus
+// the session's MachineId; when risk is nil or partial, no machine headers are
+// sent at all — a full set of derived values would be filtered as an
+// unofficial client.
 //
-// The Bearer token defaults to the session's securityOauthToken. Global
-// (qoder.sh) rejects that token on the campaign endpoint (401 TOKEN_EXPIRE) and
-// requires the OpenAPI bearer instead; callers there should use
-// CheckinWithBearer with the OpenAPI token.
-func CheckinWithRisk(ctx context.Context, sess *SessionContext, pat string, region *RegionConfig, risk *RiskIdentity) (CheckinResult, error) {
+// The Bearer token defaults to the session's securityOauthToken; the
+// campaigns endpoint rejects that in both regions, so production callers use
+// CheckinWithBearer with the jt- OpenAPI token.
+func CheckinWithRisk(ctx context.Context, sess *SessionContext, region *RegionConfig, risk *RiskIdentity) (CheckinResult, error) {
 	if sess == nil {
 		return CheckinResult{}, errors.New("qoder check-in: no session")
 	}
-	return CheckinWithBearer(ctx, sess, pat, region, sess.Identity.SecurityOauthToken, risk)
+	return CheckinWithBearer(ctx, sess, region, sess.Identity.SecurityOauthToken, risk)
 }
 
 // CheckinWithBearer is the low-level entry: it uses the supplied bearer token
-// (CN: securityOauthToken; global: OpenAPI token) plus the optional genuine
-// device fingerprint.
-func CheckinWithBearer(ctx context.Context, sess *SessionContext, pat string, region *RegionConfig, bearer string, risk *RiskIdentity) (CheckinResult, error) {
+// (both regions: the jt- OpenAPI token) plus the optional genuine device
+// fingerprint.
+func CheckinWithBearer(ctx context.Context, sess *SessionContext, region *RegionConfig, bearer string, risk *RiskIdentity) (CheckinResult, error) {
 	if sess == nil {
 		return CheckinResult{}, errors.New("qoder check-in: no session")
 	}
@@ -142,20 +142,14 @@ func CheckinWithBearer(ctx context.Context, sess *SessionContext, pat string, re
 
 	base, origin := checkinEndpoint(region)
 
-	// Prefer the genuine desktop fingerprint when available: the campaign
-	// service only exposes the claimable daily-credit activity to the official
-	// client's machine identity. Fall back to the PAT-derived identity otherwise.
-	machineID := sess.MachineID
-	machineToken := sess.MachineToken
-	machineType := sess.MachineType
-	machineCode := deriveMachineCode(pat)
-	if risk.Valid() {
-		machineToken = risk.MachineToken
-		machineType = risk.MachineType
-		machineCode = risk.MachineCode
-	}
-	machineOS := machineOSString()
-	machineHostname := machineHostnameString()
+	// Machine headers: real desktop identity => send all six; no native
+	// identity (typical on Linux/Docker, where runtime-info is unavailable)
+	// => send none. A full set of derived (non-native) values marks the caller
+	// as an unofficial client and the claimable daily-credit activity is
+	// filtered out of the list. UA / Cosy-ClientType / Cosy-Version must still
+	// be present or the endpoint returns an empty campaign list without any
+	// error.
+	sendMachineHeaders := risk.Valid()
 
 	doRequest := func(path, method string) (map[string]any, int, error) {
 		reqCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
@@ -170,15 +164,17 @@ func CheckinWithBearer(ctx context.Context, sess *SessionContext, pat string, re
 		req.Header.Set("User-Agent", "Qoder")
 		req.Header.Set("Cosy-ClientType", "10")
 		req.Header.Set("Cosy-Version", "0.3.4")
-		req.Header.Set("Cosy-MachineId", machineID)
-		req.Header.Set("Cosy-MachineToken", machineToken)
-		req.Header.Set("Cosy-MachineType", machineType)
-		req.Header.Set("Cosy-MachineCode", machineCode)
-		if machineOS != "" {
-			req.Header.Set("Cosy-MachineOS", machineOS)
-		}
-		if machineHostname != "" {
-			req.Header.Set("Cosy-MachineHostname", machineHostname)
+		if sendMachineHeaders {
+			req.Header.Set("Cosy-MachineId", sess.MachineID)
+			req.Header.Set("Cosy-MachineToken", risk.MachineToken)
+			req.Header.Set("Cosy-MachineType", risk.MachineType)
+			req.Header.Set("Cosy-MachineCode", risk.MachineCode)
+			if machineOS := machineOSString(); machineOS != "" {
+				req.Header.Set("Cosy-MachineOS", machineOS)
+			}
+			if host := machineHostnameString(); host != "" {
+				req.Header.Set("Cosy-MachineHostname", host)
+			}
 		}
 		req.Header.Set("Origin", origin)
 		req.Header.Set("Referer", base+"/growth-page/activity-iframe")
@@ -397,17 +393,6 @@ func truncateOneLine(s string) string {
 	return s
 }
 
-// deriveMachineCode is the fourth machine-identity header the OpenAPI campaigns
-// endpoint expects (Cosy-MachineCode), alongside Id/Token/Type. The CLI computes
-// it from real hardware; we derive a stable value from the PAT instead, mirroring
-// the other derived identities. A partial identity (missing any of the four)
-// causes the campaigns endpoint to silently drop the claimable credit campaign,
-// so this MUST be non-empty.
-func deriveMachineCode(pat string) string {
-	sum := md5.Sum([]byte("machinecode:" + pat))
-	return hex.EncodeToString(sum[:])
-}
-
 // machineOSString mirrors the desktop client's machineOS(): "<arch>_<platform>"
 // (e.g. "aarch64_darwin").
 func machineOSString() string {
 
@@ -20,6 +20,13 @@ func newCheckinTestSession() *SessionContext {
 	}
 }
 
+// machineHeaderNames is the full six-header set; without a genuine desktop
+// fingerprint none of them may be sent.
+var machineHeaderNames = []string{
+	"Cosy-MachineId", "Cosy-MachineToken", "Cosy-MachineType",
+	"Cosy-MachineCode", "Cosy-MachineOS", "Cosy-MachineHostname",
+}
+
 // withCheckinServer points the endpoint hook at srv for the test duration.
 func withCheckinServer(t *testing.T, srv *httptest.Server) {
 	t.Helper()
@@ -39,8 +46,12 @@ func TestCheckinSuccess(t *testing.T) {
 		if !strings.HasPrefix(r.Header.Get("Authorization"), "Bearer ") {
 			t.Errorf("missing bearer: %q", r.Header.Get("Authorization"))
 		}
-		if r.Header.Get("Cosy-MachineCode") == "" {
-			t.Error("missing Cosy-MachineCode")
+		// No genuine fingerprint (nil risk) => no machine headers at all: a
+		// full set of derived ones would filter the claimable activity.
+		for _, h := range machineHeaderNames {
+			if got := r.Header.Get(h); got != "" {
+				t.Errorf("%s = %q, want no machine headers without a desktop fingerprint", h, got)
+			}
 		}
 		switch {
 		case r.Method == http.MethodGet && strings.HasSuffix(r.URL.Path, "/campaigns"):
@@ -63,7 +74,7 @@ func TestCheckinSuccess(t *testing.T) {
 	defer srv.Close()
 	withCheckinServer(t, srv)
 
-	res, err := Checkin(context.Background(), newCheckinTestSession(), "pat-1", CN)
+	res, err := Checkin(context.Background(), newCheckinTestSession(), CN)
 	if err != nil {
 		t.Fatalf("Checkin: %v", err)
 	}
@@ -85,7 +96,7 @@ func TestCheckinAlready(t *testing.T) {
 	defer srv.Close()
 	withCheckinServer(t, srv)
 
-	res, err := Checkin(context.Background(), newCheckinTestSession(), "pat-1", CN)
+	res, err := Checkin(context.Background(), newCheckinTestSession(), CN)
 	if err != nil {
 		t.Fatalf("Checkin: %v", err)
 	}
@@ -101,7 +112,7 @@ func TestCheckinSkippedOn404(t *testing.T) {
 	defer srv.Close()
 	withCheckinServer(t, srv)
 
-	res, err := Checkin(context.Background(), newCheckinTestSession(), "pat-1", CN)
+	res, err := Checkin(context.Background(), newCheckinTestSession(), CN)
 	if err != nil {
 		t.Fatalf("Checkin: %v", err)
 	}
@@ -123,7 +134,7 @@ func TestCheckinNonCreditClaimIsSkipped(t *testing.T) {
 	defer srv.Close()
 	withCheckinServer(t, srv)
 
-	res, err := Checkin(context.Background(), newCheckinTestSession(), "pat-1", CN)
+	res, err := Checkin(context.Background(), newCheckinTestSession(), CN)
 	if err != nil {
 		t.Fatalf("Checkin: %v", err)
 	}
@@ -156,7 +167,7 @@ func TestCheckinClaimRecovered(t *testing.T) {
 	defer srv.Close()
 	withCheckinServer(t, srv)
 
-	res, err := Checkin(context.Background(), newCheckinTestSession(), "pat-1", CN)
+	res, err := Checkin(context.Background(), newCheckinTestSession(), CN)
 	if err != nil {
 		t.Fatalf("Checkin: %v", err)
 	}
@@ -166,10 +177,11 @@ func TestCheckinClaimRecovered(t *testing.T) {
 }
 
 // CheckinWithRisk must send the supplied genuine device fingerprint headers
-// instead of the PAT-derived ones.
+// (plus the session's MachineId) instead of any derived ones.
 func TestCheckinWithRiskSendsRiskHeaders(t *testing.T) {
-	var gotToken, gotType, gotCode string
+	var gotID, gotToken, gotType, gotCode string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotID = r.Header.Get("Cosy-MachineId")
 		gotToken = r.Header.Get("Cosy-MachineToken")
 		gotType = r.Header.Get("Cosy-MachineType")
 		gotCode = r.Header.Get("Cosy-MachineCode")
@@ -182,16 +194,18 @@ func TestCheckinWithRiskSendsRiskHeaders(t *testing.T) {
 	withCheckinServer(t, srv)
 
 	risk := &RiskIdentity{MachineToken: "real-token-88", MachineType: "real-type", MachineCode: "real-code"}
-	if _, err := CheckinWithRisk(context.Background(), newCheckinTestSession(), "pat-1", CN, risk); err != nil {
+	if _, err := CheckinWithRisk(context.Background(), newCheckinTestSession(), CN, risk); err != nil {
 		t.Fatalf("CheckinWithRisk: %v", err)
 	}
-	if gotToken != "real-token-88" || gotType != "real-type" || gotCode != "real-code" {
-		t.Errorf("risk headers not sent: token=%q type=%q code=%q", gotToken, gotType, gotCode)
+	if gotID != "mid" || gotToken != "real-token-88" || gotType != "real-type" || gotCode != "real-code" {
+		t.Errorf("risk headers not sent: id=%q token=%q type=%q code=%q", gotID, gotToken, gotType, gotCode)
 	}
 }
 
-// A nil risk identity falls back to the derived headers (non-empty token).
-func TestCheckinWithRiskNilFallsBack(t *testing.T) {
+// A nil risk identity sends no machine headers: the derived fallback was
+// removed because a full set of derived headers marks the caller as an
+// unofficial client and the claimable activity is filtered out.
+func TestCheckinWithRiskNilSendsNoMachineHeaders(t *testing.T) {
 	var gotToken string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		gotToken = r.Header.Get("Cosy-MachineToken")
@@ -203,11 +217,11 @@ func TestCheckinWithRiskNilFallsBack(t *testing.T) {
 	defer srv.Close()
 	withCheckinServer(t, srv)
 
-	if _, err := CheckinWithRisk(context.Background(), newCheckinTestSession(), "pat-1", CN, nil); err != nil {
+	if _, err := CheckinWithRisk(context.Background(), newCheckinTestSession(), CN, nil); err != nil {
 		t.Fatalf("CheckinWithRisk: %v", err)
 	}
-	if gotToken != "mtok" { // newCheckinTestSession's MachineToken
-		t.Errorf("expected fallback to session machine token, got %q", gotToken)
+	if gotToken != "" {
+		t.Errorf("expected no machine headers without a fingerprint, got Cosy-MachineToken=%q", gotToken)
 	}
 }
 
@@ -226,7 +240,7 @@ func TestCheckinWithBearerUsesSuppliedToken(t *testing.T) {
 	withCheckinServer(t, srv)
 
 	sess := newCheckinTestSession() // securityOauthToken = "sot-token"
-	if _, err := CheckinWithBearer(context.Background(), sess, "pat-1", CN, "openapi-bearer-xyz", nil); err != nil {
+	if _, err := CheckinWithBearer(context.Background(), sess, CN, "openapi-bearer-xyz", nil); err != nil {
 		t.Fatalf("CheckinWithBearer: %v", err)
 	}
 	if gotAuth != "Bearer openapi-bearer-xyz" {
 
@@ -11,8 +11,10 @@ package auth
 // JSON object with machineToken/machineType/machineCode.
 //
 // We therefore locate that helper in the installed app and run it. When it is
-// unavailable (headless server, different OS, etc.) we fall back to the derived
-// identity so the call still works — it just may not see the daily campaign.
+// unavailable (headless server, different OS, etc.) no machine headers are sent
+// at all: a full set of DERIVED (non-native) values marks the caller as an
+// unofficial client and the daily-credit campaign is silently dropped, while
+// sending none keeps the generic daily activity visible.
 
 import (
 	"context"
 
@@ -2134,6 +2134,43 @@ func TestCNQuotaUsesCOSYToken(t *testing.T) {
 	}
 }
 
+// TestCNBearerSplit 国内版的两个 bearer 必须分开解析：额度用 COSY 令牌（不触发
+// exchange），而签到 campaigns 端点只认 jt- OpenAPI 令牌，必须走 exchange。
+func TestCNBearerSplit(t *testing.T) {
+	var exchangeHits atomic.Int32
+	mux := http.NewServeMux()
+	mux.HandleFunc("/algo/api/v3/user/jobToken", func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintf(w, `{"name":"tester","id":"uid1","refreshToken":"rt","securityOauthToken":"sot","expireTime":%d}`, time.Now().Add(6*time.Hour).UnixMilli())
+	})
+	mux.HandleFunc("/api/v1/jobToken/exchange", func(w http.ResponseWriter, r *http.Request) {
+		exchangeHits.Add(1)
+		io.WriteString(w, `{"token":"jt-cn","refresh_token":"jrt","expires_at":"2099-01-01T00:00:00Z"}`)
+	})
+	srv := httptest.NewServer(mux)
+	t.Cleanup(srv.Close)
+	b := NewOpenAiBridge("pt-test", &auth.RegionConfig{Name: "test", AuthBase: srv.URL, ChatBase: srv.URL, OpenAPIBase: srv.URL})
+	if err := b.EnsureFreshSession(context.Background()); err != nil {
+		t.Fatalf("EnsureFreshSession: %v", err)
+	}
+
+	// Quota keeps using the COSY session token; no exchange is triggered.
+	qtok, err := b.quotaBearer(context.Background())
+	if err != nil {
+		t.Fatalf("quotaBearer: %v", err)
+	}
+	if qtok != "sot" || exchangeHits.Load() != 0 {
+		t.Errorf("CN quota bearer = %q (exchange hits %d), want the COSY token without exchange", qtok, exchangeHits.Load())
+	}
+	// The campaigns bearer must be the exchanged jt- token in both regions.
+	ctok, err := b.openAPIBearer(context.Background())
+	if err != nil {
+		t.Fatalf("openAPIBearer: %v", err)
+	}
+	if ctok != "jt-cn" || exchangeHits.Load() != 1 {
+		t.Errorf("campaigns bearer = %q (exchange hits %d), want the exchanged jt- token", ctok, exchangeHits.Load())
+	}
+}
+
 // TestChatHandlerStripsRegionPrefix 模型名区域前缀在进入 bridge 前被剥离，
 // 统计标签用裸模型名；解析出的 region 传给 resolver。
 func TestChatHandlerStripsRegionPrefix(t *testing.T) {
@@ -2225,8 +2262,8 @@ func TestInvalidateOpenAPIBearer(t *testing.T) {
 	}
 }
 
-// Checkin 取不到 bearer 时必须直接失败，而不是静默退回 COSY 令牌（global 只
-// 会拒绝那个令牌，退回只会掩盖真实原因并多打一次必然失败的请求）。
+// Checkin 取不到 bearer 时必须直接失败，而不是静默退回 COSY 令牌（两区域的
+// campaigns 端点都会拒绝那个令牌，退回只会掩盖真实原因并多打一次必然失败的请求）。
 func TestCheckinFailsWhenBearerUnavailable(t *testing.T) {
 	mux := http.NewServeMux()
 	mux.HandleFunc("/algo/api/v3/user/jobToken", func(w http.ResponseWriter, r *http.Request) {