mslxdff 0.1.197 → 0.1.199

package/src/providers/codearts/chat.js

@@ -1,182 +1,182 @@
-// CodeArts 聊天服务：上游 body/头组装 + SDK-HMAC-SHA256 签名 + 401 刷新重试 + 环形切号。
-// 上游恒 stream:true（chatBodyV2 契约）；流式客户端转 OpenAI SSE，非流式聚合回 JSON。
-import crypto from "node:crypto";
-import { joinUrl } from "../base.js";
-import { createTransport } from "../../transport/index.js";
-import { SNAP_BASE, EP_CHAT_V2, chatBaseHeaders, MAAS_TYPE_HEADER, MAAS_BENEFIT, MAX_TOKENS_CEILING } from "./const.js";
-import { signRequest } from "./sign.js";
-import { newChatId, preflightResponse, sseToOpenAIResponse, aggregateToCompletion, UpstreamEventError } from "./stream.js";
-
-const MODEL_RULES = [
-  { match: (m) => String(m || "").toLowerCase().includes("deepseek"), scope: "all" },
-  { match: (m) => /(^kimi-|kimi)/i.test(String(m || "")), scope: "toolCalls" },
-];
-
-// DeepSeek 系思考模式要求 assistant 消息回传 reasoning_content，缺失补 " " 占位（ADR-0001 同款）。
-export function injectReasoningPlaceholder(messages, model) {
-  const rule = MODEL_RULES.find((r) => r.match(model));
-  if (!rule || !Array.isArray(messages)) return messages;
-  return messages.map((m) => {
-    if (m?.role !== "assistant") return m;
-    if (typeof m.reasoning_content === "string" && m.reasoning_content.length) return m;
-    if (rule.scope === "toolCalls" && !(Array.isArray(m.tool_calls) && m.tool_calls.length)) return m;
-    return { ...m, reasoning_content: " " };
-  });
-}
-
-const PASSTHROUGH_KEYS = ["temperature", "top_p", "max_tokens", "max_completion_tokens", "reasoning_effort", "tools", "tool_choice", "stop", "presence_penalty", "frequency_penalty", "response_format", "user", "n", "seed"];
-
-export function buildUpstreamBody(body, { chatId, upstreamModel }) {
-  const out = {
-    model: upstreamModel,
-    stream: true, // v2 端点契约：恒流式，非流式由本层聚合
-    messages: injectReasoningPlaceholder(body?.messages || [], upstreamModel),
-    prompt_cache_key: chatId,
-    tool_stream: true,
-    chat_id: chatId,
-  };
-  for (const k of PASSTHROUGH_KEYS) {
-    if (k === "max_completion_tokens") continue; // v2 端点不认这个名字（透传 → InferHub.001001005.400，2026-10-16 现网 A/B 复现）
-    if (body?.[k] !== undefined && body?.[k] !== null) out[k] = body[k];
-  }
-  // Responses 风格客户端只发 max_completion_tokens：映射成 v2 认的 max_tokens（显式 max_tokens 优先）
-  if (out.max_tokens === undefined && body?.max_completion_tokens != null) out.max_tokens = body.max_completion_tokens;
-  // 超上限的 max_tokens 上游一律回 InferHub.001001005.400（参数非法），在这里夹住（env 可放宽）
-  const ceiling = Number.parseInt(process.env.MSLXDFF_CODEARTS_MAX_TOKENS_CEILING ?? "", 10) || MAX_TOKENS_CEILING;
-  if (typeof out.max_tokens === "number" && out.max_tokens > ceiling) out.max_tokens = ceiling;
-  return out;
-}
-
-// Session-Id：由 chatId 派生的稳定会话标识（prompt cache 亲和，对齐 Go sessionIDFor）。
-function sessionIdFor(chatId) {
-  return crypto.createHash("sha256").update(`codearts-session:${chatId}`, "utf8").digest("hex").slice(0, 32);
-}
-
-function stripOwnPrefix(model, providerId) {
-  const s = String(model || "");
-  const i = s.indexOf("/");
-  if (i <= 0) return s;
-  return s.slice(0, i).toLowerCase() === String(providerId || "").toLowerCase() ? s.slice(i + 1) : s;
-}
-
-export function createChatService({
-  id = "codearts",
-  baseUrl = SNAP_BASE,
-  chatPath = EP_CHAT_V2,
-  fetchImpl,
-  dispatcher,
-  authPool,
-  catalog,
-  connectTimeoutMs = 30_000,
-  clock = Date.now,
-  } = {}) {
-  const resolvedBase = String(baseUrl).trim().replace(/\/+$/, "") || SNAP_BASE;
-  const transport = createTransport({ fetchImpl, dispatcher, keepAlive: !!dispatcher, timeoutMs: connectTimeoutMs, retry: {} });
-
-  async function sendOnce({ bodyStr, account, benefit, chatId, sessionId, traceId }) {
-    const url = joinUrl(resolvedBase, chatPath);
-    const h = chatBaseHeaders(account.securityToken, traceId);
-    if (benefit) h[MAAS_TYPE_HEADER] = MAAS_BENEFIT;
-    const { headers } = signRequest({ method: "POST", url, headers: h, body: bodyStr, cred: account });
-    // Chat-Id / Session-Id 在签名之后追加（对齐官方客户端：不进 SignedHeaders）。
-    headers["chat-id"] = chatId;
-    headers["session-id"] = sessionId;
-    return transport.request({ url, method: "POST", headers, body: bodyStr, stream: true, timeoutMs: connectTimeoutMs });
-  }
-
-  function errRes(status, msg, code) {
-    return new Response(JSON.stringify({ error: { message: msg, type: "upstream_error", ...(code ? { code } : {}) } }), {
-      status,
-      headers: { "Content-Type": "application/json" },
-    });
-  }
-
-  function withTiming(res, t0) {
-    try { res._t = { attempts: [], waitMs: 0, totalMs: Math.round(clock() - t0) }; } catch {}
-    return res;
-  }
-
-  /**
-   * 跑一次对话。body.model 已由 dispatcher 剥前缀（容忍自带前缀）。
-   * @returns {Promise<Response>} 流式 → OpenAI SSE；非流式 → chat.completion JSON
-   */
-  async function runChat(body, activeRing, opts = {}) {
-    const t0 = clock();
-    const requestedModel = String(body?.model || "");
-    const rawModel = stripOwnPrefix(requestedModel, id);
-    const upstreamModel = catalog?.canonical(rawModel) || rawModel;
-    const chatId = newChatId(body, opts);
-    const sessionId = sessionIdFor(chatId);
-    const upstreamBody = buildUpstreamBody(body, { chatId, upstreamModel });
-    const bodyStr = JSON.stringify(upstreamBody);
-    const isStream = body?.stream === true;
-    let lastErr = null;
-
-    const maxTries = Math.max(1, activeRing.size || 1);
-    for (let attempt = 0; attempt < maxTries; attempt++) {
-      const blob = activeRing.next();
-      if (!blob) break;
-      let account;
-      try {
-        account = await authPool.getCredential(blob);
-      } catch (err) {
-        try { activeRing.onError(blob); } catch {}
-        lastErr = err;
-        continue; // 死号/不在池：换下一个账号
-      }
-      const benefit = catalog?.isBenefit ? catalog.isBenefit(account.userId, upstreamModel) : false;
-      const traceId = crypto.randomBytes(8).toString("hex") + String(clock());
-      let res;
-      try {
-        res = await sendOnce({ bodyStr, account, benefit, chatId, sessionId, traceId });
-      } catch (err) {
-        try { activeRing.onError(blob); } catch {}
-        lastErr = err;
-        continue;
-      }
-      if (res.status === 401 || res.status === 403) {
-        // STS 临时凭证失效：强制刷新重试一次，仍 401/403 换号
-        authPool.invalidate(blob);
-        let account2 = null;
-        try { account2 = await authPool.getCredential(blob); } catch { /* 死号 → 换号 */ }
-        if (account2) {
-          const traceId2 = crypto.randomBytes(8).toString("hex") + String(clock());
-          try { res = await sendOnce({ bodyStr, account: account2, benefit, chatId, sessionId, traceId: traceId2 }); } catch (err2) { lastErr = err2; try { activeRing.onError(blob); } catch {} continue; }
-          if (res.status === 401 || res.status === 403) {
-            try { await res.text(); } catch {}
-            try { activeRing.onError(blob); } catch {}
-            lastErr = new Error(`codearts auth still failing after refresh (http ${res.status})`);
-            continue;
-          }
-        } else {
-          try { activeRing.onError(blob); } catch {}
-          continue;
-        }
-      }
-      if (res.status >= 400) {
-        const txt = await res.text().catch(() => "");
-        if (res.status === 429 || res.status >= 500) try { activeRing.onError(blob); } catch {}
-        return withTiming(errRes(res.status, `codearts upstream http ${res.status}: ${String(txt).slice(0, 300)}`), t0);
-      }
-      try {
-        const pre = await preflightResponse(res); // HTTP 200 内嵌错误（排队/未注册/福利未领）→ 抛 UpstreamEventError
-        if (isStream) return withTiming(sseToOpenAIResponse(pre, { model: requestedModel || upstreamModel, id: `chatcmpl-${chatId.slice(0, 12)}` }), t0);
-        const data = await aggregateToCompletion(pre, { model: requestedModel || upstreamModel, id: `chatcmpl-${chatId.slice(0, 12)}` });
-        return withTiming(new Response(JSON.stringify(data), { status: 200, headers: { "Content-Type": "application/json" } }), t0);
-      } catch (err) {
-        if (err instanceof UpstreamEventError) {
-          if (err.status === 429 || err.status >= 500) try { activeRing.onError(blob); } catch {}
-          return withTiming(errRes(err.status, `codearts upstream: ${err.message}`, err.code), t0);
-        }
-        try { activeRing.onError(blob); } catch {}
-        lastErr = err;
-        continue;
-      }
-    }
-    throw Object.assign(lastErr || new Error("codearts: all accounts unavailable"), {
-      _t: { attempts: [], waitMs: 0, totalMs: Math.round(clock() - t0) },
-    });
-  }
-
-  return { runChat, buildUpstreamBody, injectReasoningPlaceholder, _sendOnce: sendOnce };
-}
+// CodeArts 聊天服务：上游 body/头组装 + SDK-HMAC-SHA256 签名 + 401 刷新重试 + 环形切号。
+// 上游恒 stream:true（chatBodyV2 契约）；流式客户端转 OpenAI SSE，非流式聚合回 JSON。
+import crypto from "node:crypto";
+import { joinUrl } from "../base.js";
+import { createTransport } from "../../transport/index.js";
+import { SNAP_BASE, EP_CHAT_V2, chatBaseHeaders, MAAS_TYPE_HEADER, MAAS_BENEFIT, MAX_TOKENS_CEILING } from "./const.js";
+import { signRequest } from "./sign.js";
+import { newChatId, preflightResponse, sseToOpenAIResponse, aggregateToCompletion, UpstreamEventError } from "./stream.js";
+
+const MODEL_RULES = [
+  { match: (m) => String(m || "").toLowerCase().includes("deepseek"), scope: "all" },
+  { match: (m) => /(^kimi-|kimi)/i.test(String(m || "")), scope: "toolCalls" },
+];
+
+// DeepSeek 系思考模式要求 assistant 消息回传 reasoning_content，缺失补 " " 占位（ADR-0001 同款）。
+export function injectReasoningPlaceholder(messages, model) {
+  const rule = MODEL_RULES.find((r) => r.match(model));
+  if (!rule || !Array.isArray(messages)) return messages;
+  return messages.map((m) => {
+    if (m?.role !== "assistant") return m;
+    if (typeof m.reasoning_content === "string" && m.reasoning_content.length) return m;
+    if (rule.scope === "toolCalls" && !(Array.isArray(m.tool_calls) && m.tool_calls.length)) return m;
+    return { ...m, reasoning_content: " " };
+  });
+}
+
+const PASSTHROUGH_KEYS = ["temperature", "top_p", "max_tokens", "max_completion_tokens", "reasoning_effort", "tools", "tool_choice", "stop", "presence_penalty", "frequency_penalty", "response_format", "user", "n", "seed"];
+
+export function buildUpstreamBody(body, { chatId, upstreamModel }) {
+  const out = {
+    model: upstreamModel,
+    stream: true, // v2 端点契约：恒流式，非流式由本层聚合
+    messages: injectReasoningPlaceholder(body?.messages || [], upstreamModel),
+    prompt_cache_key: chatId,
+    tool_stream: true,
+    chat_id: chatId,
+  };
+  for (const k of PASSTHROUGH_KEYS) {
+    if (k === "max_completion_tokens") continue; // v2 端点不认这个名字（透传 → InferHub.001001005.400，2026-10-16 现网 A/B 复现）
+    if (body?.[k] !== undefined && body?.[k] !== null) out[k] = body[k];
+  }
+  // Responses 风格客户端只发 max_completion_tokens：映射成 v2 认的 max_tokens（显式 max_tokens 优先）
+  if (out.max_tokens === undefined && body?.max_completion_tokens != null) out.max_tokens = body.max_completion_tokens;
+  // 超上限的 max_tokens 上游一律回 InferHub.001001005.400（参数非法），在这里夹住（env 可放宽）
+  const ceiling = Number.parseInt(process.env.MSLXDFF_CODEARTS_MAX_TOKENS_CEILING ?? "", 10) || MAX_TOKENS_CEILING;
+  if (typeof out.max_tokens === "number" && out.max_tokens > ceiling) out.max_tokens = ceiling;
+  return out;
+}
+
+// Session-Id：由 chatId 派生的稳定会话标识（prompt cache 亲和，对齐 Go sessionIDFor）。
+function sessionIdFor(chatId) {
+  return crypto.createHash("sha256").update(`codearts-session:${chatId}`, "utf8").digest("hex").slice(0, 32);
+}
+
+function stripOwnPrefix(model, providerId) {
+  const s = String(model || "");
+  const i = s.indexOf("/");
+  if (i <= 0) return s;
+  return s.slice(0, i).toLowerCase() === String(providerId || "").toLowerCase() ? s.slice(i + 1) : s;
+}
+
+export function createChatService({
+  id = "codearts",
+  baseUrl = SNAP_BASE,
+  chatPath = EP_CHAT_V2,
+  fetchImpl,
+  dispatcher,
+  authPool,
+  catalog,
+  connectTimeoutMs = 30_000,
+  clock = Date.now,
+  } = {}) {
+  const resolvedBase = String(baseUrl).trim().replace(/\/+$/, "") || SNAP_BASE;
+  const transport = createTransport({ fetchImpl, dispatcher, keepAlive: !!dispatcher, timeoutMs: connectTimeoutMs, retry: {} });
+
+  async function sendOnce({ bodyStr, account, benefit, chatId, sessionId, traceId }) {
+    const url = joinUrl(resolvedBase, chatPath);
+    const h = chatBaseHeaders(account.securityToken, traceId);
+    if (benefit) h[MAAS_TYPE_HEADER] = MAAS_BENEFIT;
+    const { headers } = signRequest({ method: "POST", url, headers: h, body: bodyStr, cred: account });
+    // Chat-Id / Session-Id 在签名之后追加（对齐官方客户端：不进 SignedHeaders）。
+    headers["chat-id"] = chatId;
+    headers["session-id"] = sessionId;
+    return transport.request({ url, method: "POST", headers, body: bodyStr, stream: true, timeoutMs: connectTimeoutMs });
+  }
+
+  function errRes(status, msg, code) {
+    return new Response(JSON.stringify({ error: { message: msg, type: "upstream_error", ...(code ? { code } : {}) } }), {
+      status,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  function withTiming(res, t0) {
+    try { res._t = { attempts: [], waitMs: 0, totalMs: Math.round(clock() - t0) }; } catch {}
+    return res;
+  }
+
+  /**
+   * 跑一次对话。body.model 已由 dispatcher 剥前缀（容忍自带前缀）。
+   * @returns {Promise<Response>} 流式 → OpenAI SSE；非流式 → chat.completion JSON
+   */
+  async function runChat(body, activeRing, opts = {}) {
+    const t0 = clock();
+    const requestedModel = String(body?.model || "");
+    const rawModel = stripOwnPrefix(requestedModel, id);
+    const upstreamModel = catalog?.canonical(rawModel) || rawModel;
+    const chatId = newChatId(body, opts);
+    const sessionId = sessionIdFor(chatId);
+    const upstreamBody = buildUpstreamBody(body, { chatId, upstreamModel });
+    const bodyStr = JSON.stringify(upstreamBody);
+    const isStream = body?.stream === true;
+    let lastErr = null;
+
+    const maxTries = Math.max(1, activeRing.size || 1);
+    for (let attempt = 0; attempt < maxTries; attempt++) {
+      const blob = activeRing.next();
+      if (!blob) break;
+      let account;
+      try {
+        account = await authPool.getCredential(blob);
+      } catch (err) {
+        try { activeRing.onError(blob); } catch {}
+        lastErr = err;
+        continue; // 死号/不在池：换下一个账号
+      }
+      const benefit = catalog?.isBenefit ? catalog.isBenefit(account.userId, upstreamModel) : false;
+      const traceId = crypto.randomBytes(8).toString("hex") + String(clock());
+      let res;
+      try {
+        res = await sendOnce({ bodyStr, account, benefit, chatId, sessionId, traceId });
+      } catch (err) {
+        try { activeRing.onError(blob); } catch {}
+        lastErr = err;
+        continue;
+      }
+      if (res.status === 401 || res.status === 403) {
+        // STS 临时凭证失效：强制刷新重试一次，仍 401/403 换号
+        authPool.invalidate(blob);
+        let account2 = null;
+        try { account2 = await authPool.getCredential(blob); } catch { /* 死号 → 换号 */ }
+        if (account2) {
+          const traceId2 = crypto.randomBytes(8).toString("hex") + String(clock());
+          try { res = await sendOnce({ bodyStr, account: account2, benefit, chatId, sessionId, traceId: traceId2 }); } catch (err2) { lastErr = err2; try { activeRing.onError(blob); } catch {} continue; }
+          if (res.status === 401 || res.status === 403) {
+            try { await res.text(); } catch {}
+            try { activeRing.onError(blob); } catch {}
+            lastErr = new Error(`codearts auth still failing after refresh (http ${res.status})`);
+            continue;
+          }
+        } else {
+          try { activeRing.onError(blob); } catch {}
+          continue;
+        }
+      }
+      if (res.status >= 400) {
+        const txt = await res.text().catch(() => "");
+        if (res.status === 429 || res.status >= 500) try { activeRing.onError(blob); } catch {}
+        return withTiming(errRes(res.status, `codearts upstream http ${res.status}: ${String(txt).slice(0, 300)}`), t0);
+      }
+      try {
+        const pre = await preflightResponse(res); // HTTP 200 内嵌错误（排队/未注册/福利未领）→ 抛 UpstreamEventError
+        if (isStream) return withTiming(sseToOpenAIResponse(pre, { model: requestedModel || upstreamModel, id: `chatcmpl-${chatId.slice(0, 12)}` }), t0);
+        const data = await aggregateToCompletion(pre, { model: requestedModel || upstreamModel, id: `chatcmpl-${chatId.slice(0, 12)}` });
+        return withTiming(new Response(JSON.stringify(data), { status: 200, headers: { "Content-Type": "application/json" } }), t0);
+      } catch (err) {
+        if (err instanceof UpstreamEventError) {
+          if (err.status === 429 || err.status >= 500) try { activeRing.onError(blob); } catch {}
+          return withTiming(errRes(err.status, `codearts upstream: ${err.message}`, err.code), t0);
+        }
+        try { activeRing.onError(blob); } catch {}
+        lastErr = err;
+        continue;
+      }
+    }
+    throw Object.assign(lastErr || new Error("codearts: all accounts unavailable"), {
+      _t: { attempts: [], waitMs: 0, totalMs: Math.round(clock() - t0) },
+    });
+  }
+
+  return { runChat, buildUpstreamBody, injectReasoningPlaceholder, _sendOnce: sendOnce };
+}

package/src/providers/globalqwenwork/cosy.js

@@ -1,123 +1,123 @@
-// cosy.js（COSY 会话 + 签名头）— vendor 自 src/providers/qwenwork/cosy.js 逐字搬；
-// 本目录 import 全为相对路径，自动绑定本目录 constants/crypto/rsa。线上头 x-qwenwork-* 与 cn 同名，**禁止改名**（实测 .ai 接受）。
-// 关键不变式（改动即 403）：
-//  · identity/payload 都必须 key 升序紧凑 JSON（sortedCompact）
-//  · 签名 = md5(payloadB64 \n cosyKey \n date \n body \n pathSig)，pathSig 去 /algo 前缀、不含 query
-//  · authorization = `Bearer COSY.${payloadB64}.${sig}`；payloadB64 是**标准 base64（带 padding）**
-//  · 同一 requestId 重放会被上游判 `code 103 Duplicate request`
-import { uuid, b64, b64url, utf8, aesCbcEncrypt, md5 } from "./crypto.js";
-import { rsaPkcs1Encrypt } from "./rsa.js";
-import {
-  COSY_VERSION, IDE_VERSION, RELEASE_VERSION, BUILD, CLIENT_TYPE,
-  BUSINESS_PRODUCT, BUSINESS_TYPE, SCENE, MACHINE_OS, UA,
-} from "./constants.js";
-
-const cache = new Map();
-
-function sortedCompact(obj) {
-  const keys = Object.keys(obj).sort();
-  let out = "{";
-  for (let i = 0; i < keys.length; i++) {
-    if (i > 0) out += ",";
-    out += JSON.stringify(keys[i]) + ":" + JSON.stringify(obj[keys[i]]);
-  }
-  return out + "}";
-}
-
-function newSession(account) {
-  const machineID = uuid();
-  const seed = (uuid() + uuid()).slice(0, 50);
-  const machineToken = b64url(utf8(seed));
-  const machineType = uuid().replace(/-/g, "").slice(0, 18);
-  const tempKey = uuid().replace(/-/g, "").slice(0, 16);
-
-  const identity = sortedCompact({
-    uid: account.uid || "",
-    aid: account.uid || "",
-    name: account.nickname || "",
-    email: account.email || "",
-    security_oauth_token: account.accessToken,
-  });
-
-  return {
-    machineID,
-    machineToken,
-    machineType,
-    tempKey,
-    cosyKey: rsaPkcs1Encrypt(utf8(tempKey)),
-    info: b64(aesCbcEncrypt(utf8(identity), utf8(tempKey))),
-    accessToken: account.accessToken,
-  };
-}
-
-export function sessionFor(account) {
-  if (!account || !account.accessToken) throw new Error("cosy: empty access token");
-  const key = account.id || account.uid || account.accessToken.slice(0, 16);
-  const hit = cache.get(key);
-  if (hit && hit.accessToken === account.accessToken) return hit;
-  if (cache.size > 128) cache.clear();
-  const sess = newSession(account);
-  cache.set(key, sess);
-  return sess;
-}
-
-export function invalidateSession(account) {
-  const key = account && (account.id || account.uid);
-  if (key) cache.delete(key);
-}
-
-function pathSig(rawURL) {
-  const u = new URL(rawURL);
-  let p = u.pathname;
-  if (p.startsWith("/algo")) p = p.slice("/algo".length);
-  return p;
-}
-
-export function signHeaders(account, body, rawURL, modelKey, accept) {
-  const sess = sessionFor(account);
-  const payload = sortedCompact({
-    cosyVersion: COSY_VERSION,
-    ideVersion: IDE_VERSION,
-    info: sess.info,
-    requestId: uuid(),
-    version: "v1",
-  });
-  const payloadB64 = b64(utf8(payload));
-  const date = Math.floor(Date.now() / 1000).toString();
-  const sig = md5(`${payloadB64}\n${sess.cosyKey}\n${date}\n${body}\n${pathSig(rawURL)}`);
-
-  const headers = {
-    accept: accept || "text/event-stream",
-    "content-type": "application/json",
-    "user-agent": UA,
-    "x-request-id": uuid(),
-    "x-qwenwork-version": IDE_VERSION,
-    "x-qwenwork-release-version": RELEASE_VERSION,
-    "x-qwenwork-build": BUILD,
-    "x-qwenwork-platform": "win32",
-    "x-qwenwork-arch": "x64",
-    "x-qwenwork-channel": "stable",
-    "cosy-version": COSY_VERSION,
-    "cosy-clienttype": CLIENT_TYPE,
-    "cosy-business-product": BUSINESS_PRODUCT,
-    "cosy-business-type": BUSINESS_TYPE,
-    "cosy-scene": SCENE,
-    "cosy-machineos": MACHINE_OS,
-    "login-version": "v2",
-    authorization: `Bearer COSY.${payloadB64}.${sig}`,
-    "cosy-key": sess.cosyKey,
-    "cosy-user": account.uid || "",
-    "cosy-date": date,
-    "cosy-machineid": sess.machineID,
-    "accept-encoding": "identity",
-    connection: "keep-alive",
-    "cache-control": "no-cache",
-  };
-  if (modelKey) {
-    headers["x-model-key"] = modelKey;
-    headers["x-model-source"] = "system";
-  }
-  return headers;
-}
-
-// globalqwenwork 变体（国际站 gateway.qwenwork.ai）：协议与 cn 逐字同构，2026-10-01 现网实测签名/请求 200 — 见 docs/adr/0041-globalqwenwork-international-provider.md
+// cosy.js（COSY 会话 + 签名头）— vendor 自 src/providers/qwenwork/cosy.js 逐字搬；
+// 本目录 import 全为相对路径，自动绑定本目录 constants/crypto/rsa。线上头 x-qwenwork-* 与 cn 同名，**禁止改名**（实测 .ai 接受）。
+// 关键不变式（改动即 403）：
+//  · identity/payload 都必须 key 升序紧凑 JSON（sortedCompact）
+//  · 签名 = md5(payloadB64 \n cosyKey \n date \n body \n pathSig)，pathSig 去 /algo 前缀、不含 query
+//  · authorization = `Bearer COSY.${payloadB64}.${sig}`；payloadB64 是**标准 base64（带 padding）**
+//  · 同一 requestId 重放会被上游判 `code 103 Duplicate request`
+import { uuid, b64, b64url, utf8, aesCbcEncrypt, md5 } from "./crypto.js";
+import { rsaPkcs1Encrypt } from "./rsa.js";
+import {
+  COSY_VERSION, IDE_VERSION, RELEASE_VERSION, BUILD, CLIENT_TYPE,
+  BUSINESS_PRODUCT, BUSINESS_TYPE, SCENE, MACHINE_OS, UA,
+} from "./constants.js";
+
+const cache = new Map();
+
+function sortedCompact(obj) {
+  const keys = Object.keys(obj).sort();
+  let out = "{";
+  for (let i = 0; i < keys.length; i++) {
+    if (i > 0) out += ",";
+    out += JSON.stringify(keys[i]) + ":" + JSON.stringify(obj[keys[i]]);
+  }
+  return out + "}";
+}
+
+function newSession(account) {
+  const machineID = uuid();
+  const seed = (uuid() + uuid()).slice(0, 50);
+  const machineToken = b64url(utf8(seed));
+  const machineType = uuid().replace(/-/g, "").slice(0, 18);
+  const tempKey = uuid().replace(/-/g, "").slice(0, 16);
+
+  const identity = sortedCompact({
+    uid: account.uid || "",
+    aid: account.uid || "",
+    name: account.nickname || "",
+    email: account.email || "",
+    security_oauth_token: account.accessToken,
+  });
+
+  return {
+    machineID,
+    machineToken,
+    machineType,
+    tempKey,
+    cosyKey: rsaPkcs1Encrypt(utf8(tempKey)),
+    info: b64(aesCbcEncrypt(utf8(identity), utf8(tempKey))),
+    accessToken: account.accessToken,
+  };
+}
+
+export function sessionFor(account) {
+  if (!account || !account.accessToken) throw new Error("cosy: empty access token");
+  const key = account.id || account.uid || account.accessToken.slice(0, 16);
+  const hit = cache.get(key);
+  if (hit && hit.accessToken === account.accessToken) return hit;
+  if (cache.size > 128) cache.clear();
+  const sess = newSession(account);
+  cache.set(key, sess);
+  return sess;
+}
+
+export function invalidateSession(account) {
+  const key = account && (account.id || account.uid);
+  if (key) cache.delete(key);
+}
+
+function pathSig(rawURL) {
+  const u = new URL(rawURL);
+  let p = u.pathname;
+  if (p.startsWith("/algo")) p = p.slice("/algo".length);
+  return p;
+}
+
+export function signHeaders(account, body, rawURL, modelKey, accept) {
+  const sess = sessionFor(account);
+  const payload = sortedCompact({
+    cosyVersion: COSY_VERSION,
+    ideVersion: IDE_VERSION,
+    info: sess.info,
+    requestId: uuid(),
+    version: "v1",
+  });
+  const payloadB64 = b64(utf8(payload));
+  const date = Math.floor(Date.now() / 1000).toString();
+  const sig = md5(`${payloadB64}\n${sess.cosyKey}\n${date}\n${body}\n${pathSig(rawURL)}`);
+
+  const headers = {
+    accept: accept || "text/event-stream",
+    "content-type": "application/json",
+    "user-agent": UA,
+    "x-request-id": uuid(),
+    "x-qwenwork-version": IDE_VERSION,
+    "x-qwenwork-release-version": RELEASE_VERSION,
+    "x-qwenwork-build": BUILD,
+    "x-qwenwork-platform": "win32",
+    "x-qwenwork-arch": "x64",
+    "x-qwenwork-channel": "stable",
+    "cosy-version": COSY_VERSION,
+    "cosy-clienttype": CLIENT_TYPE,
+    "cosy-business-product": BUSINESS_PRODUCT,
+    "cosy-business-type": BUSINESS_TYPE,
+    "cosy-scene": SCENE,
+    "cosy-machineos": MACHINE_OS,
+    "login-version": "v2",
+    authorization: `Bearer COSY.${payloadB64}.${sig}`,
+    "cosy-key": sess.cosyKey,
+    "cosy-user": account.uid || "",
+    "cosy-date": date,
+    "cosy-machineid": sess.machineID,
+    "accept-encoding": "identity",
+    connection: "keep-alive",
+    "cache-control": "no-cache",
+  };
+  if (modelKey) {
+    headers["x-model-key"] = modelKey;
+    headers["x-model-source"] = "system";
+  }
+  return headers;
+}
+
+// globalqwenwork 变体（国际站 gateway.qwenwork.ai）：协议与 cn 逐字同构，2026-10-01 现网实测签名/请求 200 — 见 docs/adr/0041-globalqwenwork-international-provider.md