mslxdff 0.1.159 → 0.1.161

package/src/providers/globalqwenwork/constants.js

@@ -0,0 +1,73 @@
+// globalqwenwork（千问办公国际站 gateway.qwenwork.ai）上游技术常量。
+// 值来源：2026-10-01 用真号现网取证 —— 设备流/poll/refresh/userinfo/account-context/
+// model/list/COSY 签名/chat SSE 全部实测 200（非推测）。**禁止凭记忆改值**；
+// 要改先现网复测（客户端一升级这些快照就可能 403）。
+// Note: 为何独立 provider 而非 qwenwork 的新 region — 见 docs/adr/0041-globalqwenwork-international-provider.md
+export const BASE = "https://gateway.qwenwork.ai";
+
+// OAuth 设备授权。client_id 与 cn 站（qwenwork 的 e883ade2…）**不同**：实测用 cn 的
+// client_id + redirect_uri=qwenwork-cn:// 打本域名，selectAccounts 判
+// `INVALID_DEVICE_FLOW / field=query / reason=not_allowed`（整串 query 不被接受）。
+// 国际版官方客户端硬编码 CONFIGURED_OAUTH_CLIENT_ID=cc65e5fc…（app.asar 取证 + 运行日志实证）。
+export const CLIENT_ID = "cc65e5fc-05bd-4f5d-a4e8-0df19aa3d75a";
+// 深链协议同国际版客户端日志：`qwenwork://`（cn 站是 `qwenwork-cn://`）
+export const REDIRECT_URI = "qwenwork://";
+
+export const DEVICE_AUTH_URL = `${BASE}/device/selectAccounts`;
+export const POLL_URL = `${BASE}/api/v1/deviceToken/poll`;
+export const REFRESH_URL = `${BASE}/api/v1/deviceToken/refresh`;
+export const USERINFO_URL = `${BASE}/api/v1/userinfo`;
+// 额度/套餐：data.{user,plan,quota}；国际站免费档 pid=`subscription-sgp-free`（新加坡池，与 cn 积分池独立）
+export const ACCOUNT_CONTEXT_URL = `${BASE}/api/v1/adapter/user/account-context?include=user,plan,quota`;
+// 无 `Encode=1`：请求体走纯 JSON（与 cn 同）
+export const CHAT_URL = `${BASE}/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common`;
+export const MODELS_URL = `${BASE}/algo/api/v2/model/list`;
+
+export function envStr(name, fallback) {
+  const v = process.env[name];
+  return typeof v === "string" && v.trim() ? v.trim() : fallback;
+}
+
+// 客户端指纹常量：实测国际站网关接受 cn 同款值（COSY 签名 200），故与 qwenwork 保持一致；
+// 官方国际版客户端自身 UA 为 `qwenwork/1.0.4`，如上游开始校验版本可用下列 env 覆盖排障。
+export const UA = envStr("MSLXDFF_GLOBALQWENWORK_UA", "qoderwork/1.0.5");
+export const COSY_VERSION = envStr("MSLXDFF_GLOBALQWENWORK_COSY_VERSION", "1.1.18");
+export const IDE_VERSION = envStr("MSLXDFF_GLOBALQWENWORK_IDE_VERSION", "1.0.5");
+export const RELEASE_VERSION = envStr("MSLXDFF_GLOBALQWENWORK_RELEASE_VERSION", "1.0.5-26090901");
+export const BUILD = envStr("MSLXDFF_GLOBALQWENWORK_BUILD", "26090901");
+export const CLIENT_TYPE = "6";
+// 业务归属字段：实测国际站接受 cn 同款 `qoder_work`/`agent`/`qwork`（chat 200 出词）
+export const BUSINESS_PRODUCT = "qoder_work";
+export const BUSINESS_TYPE = "agent";
+export const SCENE = "qwork";
+export const MACHINE_OS = "x86_64_win32";
+
+// 上游 model/list 返回 11 个根切片，实测国际站同样**只有 `qwork` 非空**（n=2）；
+// 但切片内容与 cn 站**完全不同池**：cn 是 flash/pro/qwen3.8-max-preview，国际站是下面两个。
+export const MODEL_SLICE = "qwork";
+export const DEFAULT_MODEL = "qwork-auto";
+export const CONTEXT_LENGTH = 180000;
+export const MAX_TOKENS_DEFAULT = 32000;
+
+// 实测模型池（2026-10-01 真号取证，`/algo/api/v2/model/list` 原文）：
+// 两者 is_reasoning=false / is_vl=true / price_factor=0 / max_input_tokens=180000 /
+// context_config 1M(默认)|200K|400K；`qwork-auto` 上游实为 qwen3.8-flash，
+// `qwork-advanced` 上游实为 gpt-5.6-sol（响应头 X-Model-Name 取证）。仅作取数失败时兜底展示。
+export const KNOWN_MODELS = [
+  { key: "qwork-auto", name: "Standard｜Qwen3.8-Flash", priceFactor: 0 },
+  { key: "qwork-advanced", name: "Advanced", priceFactor: 0 },
+];
+
+// RSA-1024 模数：实测国际站接受与 cn **同一枚**模数（COSY 签名 200），逐字符沿用勿改。
+export const RSA_MODULUS_HEX =
+  "c0f22307e5cd362e296bb04470f6de8fbf935ce24e8fcf511a0e2701329769c4" +
+  "a76e499bb938036a52af1eaf818cf79a2600620e3ce87e371d2ca6d85803606a" +
+  "1b3fa5e874643c9ed2db7e85673ef7227fca56e2e7c08f0927609bb896a9f24b" +
+  "e1782099a66016a5bfdc3f1ff756bfc9e88d7b5dc5be30bf45a0223a00ebcecf";
+export const RSA_EXPONENT = 65537;
+
+export const LOGIN_TTL_MS = 10 * 60 * 1000;
+export const COOLDOWN_MS = 30_000;
+export const QUOTA_COOLDOWN_MS = 60 * 60 * 1000;
+export const REFRESH_MARGIN_MS = 30 * 60 * 1000;
+export const MODELS_CACHE_MS = 10 * 60 * 1000;

package/src/providers/globalqwenwork/cosy.js

@@ -0,0 +1,123 @@
+// cosy.js（COSY 会话 + 签名头）— vendor 自 src/providers/qwenwork/cosy.js 逐字搬；
+// 本目录 import 全为相对路径，自动绑定本目录 constants/crypto/rsa。线上头 x-qwenwork-* 与 cn 同名，**禁止改名**（实测 .ai 接受）。
+// 关键不变式（改动即 403）：
+//  · identity/payload 都必须 key 升序紧凑 JSON（sortedCompact）
+//  · 签名 = md5(payloadB64 \n cosyKey \n date \n body \n pathSig)，pathSig 去 /algo 前缀、不含 query
+//  · authorization = `Bearer COSY.${payloadB64}.${sig}`；payloadB64 是**标准 base64（带 padding）**
+//  · 同一 requestId 重放会被上游判 `code 103 Duplicate request`
+import { uuid, b64, b64url, utf8, aesCbcEncrypt, md5 } from "./crypto.js";
+import { rsaPkcs1Encrypt } from "./rsa.js";
+import {
+  COSY_VERSION, IDE_VERSION, RELEASE_VERSION, BUILD, CLIENT_TYPE,
+  BUSINESS_PRODUCT, BUSINESS_TYPE, SCENE, MACHINE_OS, UA,
+} from "./constants.js";
+
+const cache = new Map();
+
+function sortedCompact(obj) {
+  const keys = Object.keys(obj).sort();
+  let out = "{";
+  for (let i = 0; i < keys.length; i++) {
+    if (i > 0) out += ",";
+    out += JSON.stringify(keys[i]) + ":" + JSON.stringify(obj[keys[i]]);
+  }
+  return out + "}";
+}
+
+function newSession(account) {
+  const machineID = uuid();
+  const seed = (uuid() + uuid()).slice(0, 50);
+  const machineToken = b64url(utf8(seed));
+  const machineType = uuid().replace(/-/g, "").slice(0, 18);
+  const tempKey = uuid().replace(/-/g, "").slice(0, 16);
+
+  const identity = sortedCompact({
+    uid: account.uid || "",
+    aid: account.uid || "",
+    name: account.nickname || "",
+    email: account.email || "",
+    security_oauth_token: account.accessToken,
+  });
+
+  return {
+    machineID,
+    machineToken,
+    machineType,
+    tempKey,
+    cosyKey: rsaPkcs1Encrypt(utf8(tempKey)),
+    info: b64(aesCbcEncrypt(utf8(identity), utf8(tempKey))),
+    accessToken: account.accessToken,
+  };
+}
+
+export function sessionFor(account) {
+  if (!account || !account.accessToken) throw new Error("cosy: empty access token");
+  const key = account.id || account.uid || account.accessToken.slice(0, 16);
+  const hit = cache.get(key);
+  if (hit && hit.accessToken === account.accessToken) return hit;
+  if (cache.size > 128) cache.clear();
+  const sess = newSession(account);
+  cache.set(key, sess);
+  return sess;
+}
+
+export function invalidateSession(account) {
+  const key = account && (account.id || account.uid);
+  if (key) cache.delete(key);
+}
+
+function pathSig(rawURL) {
+  const u = new URL(rawURL);
+  let p = u.pathname;
+  if (p.startsWith("/algo")) p = p.slice("/algo".length);
+  return p;
+}
+
+export function signHeaders(account, body, rawURL, modelKey, accept) {
+  const sess = sessionFor(account);
+  const payload = sortedCompact({
+    cosyVersion: COSY_VERSION,
+    ideVersion: IDE_VERSION,
+    info: sess.info,
+    requestId: uuid(),
+    version: "v1",
+  });
+  const payloadB64 = b64(utf8(payload));
+  const date = Math.floor(Date.now() / 1000).toString();
+  const sig = md5(`${payloadB64}\n${sess.cosyKey}\n${date}\n${body}\n${pathSig(rawURL)}`);
+
+  const headers = {
+    accept: accept || "text/event-stream",
+    "content-type": "application/json",
+    "user-agent": UA,
+    "x-request-id": uuid(),
+    "x-qwenwork-version": IDE_VERSION,
+    "x-qwenwork-release-version": RELEASE_VERSION,
+    "x-qwenwork-build": BUILD,
+    "x-qwenwork-platform": "win32",
+    "x-qwenwork-arch": "x64",
+    "x-qwenwork-channel": "stable",
+    "cosy-version": COSY_VERSION,
+    "cosy-clienttype": CLIENT_TYPE,
+    "cosy-business-product": BUSINESS_PRODUCT,
+    "cosy-business-type": BUSINESS_TYPE,
+    "cosy-scene": SCENE,
+    "cosy-machineos": MACHINE_OS,
+    "login-version": "v2",
+    authorization: `Bearer COSY.${payloadB64}.${sig}`,
+    "cosy-key": sess.cosyKey,
+    "cosy-user": account.uid || "",
+    "cosy-date": date,
+    "cosy-machineid": sess.machineID,
+    "accept-encoding": "identity",
+    connection: "keep-alive",
+    "cache-control": "no-cache",
+  };
+  if (modelKey) {
+    headers["x-model-key"] = modelKey;
+    headers["x-model-source"] = "system";
+  }
+  return headers;
+}
+
+// globalqwenwork 变体（国际站 gateway.qwenwork.ai）：协议与 cn 逐字同构，2026-10-01 现网实测签名/请求 200 — 见 docs/adr/0041-globalqwenwork-international-provider.md

package/src/providers/globalqwenwork/crypto.js

@@ -0,0 +1,220 @@
+// vendor 自 qwenwork2api-makers 的 edge-functions/_shared/crypto.js（逐字搬，仅加 webcrypto 兜底）。
+// 原作者手写 AES/RSA/MD5 是因为 Cloudflare Workers 无 node:crypto；**不要**"顺手优化"成原生实现 ——
+// 实测换成 node:crypto 后上游回 `code 101 Signature invalid`（RSA/AES 材料与上游期望不等价）。
+// Node 侧需要 globalThis.crypto（getRandomValues / subtle.digest）；<19 用 node:crypto 的 webcrypto 兜底。
+if (!globalThis.crypto || !globalThis.crypto.subtle) {
+  const { webcrypto } = await import("node:crypto");
+  globalThis.crypto = webcrypto;
+}
+
+const SBOX = (() => {
+  const s = new Uint8Array(256);
+  let p = 1;
+  let q = 1;
+  do {
+    p = p ^ ((p << 1) & 0xff) ^ (p & 0x80 ? 0x1b : 0);
+    q ^= q << 1;
+    q ^= q << 2;
+    q ^= q << 4;
+    if (q & 0x80) q ^= 0x09;
+    q &= 0xff;
+    const x = q ^ ((q << 1) | (q >> 7)) ^ ((q << 2) | (q >> 6)) ^ ((q << 3) | (q >> 5)) ^ ((q << 4) | (q >> 4));
+    s[p] = (x ^ 0x63) & 0xff;
+  } while (p !== 1);
+  s[0] = 0x63;
+  return s;
+})();
+
+const RCON = [0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36];
+
+export function utf8(str) {
+  return new TextEncoder().encode(str);
+}
+
+export function hex(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i++) out += bytes[i].toString(16).padStart(2, "0");
+  return out;
+}
+
+export function b64(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s);
+}
+
+export function unb64(str) {
+  const s = atob(str);
+  const out = new Uint8Array(s.length);
+  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
+  return out;
+}
+
+export function b64url(bytes) {
+  return b64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+export function uuid() {
+  const r = new Uint8Array(16);
+  crypto.getRandomValues(r);
+  r[6] = (r[6] & 0x0f) | 0x40;
+  r[8] = (r[8] & 0x3f) | 0x80;
+  const h = hex(r);
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+
+const MD5_S = [
+  7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
+  4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,
+];
+
+const MD5_K = new Int32Array(64);
+for (let i = 0; i < 64; i++) MD5_K[i] = Math.floor(Math.abs(Math.sin(i + 1)) * 4294967296) | 0;
+
+function rotl(x, n) {
+  return (x << n) | (x >>> (32 - n));
+}
+
+export function md5(input) {
+  const msg = typeof input === "string" ? utf8(input) : input;
+  const len = msg.length;
+  const bitLen = len * 8;
+  const padLen = (56 - ((len + 1) % 64) + 64) % 64;
+  const total = len + 1 + padLen + 8;
+  const buf = new Uint8Array(total);
+  buf.set(msg, 0);
+  buf[len] = 0x80;
+  const view = new DataView(buf.buffer);
+  view.setUint32(total - 8, bitLen >>> 0, true);
+  view.setUint32(total - 4, Math.floor(bitLen / 4294967296), true);
+
+  let a0 = 0x67452301;
+  let b0 = 0xefcdab89;
+  let c0 = 0x98badcfe;
+  let d0 = 0x10325476;
+
+  for (let i = 0; i < total; i += 64) {
+    const m = new Int32Array(16);
+    for (let j = 0; j < 16; j++) m[j] = view.getInt32(i + j * 4, true);
+    let a = a0;
+    let b = b0;
+    let c = c0;
+    let d = d0;
+    for (let j = 0; j < 64; j++) {
+      let f;
+      let g;
+      if (j < 16) {
+        f = (b & c) | (~b & d);
+        g = j;
+      } else if (j < 32) {
+        f = (d & b) | (~d & c);
+        g = (5 * j + 1) % 16;
+      } else if (j < 48) {
+        f = b ^ c ^ d;
+        g = (3 * j + 5) % 16;
+      } else {
+        f = c ^ (b | ~d);
+        g = (7 * j) % 16;
+      }
+      f = (f + a + MD5_K[j] + m[g]) | 0;
+      a = d;
+      d = c;
+      c = b;
+      b = (b + rotl(f, MD5_S[j])) | 0;
+    }
+    a0 = (a0 + a) | 0;
+    b0 = (b0 + b) | 0;
+    c0 = (c0 + c) | 0;
+    d0 = (d0 + d) | 0;
+  }
+
+  const out = new Uint8Array(16);
+  const ov = new DataView(out.buffer);
+  ov.setInt32(0, a0, true);
+  ov.setInt32(4, b0, true);
+  ov.setInt32(8, c0, true);
+  ov.setInt32(12, d0, true);
+  return hex(out);
+}
+
+function xtime(a) {
+  return ((a << 1) ^ (a & 0x80 ? 0x1b : 0)) & 0xff;
+}
+
+function keyExpansion(key) {
+  const w = new Uint8Array(176);
+  w.set(key, 0);
+  for (let i = 4; i < 44; i++) {
+    const t = [w[(i - 1) * 4], w[(i - 1) * 4 + 1], w[(i - 1) * 4 + 2], w[(i - 1) * 4 + 3]];
+    if (i % 4 === 0) {
+      const r = t[0];
+      t[0] = t[1];
+      t[1] = t[2];
+      t[2] = t[3];
+      t[3] = r;
+      for (let j = 0; j < 4; j++) t[j] = SBOX[t[j]];
+      t[0] ^= RCON[i / 4 - 1];
+    }
+    for (let j = 0; j < 4; j++) w[i * 4 + j] = w[(i - 4) * 4 + j] ^ t[j];
+  }
+  return w;
+}
+
+function addRoundKey(state, w, round) {
+  for (let c = 0; c < 4; c++) {
+    for (let r = 0; r < 4; r++) state[c * 4 + r] ^= w[round * 16 + c * 4 + r];
+  }
+}
+
+function subBytes(state) {
+  for (let i = 0; i < 16; i++) state[i] = SBOX[state[i]];
+}
+
+function shiftRows(s) {
+  const t = s.slice();
+  const map = [0, 5, 10, 15, 4, 9, 14, 3, 8, 13, 2, 7, 12, 1, 6, 11];
+  for (let i = 0; i < 16; i++) s[i] = t[map[i]];
+}
+
+function mixColumns(s) {
+  for (let c = 0; c < 4; c++) {
+    const i = c * 4;
+    const a0 = s[i];
+    const a1 = s[i + 1];
+    const a2 = s[i + 2];
+    const a3 = s[i + 3];
+    s[i] = xtime(a0) ^ (xtime(a1) ^ a1) ^ a2 ^ a3;
+    s[i + 1] = a0 ^ xtime(a1) ^ (xtime(a2) ^ a2) ^ a3;
+    s[i + 2] = a0 ^ a1 ^ xtime(a2) ^ (xtime(a3) ^ a3);
+    s[i + 3] = (xtime(a0) ^ a0) ^ a1 ^ a2 ^ xtime(a3);
+  }
+}
+
+export function aesCbcEncrypt(plain, key) {
+  const w = keyExpansion(key);
+  const padLen = 16 - (plain.length % 16);
+  const data = new Uint8Array(plain.length + padLen);
+  data.set(plain, 0);
+  for (let i = plain.length; i < data.length; i++) data[i] = padLen;
+  const out = new Uint8Array(data.length);
+  const block = new Uint8Array(16);
+  let prev = key.slice(0, 16);
+  for (let off = 0; off < data.length; off += 16) {
+    for (let i = 0; i < 16; i++) block[i] = data[off + i] ^ prev[i];
+    addRoundKey(block, w, 0);
+    for (let round = 1; round < 10; round++) {
+      subBytes(block);
+      shiftRows(block);
+      mixColumns(block);
+      addRoundKey(block, w, round);
+    }
+    subBytes(block);
+    shiftRows(block);
+    addRoundKey(block, w, 10);
+    out.set(block, off);
+    prev = block.slice(0, 16);
+  }
+  return out;
+}
+
+// globalqwenwork 变体：国际站 gateway.qwenwork.ai，协议与 cn 逐字同构（2026-10-01 现网取证），仅命名空间与常量不同 — 见 docs/adr/0041-globalqwenwork-international-provider.md

package/src/providers/globalqwenwork/http.js

@@ -0,0 +1,22 @@
+// vendor 自 src/providers/qwenwork/http.js（只保留本 provider 用得上的部分；CORS/preflight 属原项目的边缘层，不带）。
+export function cleanErrorText(value) {
+  let s = String(value === undefined || value === null ? "" : value);
+  s = s
+    .replace(/<script[\s\S]*?<\/script>/gi, " ")
+    .replace(/<style[\s\S]*?<\/style>/gi, " ")
+    .replace(/<[^>]*>/g, " ")
+    .replace(/[\r\n\t]+/g, " ")
+    .replace(/[^\S ]+/g, "")
+    .replace(/\s+/g, " ")
+    .trim();
+  if (s.length > 200) s = s.slice(0, 200);
+  return s;
+}
+
+export function timeoutSignal(ms) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), ms);
+  return { signal: controller.signal, done: () => clearTimeout(timer) };
+}
+
+// globalqwenwork 变体：国际站 gateway.qwenwork.ai，协议与 cn 逐字同构（2026-10-01 现网取证），仅命名空间与常量不同 — 见 docs/adr/0041-globalqwenwork-international-provider.md