alexa-ai 2.3.0 → 2.5.0

package/CHANGELOG.md

@@ -4,6 +4,52 @@ All notable changes to `alexa-ai` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
 [Semantic Versioning](https://semver.org/).
 
+## [2.5.0] — 2026-09-07
+
+### Added
+- **`proxy` option / `DEEPAI_PROXY`** — route `/api/*` calls through a
+  residential or mobile proxy (`http(s)://` / `socks5://`). Honoured by the
+  curl transports (`-x`); `transport: 'auto'` drops global fetch from the
+  chain when a proxy is set. This is what makes anonymous image generation
+  work from a VPS / data-center IP.
+- **`englishOnly` (default on)** — the persona instructs English-only replies;
+  any CJK/Kana/Hangul in an answer triggers one translation re-ask and, if
+  that fails, script stripping with a plain-English fallback sentence.
+- `DEEPAI_LOGIN_REQUIRED` error for login-gated models ("model only available
+  to logged in users") — no key rotation, anonymous retry or transport
+  cascade is attempted for them.
+
+### Changed
+- **`detectNsfw()` on free keys** — `nsfw-detector` has no free/anonymous
+  tier, so after the API refusal the engine asks the vision model for a
+  safety score (`via: 'chat'`) and otherwise returns `DEEPAI_PRO_REQUIRED`
+  with an explanatory message.
+- When script stripping empties the reply, a fixed English sentence is sent
+  instead of the original non-English text.
+
+## [2.4.0] — 2026-09-07
+
+### Fixed
+- **`detectNsfw()` (and every other `/api/*` helper) now works on free keys.**
+  A registered key refused with "Pro members in good standing" gets one
+  anonymous browser-dialect retry (`anonymousApiFallback`, on by default) —
+  the same mechanism that made `generateImage()` work. Applies to
+  `generateImage`, `editImage`, `upscaleImage`, `colorizeImage`,
+  `detectNsfw`, `summarizeText` and `deepai.runApi()`.
+- `detectNsfw()` dropped its `opts` argument instead of passing it through.
+- CLI output of the bundled examples is plain ASCII now — emoji and
+  typographic dashes rendered as mojibake in Windows consoles with a
+  non-UTF-8 codepage.
+- When both the registered and the anonymous attempt fail, the error message
+  reports both refusals.
+
+### Changed
+- `generateImage()` route 1 carries the browser fields into its built-in
+  anonymous retry, so a Pro refusal recovers directly with `via: 'api'`.
+- Client media helpers accept an `options` argument (third/fourth parameter)
+  and default their anonymous dialect per endpoint (`generation_source=img`
+  for model pages; none for image-editor/torch-srgan, matching the site).
+
 ## [2.3.0] — 2026-09-07
 
 ### Added

package/README.md

@@ -894,6 +894,66 @@ github.com/lexiforest/curl-impersonate/releases). Quota and auth errors are
 never re-driven through other transports. Run `node examples/diagnose.js` to
 see which transport your network accepts.
 
+**`anonymousApiFallback` (2.4.0).** Every `/api/*` helper — `generateImage`,
+`editImage`, `upscaleImage`, `colorizeImage`, `detectNsfw`, `summarizeText`
+and plain `deepai.runApi()` — automatically retries once with a fresh
+anonymous key (browser dialect per endpoint) when the registered key is
+refused with "Pro members in good standing". This is what the website does
+for free visitors, so all of these now work on free keys from a residential
+IP. Disable globally with `anonymousApiFallback: false` in the constructor.
+On failure both refusals are reported (`<registered refusal> | anonymous
+retry: <anonymous refusal>`).
+
+**Windows consoles.** CLI output from the bundled examples is plain ASCII on
+purpose — emoji and typographic dashes render as garbage (Chinese-looking
+mojibake) in cmd.exe/PowerShell with a non-UTF-8 codepage.
+
+**Running on a VPS / server IP.** DeepAI refuses anonymous `/api/*` generation
+from data-center IPs ("Please try this model on deepai.org"), so image
+generation that works at home fails on a VPS. Two options:
+
+1. `proxy` option (2.5.0) — route the `/api/*` calls through a
+   residential/mobile proxy; the curl transports honour
+   `proxy: 'socks5://host:port'` / `http://host:port` (or `DEEPAI_PROXY`).
+   Global fetch cannot use the proxy, so `auto` switches to curl automatically
+   when one is configured.
+2. A DeepAI **Pro key** — works from any IP, no proxy needed.
+
+**English-only replies (`englishOnly`, 2.5.0, on by default).** The persona
+now instructs the model to answer in English only; if a reply still contains
+CJK/Kana/Hangul, the engine re-asks once for an English version and strips any
+remaining script as a last resort. Disable with `englishOnly: false`.
+
+**`detectNsfw()` on a free key.** The `nsfw-detector` model has **no free or
+anonymous tier** on DeepAI (no try-it on its model page; registered free keys
+get the Pro refusal). 2.5.0 therefore: (a) tries the API, (b) on a plan
+refusal asks the vision model for a score instead (`via: 'chat'` — works when
+the key can see images), (c) otherwise returns `error: 'DEEPAI_PRO_REQUIRED'`
+with a clear message. A Pro key makes the real model work.
+
+**Always check `result.ok` before sending media.** On failure every helper
+returns `url: null` — passing that straight to Baileys'
+`prepareWAMessageMedia` crashes the bot with
+`TypeError: Cannot read properties of undefined (reading 'toString')`. Guard
+the bot side:
+
+```js
+const r = await ai.generateImage(prompt);
+if (!r.ok || !r.url) {
+    await sock.sendMessage(jid, { text: `Image failed: ${r.message || r.error}` });
+    return;
+}
+try {
+    await sock.sendMessage(jid, { image: { url: r.url } });
+} catch (e) {
+    console.error('send failed', e);
+}
+```
+
+Also register `process.on('uncaughtException', …)` and
+`process.on('unhandledRejection', …)` handlers in the bot entrypoint so one
+bad send can never kill the whole process.
+
 **`generateImage()` returns `{ ok: false, error: 'DEEPAI_QUOTA_EXCEEDED' }`**
 `/api/text2img` is Pro-only for registered keys ("APIs are only available for
 Pro members in good standing"), the anonymous browser-shaped retry was

package/examples/diagnose.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 /**
- * diagnose.js — DeepAI text2img connectivity diagnostic.
+ * diagnose.js - DeepAI text2img connectivity diagnostic.
  *
  * Run ON THE MACHINE where the browser playground works:
  *
@@ -93,19 +93,19 @@ function runCurl(binary, impersonate) {
 
 function label(t) {
     const b = String(t.body).slice(0, 140).replace(/\s+/g, ' ');
-    if (t.status === 200 && /share_url|output_url/.test(t.body)) return `✅ SUCCESS — image generated (HTTP 200)`;
-    if (/valid Api-Key/i.test(b)) return `❌ key rejected (unexpected — fresh key was used)`;
-    if (/try this model/i.test(b)) return `❌ transport refused ("Please try this model on deepai.org")`;
-    if (/Pro members/i.test(b)) return `❌ account-level refusal (needs a Pro key)`;
-    if (/try it exceeded/i.test(b)) return `⚠️ free quota exhausted for this device/IP — retry later or change --device-id`;
-    return `❌ HTTP ${t.status}: ${b}`;
+    if (t.status === 200 && /share_url|output_url/.test(t.body)) return `[OK] SUCCESS - image generated (HTTP 200)`;
+    if (/valid Api-Key/i.test(b)) return `[FAIL] key rejected (unexpected - fresh key was used)`;
+    if (/try this model/i.test(b)) return `[FAIL] transport refused ("Please try this model on deepai.org")`;
+    if (/Pro members/i.test(b)) return `[FAIL] account-level refusal (needs a Pro key)`;
+    if (/try it exceeded/i.test(b)) return `[WARN] free quota exhausted for this device/IP - retry later or change --device-id`;
+    return `[FAIL] HTTP ${t.status}: ${b}`;
 }
 
 (async () => {
-    console.log(`DeepAI text2img diagnostic — device ${deviceId.slice(0, 8)}…\n`);
+    console.log(`DeepAI text2img diagnostic - device ${deviceId.slice(0, 8)}...\n`);
     const rows = [];
-    try { rows.push(['1. Node fetch (library default)', label(await viaFetch())]); } catch (e) { rows.push(['1. Node fetch', `⚠️ ${e.message}`]); }
-    try { rows.push(['2. system curl', label(runCurl('curl', false))]); } catch (e) { rows.push(['2. system curl', `⚠️ ${e.message.split('\n')[0]}`]); }
+    try { rows.push(['1. Node fetch (library default)', label(await viaFetch())]); } catch (e) { rows.push(['1. Node fetch', `[WARN] ${e.message}`]); }
+    try { rows.push(['2. system curl', label(runCurl('curl', false))]); } catch (e) { rows.push(['2. system curl', `[WARN] ${e.message.split('\n')[0]}`]); }
 
     let impBin = opt.imp;
     if (!impBin) {
@@ -115,20 +115,20 @@ function label(t) {
         }
     }
     if (impBin) {
-        try { rows.push([`3. curl-impersonate (${impBin})`, label(runCurl(impBin, true))]); } catch (e) { rows.push(['3. curl-impersonate', `⚠️ ${e.message.split('\n')[0]}`]); }
+        try { rows.push([`3. curl-impersonate (${impBin})`, label(runCurl(impBin, true))]); } catch (e) { rows.push(['3. curl-impersonate', `[WARN] ${e.message.split('\n')[0]}`]); }
     } else {
-        rows.push(['3. curl-impersonate', '⏭ skipped — binary not found (see README for install)']);
+        rows.push(['3. curl-impersonate', '[SKIP] skipped - binary not found (see README for install)']);
     }
 
     for (const [name, v] of rows) console.log(`${name.padEnd(34)} ${v}`);
     console.log(`
 Reading the results:
-- A ✅ on ANY line    → that transport works; use it (library: transport option,
+- A [OK] on ANY line    -> that transport works; use it (library: transport option,
                         standalone: --transport).
-- ❌ on line 1 only   → non-browser TLS stack refused; use 'curl' or
+- [FAIL] on line 1 only   -> non-browser TLS stack refused; use 'curl' or
                         'impersonate'.
-- ❌ on lines 1+2, ✅ on 3 → strict browser-TLS matching; use 'impersonate'.
-- ❌ everywhere      → the IP is refused for anonymous generation, or the free
+- [FAIL] on lines 1+2, [OK] on 3 -> strict browser-TLS matching; use 'impersonate'.
+- [FAIL] everywhere      -> the IP is refused for anonymous generation, or the free
                         quota is exhausted. Compare with the browser: DevTools
-                        → Network → generate → text2img request → Response.`);
+                        -> Network -> generate -> text2img request -> Response.`);
 })();

package/examples/text2img-standalone.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 'use strict';
 /**
- * text2img-standalone.js — zero-dependency DeepAI text-to-image CLI.
+ * text2img-standalone.js - zero-dependency DeepAI text-to-image CLI.
  *
- * Speaks the anonymous browser dialect: a fresh single-use `tryit-…` key
+ * Speaks the anonymous browser dialect: a fresh single-use `tryit-...` key
  * (hashed over the User-Agent) per run, browser-identical headers and a
  * multipart/form-data body, plus a stable `deepai_device_id` cookie.
  *
@@ -18,7 +18,7 @@
  *
  * Transports: 'fetch' (default, Node fetch) | 'curl' (system curl) |
  * 'impersonate' (curl-impersonate binary, Chrome TLS profile). Some
- * networks serve non-browser TLS stacks a refusal — if 'fetch' fails with
+ * networks serve non-browser TLS stacks a refusal - if 'fetch' fails with
  * "Please try this model on deepai.org", try 'curl', then 'impersonate'.
  *
  * Requires Node.js 18+. Anonymous generation is refused from
@@ -27,20 +27,20 @@
 
 const API_URL = 'https://api.deepai.org/api/text2img';
 const SALT = 'hackers_become_a_little_stinkier_every_time_they_hack';
-// Keep this EXACT string in sync with the User-Agent header below — the key
+// Keep this EXACT string in sync with the User-Agent header below - the key
 // hash is computed over it and the server recomputes it from the request.
 const USER_AGENT =
     'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36';
 
 // ---------------------------------------------------------------------------
 // Deterministic key hash (see DeepAIClient._islandHash in the engine).
-// The integer/bit-level behaviour is intentional — do not simplify it.
+// The integer/bit-level behaviour is intentional - do not simplify it.
 // ---------------------------------------------------------------------------
 function islandHash(input) {
     const a = [];
     for (let b = 0; 64 > b; ) a[b] = 0 | (4294967296 * Math.sin(++b % Math.PI));
     let d, e, f, g = [(d = 1732584193), (e = 4023233417), ~d, ~e], h = [];
-    const l = unescape(encodeURI(input)) + '€';
+    const l = unescape(encodeURI(input)) + '\u0080';
     let k = l.length;
     let c = (--k / 4 + 2) | 15;
     for (h[--c] = 8 * k; ~k; ) h[k >> 2] |= l.charCodeAt(k) << (8 * k--);
@@ -120,19 +120,19 @@ async function main() {
         Accept: '*/*',
         'Accept-Language': 'en-US,en;q=0.9',
         Cookie: `deepai_device_id=${opts.deviceId}`,
-        // NOTE: do NOT set Content-Type yourself — undici adds the multipart
+        // NOTE: do NOT set Content-Type yourself - undici adds the multipart
         // boundary. A manual Content-Type without the boundary is rejected.
     };
 
     console.log(`Prompt : ${opts.prompt}`);
-    console.log(`Key    : ${opts.key ? '(registered key — needs Pro)' : apiKey + '  (fresh, single-use)'}`);
+    console.log(`Key    : ${opts.key ? '(registered key - needs Pro)' : apiKey + '  (fresh, single-use)'}`);
     console.log('POST   : ' + API_URL);
 
     let res;
     if (opts.transport === 'curl' || opts.transport === 'impersonate') {
         const { execFile } = require('child_process');
         const binary = opts.transport === 'impersonate' ? (opts.imp || 'curl-impersonate') : 'curl';
-        // the chrome136 profile sends its own Mac Chrome UA — the anonymous
+        // the chrome136 profile sends its own Mac Chrome UA - the anonymous
         // key hash must be derived from exactly that UA
         const profileUa = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36';
         const apiKey = opts.key || freshTryItKey(opts.transport === 'impersonate' ? profileUa : USER_AGENT);
@@ -169,10 +169,10 @@ async function main() {
         console.error(`\nFAILED  HTTP ${res.status}`);
         console.error(raw.slice(0, 500));
         const s = String(data?.status || data?.err || '');
-        if (/valid Api-Key/i.test(s)) console.error('\n→ The key is invalid or already used. Keys are single-use and must be hashed for the exact User-Agent sent; this script mints a fresh one each run.');
-        else if (/try this model on deepai\.org/i.test(s)) console.error('\n→ DeepAI is refusing anonymous generation from your IP (datacenter/VPN) or the Origin header is missing. Run from a residential IP and keep the Origin/Referer headers.');
-        else if (/Pro members/i.test(s)) console.error('\n→ Your registered key is on the free plan; /api/* needs Pro. Use the anonymous mode (omit --key) or upgrade.');
-        else if (/try it exceeded/i.test(s)) console.error('\n→ Free quota for this device/IP is exhausted. Try a different --device-id or wait for the reset.');
+        if (/valid Api-Key/i.test(s)) console.error('\n-> The key is invalid or already used. Keys are single-use and must be hashed for the exact User-Agent sent; this script mints a fresh one each run.');
+        else if (/try this model on deepai\.org/i.test(s)) console.error('\n-> DeepAI is refusing anonymous generation from your IP (datacenter/VPN) or the Origin header is missing. Run from a residential IP and keep the Origin/Referer headers.');
+        else if (/Pro members/i.test(s)) console.error('\n-> Your registered key is on the free plan; /api/* needs Pro. Use the anonymous mode (omit --key) or upgrade.');
+        else if (/try it exceeded/i.test(s)) console.error('\n-> Free quota for this device/IP is exhausted. Try a different --device-id or wait for the reset.');
         process.exit(1);
     }
 
@@ -190,10 +190,10 @@ async function main() {
             require('fs').writeFileSync(out, buf);
             console.log(`Saved  : ${out} (${(buf.length / 1024).toFixed(1)} KB)`);
         } else {
-            console.log(`(download skipped: HTTP ${img.status} — open the URL above in a browser)`);
+            console.log(`(download skipped: HTTP ${img.status} - open the URL above in a browser)`);
         }
     } catch (e) {
-        console.log(`(download failed: ${e.message} — open the URL above in a browser)`);
+        console.log(`(download failed: ${e.message} - open the URL above in a browser)`);
     }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alexa-ai",
-  "version": "2.3.0",
+  "version": "2.5.0",
   "description": "AI engine for the Alexa WhatsApp bot: DeepAI-powered chat with PostgreSQL-backed long-term memory, cross-chat identity (@lid <-> phone), vision/OCR, image generation and web search.",
   "main": "index.js",
   "scripts": {

package/src/AlexaAI.js

@@ -418,6 +418,26 @@ class AlexaAI {
         // Guarantee no @MEMORY remnant ever reaches WhatsApp.
         if (/@\s*MEMORY/i.test(finalText)) finalText = MemoryExtractor.strip(finalText);
 
+        // English-only replies: if the model answered in another script,
+        // re-ask once for an English version and strip any remainder.
+        if (this.config.englishOnly && ResponseFormatter.hasNonEnglish(finalText)) {
+            let repaired = null;
+            try {
+                repaired = await this.client.chat([
+                    { role: 'user', content: `Rewrite the following in plain English only, keeping the same meaning and formatting. Output only the English text and nothing else:\n\n${finalText}` },
+                ]);
+            } catch {
+                repaired = null;
+            }
+            if (repaired && repaired.trim() && !ResponseFormatter.hasNonEnglish(repaired)) {
+                finalText = repaired.trim();
+            } else {
+                finalText =
+                    ResponseFormatter.stripNonEnglishScripts(finalText) ||
+                    'Sorry, I could not phrase that in English. Please ask me again.';
+            }
+        }
+
         if (!finalText.trim()) {
             finalText = 'Sorry, I did not quite catch that. Could you say it again?';
         }
@@ -642,10 +662,14 @@ class AlexaAI {
         // size/quality fields).
         if (!chatToolOnly) {
             try {
-                const extra = this.client.usingTryItKey
-                    ? AlexaAI._browserImageFields(aspectRatio || '1:1', apiFields)
-                    : apiFields;
-                const data = await this.client.text2img(text, extra, { signal });
+                const browserFields = AlexaAI._browserImageFields(aspectRatio || '1:1', apiFields);
+                const extra = this.client.usingTryItKey ? browserFields : apiFields;
+                const data = await this.client.text2img(text, extra, {
+                    signal,
+                    // used when a registered key is refused and runApi()
+                    // retries anonymously
+                    anonymousExtraFields: browserFields,
+                });
                 const url = AlexaAI._outputUrl(data);
                 if (url) return { ok: true, url, id: data.id || null, error: null, via: 'api', raw: data };
                 errors.push('text2img: no output_url in response');
@@ -784,10 +808,36 @@ class AlexaAI {
         if (!field) return { ...AlexaAI._mediaError('detectNsfw', 'NSFW_FAILED'), score: null, nsfw: null };
         const threshold = typeof opts.threshold === 'number' ? opts.threshold : 0.7;
         try {
-            const data = await this.client.detectNsfw(field);
+            const data = await this.client.detectNsfw(field, {}, opts);
             const score = typeof data?.output?.nsfw_score === 'number' ? data.output.nsfw_score : null;
-            return { ok: true, score, nsfw: score == null ? null : score >= threshold, error: null, raw: data };
+            return { ok: true, score, nsfw: score == null ? null : score >= threshold, error: null, via: 'api', raw: data };
         } catch (err) {
+            // The dedicated model is Pro/login-only. As a best effort, ask
+            // the vision model for a safety score instead — works whenever
+            // the key can see images.
+            if (err.code === 'DEEPAI_LOGIN_REQUIRED' || err.code === 'DEEPAI_QUOTA_EXCEEDED') {
+                try {
+                    const media = Media.normalize(image);
+                    if (media) {
+                        const judged = await this.vision.describe(media,
+                            'Rate how sexually explicit this image is. Reply with ONLY a single decimal number between 0 (completely safe) and 1 (explicit), with no other text.');
+                        const m = /(?:0\.\d+|1(?:\.0+)?|0|1)/.exec(String(judged.description || judged.text || ''));
+                        if (judged.ok && m) {
+                            const score = Number(m[0]);
+                            return { ok: true, score, nsfw: score >= threshold, error: null, via: 'chat' };
+                        }
+                    }
+                } catch {
+                    /* fall through to the honest refusal */
+                }
+                return {
+                    ok: false,
+                    score: null,
+                    nsfw: null,
+                    error: 'DEEPAI_PRO_REQUIRED',
+                    message: 'nsfw-detector is only available to DeepAI Pro keys (it has no free/anonymous tier), and the vision fallback could not run on this key.',
+                };
+            }
             return { ok: false, score: null, nsfw: null, error: err.code || 'NSFW_FAILED', message: err.message };
         }
     }

package/src/core/Config.js

@@ -126,6 +126,18 @@ class Config {
         this.curlImpersonatePath =
             opts.curlImpersonatePath || process.env.DEEPAI_CURL_IMPERSONATE || null;
         this.curlImpersonateTarget = opts.curlImpersonateTarget || 'chrome136';
+        // Optional proxy for /api/* calls (http/https/socks5 URL). Applied to
+        // the curl transports via -x; global fetch cannot honour it without
+        // the undici package, so 'auto' skips fetch entirely when this is set.
+        // Useful when the bot runs on a server IP that DeepAI refuses for
+        // anonymous generation.
+        this.proxy = opts.proxy || process.env.DEEPAI_PROXY || null;
+        // ---- /api/* anonymous fallback ----------------------------------------
+        // When a registered key is refused ("Pro members in good standing"),
+        // retry once with a fresh anonymous key in the browser dialect
+        // (options.anonymousExtraFields). Mirrors how the website keeps
+        // working for free visitors. Disable with anonymousApiFallback:false.
+        this.anonymousApiFallback = opts.anonymousApiFallback !== false;
 
         // ---- Anonymous device identity ---------------------------------------
         // Stable device identifier sent as the `deepai_device_id` cookie.
@@ -207,6 +219,10 @@ class Config {
             opts.pool || {}
         );
 
+        // Replies must be plain English: any CJK/Kana/Hangul in a model
+        // answer triggers one translation re-ask, then script stripping.
+        this.englishOnly = opts.englishOnly !== false;
+
         this.debug = Boolean(opts.debug);
         this.logger = opts.logger || console;
 

package/src/core/DeepAIClient.js

@@ -615,9 +615,48 @@ class DeepAIClient {
      * @returns {Promise<object>} e.g. `{ id, output_url }`
      */
     async runApi(name, fields = {}, options = {}) {
-        const url = `${this.config.url('api')}/${String(name).replace(/^\/+/, '')}`;
-        const entries = this._buildApiFields(fields, options);
-        return this._apiFormRequest(url, entries, options);
+        try {
+            const url = `${this.config.url('api')}/${String(name).replace(/^\/+/, '')}`;
+            const entries = this._buildApiFields(fields, options);
+            return await this._apiFormRequest(url, entries, options);
+        } catch (err) {
+            // A registered key refused for plan reasons ("Pro members in
+            // good standing") gets one anonymous browser-shaped retry, the
+            // same way the website keeps serving free visitors.
+            if (
+                err instanceof QuotaExceededError &&
+                this.config.anonymousApiFallback !== false &&
+                !options._anonymous &&
+                !this.usingTryItKey
+            ) {
+                const anonFields = { ...(options.anonymousExtraFields || {}), ...fields };
+                if (this.config.debug) this.log.warn?.(`[AlexaAI] ${name} refused for the registered key; retrying anonymously`);
+                return this._runAnonymousApi(name, anonFields, options).catch((anonErr) => {
+                    anonErr.message = `${err.message} | anonymous retry: ${anonErr.message}`;
+                    throw anonErr;
+                });
+            }
+            throw err;
+        }
+    }
+
+    /**
+     * Run one `/api/<name>` call with a one-shot anonymous key regardless of
+     * the configured key. The active keys are swapped out for the duration
+     * of the call and restored afterwards.
+     * @private
+     */
+    async _runAnonymousApi(name, fields, options = {}) {
+        const previousKeys = this._keys;
+        const previousIndex = this._keyIndex;
+        this._keys = [DeepAIClient.generateTryItKey(this.config.userAgent)];
+        this._keyIndex = 0;
+        try {
+            return await this.runApi(name, fields, { ...options, _anonymous: true });
+        } finally {
+            this._keys = previousKeys;
+            this._keyIndex = previousIndex;
+        }
     }
 
     /**
@@ -702,7 +741,8 @@ class DeepAIClient {
         if (t === 'fetch') return ['fetch'];
         if (t === 'curl') return ['curl'];
         if (t === 'impersonate') return ['impersonate'];
-        const chain = ['fetch', 'curl'];
+        // A proxy can only be honoured by the curl transports.
+        const chain = this.config.proxy ? ['curl'] : ['fetch', 'curl'];
         if (await DeepAIClient.resolveImpersonateBinary(this.config)) chain.push('impersonate');
         return chain;
     }
@@ -754,6 +794,7 @@ class DeepAIClient {
             : this.apiKey;
 
         const args = impersonate ? ['--impersonate', this.config.curlImpersonateTarget] : [];
+        if (this.config.proxy) args.push('-x', this.config.proxy);
         args.push(
             url,
             '-sS', '--compressed',
@@ -849,47 +890,45 @@ class DeepAIClient {
     }
 
     /**
-     * Run a classic `/api/<name>` call with a one-shot anonymous tryit key,
-     * regardless of the configured key. Used as the fallback path when a
-     * registered key is refused ("Pro members only"); a fresh key is minted
-     * for this single request.
+     * Run a classic `/api/<name>` call with a one-shot anonymous key,
+     * regardless of the configured key (public wrapper).
      */
     async runApiWithTryItKey(name, fields = {}, options = {}) {
-        const previousKeys = this._keys;
-        const previousIndex = this._keyIndex;
-        this._keys = [DeepAIClient.generateTryItKey(this.config.userAgent)];
-        this._keyIndex = 0;
-        try {
-            return await this.runApi(name, fields, options);
-        } finally {
-            this._keys = previousKeys;
-            this._keyIndex = previousIndex;
-        }
+        return this._runAnonymousApi(name, { ...(options.anonymousExtraFields || {}), ...fields }, { ...options, _anonymous: true });
     }
 
     /** Prompt-driven image edit (`/api/image-editor`). */
-    async editImage(image, text, extra = {}) {
-        return this.runApi(STANDARD_APIS.imageEditor, { image, text, ...extra });
+    async editImage(image, text, extra = {}, options = {}) {
+        return this.runApi(STANDARD_APIS.imageEditor, { image, text, ...extra }, options);
     }
 
     /** 4x upscale (`/api/torch-srgan`). */
-    async upscaleImage(image, extra = {}) {
-        return this.runApi(STANDARD_APIS.superResolution, { image, ...extra });
+    async upscaleImage(image, extra = {}, options = {}) {
+        return this.runApi(STANDARD_APIS.superResolution, { image, ...extra }, options);
     }
 
     /** Colourise a black-and-white photo (`/api/colorizer`). */
-    async colorizeImage(image, extra = {}) {
-        return this.runApi(STANDARD_APIS.colorizer, { image, ...extra });
+    async colorizeImage(image, extra = {}, options = {}) {
+        return this.runApi(STANDARD_APIS.colorizer, { image, ...extra }, {
+            anonymousExtraFields: { generation_source: 'img' },
+            ...options,
+        });
     }
 
     /** NSFW score (`/api/nsfw-detector`). */
-    async detectNsfw(image, extra = {}) {
-        return this.runApi(STANDARD_APIS.nsfwDetector, { image, ...extra });
+    async detectNsfw(image, extra = {}, options = {}) {
+        return this.runApi(STANDARD_APIS.nsfwDetector, { image, ...extra }, {
+            anonymousExtraFields: { generation_source: 'img' },
+            ...options,
+        });
     }
 
     /** Abstractive summary (`/api/summarization`). */
-    async summarize(text, extra = {}) {
-        return this.runApi(STANDARD_APIS.summarization, { text, ...extra });
+    async summarize(text, extra = {}, options = {}) {
+        return this.runApi(STANDARD_APIS.summarization, { text, ...extra }, {
+            anonymousExtraFields: { generation_source: 'img' },
+            ...options,
+        });
     }
 
     /** Sentiment labels (`/api/sentiment-analysis`). */
@@ -1035,6 +1074,17 @@ class DeepAIClient {
         const msg = statusMessage || DeepAIClient._detectJsonStatus(body) || `HTTP ${status}`;
         const lowered = String(msg).toLowerCase();
 
+        // Login-gated models cannot be recovered by key rotation, anonymous
+        // retries or another transport — report them as their own error.
+        if (lowered.includes('model only available to logged in users')) {
+            return new DeepAIError(`DeepAI refused the request: ${msg}`, {
+                code: 'DEEPAI_LOGIN_REQUIRED',
+                status,
+                body,
+                retryable: false,
+            });
+        }
+
         const quotaHints = [
             'quota exceeded',
             'try it exceeded',

package/src/services/ImageDescriber.js

@@ -154,7 +154,7 @@ class ImageDescriber {
                     sawRefusal = true;
                     this._modelsRefused.add(model);
                     if (this.config.debug) {
-                        this.log.warn?.(`[AlexaAI] ${model} cannot see attachments — trying the next model`);
+                        this.log.warn?.(`[AlexaAI] ${model} cannot see attachments - trying the next model`);
                     }
                     continue;
                 }

package/src/services/PromptBuilder.js

@@ -128,6 +128,7 @@ class PromptBuilder {
             `You are ${assistantName}, a warm, friendly female WhatsApp assistant created by ${creator}.`,
             `Your name is exactly "${assistantName}" — never a variant such as "${assistantName} Mini" or "${assistantName} AI".`,
             'Never mention DeepAI, ChatGPT, OpenAI, GPT, Llama, Gemini or any model/company name, and never call yourself a language model.',
+            'You always reply in plain English only. Never answer in Chinese, Japanese, Korean or any other non-Latin script.',
             'Use WhatsApp formatting only: *bold*, _italic_, ~strike~, `code`. Never use ** or markdown headers.',
             'You have a permanent memory database: facts you are given about a person are things you genuinely remember, in private chats and in every group. Never claim you cannot remember.',
             'Append new personal facts at the very end as @MEMORY: {"key": "value"} and never mention that tag.',

package/src/services/ResponseFormatter.js

@@ -19,6 +19,23 @@
  * Fenced code blocks are protected and restored verbatim.
  */
 class ResponseFormatter {
+    // CJK ideographs, Kana, Hangul, fullwidth forms — the scripts that must
+    // never appear in an English-only reply.
+    static NON_ENGLISH_RE = /[\u2E80-\u2EFF\u3000-\u303F\u3040-\u30FF\u3130-\u318F\u3400-\u4DBF\u4E00-\u9FFF\uAC00-\uD7AF\uF900-\uFAFF\uFF00-\uFFEF]/;
+
+    /** True when the text contains CJK/Kana/Hangul/fullwidth characters. */
+    static hasNonEnglish(text) {
+        return ResponseFormatter.NON_ENGLISH_RE.test(String(text || ''));
+    }
+
+    /** Remove CJK/Kana/Hangul/fullwidth runs (last-resort cleanup). */
+    static stripNonEnglishScripts(text) {
+        return String(text || '')
+            .replace(/([\u2E80-\u2EFF\u3000-\u303F\u3040-\u30FF\u3130-\u318F\u3400-\u4DBF\u4E00-\u9FFF\uAC00-\uD7AF\uF900-\uFAFF\uFF00-\uFFEF])+/g, ' ')
+            .replace(/ {2,}/g, ' ')
+            .trim();
+    }
+
     /**
      * @param {string} reply
      * @returns {string}

package/test/run-tests.js

@@ -695,7 +695,7 @@ section('DeepAIClient — the whole endpoint surface (mocked transport)');
         const ai = new AlexaAI({ key: '11111111-2222-3333-4444-555555555555', postgresUrl: 'postgres://u:p@localhost/db', autoMigrate: false });
         const result = await ai.generateImage('a cute orange cat', { aspectRatio: '16:9' });
         global.fetch = realFetch;
-        ok('generateImage recovers via the anonymous browser-shaped retry', result.ok === true && result.via === 'anonymous');
+        ok('generateImage recovers through the built-in anonymous fallback', result.ok === true && result.via === 'api');
         const anon = calls.find((c) => DeepAIClient.isTryItKey(c.key));
         ok(
             'anonymous retry carries the browser fields',
@@ -707,6 +707,67 @@ section('DeepAIClient — the whole endpoint surface (mocked transport)');
                 anon.form.quality === 'true'
         );
         ok('share_url is preferred over output_url', result.url === 'https://deepai.org/generated-image.png');
+
+        // detectNsfw: same Pro refusal, same anonymous recovery
+        calls.length = 0;
+        global.fetch = async (url, init = {}) => {
+            const form = {};
+            for (const [k, v] of init.body.entries()) form[k] = v;
+            calls.push({ url, key: init.headers['api-key'], form });
+            const first = calls.filter((c) => /nsfw-detector$/.test(c.url)).length === 1;
+            return {
+                status: first ? 402 : 200,
+                headers: { get: () => 'application/json' },
+                text: async () =>
+                    first
+                        ? JSON.stringify({ status: 'APIs are only available for Pro members in good standing' })
+                        : JSON.stringify({ id: 'n1', output: { nsfw_score: 0.13 } }),
+            };
+        };
+        const nsfw = await ai.detectNsfw(Buffer.from('fake-image-bytes'));
+        global.fetch = realFetch;
+        ok('detectNsfw recovers through the anonymous fallback', nsfw.ok === true && nsfw.score === 0.13 && nsfw.nsfw === false);
+        const anonNsfw = calls.find((c) => DeepAIClient.isTryItKey(c.key));
+        ok('anonymous nsfw retry uses the model-page dialect', anonNsfw && anonNsfw.form.generation_source === 'img');
+
+        // anonymousApiFallback:false keeps the refusal (no /api retry; the
+        // vision fallback may still run but makes no /api/nsfw-detector call)
+        const strict = new AlexaAI({ key: '11111111-2222-3333-4444-555555555555', postgresUrl: 'postgres://u:p@localhost/db', autoMigrate: false, anonymousApiFallback: false });
+        let apiCalls = 0;
+        global.fetch = async (url, init = {}) => {
+            if (/nsfw-detector$/.test(String(url))) apiCalls++;
+            return { status: 402, headers: { get: () => 'application/json' }, text: async () => JSON.stringify({ status: 'APIs are only available for Pro members in good standing' }) };
+        };
+        const refused = await strict.detectNsfw(Buffer.from('fake-image-bytes'));
+        global.fetch = realFetch;
+        ok('anonymousApiFallback:false surfaces the refusal', refused.ok === false && refused.error === 'DEEPAI_PRO_REQUIRED');
+        ok('no anonymous retry was made', apiCalls === 1);
+
+        // login-gated models map to DEEPAI_LOGIN_REQUIRED and never rotate keys
+        {
+            const cfg2 = new Config({ key: 'tryit-1-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', keys: ['tryit-1-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', 'tryit-2-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'], postgresUrl: 'postgres://u:p@localhost/db', maxRetries: 0 });
+            const c2 = new DeepAIClient(cfg2);
+            const seen2 = [];
+            global.fetch = async (url, init = {}) => {
+                seen2.push(init.headers['api-key']);
+                return { status: 401, headers: { get: () => 'application/json' }, text: async () => JSON.stringify({ status: 'model only available to logged in users' }) };
+            };
+            let loginErr = null;
+            try { await c2.runApi('nsfw-detector', { image: 'https://x/y.png' }); } catch (e) { loginErr = e; }
+            global.fetch = realFetch;
+            ok('login-gated model raises DEEPAI_LOGIN_REQUIRED', loginErr?.code === 'DEEPAI_LOGIN_REQUIRED');
+            ok('no key rotation on login-gated models', seen2.length === 1);
+        }
+
+        // the vision fallback answers when the model refuses for plan reasons
+        {
+            const ai2 = new AlexaAI({ key: '11111111-2222-3333-4444-555555555555', postgresUrl: 'postgres://u:p@localhost/db', autoMigrate: false });
+            ai2.vision = { describe: async () => ({ ok: true, description: '0.85' }) };
+            global.fetch = async () => ({ status: 402, headers: { get: () => 'application/json' }, text: async () => JSON.stringify({ status: 'APIs are only available for Pro members in good standing' }) });
+            const judged = await ai2.detectNsfw(Buffer.from('fake'), { threshold: 0.7 });
+            global.fetch = realFetch;
+            ok('detectNsfw falls back to the vision model', judged.ok === true && judged.via === 'chat' && judged.score === 0.85 && judged.nsfw === true);
+        }
     }
     
 {
@@ -794,6 +855,22 @@ section('DeepAIClient — the whole endpoint surface (mocked transport)');
         ok('fetch-only transport never shells out', curlCalled === false);
     }
 
+    // 5. a proxy pins the chain to the curl transports and passes -x
+    {
+        let call = null;
+        DeepAIClient.execCurl = async (bin, args) => { call = { bin, args }; return '{"id":"p1","share_url":"https://deepai.org/p.png"}\n200'; };
+        const client = new DeepAIClient(new Config({
+            key: 'k', postgresUrl: 'postgres://u:p@localhost/db',
+            proxy: 'socks5://127.0.0.1:9050', maxRetries: 0,
+        }));
+        const chain = await client._transportChain();
+        ok('proxy removes fetch from the transport chain', !chain.includes('fetch') && chain.includes('curl'));
+        const data = await client.runApi('text2img', { text: 'cat' });
+        ok('proxied request succeeds through curl', data.share_url === 'https://deepai.org/p.png');
+        const xi = call.args.indexOf('-x');
+        ok('curl receives the proxy flag', xi !== -1 && call.args[xi + 1] === 'socks5://127.0.0.1:9050');
+    }
+
     global.fetch = realFetch;
     DeepAIClient.execCurl = realExecCurl;
     DeepAIClient._impersonateCache = realCache;
@@ -890,6 +967,19 @@ async function endToEndTests() {
         deepai.push('Sure! DeepAI can help you with that.');
         const leak = await ai.chat({ message: 'can you help me?', userId: '78151912841263@lid' });
         ok('vendor name never ships', !/deepai/i.test(leak.text));
+
+        // 7. A non-English reply is re-asked in English.
+        deepai.push('你好！很高兴认识你，Nimal。');
+        deepai.push('Hello! Very nice to meet you, Nimal.');
+        const zh = await ai.chat({ message: 'hi again', userId: '78151912841263@lid' });
+        check('Chinese reply is re-asked in English', zh.text, 'Hello! Very nice to meet you, Nimal.');
+
+        // 8. When the re-ask also fails, the CJK is stripped (or replaced).
+        deepai.push('这是一段完全中文的回答。');
+        deepai.push('还是中文。');
+        const zh2 = await ai.chat({ message: 'hello', userId: '78151912841263@lid' });
+        ok('unrecoverable reply carries no CJK', !/[\u4E00-\u9FFF]/.test(zh2.text));
+        ok('unrecoverable reply is non-empty', zh2.text.trim().length > 0);
     } finally {
         deepai.restore();
     }