magpie-gemini-web 0.5.6 → 0.7.0

package/lib/backend.mjs

@@ -1,16 +1,20 @@
 import { citeStream, citeJSON } from './cite.mjs';
+import { validateProxyURL } from './setup.mjs';
 
 export const DEFAULT_BASE = 'http://127.0.0.1:8083/v1';
+export const PLUGIN_ICON = 'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIj48ZGVmcz48bGluZWFyR3JhZGllbnQgaWQ9ImEiIHgxPSIyIiB5MT0iMyIgeDI9IjIwIiB5Mj0iMjEiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAlIiBzdG9wLWNvbG9yPSIjMDZCNkQ0Ii8+PHN0b3Agb2Zmc2V0PSI1MCUiIHN0b3AtY29sb3I9IiMzQjgyRjYiLz48c3RvcCBvZmZzZXQ9IjEwMCUiIHN0b3AtY29sb3I9IiM4QjVDRjYiLz48L2xpbmVhckdyYWRpZW50PjxsaW5lYXJHcmFkaWVudCBpZD0iYiIgeDE9IjE0IiB5MT0iMiIgeDI9IjIyIiB5Mj0iMTAiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBvZmZzZXQ9IjAlIiBzdG9wLWNvbG9yPSIjOEI1Q0Y2Ii8+PHN0b3Agb2Zmc2V0PSIxMDAlIiBzdG9wLWNvbG9yPSIjRUM0ODk5Ii8+PC9saW5lYXJHcmFkaWVudD48L2RlZnM+PHBhdGggZD0iTTEwIDMuMkMxMC4zNSAzLjIgMTAuNjIgMy40NSAxMC43MiAzLjhDMTEuNDUgNi44NSAxMy4xNSA4LjU1IDE2LjIgOS4yOEMxNi41NSA5LjM4IDE2LjggOS42NSAxNi44IDEwQzE2LjggMTAuMzUgMTYuNTUgMTAuNjIgMTYuMiAxMC43MkMxMy4xNSAxMS40NSAxMS40NSAxMy4xNSAxMC43MiAxNi4yQzEwLjYyIDE2LjU1IDEwLjM1IDE2LjggMTAgMTYuOEM5LjY1IDE2LjggOS4zOCAxNi41NSA5LjI4IDE2LjJDOC41NSAxMy4xNSA2Ljg1IDExLjQ1IDMuOCAxMC43MkMzLjQ1IDEwLjYyIDMuMiAxMC4zNSAzLjIgMTBDMy4yIDkuNjUgMy40NSA5LjM4IDMuOCA5LjI4QzYuODUgOC41NSA4LjU1IDYuODUgOS4yOCAzLjhDOS4zOCAzLjQ1IDkuNjUgMy4yIDEwIDMuMloiIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0wLjUgMi41KSBzY2FsZSgxLjEyKSIgZmlsbD0idXJsKCNhKSIvPjxwYXRoIGQ9Ik0xOC4yIDEuOEMxOC40MiAxLjggMTguNiAxLjk1IDE4LjY2IDIuMTZDMTkuMDggMy44MiAyMC4wMiA0Ljc2IDIxLjY4IDUuMThDMjEuODkgNS4yNCAyMi4wNCA1LjQyIDIyLjA0IDUuNjRDMjIuMDQgNS44NiAyMS44OSA2LjA0IDIxLjY4IDYuMUMyMC4wMiA2LjUyIDE5LjA4IDcuNDYgMTguNjYgOS4xMkMxOC42IDkuMzMgMTguNDIgOS40OCAxOC4yIDkuNDhDMTcuOTggOS40OCAxNy44IDkuMzMgMTcuNzQgOS4xMkMxNy4zMiA3LjQ2IDE2LjM4IDYuNTIgMTQuNzIgNi4xQzE0LjUxIDYuMDQgMTQuMzYgNS44NiAxNC4zNiA1LjY0QzE0LjM2IDUuNDIgMTQuNTEgNS4yNCAxNC43MiA1LjE4QzE2LjM4IDQuNzYgMTcuMzIgMy44MiAxNy43NCAyLjE2QzE3LjggMS45NSAxNy45OCAxLjggMTguMiAxLjhaIiBmaWxsPSJ1cmwoI2IpIi8+PGNpcmNsZSBjeD0iMTcuOCIgY3k9IjE4LjIiIHI9IjEuMzUiIGZpbGw9IiM2MzY2RjEiLz48L3N2Zz4=';
 
 const MEDIA_SPECIAL = /(?:^|[-_])(image|music|canvas|video|research)(?:[-_]|$)/i;
 const CONTROL_CHARS = /[\x00-\x1f\x7f]/;
 const NEWLINE_CHARS = /[\r\n]/;
 
-// The backend has no effort parameter: extended thinking is a separate "<id>-thinking" model.
-// A base model with such a twin offers low (itself) and high (the twin), and the twin isn't
-// listed on its own; a request that names it still goes through. Magpie maps any other level to
-// the nearest declared one before it reaches us; direct callers get the same rule.
+// The backend has no effort parameter: extended thinking uses separate "<id>-thinking-medium"
+// and "<id>-thinking" models. A base model with such twins offers low (itself), medium (when
+// "<id>-thinking-medium" exists), and high ("<id>-thinking"), while the twins aren't listed on
+// their own; a request that names one directly still goes through. Magpie maps any other level
+// to the nearest declared one before it reaches us; direct callers get the same rule.
 const THINKING_SUFFIX = '-thinking';
+const MEDIUM_THINKING_SUFFIX = '-thinking-medium';
 const LOW_EFFORTS = new Set(['none', 'minimal', 'low']);
 const MODEL_CACHE_MS = 10 * 60 * 1000;
 const knownModels = new Map();
@@ -21,6 +25,7 @@ export const UNREACHABLE_HEADER = 'X-Gemini-Web-Backend';
 
 const KNOWN_OPTIONS = new Set([
   'baseURL',
+  'proxy',
   'allowTools',
   'allowImages',
   'contextLimit',
@@ -115,6 +120,13 @@ export function settings(options = {}) {
     baseURL = normalizeBaseURL(options.baseURL);
   }
 
+  let proxy = '';
+  if (options.proxy !== undefined) {
+    proxy = validateProxyURL(options.proxy);
+  } else if (process.env.GEMINI_WEB_PROXY) {
+    proxy = validateProxyURL(process.env.GEMINI_WEB_PROXY);
+  }
+
   // On by default: coding agents send tools with every request and don't read toolcall,
   // so turning this off only means every one of their requests gets a 400.
   let allowTools = true;
@@ -181,6 +193,7 @@ export function settings(options = {}) {
 
   return {
     baseURL,
+    proxy,
     allowTools,
     allowImages,
     contextLimit,
@@ -289,7 +302,16 @@ export async function listModels(c, opts) {
   const result = Object.create(null);
   for (const id of validIds) {
     if (id.endsWith(THINKING_SUFFIX) && ids.has(id.slice(0, -THINKING_SUFFIX.length))) continue;
-    const hasTwin = !id.endsWith(THINKING_SUFFIX) && ids.has(id + THINKING_SUFFIX);
+    if (id.endsWith(MEDIUM_THINKING_SUFFIX) && ids.has(id.slice(0, -MEDIUM_THINKING_SUFFIX.length))) continue;
+    const isTwin = id.endsWith(THINKING_SUFFIX) || id.endsWith(MEDIUM_THINKING_SUFFIX);
+    const hasMedium = !isTwin && ids.has(id + MEDIUM_THINKING_SUFFIX);
+    const hasHigh = !isTwin && ids.has(id + THINKING_SUFFIX);
+    const variants = {};
+    if (hasMedium || hasHigh) {
+      variants.low = {};
+      if (hasMedium) variants.medium = {};
+      if (hasHigh) variants.high = {};
+    }
     result[id] = {
       id,
       providerID: 'gemini-web',
@@ -326,7 +348,7 @@ export async function listModels(c, opts) {
       },
       options: {},
       headers: {},
-      variants: hasTwin ? { low: {}, high: {} } : {},
+      variants,
       status: 'active'
     };
   }
@@ -345,7 +367,7 @@ async function thinkingTwin(body, c, opts) {
   const effort = body.reasoning_effort;
   const model = body.model;
   if (typeof effort !== 'string' || LOW_EFFORTS.has(effort)) return null;
-  if (typeof model !== 'string' || model.endsWith(THINKING_SUFFIX)) return null;
+  if (typeof model !== 'string' || model.endsWith(THINKING_SUFFIX) || model.endsWith(MEDIUM_THINKING_SUFFIX)) return null;
 
   let cached = knownModels.get(modelCacheKey(c));
   if (!cached || Date.now() - cached.at > MODEL_CACHE_MS) {
@@ -356,6 +378,9 @@ async function thinkingTwin(body, c, opts) {
     }
     cached = knownModels.get(modelCacheKey(c));
   }
+  if (effort === 'medium' && cached?.ids.has(model + MEDIUM_THINKING_SUFFIX)) {
+    return model + MEDIUM_THINKING_SUFFIX;
+  }
   const twin = model + THINKING_SUFFIX;
   return cached?.ids.has(twin) ? twin : null;
 }
@@ -535,12 +560,14 @@ export async function forward(input, init, getAuth, opts) {
   let upstreamRes;
   timer.start();
   try {
+    // Bun's fetch drops a connection idle for 300 s; the timer sets the deadline instead.
     upstreamRes = await fetch(incomingUrl, {
       method: req.method,
       headers,
       body: rawBody,
       signal,
-      redirect: 'error'
+      redirect: 'error',
+      timeout: false
     });
   } catch (err) {
     if (req.signal.aborted) {

package/lib/native.mjs

@@ -2,23 +2,24 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
-import { spawn } from 'node:child_process';
+import { spawn, execFile } from 'node:child_process';
+import { validateProxyURL } from './setup.mjs';
 import release from './backend-release.json' with { type: 'json' };
 
 export const BACKEND_VERSION = `v${release.version}`;
 const RELEASE_BASE = `https://github.com/${release.repository}/releases/download/${release.tag}/`;
 export const PINNED_BINARIES = release.binaries;
 
-const UPSTREAM_VERSION = 'v4.22.0';
+const UPSTREAM_VERSION = 'v4.26.0';
 const UPSTREAM_BASE = `https://github.com/zexadev/gemini-web2api-go/releases/download/${UPSTREAM_VERSION}/`;
 // Retained for an explicit, checksum-verified rollback to the upstream release.
 export const UPSTREAM_BINARIES = {
-  'darwin-arm64': { asset: 'gemini-web2api-go_v4.22.0_darwin_arm64', sha256: 'c69ca75cf43017cf2a62dbf5c12b07f6bde66f403f714c32209b1ad350ed24c9' },
-  'darwin-x64': { asset: 'gemini-web2api-go_v4.22.0_darwin_amd64', sha256: '384e617bcc30aacac6b7c4e4d0490e88d282b13b29f7a0a20d645b69514cd405' },
-  'linux-x64': { asset: 'gemini-web2api-go_v4.22.0_linux_amd64', sha256: '21fcc81e0ad8ce0921e6b6c2cafce1089852530142b37e0289355c6e72df5299' },
-  'linux-arm64': { asset: 'gemini-web2api-go_v4.22.0_linux_arm64', sha256: 'f2822fa0f1a7d2b37c2bc9cbb30a95c2e8028462453a110389511408bdfd4fd7' },
-  'win32-x64': { asset: 'gemini-web2api-go_v4.22.0_windows_amd64.exe', sha256: '17e37f7e5c813b2a8d90c9a0265e6cde3bcfa4e814822af999fe8c4178f02729' },
-  'win32-arm64': { asset: 'gemini-web2api-go_v4.22.0_windows_arm64.exe', sha256: 'b42e951bfc08d7fe8bdb436dca87fc6a1b7948bb8d10e110653bcf13a790756c' }
+  'darwin-arm64': { asset: 'gemini-web2api-go_v4.26.0_darwin_arm64', sha256: 'cb1afabb5c5db57f99dc67b7cdf8c862a6e7aa33883cbe5355da6f696f02bc41' },
+  'darwin-x64': { asset: 'gemini-web2api-go_v4.26.0_darwin_amd64', sha256: 'de4e519a65caa168b49d906c73e9012a0b8f09ec80978dc8d3efcb674bb28c8f' },
+  'linux-x64': { asset: 'gemini-web2api-go_v4.26.0_linux_amd64', sha256: '2c0c4cb73989a34ca76a9e75c79e0e8684c6d7abc58231c65ef1eca4c411be81' },
+  'linux-arm64': { asset: 'gemini-web2api-go_v4.26.0_linux_arm64', sha256: '5518a5f055e025b118d327b361f8c9f81df319132ed5e064eea191bbe129a50a' },
+  'win32-x64': { asset: 'gemini-web2api-go_v4.26.0_windows_amd64.exe', sha256: '32717fed3ed02b5c82950a01ab3a49e6724de21be8b31c7bb83e8e2e8e454128' },
+  'win32-arm64': { asset: 'gemini-web2api-go_v4.26.0_windows_arm64.exe', sha256: 'ed5a4f0b6f6b0078ff2173f9b3128ed0836748e42e35ea78ff1bc6e1f456e37d' }
 };
 
 export function pinnedBinary(platform = process.platform, arch = process.arch, channel = 'optimized') {
@@ -76,6 +77,7 @@ export async function installBackend(options = {}) {
   const expectedHash = options.expectedHash || pin.sha256;
   const downloadUrl = options.url || pin.url;
   const fetchFn = options.fetchFn || globalThis.fetch;
+  const proxy = validateProxyURL(options.proxy ?? process.env.GEMINI_WEB_PROXY ?? '');
 
   const dataDir = options.dataDir || getDataDir();
   fs.mkdirSync(dataDir, { recursive: true, mode: 0o700 });
@@ -98,24 +100,57 @@ export async function installBackend(options = {}) {
 
   if (!binaryReady) {
     console.log(`Downloading backend binary from ${downloadUrl}...`);
-    const res = await fetchFn(downloadUrl, {
-      signal: AbortSignal.timeout(300000)
-    });
-    if (!res.ok) {
-      throw new Error(`Failed to download binary: HTTP ${res.status}`);
-    }
-
-    const arrayBuffer = await res.arrayBuffer();
-    const buffer = Buffer.from(arrayBuffer);
-    const downloadedHash = crypto.createHash('sha256').update(buffer).digest('hex');
-
-    if (downloadedHash !== expectedHash) {
-      throw new Error(`SHA256 checksum mismatch: expected ${expectedHash}, got ${downloadedHash}`);
-    }
-
     const tmpPath = path.join(binDir, `gemini-web2api-go.tmp.${Date.now()}.${crypto.randomBytes(4).toString('hex')}`);
     try {
-      fs.writeFileSync(tmpPath, buffer, { mode: 0o700 });
+      // A slow download goes on while data keeps coming; a minute without any gives it up.
+      if (proxy && (!options.fetchFn || options.fetchFn === globalThis.fetch)) {
+        const curlArgs = [
+          '--fail', '--location', '--silent', '--show-error',
+          '--connect-timeout', '15', '--speed-limit', '1', '--speed-time', '60',
+          '--proxy', proxy,
+          '-o', tmpPath, downloadUrl
+        ];
+        await new Promise((resolve, reject) => {
+          execFile('curl', curlArgs, (err, _stdout, stderr) => {
+            if (!err) return resolve();
+            const status = err.code || err.status || 'failed';
+            const reason = String(stderr || '').trim().slice(0, 500);
+            reject(new Error(`Failed to download binary via curl (status: ${status})${reason ? `: ${reason}` : ''}`));
+          });
+        });
+        fs.chmodSync(tmpPath, 0o700);
+      } else {
+        const stall = new AbortController();
+        let timer;
+        const rearm = () => {
+          clearTimeout(timer);
+          timer = setTimeout(() => stall.abort(new Error('Failed to download binary: no data for 60 s')), 60000);
+        };
+        const chunks = [];
+        try {
+          rearm();
+          const res = await fetchFn(downloadUrl, {
+            ...(proxy ? { proxy } : {}),
+            signal: stall.signal
+          });
+          if (!res.ok) {
+            throw new Error(`Failed to download binary: HTTP ${res.status}`);
+          }
+          for await (const chunk of res.body) {
+            chunks.push(chunk);
+            rearm();
+          }
+        } finally {
+          clearTimeout(timer);
+        }
+        fs.writeFileSync(tmpPath, Buffer.concat(chunks), { mode: 0o700 });
+      }
+
+      const downloadedHash = computeFileHash(tmpPath);
+      if (downloadedHash !== expectedHash) {
+        throw new Error(`SHA256 checksum mismatch: expected ${expectedHash}, got ${downloadedHash}`);
+      }
+
       fs.renameSync(tmpPath, binPath);
       fs.chmodSync(binPath, 0o700);
       console.log(`Backend binary installed: ${binPath}`);
@@ -341,9 +376,19 @@ async function withLock(dataDir, fn, timeoutMs) {
       await sleep(300);
     }
   }
+  // A download has no overall deadline, so the holder keeps the lock fresh while it works;
+  // only a lock left by a process that is gone goes stale.
+  const keepFresh = setInterval(() => {
+    try {
+      const now = new Date();
+      fs.utimesSync(lockPath, now, now);
+    } catch {}
+  }, Math.max(1000, Math.floor(timeoutMs / 4)));
+  keepFresh.unref?.();
   try {
     return await fn();
   } finally {
+    clearInterval(keepFresh);
     fs.rmSync(lockPath, { force: true });
   }
 }
@@ -376,7 +421,7 @@ export async function ensureBackend(options = {}) {
     const trusted = trustedHashes(dataDir, platform, arch);
     const binPath = binaryPath(dataDir, platform);
     if (!fs.existsSync(binPath) || !trusted.includes(computeFileHash(binPath))) {
-      await installBackend({ dataDir, platform, arch, fetchFn, channel: backendChannel(dataDir) });
+      await installBackend({ dataDir, platform, arch, fetchFn, channel: backendChannel(dataDir), proxy: options.proxy });
     } else {
       ensureDataFiles(dataDir);
     }
@@ -389,8 +434,9 @@ export async function ensureBackend(options = {}) {
     const launch = prepareLaunch(dataDir, trusted, platform);
     const logPath = path.join(dataDir, 'backend.log');
     const log = fs.openSync(logPath, 'a', 0o600);
+    let child;
     try {
-      const child = spawnFn(launch.binPath, launch.args, {
+      child = spawnFn(launch.binPath, launch.args, {
         env: launch.env,
         detached: true,
         stdio: ['ignore', log, log],
@@ -408,6 +454,11 @@ export async function ensureBackend(options = {}) {
       if (await backendState(setup, fetchFn) === 'up') return setup;
       await sleep(300);
     }
+    try { child?.kill?.('SIGTERM'); } catch {}
+    if (child?.pid && typeof child?.kill !== 'function') {
+      try { process.kill(child.pid, 'SIGTERM'); } catch {}
+    }
+    fs.rmSync(path.join(dataDir, 'backend.pid'), { force: true });
     throw new Error(`Gemini Web backend did not start within ${Math.round(startTimeoutMs / 1000)}s; see ${logPath}`);
   }, 600000);
 }

package/lib/setup.mjs

@@ -1,5 +1,36 @@
 // Sign-in helpers for the one-click setup: turn what the user pasted into a Cookie header and
 // add it to the local backend's account pool through its admin API.
+import path from 'node:path';
+import os from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+// Do not infer support from a version: upstream and local builds can have the same version
+// while silently ignoring proxy_id. Recheck at submission too, in case the service restarted.
+export async function requireLoginBackend(setup, options = {}) {
+  const fetchFn = options.fetchFn || globalThis.fetch;
+  let res, info;
+  try {
+    res = await fetchFn(`${setup.origin}/`, {
+      method: 'GET', redirect: 'error', signal: AbortSignal.timeout(5000)
+    });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    info = await res.json();
+  } catch (err) {
+    throw new Error(`无法确认本地 Gemini Web 后端的登录能力（${setup.origin}）：${err.message}`);
+  }
+  if (info?.capabilities?.account_proxy_binding === true) return;
+  const dataDir = options.dataDir || process.env.GEMINI_WEB_DATA_DIR || path.join(os.homedir(), '.local', 'share', 'magpie-gemini-web');
+  const platform = options.platform || process.platform;
+  const script = fileURLToPath(new URL('../scripts/backend.mjs', import.meta.url));
+  // PowerShell and POSIX shells both accept single-quoted literal arguments, but escape
+  // apostrophes differently. Never interpolate credentials or proxy URLs into the hint.
+  const quote = value => `'${value.replaceAll("'", platform === 'win32' ? "''" : "'\\''")}'`;
+  const command = `node ${quote(script)} install --data-dir=${quote(path.resolve(dataDir))}`;
+  const stop = platform === 'win32'
+    ? '在任务管理器的「详细信息」中结束本数据目录对应的 gemini-web2api-go.exe'
+    : '在活动监视器或进程管理器中停止本数据目录对应的 gemini-web2api-go';
+  throw new Error(`正在运行的 Gemini Web 后端不支持登录时绑定代理，请先升级。先退出 Magpie，${stop}，再执行：\n${command}\n数据目录：${path.resolve(dataDir)}。如下载需要代理，请先设置 GEMINI_WEB_PROXY 环境变量。升级后重新打开 Magpie 并登录；账号和配置会保留。`);
+}
 
 // The sign-in cookies a gemini.google.com request carries; without these the backend serves
 // the request anonymously (or the account check fails).
@@ -79,6 +110,31 @@ export function parseCookieInput(input) {
 }
 
 const ADMIN_TIMEOUT_MS = 60000;
+const PROXY_PROTOCOLS = new Set(['http:', 'https:', 'socks5:', 'socks5h:']);
+
+// validateProxyURL checks a proxy URL meant for the backend's proxy pool (http, https, socks5,
+// or socks5h). An empty or omitted value returns '', meaning no proxy is set here.
+export function validateProxyURL(proxy) {
+  if (proxy === undefined || proxy === null || proxy === '') return '';
+  if (typeof proxy !== 'string') {
+    throw new Error('Invalid option proxy: must be a string');
+  }
+  const trimmed = proxy.trim();
+  if (!trimmed) return '';
+  if (/[\r\n]/.test(trimmed)) {
+    throw new Error('Invalid proxy URL: must not contain newlines');
+  }
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new Error('代理地址格式无效：请填写完整的 URL，例如 http://127.0.0.1:7890 或 socks5://127.0.0.1:1080');
+  }
+  if (!PROXY_PROTOCOLS.has(parsed.protocol)) {
+    throw new Error('代理地址必须以 http://、https://、socks5:// 或 socks5h:// 开头');
+  }
+  return trimmed;
+}
 
 // adminCall is one request to the backend's admin API. A request that gets no answer within
 // ADMIN_TIMEOUT_MS fails with timeoutMessage when one is given: the backend was reached, but what
@@ -108,10 +164,41 @@ async function adminCall(setup, fetchFn, method, path, body, timeoutMessage) {
   return data;
 }
 
+// ensureProxy makes sure the given proxy URL is present, enabled, and not circuit-broken in the
+// backend's proxy pool before the backend reaches gemini.google.com to check a cookie.
+export async function ensureProxy(setup, proxy, options = {}) {
+  const url = validateProxyURL(proxy);
+  if (!url) return null;
+  const fetchFn = options.fetchFn || globalThis.fetch;
+  const name = options.name || 'Magpie';
+  const listed = await adminCall(setup, fetchFn, 'GET', 'proxies');
+  const items = Array.isArray(listed?.items) ? listed.items : [];
+  const exact = items.find(p => p && p.url === url && Number.isInteger(p.id));
+  if (exact) {
+    if (!exact.enabled) {
+      await adminCall(setup, fetchFn, 'PATCH', `proxies/${exact.id}`, { enabled: true });
+    }
+    if ((exact.fail_count ?? 0) > 0) {
+      await adminCall(setup, fetchFn, 'POST', `proxies/${exact.id}/reset`);
+    }
+    return { id: exact.id, url };
+  }
+  const managed = items.find(p => p && p.name === name && Number.isInteger(p.id));
+  if (managed) {
+    await adminCall(setup, fetchFn, 'PATCH', `proxies/${managed.id}`, { name, url, enabled: true });
+    if ((managed.fail_count ?? 0) > 0) {
+      await adminCall(setup, fetchFn, 'POST', `proxies/${managed.id}/reset`);
+    }
+    return { id: managed.id, url };
+  }
+  const created = await adminCall(setup, fetchFn, 'POST', 'proxies', { name, url, weight: 1 });
+  return { id: created.id, url };
+}
+
 // The check is the backend fetching gemini.google.com with the cookie, directly or through the
 // backend's own proxy pool: neither Magpie's proxy nor HTTP_PROXY reach it.
 function proxyHint(setup) {
-  return `后端不走 Magpie 的代理，也不读系统代理（HTTP_PROXY / HTTPS_PROXY）：需要代理才能访问 Google 的话，请在管理面板 ${setup.origin}/admin 的代理池里添加（登录口令是数据目录 secrets.json 里的 adminToken），然后重试。`;
+  return `后端不走 Magpie 的代理，也不读系统代理（HTTP_PROXY / HTTPS_PROXY）：需要代理才能访问 Google 的话，请在登录时填写代理地址（或设置插件选项 proxy / 环境变量 GEMINI_WEB_PROXY，也可以在管理面板 ${setup.origin}/admin 的代理池里添加，登录口令是数据目录 secrets.json 里的 adminToken），然后重试。`;
 }
 
 // checkFailure is the error for a check that came back not ok. The backend words the cookie's
@@ -128,11 +215,18 @@ function checkFailure(setup, detail) {
 // account that fails the check is removed again, and the error says why.
 export async function importCookie(setup, cookie, options = {}) {
   const fetchFn = options.fetchFn || globalThis.fetch;
+  await requireLoginBackend(setup, options);
+  let proxyId = Number.isInteger(options.proxyId) ? options.proxyId : undefined;
+  if (options.proxy) {
+    const ensured = await ensureProxy(setup, options.proxy, { fetchFn });
+    if (ensured && Number.isInteger(ensured.id)) proxyId = ensured.id;
+  }
   const label = options.label || `Magpie ${new Date().toISOString().slice(0, 10)}`;
   const added = await adminCall(setup, fetchFn, 'POST', 'cookies', {
     label,
     cookie,
-    note: 'Added by Magpie one-click setup'
+    note: 'Added by Magpie one-click setup',
+    ...(proxyId !== undefined ? { proxy_id: proxyId } : {})
   });
   if (!Number.isInteger(added.id)) throw new Error('本地后端没有返回新账号的 id');
 

package/lib/studio-native.mjs

@@ -3,6 +3,8 @@ import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
 import net from 'node:net';
+import http from 'node:http';
+import { Readable } from 'node:stream';
 import { fileURLToPath } from 'node:url';
 import { spawn, execFile, execFileSync } from 'node:child_process';
 import { promisify } from 'node:util';
@@ -16,6 +18,7 @@ export const STUDIO_VERSION = `v${release.version}`;
 export const PINNED_ARCHIVES = release.binaries;
 // The port a new setup tries first: AIStudio2API's own default.
 export const DEFAULT_STUDIO_PORT = 2048;
+const DEFAULT_PREVIEW_PORT = 2050;
 // backend.log is set aside as backend.log.1 when a start finds it past this size.
 const LOG_ROTATE_BYTES = 10 * 1024 * 1024;
 
@@ -34,7 +37,7 @@ export function setupStep(dataDir) {
 }
 
 export function studioDataDir(env = process.env) {
-  return env.AI_STUDIO_DATA_DIR || path.join(os.homedir(), '.local', 'share', 'magpie-ai-studio');
+  return path.resolve(env.AI_STUDIO_DATA_DIR || path.join(os.homedir(), '.local', 'share', 'magpie-ai-studio'));
 }
 
 export function computeFileHash(filePath) {
@@ -59,7 +62,7 @@ export function studioCommand(action, { dataDir } = {}) {
 // has free. A user who already runs AIStudio2API keeps it on its default port, which a new setup
 // would otherwise find taken on every start.
 export async function pickStudioPort(preferred = DEFAULT_STUDIO_PORT) {
-  if (!(await portAnswers(preferred)) && await canListen(preferred)) return preferred;
+  if (preferred > 0 && !(await portAnswers(preferred)) && await canListen(preferred)) return preferred;
   return new Promise((resolve, reject) => {
     const server = net.createServer();
     server.once('error', reject);
@@ -189,11 +192,12 @@ export function validateConfig(config) {
 
 // ENV_KEYS are the settings upstream reads from .env, in the order it writes them (config.configKeys).
 const ENV_KEYS = [
-  'AISTUDIO_AUTH_STATES', 'LISTEN_ADDR', 'PROXY_API_KEY', 'PROXY', 'INIT_TIMEOUT', 'REQUEST_TIMEOUT',
+  'AISTUDIO_AUTH_STATES', 'LISTEN_ADDR', 'PREVIEW_LISTEN_ADDR', 'PROXY_API_KEY', 'PROXY', 'INIT_TIMEOUT', 'REQUEST_TIMEOUT',
   'WARM_WORKER_LIMIT', 'MAX_ACTIVE_WORKERS', 'WARM_STARTUP_CONCURRENCY', 'PER_ACCOUNT_CONCURRENCY',
-  'ROUTING_STRATEGY', 'UPSTREAM_CHANNELS', 'MODEL_MAPPING', 'TEMPORARY_CHAT', 'WAA_BACKEND', 'AUTO_START',
-  'REQUEST_BODY_LOG', 'LOG_FILE', 'LOG_MAX_TOTAL_MB', 'ADMIN_AUTH_ENABLED', 'ADMIN_USERNAME', 'ADMIN_PASSWORD',
-  'BUILD_NATIVE_NONSTREAM', 'MODEL_CHANNELS', 'MEDIA_OUTPUT', 'MEDIA_BASE_URL'
+  'ROUTING_STRATEGY', 'UPSTREAM_CHANNELS', 'MODEL_MAPPING', 'MODEL_CHANNELS', 'TEMPORARY_CHAT', 'WAA_BACKEND',
+  'MEDIA_OUTPUT', 'MEDIA_BASE_URL', 'AUTO_START', 'REQUEST_BODY_LOG', 'LOG_FILE', 'LOG_MAX_TOTAL_MB',
+  'ADMIN_AUTH_ENABLED', 'ADMIN_USERNAME', 'ADMIN_PASSWORD', 'BUILD_NATIVE_NONSTREAM',
+  'NONSTREAM_KEEPALIVE', 'FAKE_STREAM', 'YOUTUBE_LINKS', 'FIRST_EVENT_HEDGE'
 ];
 
 // PROXY_ENV are the proxy variables the service would fall back to with no PROXY of its own.
@@ -211,7 +215,8 @@ const SETTING_DEFAULTS = {
   WARM_STARTUP_CONCURRENCY: '1',
   ROUTING_STRATEGY: 'fill-first',
   REQUEST_TIMEOUT: '30m',
-  INIT_TIMEOUT: '2m'
+  INIT_TIMEOUT: '2m',
+  NONSTREAM_KEEPALIVE: 'false'
 };
 
 // pluginEnv is the settings this plugin depends on to reach, trust and drive the service. The
@@ -305,6 +310,17 @@ function writeStudioEnv(dataDir, values) {
   fs.chmodSync(envPath, 0o600);
 }
 
+function previewPort(addr) {
+  const match = /^.+:(\d+)$/.exec(String(addr ?? '').trim());
+  if (!match) return 0;
+  const port = Number(match[1]);
+  return Number.isInteger(port) && port >= 1 && port <= 65535 ? port : 0;
+}
+
+function defaultPreviewPort(studioPort) {
+  return studioPort === DEFAULT_PREVIEW_PORT ? DEFAULT_PREVIEW_PORT + 1 : DEFAULT_PREVIEW_PORT;
+}
+
 // syncStudioEnv brings .env up to date with config.json, keeping what the admin page saved: this
 // plugin's settings are written over, the others only when missing. A missing PROXY is the one
 // given, else the one an older config.json kept (which nothing reads after that).
@@ -312,10 +328,26 @@ function syncStudioEnv(dataDir, config, seedProxy) {
   const values = readStudioEnv(dataDir);
   Object.assign(values, pluginEnv(dataDir, config));
   for (const [key, value] of Object.entries(SETTING_DEFAULTS)) values[key] ??= value;
+  const preview = previewPort(values.PREVIEW_LISTEN_ADDR);
+  if (!preview || preview === config.port) {
+    values.PREVIEW_LISTEN_ADDR = `127.0.0.1:${defaultPreviewPort(config.port)}`;
+  }
   values.PROXY ??= validateProxy(seedProxy) || config.proxy;
   writeStudioEnv(dataDir, values);
 }
 
+// ensurePreviewPort makes sure PREVIEW_LISTEN_ADDR in .env is on a free port other than
+// studioPort before the service starts: upstream listens on both and exits when either is taken.
+async function ensurePreviewPort(dataDir, studioPort) {
+  const values = readStudioEnv(dataDir);
+  const current = previewPort(values.PREVIEW_LISTEN_ADDR);
+  if (current && current !== studioPort && !(await portAnswers(current)) && await canListen(current)) return;
+  let port = await pickStudioPort(defaultPreviewPort(studioPort));
+  while (port === studioPort) port = await pickStudioPort(0);
+  values.PREVIEW_LISTEN_ADDR = `127.0.0.1:${port}`;
+  writeStudioEnv(dataDir, values);
+}
+
 // saveStudioProxy saves the service's proxy in its .env, as the admin page does. The service
 // takes it the next time its generation service starts.
 export function saveStudioProxy(dataDir, proxy) {
@@ -398,6 +430,20 @@ export function localStudio(options = {}) {
   };
 }
 
+// nodeFetch is fetch over node:http, bounded only by its signal.
+export function nodeFetch(url, init = {}) {
+  return new Promise((resolve, reject) => {
+    const options = { method: init.method, headers: Object.fromEntries(new Headers(init.headers)), signal: init.signal };
+    const req = http.request(url, options, res => {
+      const headers = new Headers();
+      for (let i = 0; i < res.rawHeaders.length; i += 2) headers.append(res.rawHeaders[i], res.rawHeaders[i + 1]);
+      resolve(new Response(res.statusCode === 204 ? null : Readable.toWeb(res), { status: res.statusCode, headers }));
+    });
+    req.on('error', reject);
+    req.end(init.body ?? undefined);
+  });
+}
+
 export async function studioAdmin(local, method, pathname, body = null, options = {}) {
   if (!local || typeof local !== 'object') {
     throw new Error('localStudio configuration required for studioAdmin');
@@ -484,11 +530,13 @@ export async function studioAdmin(local, method, pathname, body = null, options
         payload = String(body);
       }
     }
+    // Bun's fetch drops a connection idle for 300 s; the signal sets the deadline instead.
     return fetchFn(url, {
       method,
       headers,
       body: payload,
       redirect: 'error',
+      timeout: false,
       signal: AbortSignal.timeout(timeoutMs)
     });
   }
@@ -893,7 +941,7 @@ export function verifyProcessIdentity(pid, expectedBinaryPath, platform = proces
         '-NoProfile',
         '-NonInteractive',
         '-Command',
-        `Get-CimInstance Win32_Process -Filter "ProcessId = $env:TARGET_PID" | Select-Object -ExpandProperty ExecutablePath`
+        `[Console]::OutputEncoding = [Text.UTF8Encoding]::new(); Get-CimInstance Win32_Process -Filter "ProcessId = $env:TARGET_PID" | Select-Object -ExpandProperty ExecutablePath`
       ], {
         env: { ...process.env, TARGET_PID: String(pid) },
         encoding: 'utf8',
@@ -1188,7 +1236,7 @@ export async function installStudio(options = {}) {
         fs.writeFileSync(archivePath, buffer, { mode: 0o600 });
       } else {
         // Without a progress meter curl's stderr holds just the reason a download failed.
-        const curlArgs = ['--fail', '--location', '--silent', '--show-error', '--connect-timeout', '15', '--max-time', '300'];
+        const curlArgs = ['--fail', '--location', '--silent', '--show-error', '--connect-timeout', '15', '--speed-limit', '1', '--speed-time', '60'];
         if (proxy) {
           curlArgs.push('--proxy', proxy);
         }
@@ -1513,6 +1561,7 @@ async function launchStudio(options) {
     if (health.state === 'foreign') throw portTaken(local);
     if (health.state !== 'down') throw notResponding(local, health);
     assertStudioExited(dataDir, platform);
+    await ensurePreviewPort(dataDir, config.port);
     protectPackage(dataDir, platform);
 
     // Clean environment: no host AISTUDIO_* or WAA_* vars, nor any of upstream's settings, which