mslxdff 0.1.174 → 0.1.175

package/src/providers/codearts/chat.js

@@ -3,7 +3,7 @@
 import crypto from "node:crypto";
 import { joinUrl } from "../base.js";
 import { createTransport } from "../../transport/index.js";
-import { SNAP_BASE, EP_CHAT_V2, chatBaseHeaders, MAAS_TYPE_HEADER, MAAS_BENEFIT } from "./const.js";
+import { SNAP_BASE, EP_CHAT_V2, chatBaseHeaders, MAAS_TYPE_HEADER, MAAS_BENEFIT, MAX_TOKENS_CEILING } from "./const.js";
 import { signRequest } from "./sign.js";
 import { newChatId, preflightResponse, sseToOpenAIResponse, aggregateToCompletion, UpstreamEventError } from "./stream.js";
 
@@ -36,8 +36,14 @@ export function buildUpstreamBody(body, { chatId, upstreamModel }) {
     chat_id: chatId,
   };
   for (const k of PASSTHROUGH_KEYS) {
+    if (k === "max_completion_tokens") continue; // v2 端点不认这个名字（透传 → InferHub.001001005.400，2026-10-16 现网 A/B 复现）
     if (body?.[k] !== undefined && body?.[k] !== null) out[k] = body[k];
   }
+  // Responses 风格客户端只发 max_completion_tokens：映射成 v2 认的 max_tokens（显式 max_tokens 优先）
+  if (out.max_tokens === undefined && body?.max_completion_tokens != null) out.max_tokens = body.max_completion_tokens;
+  // 超上限的 max_tokens 上游一律回 InferHub.001001005.400（参数非法），在这里夹住（env 可放宽）
+  const ceiling = Number.parseInt(process.env.MSLXDFF_CODEARTS_MAX_TOKENS_CEILING ?? "", 10) || MAX_TOKENS_CEILING;
+  if (typeof out.max_tokens === "number" && out.max_tokens > ceiling) out.max_tokens = ceiling;
   return out;
 }
 

package/src/providers/codearts/const.js

@@ -44,7 +44,8 @@ export const MAAS_TYPE_HEADER = "maas_type";
 export const MAAS_BENEFIT = "benefit";
 
 // 冷启动种子：福利套餐轮换后新模型在首次发现前也按福利路由（宁多带不少带，少带即 404）。
-export const SEED_BENEFIT_MODELS = ["deepseek-v4-flash-0731", "deepseek-v4-pro-0813", "glm-5.3-flash"];
+// 现网取证 2026-10-16（福利网关 /api/v1/gateway/config，error_code=0000）共 4 位：下列 4 个 id 逐字对齐上游。
+export const SEED_BENEFIT_MODELS = ["deepseek-v4-flash-0731", "deepseek-v4-pro-0813", "deepseek-v4.1-flash", "glm-5.3-flash"];
 // 内置模型种子（仅用于大小写归一，不标福利）。
 export const SEED_KNOWN_MODELS = [
   "GLM-5.2", "GLM-5.2-ArkTS-SPARK", "GLM-5.1", "GLM-4.7",
@@ -58,3 +59,7 @@ export const CATALOG_TTL_MS = 60 * 60 * 1000;
 export const MODELS_CACHE_TTL_MS = 10 * 60 * 1000;
 // STS 凭证提前刷新量（对齐 codearts2api RefreshSkew 30min）。
 export const REFRESH_SKEW_MS_DEFAULT = 30 * 60 * 1000;
+
+// 上游 max_tokens 真实上限：福利网关自报 131072~393216 是假的 —— 现网实测 65536 通、
+// 98304 即 InferHub.001001005.400（2026-10-16 定位）；此前成功请求均为 64000。
+export const MAX_TOKENS_CEILING = 65536;

package/src/providers/codearts/index.js

@@ -98,20 +98,27 @@ export function createCodeartsProvider({
   // 三路发现（主账号）；结果写目录（benefit 判定按账号隔离）
   let discovering = null;
   async function discover(force = false) {
-    const primary = pool.pickPrimary();
-    if (!primary) throw new Error("codearts: no alive account — run: mslxdff -provider codearts login");
-    if (!force && !catalog.isStale(primary.userId, clock())) return catalog.accountModels(primary.userId);
+    const candidates = pool.aliveAccounts();
+    if (!candidates.length) throw new Error("codearts: no alive account — run: mslxdff -provider codearts login");
     if (discovering) return discovering;
     discovering = (async () => {
-      try {
-        const account = await pool.getCredential(primary.blob);
-        const { models, builtinOk, benefitOk } = await discoverAccountModels({ account, snapBase: resolvedBase, benefitHost, autoClaim, fetchImpl });
-        catalog.setAccount(account.userId, models, { keepBenefit: builtinOk && !benefitOk, now: clock() });
-        return models;
-      } finally {
-        discovering = null;
+      let lastErr = null;
+      // 逐个账号试（blob 顺序 = 主账号优先）：state 里可能留着已被轮转消费的僵尸凭证（实测 STS5.1806
+      // "the refresh token has been used"，login 只追加不清旧，死号会永远排在第一个）。一个死号绝不能
+      // 把整个目录变成空表——福利套餐轮换出的新模型全靠这里发现。
+      for (const candidate of candidates) {
+        if (!force && !catalog.isStale(candidate.userId, clock())) return catalog.accountModels(candidate.userId);
+        try {
+          const account = await pool.getCredential(candidate.blob);
+          const { models, builtinOk, benefitOk } = await discoverAccountModels({ account, snapBase: resolvedBase, benefitHost, autoClaim, fetchImpl });
+          catalog.setAccount(account.userId, models, { keepBenefit: builtinOk && !benefitOk, now: clock() });
+          return models;
+        } catch (err) {
+          lastErr = err; // 死号/该号三路全空 → 换下一个号
+        }
       }
-    })();
+      throw lastErr || new Error("codearts: no account could list models — run: mslxdff -provider codearts login");
+    })().finally(() => { discovering = null; });
     return discovering;
   }
 

package/src/providers/globalqwenwork/cosy.js

@@ -1,123 +1,123 @@
-// cosy.js（COSY 会话 + 签名头）— vendor 自 src/providers/qwenwork/cosy.js 逐字搬；
-// 本目录 import 全为相对路径，自动绑定本目录 constants/crypto/rsa。线上头 x-qwenwork-* 与 cn 同名，**禁止改名**（实测 .ai 接受）。
-// 关键不变式（改动即 403）：
-//  · identity/payload 都必须 key 升序紧凑 JSON（sortedCompact）
-//  · 签名 = md5(payloadB64 \n cosyKey \n date \n body \n pathSig)，pathSig 去 /algo 前缀、不含 query
-//  · authorization = `Bearer COSY.${payloadB64}.${sig}`；payloadB64 是**标准 base64（带 padding）**
-//  · 同一 requestId 重放会被上游判 `code 103 Duplicate request`
-import { uuid, b64, b64url, utf8, aesCbcEncrypt, md5 } from "./crypto.js";
-import { rsaPkcs1Encrypt } from "./rsa.js";
-import {
-  COSY_VERSION, IDE_VERSION, RELEASE_VERSION, BUILD, CLIENT_TYPE,
-  BUSINESS_PRODUCT, BUSINESS_TYPE, SCENE, MACHINE_OS, UA,
-} from "./constants.js";
-
-const cache = new Map();
-
-function sortedCompact(obj) {
-  const keys = Object.keys(obj).sort();
-  let out = "{";
-  for (let i = 0; i < keys.length; i++) {
-    if (i > 0) out += ",";
-    out += JSON.stringify(keys[i]) + ":" + JSON.stringify(obj[keys[i]]);
-  }
-  return out + "}";
-}
-
-function newSession(account) {
-  const machineID = uuid();
-  const seed = (uuid() + uuid()).slice(0, 50);
-  const machineToken = b64url(utf8(seed));
-  const machineType = uuid().replace(/-/g, "").slice(0, 18);
-  const tempKey = uuid().replace(/-/g, "").slice(0, 16);
-
-  const identity = sortedCompact({
-    uid: account.uid || "",
-    aid: account.uid || "",
-    name: account.nickname || "",
-    email: account.email || "",
-    security_oauth_token: account.accessToken,
-  });
-
-  return {
-    machineID,
-    machineToken,
-    machineType,
-    tempKey,
-    cosyKey: rsaPkcs1Encrypt(utf8(tempKey)),
-    info: b64(aesCbcEncrypt(utf8(identity), utf8(tempKey))),
-    accessToken: account.accessToken,
-  };
-}
-
-export function sessionFor(account) {
-  if (!account || !account.accessToken) throw new Error("cosy: empty access token");
-  const key = account.id || account.uid || account.accessToken.slice(0, 16);
-  const hit = cache.get(key);
-  if (hit && hit.accessToken === account.accessToken) return hit;
-  if (cache.size > 128) cache.clear();
-  const sess = newSession(account);
-  cache.set(key, sess);
-  return sess;
-}
-
-export function invalidateSession(account) {
-  const key = account && (account.id || account.uid);
-  if (key) cache.delete(key);
-}
-
-function pathSig(rawURL) {
-  const u = new URL(rawURL);
-  let p = u.pathname;
-  if (p.startsWith("/algo")) p = p.slice("/algo".length);
-  return p;
-}
-
-export function signHeaders(account, body, rawURL, modelKey, accept) {
-  const sess = sessionFor(account);
-  const payload = sortedCompact({
-    cosyVersion: COSY_VERSION,
-    ideVersion: IDE_VERSION,
-    info: sess.info,
-    requestId: uuid(),
-    version: "v1",
-  });
-  const payloadB64 = b64(utf8(payload));
-  const date = Math.floor(Date.now() / 1000).toString();
-  const sig = md5(`${payloadB64}\n${sess.cosyKey}\n${date}\n${body}\n${pathSig(rawURL)}`);
-
-  const headers = {
-    accept: accept || "text/event-stream",
-    "content-type": "application/json",
-    "user-agent": UA,
-    "x-request-id": uuid(),
-    "x-qwenwork-version": IDE_VERSION,
-    "x-qwenwork-release-version": RELEASE_VERSION,
-    "x-qwenwork-build": BUILD,
-    "x-qwenwork-platform": "win32",
-    "x-qwenwork-arch": "x64",
-    "x-qwenwork-channel": "stable",
-    "cosy-version": COSY_VERSION,
-    "cosy-clienttype": CLIENT_TYPE,
-    "cosy-business-product": BUSINESS_PRODUCT,
-    "cosy-business-type": BUSINESS_TYPE,
-    "cosy-scene": SCENE,
-    "cosy-machineos": MACHINE_OS,
-    "login-version": "v2",
-    authorization: `Bearer COSY.${payloadB64}.${sig}`,
-    "cosy-key": sess.cosyKey,
-    "cosy-user": account.uid || "",
-    "cosy-date": date,
-    "cosy-machineid": sess.machineID,
-    "accept-encoding": "identity",
-    connection: "keep-alive",
-    "cache-control": "no-cache",
-  };
-  if (modelKey) {
-    headers["x-model-key"] = modelKey;
-    headers["x-model-source"] = "system";
-  }
-  return headers;
-}
-
-// globalqwenwork 变体（国际站 gateway.qwenwork.ai）：协议与 cn 逐字同构，2026-10-01 现网实测签名/请求 200 — 见 docs/adr/0041-globalqwenwork-international-provider.md
+// cosy.js（COSY 会话 + 签名头）— vendor 自 src/providers/qwenwork/cosy.js 逐字搬；
+// 本目录 import 全为相对路径，自动绑定本目录 constants/crypto/rsa。线上头 x-qwenwork-* 与 cn 同名，**禁止改名**（实测 .ai 接受）。
+// 关键不变式（改动即 403）：
+//  · identity/payload 都必须 key 升序紧凑 JSON（sortedCompact）
+//  · 签名 = md5(payloadB64 \n cosyKey \n date \n body \n pathSig)，pathSig 去 /algo 前缀、不含 query
+//  · authorization = `Bearer COSY.${payloadB64}.${sig}`；payloadB64 是**标准 base64（带 padding）**
+//  · 同一 requestId 重放会被上游判 `code 103 Duplicate request`
+import { uuid, b64, b64url, utf8, aesCbcEncrypt, md5 } from "./crypto.js";
+import { rsaPkcs1Encrypt } from "./rsa.js";
+import {
+  COSY_VERSION, IDE_VERSION, RELEASE_VERSION, BUILD, CLIENT_TYPE,
+  BUSINESS_PRODUCT, BUSINESS_TYPE, SCENE, MACHINE_OS, UA,
+} from "./constants.js";
+
+const cache = new Map();
+
+function sortedCompact(obj) {
+  const keys = Object.keys(obj).sort();
+  let out = "{";
+  for (let i = 0; i < keys.length; i++) {
+    if (i > 0) out += ",";
+    out += JSON.stringify(keys[i]) + ":" + JSON.stringify(obj[keys[i]]);
+  }
+  return out + "}";
+}
+
+function newSession(account) {
+  const machineID = uuid();
+  const seed = (uuid() + uuid()).slice(0, 50);
+  const machineToken = b64url(utf8(seed));
+  const machineType = uuid().replace(/-/g, "").slice(0, 18);
+  const tempKey = uuid().replace(/-/g, "").slice(0, 16);
+
+  const identity = sortedCompact({
+    uid: account.uid || "",
+    aid: account.uid || "",
+    name: account.nickname || "",
+    email: account.email || "",
+    security_oauth_token: account.accessToken,
+  });
+
+  return {
+    machineID,
+    machineToken,
+    machineType,
+    tempKey,
+    cosyKey: rsaPkcs1Encrypt(utf8(tempKey)),
+    info: b64(aesCbcEncrypt(utf8(identity), utf8(tempKey))),
+    accessToken: account.accessToken,
+  };
+}
+
+export function sessionFor(account) {
+  if (!account || !account.accessToken) throw new Error("cosy: empty access token");
+  const key = account.id || account.uid || account.accessToken.slice(0, 16);
+  const hit = cache.get(key);
+  if (hit && hit.accessToken === account.accessToken) return hit;
+  if (cache.size > 128) cache.clear();
+  const sess = newSession(account);
+  cache.set(key, sess);
+  return sess;
+}
+
+export function invalidateSession(account) {
+  const key = account && (account.id || account.uid);
+  if (key) cache.delete(key);
+}
+
+function pathSig(rawURL) {
+  const u = new URL(rawURL);
+  let p = u.pathname;
+  if (p.startsWith("/algo")) p = p.slice("/algo".length);
+  return p;
+}
+
+export function signHeaders(account, body, rawURL, modelKey, accept) {
+  const sess = sessionFor(account);
+  const payload = sortedCompact({
+    cosyVersion: COSY_VERSION,
+    ideVersion: IDE_VERSION,
+    info: sess.info,
+    requestId: uuid(),
+    version: "v1",
+  });
+  const payloadB64 = b64(utf8(payload));
+  const date = Math.floor(Date.now() / 1000).toString();
+  const sig = md5(`${payloadB64}\n${sess.cosyKey}\n${date}\n${body}\n${pathSig(rawURL)}`);
+
+  const headers = {
+    accept: accept || "text/event-stream",
+    "content-type": "application/json",
+    "user-agent": UA,
+    "x-request-id": uuid(),
+    "x-qwenwork-version": IDE_VERSION,
+    "x-qwenwork-release-version": RELEASE_VERSION,
+    "x-qwenwork-build": BUILD,
+    "x-qwenwork-platform": "win32",
+    "x-qwenwork-arch": "x64",
+    "x-qwenwork-channel": "stable",
+    "cosy-version": COSY_VERSION,
+    "cosy-clienttype": CLIENT_TYPE,
+    "cosy-business-product": BUSINESS_PRODUCT,
+    "cosy-business-type": BUSINESS_TYPE,
+    "cosy-scene": SCENE,
+    "cosy-machineos": MACHINE_OS,
+    "login-version": "v2",
+    authorization: `Bearer COSY.${payloadB64}.${sig}`,
+    "cosy-key": sess.cosyKey,
+    "cosy-user": account.uid || "",
+    "cosy-date": date,
+    "cosy-machineid": sess.machineID,
+    "accept-encoding": "identity",
+    connection: "keep-alive",
+    "cache-control": "no-cache",
+  };
+  if (modelKey) {
+    headers["x-model-key"] = modelKey;
+    headers["x-model-source"] = "system";
+  }
+  return headers;
+}
+
+// globalqwenwork 变体（国际站 gateway.qwenwork.ai）：协议与 cn 逐字同构，2026-10-01 现网实测签名/请求 200 — 见 docs/adr/0041-globalqwenwork-international-provider.md