fix(qdreader): treat risk-conf as verification block

tests/qdreader_plugin.test.mjs

@@ -306,6 +306,29 @@ test('manual sign also archives immediately after run', () => {
   assert.deepEqual(JSON.parse(r.store.qdreader_last_result_json), {});
 });
 
+test('business login-expired responses prompt cookie update', () => {
+  const store = {
+    qdreader_cookie_json: JSON.stringify({ '12345': cookie }),
+    qdreader_user_bind_json: JSON.stringify({ '12345': 'user-a' }),
+  };
+  const r = runPlugin({
+    content: '启点签到',
+    store,
+    userId: 'user-a',
+    requests: [
+      { body: { code: 0, data: { headers: { 'QD-Sign': 'sig' } } } },
+      { statusCode: 200, body: { Result: -100, Message: '用户未登录或登录状态已过期' } },
+    ],
+  });
+  assert.match(r.replies[0], /12\*\*\*45/);
+  assert.match(r.replies[0], /登录状态已失效，请更新 Cookie/);
+  assert.doesNotMatch(r.replies[0], /部分任务失败/);
+  const archive = JSON.parse(r.store.qdreader_archive_json);
+  const item = Object.values(archive)[0].items[0];
+  assert.equal(item.ok, false);
+  assert.match(item.msg, /登录状态已失效，请更新 Cookie/);
+});
+
 test('logs and archive dates use Beijing time even when runtime date is UTC', () => {
   const store = {
     qdreader_cookie_json: JSON.stringify({ '12345': cookie }),
@@ -1273,7 +1296,7 @@ test('adv and daily tasks report auth failure instead of empty list on HTTP 401'
 });
 
 
-test('daily task treats accepted risk-conf callbacks as submitted when status does not refresh immediately', () => {
+test('daily task does not report risk-conf callbacks as completed when status does not refresh', () => {
   const store = {
     qdreader_cookie_json: JSON.stringify({ '12345': cookie }),
     qdreader_user_bind_json: JSON.stringify({ '12345': 'user-a' }),
@@ -1311,8 +1334,8 @@ test('daily task treats accepted risk-conf callbacks as submitted when status do
       { statusCode: 200, body: unchanged },
     ],
   });
-  assert.match(r.replies[0], /每日任务✅\(已提交，状态待刷新\)/);
-  assert.doesNotMatch(r.replies[0], /部分任务失败/);
+  assert.match(r.replies[0], /每日任务❌\(触发风控验证，任务未确认完成\)/);
+  assert.match(r.replies[0], /部分任务失败/);
 });
 
 
@@ -1408,7 +1431,7 @@ test('adv task accepts discovered task list when upstream module name changes',
 });
 
 
-test('adv task treats accepted risk-conf callback as submitted when status does not refresh immediately', () => {
+test('adv task does not report risk-conf callback as completed when status does not refresh', () => {
   const store = {
     qdreader_cookie_json: JSON.stringify({ '12345': cookie }),
     qdreader_user_bind_json: JSON.stringify({ '12345': 'user-a' }),
@@ -1432,8 +1455,8 @@ test('adv task treats accepted risk-conf callback as submitted when status does
       { statusCode: 200, body: { code: 0, Data: { DailyBenefitModule: { TaskList: [unchanged] } } } },
     ],
   });
-  assert.match(r.replies[0], /激励任务✅\(已提交，状态待刷新\)/);
-  assert.doesNotMatch(r.replies[0], /部分任务失败/);
+  assert.match(r.replies[0], /激励任务❌\(触发风控验证，任务未确认完成\)/);
+  assert.match(r.replies[0], /部分任务失败/);
 });
 
 
@@ -1599,6 +1622,37 @@ test('message box uses upstream appappend/fromId/interaction reward chain instea
   assert.ok(r.calls.some(c => /argus\/api\/v1\/interaction\/rewardcallback/.test(c.url) && /orderId=abcdef123456/.test(c.body)));
 });
 
+test('message box does not count risk-conf reward callback as handled', () => {
+  const store = {
+    qdreader_cookie_json: JSON.stringify({ '12345': cookie }),
+    qdreader_user_bind_json: JSON.stringify({ '12345': 'user-a' }),
+    qdreader_task_pref_json: JSON.stringify({ '12345': { messageBox: true } }),
+  };
+  const now = fixedDateClass('2026-05-20T21:31:00.000+08:00');
+  const r = runPlugin({
+    content: '启点签到',
+    store,
+    userId: 'user-a',
+    globals: { Date: now },
+    requests: [
+      { body: { code: 0, data: { headers: { 'QD-Sign': 'sig' } } } },
+      { statusCode: 200, body: { code: 1, msg: '今日已签到' } },
+      { body: { code: 0, data: { headers: { 'QD-Sign': 'sig' } } } },
+      { statusCode: 200, body: { code: 1, msg: '无可领取礼包' } },
+      { body: { code: 0, data: { headers: { 'QD-Sign': 'sig' } } } },
+      { statusCode: 200, body: { code: 0, Data: { UserList: [{ RedPoint: 1, FromId: 'sender-1', Name: '大咖' }] } } },
+      { body: { code: 0, data: { headers: { 'QD-Sign': 'sig' } } } },
+      { statusCode: 200, body: { code: 0, Data: { MsgList: [{ CreateTime: '2026-05-20T21:20:00+08:00', ActionUrl: 'https://example.com/?orderId=abcdef123456' }] } } },
+      { body: { code: 0, data: { headers: { 'QD-Sign': 'sig' } } } },
+      { statusCode: 200, body: { code: 0, Data: { ChanceCount: 1, Status: 1, BookStatus: 3, RewardName: '经验' } } },
+      { body: { code: 0, data: { headers: { 'QD-Sign': 'sig' } } } },
+      { statusCode: 200, body: { Result: '0', Message: '', Data: { RiskConf: { BanId: '3', CaptchaURL: 'https://aq.qidian.com/mobile/phoneverify' } } } },
+    ],
+  });
+  assert.match(r.replies[0], /大咖荐书✅\(无待处理荐书\)/);
+  assert.doesNotMatch(r.replies[0], /成功处理 1 个荐书/);
+});
+
 test('stream uid message token matches upstream operator precedence and avoids parameter-error decimal token', () => {
   const streamQdheader = 'KG51bGwpfChudWxsKXwxMTc5fDI1NTZ8KG51bGwpfDE2LjEwfDB8aU9TL2lQaG9uZS8obnVsbCl8MHwobnVsbCl8KG51bGwpfDQ3NTcwMDk3NXwxNzc5MDA5MTM2MDAwfDB8KG51bGwpfHx8KG51bGwpfChudWxsKXww';
   const streamCookie = `QDHeader=${streamQdheader}; ywguid=120098575768; qdh=qdh; sessionyw=s; appId=12`;