@@ -11,14 +11,14 @@ Keep writing-code docs in these files only:
 | `docs/PLAN.md` | Current milestone checklist. |
 | `docs/PROVIDERS.md` | Future account-provider design. Not a current milestone. |
 
-Do not add new `TODO.md`, `NOTES.md`, or extra plan files. The only extra design doc is `docs/PROVIDERS.md` (WorkBuddy / future account types). User-facing install stays in `README.md` / `README_ZH.md`. Local protocol facts stay in ignored `docs/capture-notes.md`. Host ops stay gitignored in `docs/PRIVATE_DEPLOYMENT.md`.
+Do not add new `TODO.md`, `NOTES.md`, or extra plan files. The only extra design doc is `docs/PROVIDERS.md` (WorkBuddy / Qoder CN / future account types). User-facing install stays in `README.md` / `README_ZH.md`. Local protocol facts stay in ignored `docs/capture-notes.md`. Host ops stay gitignored in `docs/PRIVATE_DEPLOYMENT.md`.
 
 ## Do
 
 - Pull latest `main` and merge it into the current branch before starting any feature work (skip only when already on up-to-date `main`)
 - Keep architecture: auth / endpoint / executor / translate / api
 - Prefer direct HTTP/SSE to Qoder cloud APIs
-- Pin qodercli hooks in `worker/src/compat.mjs`; fail loudly on mismatch
+- Pin qodercli / qoderclicn hooks in `worker/src/compat.mjs`; fail loudly on mismatch. Qoder CN is `provider=qoder` + `region=cn`, not a new family
 - Console UI: React + Tailwind v4 + **HeroUI only** for components
 - Follow `docs/DESIGN.md` (taste v1 adapted for this console)
 - Keep iterating Qoder login, usage, and account routing. Borrow scheduling ideas from [sub2api](https://github.com/Wei-Shaw/sub2api), not its commercial gateway
@@ -32,4 +32,4 @@ Do not add new `TODO.md`, `NOTES.md`, or extra plan files. The only extra design
 - Leave console `/api/*` or worker `/admin/*` unauthenticated
 - Copy sub2api billing, Redis slots, multi-tenant API keys, or session-hash-for-profit
 - Add a new component library, purple AI chrome, centered generic login cards, or emoji in UI copy
-- Start Cursor / Anthropic / WorkBuddy until the current Qoder milestone in `docs/PLAN.md` is done
+- Start Cursor / Anthropic until the current Qoder milestone in `docs/PLAN.md` is done. Qoder CN is that milestone (`provider=qoder` + `region=cn`); do not spawn a full `qoderclicn` per request
@@ -7,10 +7,14 @@ Write each change in both `### English` and `### 中文` under `## Unreleased`.
 
 ### English
 
+- Add Qoder CN accounts as `provider=qoder` + `region=cn`, using pinned `@qodercn-ai/qoderclicn@1.1.27` and `.qoder-cn`
+- Keep Qoder failover inside the same region so Global 429s do not land on CN
 - Send CodeBuddy CLI 2.139.0 channel headers on WorkBuddy chat, with CN and Global Origin/host kept separate
 
 ### 中文
 
+- 支持添加 Qoder 国内版账号（`provider=qoder`，`region=cn`），使用 pinned `@qodercn-ai/qoderclicn@1.1.27` 和 `.qoder-cn`
+- Qoder 故障切换限制在同一 region，国际版 429 不会打到国内版
 - WorkBuddy 聊天补齐 CodeBuddy CLI 2.139.0 通道头，国内版 / 国际版 Origin 与 host 仍分开
 
 ## 0.2.10 - 2026-08-26
 
@@ -164,7 +164,7 @@ X-Qoder-Account: acc_...
 - Route requests across multiple Qoder accounts with failover
 - Keep Qoder login state available without starting a full CLI Agent per request
 
-Qoder is the only supported upstream at this time. CLI2API is a local gateway; it does not provide accounts, quotas, or an official Qoder API service.
+Supported account types are Qoder Global, Qoder CN, and WorkBuddy. CLI2API is a local gateway; it does not provide accounts, quotas, or an official API service.
 
 ## How it works
 
@@ -179,7 +179,7 @@ Each enabled account gets its own Node process and runtime directory so Qoder WA
 
 ## Features
 
-- Browser Device Flow OAuth, PAT, and `qoder-native-v1` credential import/export
+- Browser Device Flow OAuth, PAT, and `qoder-native-v1` credential import/export for Qoder Global and Qoder CN
 - OpenAI-compatible `GET /v1/models`
 - Streaming and non-streaming responses
 - Tool calls and `reasoning_content`
@@ -196,6 +196,8 @@ Each enabled account gets its own Node process and runtime directory so Qoder WA
 | `QODER_RUNTIME_DIR` | `/run/cli2api` | Ephemeral per-account Qoder runtime homes |
 | `QODER_MAX_INFLIGHT` | `4` | Maximum concurrent requests per account |
 | `QODER_WORKER_BASE_PORT` | `32100` | Internal worker port range |
+| `QODERCLI_JS` | image default | Pinned Qoder Global CLI bundle |
+| `QODERCNCLI_JS` | image default | Pinned Qoder CN CLI bundle |
 | `UPDATE_GITHUB_TOKEN` | empty | Optional GitHub token for release checks |
 | `UPDATE_AGENT_URL` | empty | Docker Desktop host updater URL, written by the installer |
 | `UPDATE_AGENT_TOKEN` | empty | Docker Desktop updater token, written by the installer |
 
@@ -164,7 +164,7 @@ X-Qoder-Account: acc_...
 - 需要在多个 Qoder 账号之间自动路由和故障切换
 - 想保留 Qoder 登录能力，同时避免每个请求启动完整 CLI Agent
 
-目前上游只支持 Qoder。CLI2API 是本地代理，不提供账号、额度或官方 API 服务。
+目前支持的账号类型是 Qoder 国际版、Qoder 国内版和 WorkBuddy。CLI2API 是本地代理，不提供账号、额度或官方 API 服务。
 
 ## 工作方式
 
@@ -179,7 +179,7 @@ OpenAI 客户端
 
 ## 支持的功能
 
-- 浏览器 Device Flow OAuth、PAT、`qoder-native-v1` 凭证导入/导出
+- Qoder 国际版 / 国内版的浏览器 Device Flow OAuth、PAT、`qoder-native-v1` 凭证导入/导出
 - OpenAI 兼容的 `GET /v1/models`
 - 流式和非流式响应
 - Tool calls 与 `reasoning_content`
@@ -196,6 +196,8 @@ OpenAI 客户端
 | `QODER_RUNTIME_DIR` | `/run/cli2api` | 临时的账号 Qoder 运行目录 |
 | `QODER_MAX_INFLIGHT` | `4` | 单账号最大并发请求数 |
 | `QODER_WORKER_BASE_PORT` | `32100` | 内部 worker 端口起点 |
+| `QODERCLI_JS` | 镜像默认值 | 固定的 Qoder 国际版 CLI bundle |
+| `QODERCNCLI_JS` | 镜像默认值 | 固定的 Qoder 国内版 CLI bundle |
 | `UPDATE_GITHUB_TOKEN` | 空 | 可选的 GitHub Release 查询 Token |
 | `UPDATE_AGENT_URL` | 空 | Docker Desktop 本机 updater 地址，由安装器写入 |
 | `UPDATE_AGENT_TOKEN` | 空 | Docker Desktop updater 令牌，由安装器写入 |
 
@@ -25,7 +25,7 @@ FROM node:20-bookworm-slim
 RUN apt-get update \
   && apt-get install -y --no-install-recommends ca-certificates curl tini \
   && rm -rf /var/lib/apt/lists/* \
-  && npm install -g @qoder-ai/qodercli@1.1.27
+	  && npm install -g @qoder-ai/qodercli@1.1.27 @qodercn-ai/qoderclicn@1.1.27
 WORKDIR /app
 COPY --from=build /out/qoder-api-proxy /app/qoder-api-proxy
 COPY --from=build /out/cli2api-updater /app/cli2api-updater
@@ -39,6 +39,7 @@ ENV HOST=0.0.0.0 \
     QODER_NODE_BINARY=/usr/local/bin/node \
     QODER_WORKER_DAEMON=/app/worker/daemon.mjs \
     QODERCLI_JS=/usr/local/lib/node_modules/@qoder-ai/qodercli/bundle/qodercli.js \
+    QODERCNCLI_JS=/usr/local/lib/node_modules/@qodercn-ai/qoderclicn/bundle/qoderclicn.js \
     PLAIN_TEMPLATE_PATH=/app/worker/last-plain.sample.json \
     QODER_WORKER_BASE_PORT=32100
 EXPOSE 3010
 
@@ -275,10 +275,15 @@ Client (OpenAI SDK / Codex / CherryStudio)
   -> qoder-api-proxy (:3010)            # one container
     -> Go control plane                  # auth, SQLite, routing, console
       -> Node daemon per account         # isolated HOME + hot QoderContext
-        -> https://api1.qoder.sh/.../agent_chat_generation?Encode=1
+        -> region=global: https://api1.qoder.sh/.../agent_chat_generation?Encode=1
+        -> region=cn:     https://gateway.qoder.com.cn/... (WASM-encoded URL)
 ```
 
-Worker pins `@qoder-ai/qodercli@1.1.27`. Needle mismatch exits loudly.
+Worker pins `@qoder-ai/qodercli@1.1.27` for `qoder/global`. Qoder CN
+(`provider=qoder`, `region=cn`) is the same daemon with a second pin,
+`@qodercn-ai/qoderclicn@1.1.27`, and HOME `.qoder-cn`. Needle mismatch
+exits loudly. See `docs/PROVIDERS.md` 「Qoder CN」; do not spawn a full
+CLI per request and do not invent a `qodercn` family.
 
 The request path that builds plaintext payloads, calls Qoder WASM encode, forwards
 HTTP/SSE, parses tools/reasoning, and resolves usage remains unchanged. The account
@@ -322,9 +327,10 @@ When qodercli changes, update the Qoder adapter and its version-aware compatibil
 tests first; do not duplicate the change in both public protocol handlers. Keep
 `/v1/chat/completions` stable while `/v1/messages` is added as a separate ingress.
 
-Additional account providers (WorkBuddy, later Cursor) are not part of this Qoder
-milestone. If a second upstream is added, it must plug into the account registry and
-executor as a provider adapter, not a second Node daemon. See `docs/PROVIDERS.md`.
+Qoder CN is still the Qoder family (`provider=qoder`, `region=cn`): same Node
+daemon, second pinned CLI. WorkBuddy is the in-process adapter. Later Cursor
+must plug into the account registry as its own provider, not a third copy of
+the Qoder worker. See `docs/PROVIDERS.md`.
 
 `/v1/messages` should be implemented as a native Anthropic boundary, not as
 Anthropic -> OpenAI -> Qoder string rewriting. Borrow sub2api's reversible tool
@@ -358,10 +364,10 @@ credential record is authoritative; the runtime files are derived working copies
 
 Supported account onboarding:
 
-- Qoder browser device-flow OAuth
-- Qoder PAT login
+- Qoder browser device-flow OAuth (Global and CN; CN host is qoder.com.cn)
+- Qoder PAT login (CN token UI: `https://qoder.com.cn/account/integrations`)
 - `qoder-native-v1` JSON import containing the encrypted `.auth/user` blob and its
-  matching `machine_id`
+  matching `machine_id` (Global lives under `.qoder`, CN under `.qoder-cn`)
 
 Arbitrary `access_token` / `refresh_token` JSON is not supported. Qoder credentials
 also depend on private user material, organization data, encryption keys, and device
 
@@ -1,6 +1,6 @@
 # CLI2API Plan
 
-last-updated: 2026-08-25
+last-updated: 2026-08-26
 
 Qoder-first OpenAI-compatible proxy. Cursor and other CLIs wait until the current Qoder milestone is done.
 
@@ -28,7 +28,7 @@ Do not:
 - Spawn a full `qodercli` agent per request
 - Public exposure without the generated API key
 - Commercial multi-user resale of one login
-- Cursor / other CLI providers in this milestone
+- Cursor / other non-Qoder CLI providers in this milestone
 - Commit host IPs, passwords, auth blobs, or `docs/PRIVATE_DEPLOYMENT.md`
 
 ## Status
@@ -40,6 +40,8 @@ Do not:
 | E | Open-source clone-and-run; `v0.1.0` at `eaf81ad` |
 | F | Error taxonomy, account failover, console sign-in, Accounts login |
 | G | Replaced by Phase H SQLite account control plane |
+| H–K | SQLite control plane, protocol notes, logs, quota display |
+| L | Qoder CN (`qoder` + `region=cn`) — planned, see below |
 
 Typical small-chat latency is ~1-2s after warmup, versus ~10s+ for spawn-CLI wrappers.
 
@@ -168,15 +170,78 @@ no scheduling, billing, or persistence changes.
 - [x] Account card renders quota progress bar + add-on line (danger at exceeded, warning at ≥80%)
 - [x] Worker compat, Go manager, and frontend coverage
 
+## Phase L — Qoder CN (China mainland)
+
+Goal: add Qoder China as `provider=qoder` + `region=cn`. Reuse the existing
+child-process worker and `qoder-native-v1` credentials. Pin a second CLI,
+`@qodercn-ai/qoderclicn@1.1.27`, instead of a new protocol adapter.
+
+Design facts and locked product decisions: `docs/PROVIDERS.md` section
+「Qoder CN（中国大陆版）」. Do not spawn a full `qoderclicn` per request.
+Do not invent a `qodercn` provider family. Do not upgrade the 1.1.27 pin.
+
+### L0 descriptor
+
+- [x] Register Qoder region `cn` on the existing Qoder descriptor
+- [x] Accept `POST /api/accounts` with `provider=qoder, region=cn`
+- [x] Keep historical empty region as `global`
+- [x] Flip `TestStoreRejectsUnknownProviderAndRegion` so `qoder+cn` is valid
+- [x] Do not merge L0 alone: an enabled CN account would still spawn the global CLI
+
+### L1 worker CLI filename
+
+- [x] Hook `qoderclicn.js` in `rewrite-loader.mjs` (same needles as 1.1.27 global; `includes("qodercli.js")` does **not** match `qoderclicn.js`)
+- [x] Resolve default bundle paths for both packages in `daemon.mjs`
+- [x] Choose `hotEndpoint` fallback from worker-only `QODER_SITE` or the loaded filename (`api1.qoder.sh` vs `gateway.qoder.com.cn`)
+- [x] Do not use `QODERCLI_SITE` to flip CN/Global; that env does not change compile-time `Xi`
+
+### L2 manager spawn
+
+- [x] Add `QODERCNCLI_JS` / `QoderCNCLIPath`; missing CN path fails spawn, never falls back to global CLI
+- [x] Keep `HOME={runtime}`. Pass CLI-readable dirs: `QODER_CONFIG_DIR={home}/.qoder` or `QODERCN_CONFIG_DIR={home}/.qoder-cn`. Do **not** rely on `QODER_HOME` — 1.1.27 CLI ignores it
+- [x] `materializeHome` / `SyncCredential` take region and read/write `.qoder` or `.qoder-cn`
+- [x] Export `qoder-native-v1` includes `provider` + `region`; import without region stays global for old bundles
+- [x] Unit test: CN account env points at `qoderclicn.js` + `.qoder-cn`; global still uses `qodercli.js` + `.qoder`
+
+### L3 same-region failover
+
+- [x] Add `RegionFilter` to `RouteQuery`; treat empty item region as `global`
+- [x] Thread region through `executor/chat.go` `pick` / `attemptsFor` / stream + non-stream loops, not only `pool.go`
+- [x] After the first pick, lock that account's region for the rest of the request
+- [x] Sticky-escape from a cooling pin stays in the same region
+- [x] Tests: Global A 429 → Global B, never CN; pin-CN cooling must not land on Global
+- [x] Merge before L4; mixed-pool UI without L3 will failover across sites
+
+### L4 console
+
+- [x] Add `qoder-cn` i18n keys and `AddAccountModal` option
+- [x] `accountProviderLabel` distinguishes Qoder CN from Qoder Global
+- [x] PAT helper text for CN points at `https://qoder.com.cn/account/integrations`
+
+### L5 image and config
+
+- [x] Install both `@qoder-ai/qodercli@1.1.27` and `@qodercn-ai/qoderclicn@1.1.27` in the image
+- [x] Export `QODERCLI_JS` and `QODERCNCLI_JS`
+- [x] README / CHANGELOG bilingual notes
+
+### L6 acceptance
+
+- [ ] Empty CN account → browser or PAT login → chat `只回复OK`
+- [ ] Import CN `qoder-native-v1` → daemon becomes hot
+- [ ] Mixed pool: pin stays on the matching CLI; Global 429 does not hit CN
+- [ ] Existing Qoder stream / tools / reasoning / usage / quota tests stay green
+- [ ] WorkBuddy path unchanged
+
 ## Later
 
-- WorkBuddy / CodeBuddy as a second account provider — design only, see `docs/PROVIDERS.md`
 - Cursor provider
 - Exact tokenizer matching if Qoder starts returning richer usage
 - In-process multi-account (still impossible for Qoder WASM)
 - Anthropic `/v1/messages`
 - sub2api-style session-hash sticky
 - Optional truncated prompt/completion capture behind an explicit switch
 
-Do not start WorkBuddy, Cursor, or other CLI providers until H7 is accepted. The
-provider-extension design lives in `docs/PROVIDERS.md`; do not add extra plan files.
+WorkBuddy J0–J4 are implemented; remaining WorkBuddy work is live-account
+acceptance, not a new design doc. Qoder CN design lives in `docs/PROVIDERS.md`.
+Do not add extra plan files. Do not start Cursor until Phase L is accepted or
+explicitly deferred.