dsh-llm-adapters 1.2.1 → 1.2.2

package/src/raccoon.ts

@@ -9,8 +9,9 @@
  */
 
 import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm'
+import { createHash } from 'node:crypto'
 import type { AccountStore } from './account-store.ts'
-import { RaccoonAuth } from './auth.ts'
+import { RaccoonAuth, decodeJwtFacts } from './auth.ts'
 import { RaccoonQrLogin } from './raccoon-login.ts'
 import type { LoginStatus } from './login-page.ts'
 import {
@@ -47,6 +48,8 @@ export interface RaccoonProviderOptions {
   fetchImpl?: typeof fetch
   /** Injectable OpenRouter lookup for tests; defaults to the live catalog. */
   openRouter?: OpenRouterLookup
+  /** Injectable session-id bookkeeping for tests; defaults to the real one. */
+  sessionIds?: RaccoonSessionIds
 }
 
 function numeric(value: unknown): number | undefined {
@@ -98,6 +101,118 @@ function raccoonHeaders(token: string): Record<string, string> {
   }
 }
 
+/**
+ * The upstream code for the account's token-throughput wall.
+ *
+ * It reads like a request-rate complaint (`您的模型请求频率超限`) and is not
+ * one: measured on a live account, ten large requests in ten seconds hit it
+ * while fifty small ones did not, and the window refills by throughput rather
+ * than by request count. The gateway sends no `Retry-After` and no
+ * `x-ratelimit-*` header, so nothing here can compute a wait either.
+ */
+export const RACCOON_RATE_LIMIT_CODE = 'user_model_rate_limited'
+
+/** Wording the gateway has used alongside that code. */
+const RATE_LIMIT_WORDS = ['user_model_rate_limited', 'rate_limit', '频率超限']
+
+/**
+ * Whether a rejection is the token wall rather than a generic failure.
+ *
+ * Matched on the status, the code and the wording, because the same condition
+ * arrives as an HTTP 429 and as an error frame inside a 200 stream.
+ */
+export function isRaccoonRateLimited(status: number | undefined, text: string): boolean {
+  if (status === 429) return true
+  const lower = text.toLowerCase()
+  return RATE_LIMIT_WORDS.some(word => lower.includes(word.toLowerCase()))
+}
+
+/**
+ * The wall, as an error the caller can tell apart from a generic 429.
+ *
+ * A subclass rather than a flag: the in-band path and the HTTP path would
+ * otherwise both be caught by the same handler, and the second pass would wrap
+ * the message the first pass had already rewritten.
+ */
+export class RaccoonRateLimitedError extends ProviderHttpError {
+  constructor(message: string) {
+    super(message, 429)
+    this.name = 'RaccoonRateLimitedError'
+  }
+}
+
+/**
+ * The message a user sees once the wall is hit.
+ *
+ * The raw text says "retry later" and gives no reason, which is why this reads
+ * as the plugin being broken. The honest answer names the cause and the one
+ * lever the user actually has on this side.
+ */
+function raccoonRateLimited(detail: string): RaccoonRateLimitedError {
+  return new RaccoonRateLimitedError(
+    '小浣熊账号的模型吞吐已达上限（不是每分钟请求数，而是按账号的 token 速率）。'
+    + '一轮对话带的上下文越大越快撞到，撞到后额度按吞吐缓慢回血，上游也没有给恢复时间。'
+    + '稍等一会儿再发；把该模型的上下文窗口调小，同一会话能撑得更久。'
+    + `上游原文：${detail}`,
+  )
+}
+
+/** The `error` object a compatible gateway puts in an SSE frame. */
+function frameFailure(frame: Record<string, unknown>): { code?: string, message?: string } | undefined {
+  const error = frame.error
+  if (error === undefined) return undefined
+  if (typeof error === 'string') return { message: error }
+  if (error === null || typeof error !== 'object') return undefined
+  const record = error as Record<string, unknown>
+  const code = typeof record.code === 'string' ? record.code : undefined
+  const message = typeof record.message === 'string' ? record.message : undefined
+  return {
+    ...code === undefined ? {} : { code },
+    ...message === undefined ? {} : { message },
+  }
+}
+
+/**
+ * One conversation's session id, stable across the turns of that conversation.
+ *
+ * The official client never opens a session per request — measured on its own
+ * logs, 125 calls over 26 minutes all carried one `sess-0-53927d74` — while an
+ * implementation that mints a fresh id per request tells the gateway that one
+ * account opened hundreds of sessions within minutes.
+ *
+ * The id is a pure function of (account, model) rather than a random value, so a
+ * restarted or hot-reloaded process continues the same conversation instead of
+ * presenting a new session, and two models stay two conversations. The principal
+ * itself never leaves the process — only a truncated digest of it does.
+ */
+export class RaccoonSessionIds {
+  /**
+   * @param principal - a value that is stable for one account and identifies it
+   *   without being the token itself (the JWT's `sub`).
+   */
+  constructor(private readonly principal: () => Promise<string | undefined>) {}
+
+  async for(model: string): Promise<string | undefined> {
+    const principal = await this.principal()
+    if (principal === undefined) return undefined
+    return raccoonSessionId(principal, model)
+  }
+}
+
+/**
+ * `sess-<sequence>-<8 hex>`, the shape the official client sends.
+ *
+ * The sequence is the official client's process-local counter and is pinned to 0
+ * here on purpose: an incrementing value would make one conversation look like a
+ * different session after a restart, which is the one thing this id exists to
+ * prevent. Identity lives in the digest, which is truncated on purpose — the id
+ * must separate accounts without naming them on the wire.
+ */
+export function raccoonSessionId(principal: string, model: string): string {
+  const digest = createHash('sha256').update(`${principal}\0${model}`).digest('hex').slice(0, 8)
+  return `sess-0-${digest}`
+}
+
 /** Whether the gateway accepts a token harvested from the browser. */
 export async function raccoonAccessTokenValid(
   token: string,
@@ -156,12 +271,16 @@ export class RaccoonProvider {
   readonly catalog: ModelCatalog
   private quotaCache: { at: number, value: QuotaSnapshot } | undefined
   private quotaInflight: Promise<QuotaSnapshot> | undefined
-  private checkinInflight: Promise<CheckinStatus> | undefined
   private loginFlow: RaccoonQrLogin | undefined
   private readonly openRouter: OpenRouterLookup
+  private readonly sessionIds: RaccoonSessionIds
 
   constructor(private readonly options: RaccoonProviderOptions) {
     this.openRouter = options.openRouter ?? new OpenRouterCatalog(options.fetchImpl ?? fetch)
+    this.sessionIds = options.sessionIds ?? new RaccoonSessionIds(async () => {
+      const stored = await options.store.raccoon()
+      return stored === undefined ? undefined : decodeJwtFacts(stored.accessToken).subject
+    })
     this.catalog = new ModelCatalog(
       () => this.fetchModels(),
       options.ttlMs,
@@ -225,6 +344,19 @@ export class RaccoonProvider {
     return raccoonHeaders(token)
   }
 
+  /**
+   * The chat headers, including the session id the gateway counts sessions by.
+   *
+   * Only chat carries it: the catalogue, quota and check-in routes are plain
+   * business calls the official client sends outside any session, so leaving
+   * them alone keeps this change to the one route it was measured on.
+   */
+  private async chatHeaders(token: string, model: string): Promise<Record<string, string>> {
+    const base = raccoonHeaders(token)
+    const sessionId = await this.sessionIds.for(model).catch(() => undefined)
+    return sessionId === undefined ? base : { ...base, 'x-raccoon-session-id': sessionId }
+  }
+
   /** Run one JSON call; a rejected token means this login needs a new scan. */
   private async authorizedJson<T>(
     path: string,
@@ -371,6 +503,15 @@ export class RaccoonProvider {
     return undefined
   }
 
+  /**
+   * Read today's grant. **Read-only on purpose.**
+   *
+   * The gateway has no claim endpoint: points are issued on the day's first
+   * website visit. Replaying that visit (`setting_info`) can trigger the grant
+   * from here, but doing so takes a state-changing action on the account without
+   * the user asking for it in that moment, so the plugin only reports. Claiming
+   * is the website's job, and the card links there.
+   */
   async checkinStatus(): Promise<CheckinStatus> {
     const grant = await this.dailyGrant()
     if (grant !== undefined) {
@@ -393,53 +534,6 @@ export class RaccoonProvider {
     }
   }
 
-  async claimCheckin(): Promise<CheckinStatus> {
-    // `setting_info` is the call the website makes on load; it is also the one
-    // that carries the point-grant popups. Ask as the web client so the server
-    // treats it as a normal page visit rather than a desktop API call.
-    await this.authorizedJson('/office/v3/setting_info', {}, {
-      'x-client-platform': 'web',
-      'x-client-version': '131.0.0.0',
-    })
-    const grant = await this.dailyGrant()
-    if (grant === undefined) {
-      return {
-        available: true,
-        claimed: false,
-        deviceClaimed: false,
-        message: '每日积分尚未到账；请打开网页签到',
-        url: RACCOON_CHECKIN_URL,
-      }
-    }
-    this.invalidateQuota()
-    return {
-      available: true,
-      claimed: true,
-      deviceClaimed: false,
-      ...grant.points === undefined ? {} : { reward: grant.points },
-      ...grant.grantedAt === undefined ? {} : { grantedAt: grant.grantedAt },
-      message: '每日积分已到账',
-      url: RACCOON_CHECKIN_URL,
-    }
-  }
-
-  /**
-   * One automatic check-in pass: report today's grant, or ask the website path
-   * to issue it. Shared so overlapping timers cannot spend two call slots.
-   */
-  async ensureDailyCheckin(): Promise<CheckinStatus> {
-    if (this.checkinInflight !== undefined) return this.checkinInflight
-    this.checkinInflight = (async () => {
-      const status = await this.checkinStatus()
-      return status.claimed ? status : this.claimCheckin()
-    })()
-    try {
-      return await this.checkinInflight
-    } finally {
-      this.checkinInflight = undefined
-    }
-  }
-
   async *stream(
     options: GenerateOptions,
     model: string,
@@ -465,7 +559,7 @@ export class RaccoonProvider {
     try {
       yield* openAiStream({
         url: `${RACCOON_BASE}/llm/v2/chat/completions`,
-        headers: this.headers(token),
+        headers: await this.chatHeaders(token, model),
         body,
         signal: options.signal,
         fetchImpl: this.options.fetchImpl,
@@ -474,11 +568,30 @@ export class RaccoonProvider {
           this.invalidateQuota()
           onUnauthorized?.()
         },
+        // The same wall arrives inside a 200 stream as an error frame. Without
+        // this hook it would surface as a generic 502 and read as a plugin bug.
+        onFrame: (frame) => {
+          const failure = frameFailure(frame)
+          if (failure === undefined) return
+          const detail = failure.message ?? failure.code ?? '上游返回错误'
+          throw isRaccoonRateLimited(undefined, `${failure.code ?? ''} ${detail}`)
+            ? raccoonRateLimited(detail)
+            : new ProviderHttpError(detail, 502)
+        },
       })
     } catch (error) {
       if (error instanceof ProviderHttpError && (error.status === 401 || error.status === 403)) {
         throw new Error('小浣熊登录已失效，请在设置页点「打开扫码登录」。')
       }
+      // The HTTP path: `openAiStream` throws the status before any frame is read.
+      // The in-band path already rewrote its own error, so it is left alone.
+      // Only the status is trusted here: matching on the wording would re-wrap a
+      // 502 that the in-band hook deliberately classified as a gateway failure.
+      if (error instanceof ProviderHttpError
+        && !(error instanceof RaccoonRateLimitedError)
+        && error.status === 429) {
+        throw raccoonRateLimited(error.message)
+      }
       throw error
     }
   }

package/lib/types/codearts-window.d.ts

@@ -1,65 +0,0 @@
-/**
- * The trial plan's chat budget.
- *
- * The gateway opens one "session" per chat request and allows **three per
- * rolling minute** for the whole account. The window is shared by every model,
- * it is not keyed by `session-id` (re-sending the same id does not buy a slot),
- * and a request rejected with `InferHub.4004.200` spends a slot just like a
- * successful one. Measured behaviour, three slots then a lockout:
- *
- * ```
- * t+0s   ok ok ok cap cap cap     burst of six
- * t+10s  cap                      …
- * t+51s  cap
- * t+61s  ok ok ok                 the burst ages out of the window
- * ```
- *
- * So a turn cannot be made to "go faster" by retrying: the only way a request
- * stops failing is to spend the budget deliberately — wait for the oldest start
- * to age out instead of firing into a wall. This class owns that bookkeeping and
- * is shared by every provider instance in the process, because a hot reload
- * must not reset the count the gateway still remembers.
- *
- * @module dsh-llm-adapters/codearts-window
- */
-/** Sessions the trial plan allows inside one window. */
-export declare const CODEARTS_SESSION_LIMIT = 3;
-/** How long a start keeps its slot. Measured: the burst frees at ~60 s. */
-export declare const CODEARTS_SESSION_WINDOW_MS = 60000;
-/** The claim a caller holds while its request is in flight. */
-export interface CodeArtsSessionSlot {
-    /**
-     * Give the slot back.
-     *
-     * The gateway does not charge for a call it turned away: a burst rejected
-     * with `TM.00001041` at t+0 s lifts at the same moment as one that was never
-     * sent. Keeping the slot after a refusal would therefore throttle the next
-     * minute to one request per twenty seconds for no reason.
-     */
-    release(): void;
-}
-export declare class CodeArtsSessionWindow {
-    private readonly limit;
-    private readonly windowMs;
-    private readonly now;
-    private readonly starts;
-    /** Serialises waiters so two callers cannot both take the last slot. */
-    private tail;
-    constructor(limit?: number, windowMs?: number, now?: () => number);
-    /** Starts recorded inside the current window. */
-    get size(): number;
-    /** Milliseconds until another start fits; `0` when the window has room. */
-    waitMs(): number;
-    /**
-     * Claim a slot, waiting for the window to roll over when it is full.
-     *
-     * The slot is recorded on return, not on completion: the gateway counts the
-     * start, and holds it for a fixed time whether the answer was short or long.
-     */
-    open(signal?: AbortSignal): Promise<CodeArtsSessionSlot>;
-    /** Forget every start (tests, and a fresh login on another account). */
-    reset(): void;
-    private trim;
-}
-/** The process-wide window; a plugin reload reuses it on purpose. */
-export declare function sharedSessionWindow(): CodeArtsSessionWindow;

package/src/codearts-window.ts

@@ -1,136 +0,0 @@
-/**
- * The trial plan's chat budget.
- *
- * The gateway opens one "session" per chat request and allows **three per
- * rolling minute** for the whole account. The window is shared by every model,
- * it is not keyed by `session-id` (re-sending the same id does not buy a slot),
- * and a request rejected with `InferHub.4004.200` spends a slot just like a
- * successful one. Measured behaviour, three slots then a lockout:
- *
- * ```
- * t+0s   ok ok ok cap cap cap     burst of six
- * t+10s  cap                      …
- * t+51s  cap
- * t+61s  ok ok ok                 the burst ages out of the window
- * ```
- *
- * So a turn cannot be made to "go faster" by retrying: the only way a request
- * stops failing is to spend the budget deliberately — wait for the oldest start
- * to age out instead of firing into a wall. This class owns that bookkeeping and
- * is shared by every provider instance in the process, because a hot reload
- * must not reset the count the gateway still remembers.
- *
- * @module dsh-llm-adapters/codearts-window
- */
-
-/** Sessions the trial plan allows inside one window. */
-export const CODEARTS_SESSION_LIMIT = 3
-
-/** How long a start keeps its slot. Measured: the burst frees at ~60 s. */
-export const CODEARTS_SESSION_WINDOW_MS = 60_000
-
-/** A little slack so a request never lands a few milliseconds early. */
-const MARGIN_MS = 1_500
-
-/** The claim a caller holds while its request is in flight. */
-export interface CodeArtsSessionSlot {
-  /**
-   * Give the slot back.
-   *
-   * The gateway does not charge for a call it turned away: a burst rejected
-   * with `TM.00001041` at t+0 s lifts at the same moment as one that was never
-   * sent. Keeping the slot after a refusal would therefore throttle the next
-   * minute to one request per twenty seconds for no reason.
-   */
-  release(): void
-}
-
-function sleep(ms: number, signal?: AbortSignal): Promise<void> {
-  return new Promise((resolve, reject) => {
-    if (signal?.aborted === true) {
-      reject(signal.reason instanceof Error ? signal.reason : new Error('aborted'))
-      return
-    }
-    const onAbort = (): void => {
-      clearTimeout(timer)
-      reject(signal?.reason instanceof Error ? signal.reason : new Error('aborted'))
-    }
-    const timer = setTimeout(() => {
-      signal?.removeEventListener('abort', onAbort)
-      resolve()
-    }, ms)
-    signal?.addEventListener('abort', onAbort, { once: true })
-  })
-}
-
-export class CodeArtsSessionWindow {
-  private readonly starts: number[] = []
-  /** Serialises waiters so two callers cannot both take the last slot. */
-  private tail: Promise<void> = Promise.resolve()
-
-  constructor(
-    private readonly limit: number = CODEARTS_SESSION_LIMIT,
-    private readonly windowMs: number = CODEARTS_SESSION_WINDOW_MS,
-    private readonly now: () => number = Date.now,
-  ) {}
-
-  /** Starts recorded inside the current window. */
-  get size(): number {
-    this.trim()
-    return this.starts.length
-  }
-
-  /** Milliseconds until another start fits; `0` when the window has room. */
-  waitMs(): number {
-    this.trim()
-    if (this.starts.length < this.limit) return 0
-    const oldest = this.starts[0] ?? 0
-    return Math.max(0, this.windowMs - (this.now() - oldest))
-  }
-
-  /**
-   * Claim a slot, waiting for the window to roll over when it is full.
-   *
-   * The slot is recorded on return, not on completion: the gateway counts the
-   * start, and holds it for a fixed time whether the answer was short or long.
-   */
-  async open(signal?: AbortSignal): Promise<CodeArtsSessionSlot> {
-    const run = this.tail.then(async (): Promise<CodeArtsSessionSlot> => {
-      for (;;) {
-        const wait = this.waitMs()
-        if (wait === 0) {
-          const start = this.now()
-          this.starts.push(start)
-          return {
-            release: () => {
-              const index = this.starts.indexOf(start)
-              if (index >= 0) this.starts.splice(index, 1)
-            },
-          }
-        }
-        await sleep(wait + MARGIN_MS, signal)
-      }
-    })
-    // A failed waiter must not poison the queue for the next one.
-    this.tail = run.then(() => undefined, () => undefined)
-    return await run
-  }
-
-  /** Forget every start (tests, and a fresh login on another account). */
-  reset(): void {
-    this.starts.length = 0
-  }
-
-  private trim(): void {
-    const now = this.now()
-    while (this.starts.length > 0 && now - (this.starts[0] ?? 0) >= this.windowMs) this.starts.shift()
-  }
-}
-
-let shared: CodeArtsSessionWindow | undefined
-
-/** The process-wide window; a plugin reload reuses it on purpose. */
-export function sharedSessionWindow(): CodeArtsSessionWindow {
-  shared ??= new CodeArtsSessionWindow()
-  return shared
-}