mslxdff 0.1.231 → 0.1.233

package/src/providers/qoder/models.js

@@ -1,5 +1,8 @@
- // qoder 模型服务（转译 bridge.go ListModels/extractModels）：原生 COSY 签名拉 /model/list，
- // 10min 缓存（按 region 分桶）；只暴露 enable=true 的可用模型（enable=false 调对话必挂，不展示）。
+// qoder 模型服务（对齐官方 qodercli + 外部参考 magpie qoder 插件/CLIProxyAPI）：
+// 原生 COSY 签名拉 /model/list，10min 缓存（按 region 分桶）；
+// 只暴露 enable=true 的可调用模型（enable=false 调对话必挂，不展示）。
+// context_config（多窗口 200K/400K/1M）与 thinking_config（推理档位）随目录带出，
+// 供 payload 选窗口/档位、供能力层展示——旧版只留 max_input_tokens，拿不到多窗口是"不好用"的一环。
 import { compatFetch, timeoutSignal } from "../../compat.js";
 import { getEndpoints, normalizeRegion } from "./constants.js";
 import { buildCosyHeaders, pathSigFrom } from "./session.js";
@@ -9,10 +12,57 @@ const CACHE_TTL_MS = 10 * 60 * 1000;
 const CREATED = 1753600000;
 const OWNER = "qoder";
 
+const positive = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
+
+// context_config → { windows:[...升序], defaultWindow }（Qoder 的 Context 设置：200K/400K/1M）
+function parseContextConfig(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
+  const windows = [];
+  let defaultWindow;
+  for (const raw of Object.values(value)) {
+    if (typeof raw !== "object" || raw === null) continue;
+    const tc = positive(raw.token_count);
+    if (tc === undefined) continue;
+    windows.push(tc);
+    if (raw.is_default === true) defaultWindow = tc;
+  }
+  windows.sort((a, b) => a - b);
+  return {
+    ...(windows.length ? { windows } : {}),
+    ...(defaultWindow !== undefined ? { defaultWindow } : {}),
+  };
+}
+
+// thinking_config → { efforts:[...], defaultEffort, enabled }（推理档位与是否可关思考）
+const EFFORT_ORDER = ["low", "medium", "high", "xhigh", "max"];
+function parseThinkingConfig(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
+  const out = {};
+  const isDefault = (e) => typeof e === "object" && e !== null && e.is_default === true;
+  const enabled = value.enabled && typeof value.enabled === "object" ? value.enabled : null;
+  if (enabled) {
+    out.thinks = true;
+    const raw = typeof enabled.efforts === "object" && enabled.efforts !== null && !Array.isArray(enabled.efforts) ? enabled.efforts : null;
+    if (raw) {
+      const efforts = Object.keys(raw).filter((k) => k.trim());
+      efforts.sort((a, b) => (EFFORT_ORDER.indexOf(a) < 0 ? 99 : EFFORT_ORDER.indexOf(a)) - (EFFORT_ORDER.indexOf(b) < 0 ? 99 : EFFORT_ORDER.indexOf(b)));
+      if (efforts.length) out.efforts = efforts;
+      for (const [k, v] of Object.entries(raw)) if (isDefault(v)) out.defaultEffort = k;
+    }
+  }
+  if (value.disabled && typeof value.disabled === "object") out.alwaysThinks = false;
+  // enabled.is_default 与 disabled.is_default 都为 true/都 false → 上游给的是"默认开还是默认关"
+  if (enabled && isDefault(value.disabled)) out.thinkDefault = false;
+  else if (enabled && isDefault(enabled)) out.thinkDefault = true;
+  return out;
+}
+
 export function extractModels(chatList) {
   const out = [];
   for (const m of Array.isArray(chatList) ? chatList : []) {
     if (!m?.key) continue;
+    const ctx = parseContextConfig(m.context_config);
+    const think = parseThinkingConfig(m.thinking_config);
     out.push({
       id: m.key,
       name: String(m.display_name || m.key),
@@ -20,12 +70,18 @@ export function extractModels(chatList) {
       isDefault: Boolean(m.is_default),
       isReasoning: Boolean(m.is_reasoning),
       contextLength: Number(m.max_input_tokens) || 0,
+      maxOutputTokens: positive(m.max_output_tokens),
       priceFactor: Number(m.price_factor) || 0,
+      isVl: m.is_vl === true,
+      source: m.source || "system",
+      ...ctx,
+      ...think,
     });
   }
   return out;
 }
 
+
 export function createModelsService({ id = "qoder", fetchImpl, clock = Date.now } = {}) {
   let cache = null, fetchedAt = 0;
 
@@ -59,6 +115,12 @@ export function createModelsService({ id = "qoder", fetchImpl, clock = Date.now
        enable: true,
        is_reasoning: m.isReasoning,
        price_factor: m.priceFactor,
+       // 供 payload 选窗口/档位、能力层展示（随目录带出，不进 /v1/models 也无害，额外字段客户端忽略）
+       ...(m.windows ? { context_windows: m.windows } : {}),
+       ...(m.defaultWindow ? { default_window: m.defaultWindow } : {}),
+       ...(m.efforts ? { reasoning_efforts: m.efforts } : {}),
+       ...(m.defaultEffort ? { default_reasoning_effort: m.defaultEffort } : {}),
+       ...(m.maxOutputTokens ? { max_output_tokens: m.maxOutputTokens } : {}),
      }));
      cacheByRegion.set(normRegion, { list, at: now });
      // 兼容旧单测 _getCache：默认读 global 桶

package/src/providers/qoder/oauth.js

@@ -4,7 +4,7 @@
 // 3. fetchUserInfo: GET /api/v1/userinfo（Bearer dt-xxx）→ uid/name/organization_id
 import { randomBytes, createHash } from "node:crypto";
 import { compatFetch, timeoutSignal } from "../../compat.js";
-import { OAUTH_CLIENT_ID, getEndpoints } from "./constants.js";
+import { OAUTH_CLIENT_ID, getEndpoints, openapiBase } from "./constants.js";
 
 const POLL_MS = 3000;
 export const POLL_TIMEOUT_MS = 10 * 60 * 1000; // 对齐 qoder2api 10 分钟
@@ -82,4 +82,45 @@ export async function waitForAuth({ region, nonce, verifier, fetchImpl = compatF
     await new Promise((r) => setTimeout(r, POLL_MS));
     try { process.stdout.write("."); } catch {}
   }
+}
+
+// device token 续期（对齐官方 CLI + magpie refreshDevice）：deviceToken 时效短（约 1 天），
+// 官方在收到 105 Login expired 时用 refresh_token 换全新的一对（旧 refresh_token 一次性，换到即弃）。
+// POST {openapiBase}/api/v1/deviceToken/refresh body{refresh_token} → { token|device_token, refresh_token }。
+// 只带 refresh_token 认证（过期 deviceToken 无需当 Bearer）；401/403 = refresh 也被拒 → 真需重登。
+// 抛错语义：{ retryable } 标记——网络/5xx 可稍后再试，4xx（refresh 作废）不可重试。
+export async function refreshDeviceToken({ region = "global", refreshToken, fetchImpl = compatFetch } = {}) {
+  const rt = String(refreshToken || "").trim();
+  if (!rt) { const e = new Error("无 refresh_token，需重新登录"); e.retryable = false; throw e; }
+  const url = `${openapiBase(region)}/api/v1/deviceToken/refresh`;
+  let res;
+  try {
+    res = await fetchImpl(url, {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({ refresh_token: rt }),
+      signal: timeoutSignal(20000),
+    });
+  } catch (e) {
+    const err = new Error(`deviceToken 刷新请求失败: ${String(e?.message || e).slice(0, 160)}`);
+    err.retryable = true; throw err;
+  }
+  const txt = await res.text().catch(() => "");
+  if (res.status === 401 || res.status === 403) {
+    const err = new Error(`deviceToken 刷新被拒 HTTP ${res.status}（refresh_token 已作废，需重新登录）`);
+    err.retryable = false; throw err;
+  }
+  if (!res.ok) {
+    const err = new Error(`deviceToken 刷新上游 HTTP ${res.status}: ${txt.slice(0, 160)}`);
+    err.retryable = true; throw err;
+  }
+  let j;
+  try { j = JSON.parse(txt); } catch { const err = new Error(`deviceToken 刷新返回非 JSON: ${txt.slice(0, 160)}`); err.retryable = false; throw err; }
+  const deviceToken = String(j.token || j.device_token || "").trim();
+  const newRefresh = String(j.refresh_token || j.refreshToken || "").trim();
+  if (!deviceToken || !newRefresh) {
+    const err = new Error("deviceToken 刷新返回不完整 token 对（缺 token 或 refresh_token）");
+    err.retryable = false; throw err;
+  }
+  return { deviceToken, refreshToken: newRefresh };
 }

package/src/providers/qoder/payload.js

@@ -1,13 +1,28 @@
-// qoder 消息/payload 组装（转译 qoder2api bridge.go CallQoderWithOpts + messages.go）
-// 模板：baseprompt.json（vendored 数据文件，含 {UUID1..5}/{TIME1} 占位符，加载时替换一次）
+// qoder 请求体装配（对齐官方 qodercli 线格式；外部参考：dsh-qoder-connect wire/serialize.ts、magpie qoder 插件）。
+// 消息形状转换层（OpenAI→Qoder wire messages / 会话指纹 / 缓存标记 / tool 配对）已拆至 wire-messages.js
+// （体积门 + 职责边界）。本文件只管：
+//  - 模板外壳加载（baseprompt.json 只作 parameters/model_config 骨架，messages/tools 一律重建）；
+//  - business.id = request_set_id（上游把排队条目与 business id 绑定，各发一个 UUID 会让排队/回放关联失效）；
+//  - business.product=cli（我们伪装的是 qodercli，不是 IDE）；
+//  - 思考档位/上下文窗口按模型目录（meta）补写；模型名映射 mapModel。
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { newUUID, unixMs } from "./fingerprint.js";
+import {
+  normalizeContent, buildUserMessage, buildStructuredMessage,
+  toQoderWireMessages, conversationSessionId, cacheMark,
+} from "./wire-messages.js";
+
+// 转换层符号 re-export（外部 import 路径保持 payload.js 不变；新代码建议直接 import wire-messages.js）
+export {
+  blankResponseMeta, buildUserMessage, buildStructuredMessage, normalizeContent,
+  withQoderPersona, toQoderWireMessages, conversationSessionId, cacheMark,
+} from "./wire-messages.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
-// 模板单例：进程内加载一次（替换占位符后 JSON.parse），每请求深拷贝
+// 模板单例：进程内加载一次（替换占位符后 JSON.parse）
 let _template = null;
 export function loadTemplate(templatePath) {
   if (_template && !templatePath) return _template;
@@ -18,56 +33,113 @@ export function loadTemplate(templatePath) {
   return _template;
 }
 
-export function blankResponseMeta() {
-  return {
-    id: "",
-    usage: {
-      prompt_tokens: 0, completion_tokens: 0, total_tokens: 0,
-      completion_tokens_details: { reasoning_tokens: 0 },
-      prompt_tokens_details: { cached_tokens: 0 },
-    },
-  };
-}
-
-// OpenAI user 消息 → Qoder contents 形状
-export function buildUserMessage(text) {
-  return {
-    role: "user", content: "",
-    contents: [{ type: "text", text: String(text || "") }],
-    response_meta: blankResponseMeta(),
-    reasoning_content_signature: "",
-  };
+// 档位对齐（参考 magpie effortFor）：把客户端要档位映射到模型声明档位集合里的最近一档（平手取高）。
+const EFFORT_RANK = ["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"];
+export function fitEffort(want, levels) {
+  const w = String(want || "").toLowerCase();
+  if (!Array.isArray(levels) || !levels.length || levels.includes(w)) return w;
+  const at = EFFORT_RANK.indexOf(w);
+  if (at < 0) return w;
+  let best = w, dist = EFFORT_RANK.length;
+  for (const l of levels) {
+    const i = EFFORT_RANK.indexOf(l);
+    if (i < 0 || l === "none") continue;
+    const d = Math.abs(i - at);
+    if (d < dist || (d === dist && i > at)) { best = l; dist = d; }
+  }
+  return best;
 }
 
-export function buildStructuredMessage(role, text) {
-  return { role, content: String(text || ""), response_meta: blankResponseMeta(), reasoning_content_signature: "" };
+// 上下文窗口选择（参考 magpie windowFor）：请求装得下默认窗口就用默认；
+// 装不下按能容纳的最小窗口升档（bytes/3 粗估 + 预留回复长度），全装不下给最大档。
+export function pickContextWindow(need, meta) {
+  const base = Number(meta?.defaultWindow) || Number(meta?.context_length) || 0;
+  const windows = Array.isArray(meta?.windows) ? meta.windows : [];
+  if (base > 0 && need <= base) return base;
+  return windows.find((w) => w >= need) ?? (windows.length ? windows[windows.length - 1] : 0);
 }
 
-export function normalizeContent(content) {
-  if (typeof content === "string") return content;
-  if (content == null) return "";
-  if (Array.isArray(content)) {
-    let out = "";
-    for (const b of content) {
-      const t = typeof b === "object" && b ? b.text : b;
-      if (typeof t === "string") out += (out ? "\n\n" : "") + t;
+// 组装上游请求体。template 外壳字段（parameters/model_config 骨架等）保留，
+// messages/tools/ids/chat_context/business 一律重建。
+// meta：模型目录行（context_windows/default_window/reasoning_efforts/default_reasoning_effort/max_output_tokens）；
+// effort：客户端声明的思考档位原始串（可空）。
+export function buildQoderBody({ template, userId, userType, model, messages, tools, maxTokens, isReasoning, meta, effort, preserveTemplateHistory = false }) {
+  const tmpl = template || loadTemplate();
+  const body = JSON.parse(JSON.stringify(tmpl));
+  const nid = newUUID();
+  const setId = newUUID();
+  body.request_id = nid;
+  body.chat_record_id = nid;
+  body.request_set_id = setId;
+  body.stream = true;
+  body.aliyun_user_type = userType || "personal_standard";
+  if (body.model_config) {
+    body.model_config.key = model;
+    if (isReasoning) body.model_config.is_reasoning = true;
+  }
+  // 推理标志两处镜像写（对齐官方 CLI 请求形状），只写 model_config 上游不吐 reasoning_content
+  if (isReasoning && body.chat_context?.extra?.modelConfig) {
+    body.chat_context.extra.modelConfig.is_reasoning = true;
+    body.chat_context.extra.modelConfig.key = model; // 与 model_config.key 同步，不留模板 "auto"
+  }
+  const wireMessages = cacheMark(preserveTemplateHistory
+    ? buildQoderMessages(tmpl, messages, Array.isArray(tools) && tools.length > 0) // 回退通道：MSLXDFF_QODER_LEGACY_WIRE=1
+    : toQoderWireMessages(messages));
+  body.session_id = conversationSessionId(userId, model, wireMessages);
+  const outCap = maxTokens > 0 ? maxTokens : (Number(meta?.max_output_tokens) || 0);
+  if (outCap > 0 && body.parameters) body.parameters.max_tokens = outCap;
+  // 思考参数按真值口径补写（models.js 目录行为 snake_case）：enable_thinking + 命中模型声明档位才发 reasoning_effort。
+  // 只在模型确实支持时补写，避免把未知参数/无效档位打给不认的模型（fitEffort 兜底后仍须 ∈ efforts 才发）。
+  if (body.parameters) {
+    const efforts = Array.isArray(meta?.reasoning_efforts) ? meta.reasoning_efforts : [];
+    const want = String(effort || "").trim().toLowerCase();
+    if (isReasoning) {
+      body.parameters.enable_thinking = true;
+      if (efforts.length) {
+        const cand = want && EFFORT_RANK.includes(want)
+          ? fitEffort(want, efforts)
+          : String(meta?.default_reasoning_effort || efforts[0] || "");
+        if (efforts.includes(cand)) body.parameters.reasoning_effort = cand;
+      }
+    } else if (want === "none" && efforts.length) {
+      body.parameters.enable_thinking = false; // 模型可关思考才发关；不可关的（无 efforts）保持默认不干预
+    }
+    // 上下文窗口升档（仅模型声明了多窗口才发）
+    const windows = Array.isArray(meta?.context_windows) ? meta.context_windows : [];
+    if (windows.length) {
+      const need = Math.ceil(JSON.stringify({ m: wireMessages, t: tools || [] }).length / 3) + (outCap || 32000);
+      const w = pickContextWindow(need, { defaultWindow: meta.default_window, context_length: meta.context_length, windows });
+      if (w > 0) body.parameters.context_length = w;
     }
-    return out;
   }
-  return JSON.stringify(content);
-}
-
-// 提取最后一条 user 消息文本（仿 ExtractLatestUserPrompt）
-export function extractLatestUserPrompt(messages) {
-  for (let i = messages.length - 1; i >= 0; i--) {
-    const m = messages[i];
-    if (m?.role === "user") return normalizeContent(m.content);
+  // chat_context 的 text/originalContent 是纯字符串（旧模板形状是 {type,text} 对象——官方从不发对象形状）
+  const prompt = (() => {
+    for (let i = wireMessages.length - 1; i >= 0; i--) {
+      const m = wireMessages[i];
+      if (m?.role === "user") return normalizeContent(m.contents?.map((p) => p.text ?? "").join("\n\n") || m.content);
+    }
+    return "";
+  })();
+  if (body.business) {
+    body.business.id = setId; // 排队条目与 business.id 绑定，必须 = request_set_id
+    body.business.product = "cli";
+    body.business.version = "1.0.0";
+    body.business.begin_at = unixMs();
+    body.business.name = prompt.length > 30 ? prompt.slice(0, 30) : prompt;
+  }
+  if (body.chat_context) {
+    body.chat_context.text = prompt;
+    if (body.chat_context.extra) body.chat_context.extra.originalContent = prompt;
   }
-  return "";
+  body.messages = wireMessages;
+  // tools 空数组契约：模板内嵌的 14 个 Qoder CLI 工具永不出门；无工具时上游官方亦发 []
+  body.tools = Array.isArray(tools) && tools.length ? tools : [];
+  return { body, prompt, mcSource: body.model_config?.source || "system" };
 }
 
-// OpenAI messages → Qoder messages（仿 BuildQoderMessages：无 system 前置模板 system；
-// user 含 tool_result 数组拆成 tool 行；assistant tool_calls 透传）
+// OpenAI messages → Qoder messages（旧版形状：无 system 前置模板 system；user=contents[]；
+// assistant tool_calls 透传；含 tool_result 数组拆成 tool 行）。
+// 仅保留给 MSLXDFF_QODER_LEGACY_WIRE=1 回退通道；正常路径用 wire-messages.js 的 toQoderWireMessages。
 export function buildQoderMessages(template, incoming, toolsEnabled) {
   const rebuilt = [];
   const hasSystem = (incoming || []).some((m) => m?.role === "system");
@@ -105,42 +177,6 @@ export function buildQoderMessages(template, incoming, toolsEnabled) {
   return rebuilt;
 }
 
-// 组装上游请求体（仿 CallQoderWithOpts）
-export function buildQoderBody({ template, userType, model, messages, tools, maxTokens, isReasoning }) {
-  const body = JSON.parse(JSON.stringify(template || loadTemplate()));
-  const nid = newUUID();
-  body.request_id = nid;
-  body.chat_record_id = nid;
-  body.request_set_id = newUUID();
-  body.session_id = newUUID();
-  body.stream = true;
-  body.aliyun_user_type = userType || "personal_standard";
-  if (body.model_config) {
-    body.model_config.key = model;
-    if (isReasoning) body.model_config.is_reasoning = true;
-  }
-  // 推理标志两处镜像写（对齐官方 CLI 请求形状），只写 model_config 上游不吐 reasoning_content
-  if (isReasoning && body.chat_context?.extra?.modelConfig) {
-    body.chat_context.extra.modelConfig.is_reasoning = true;
-    body.chat_context.extra.modelConfig.key = model; // 与 model_config.key 同步，不留模板 "auto"（评审路1 P1#5）
-  }
-  if (maxTokens > 0 && body.parameters) body.parameters.max_tokens = maxTokens;
-  const prompt = extractLatestUserPrompt(messages);
-  if (body.business) {
-    body.business.id = newUUID();
-    body.business.begin_at = unixMs();
-    body.business.name = prompt.length > 30 ? prompt.slice(0, 30) : prompt;
-  }
-  if (body.chat_context) {
-    if (body.chat_context.text) body.chat_context.text.text = prompt;
-    if (body.chat_context.extra?.originalContent) body.chat_context.extra.originalContent.text = prompt;
-  }
-  body.messages = messages;
-  // tools 空数组契约：模板内嵌的 14 个 Qoder CLI 工具永不出门；无工具时上游官方亦发 []
-  body.tools = Array.isArray(tools) && tools.length ? tools : [];
-  return { body, prompt, mcSource: body.model_config?.source || "system" };
-}
-
 // 客户端模型名 → 上游 key（仿 defaultModelMapping 双向 substring，家族关键字兜底）
 const DEFAULT_MAPPING = {
   opus: "qmodel_38max", sonnet: "gmodel", haiku: "qfmodel",

package/src/providers/qoder/request.js

@@ -1,20 +1,25 @@
 // qoder 上游请求装配（纯函数，无网络）：OpenAI body → COSY 签名请求（url/headers/bodyStr）。
 // 从 chat.js 拆出，使真流式/聚合两条管线共享同一装配口（单一来源，防两处签名漂移）。
+// MSLXDFF_QODER_LEGACY_WIRE=1 → 回退旧形状（模板注入历史 + OpenAI messages 原样）。
 import { getEndpoints, normalizeRegion } from "./constants.js";
 import { buildCosyHeaders, pathSigFrom } from "./session.js";
 import { cosyEncode } from "./encode.js";
 import { buildQoderBody, mapModel } from "./payload.js";
 
-export function buildUpstreamRequest({ sess, region, model, messages, tools, maxTokens, isReasoning }) {
+export function buildUpstreamRequest({ sess, region, model, messages, tools, maxTokens, isReasoning, meta, effort }) {
   const upstreamModel = mapModel(model);
   const { body, mcSource } = buildQoderBody({
     template: undefined,
+    userId: sess?.identity?.uid,
     userType: sess?.identity?.userType,
     model: upstreamModel,
     messages,
     tools,
     maxTokens,
     isReasoning,
+    meta,
+    effort,
+    preserveTemplateHistory: process.env.MSLXDFF_QODER_LEGACY_WIRE === "1",
   });
   const ep = getEndpoints(normalizeRegion(region));
   const url = ep.chatStreamURL;
@@ -23,5 +28,5 @@ export function buildUpstreamRequest({ sess, region, model, messages, tools, max
   headers["x-model-key"] = upstreamModel;
   headers["x-model-source"] = mcSource;
   headers["accept"] = "text/event-stream";
-  return { url, headers, bodyStr, upstreamModel, mcSource };
+  return { url, headers, bodyStr, upstreamModel, mcSource, requestSetId: body.request_set_id, sessionId: body.session_id, modelKey: upstreamModel };
 }

package/src/providers/qoder/session.js

@@ -6,7 +6,12 @@ import { cosyEncode } from "./encode.js";
 import { newUUID, unixSec } from "./fingerprint.js";
 
 export const APP_CODE = "cosy";
-export const VERSION = "1.0.10";
+// 身份版本（对齐外部参考 dsh-qoder-connect wire/cosy.ts 的 CLI 口径 1.1.47；env 可覆盖以便上游升版）
+export const VERSION = process.env.MSLXDFF_QODER_CLI_VERSION || "1.1.47";
+export const CLI_UA = `qoder/${VERSION}`;
+const MACHINE_OS = process.platform === "win32"
+  ? (process.arch === "arm64" ? "aarch64_windows" : "x86_64_windows")
+  : (process.arch === "arm64" ? "aarch64_linux" : "x86_64_linux");
 // base64("war, war never changes")
 const SECRET_B64 = "d2FyLCB3YXIgbmV2ZXIgY2hhbmdlcw==";
 
@@ -106,30 +111,41 @@ export function pathSigFrom(url) {
   }
 }
 
-// 构造请求头
-export function buildCosyHeaders(sess, pathSig, bodyStr, accept) {
+// 构造请求头（身份对齐 qodercli 参考实现：UA=qoder/<ver>、补 bodyhash/sigpath/machineos/x-request-id，
+// 摘掉 IDE 伪装头 cosy-scene/business-*——上游按请求头指纹分级，IDE+Go UA 是排队重灾区）
+// correlation: { requestId, sessionId } —— 队列探活与推理必须携带同一对 id 才能关联。
+export function buildCosyHeaders(sess, pathSig, bodyStr, accept, correlation) {
   const payloadB64 = buildPayloadB64(sess.info);
   const date = String(unixSec());
-  const sig = signRequest(payloadB64, sess.cosyKey, date, bodyStr || "", pathSig);
+  const body = bodyStr || "";
+  const sig = signRequest(payloadB64, sess.cosyKey, date, body, pathSig);
   const bearer = composeBearer(payloadB64, sig);
+  const bodyHash = createHash("md5").update(body).digest("hex");
   return {
-    "cosy-data-policy": "agree",
+    "cosy-data-policy": "disagree",
     "content-type": "application/json",
     "cosy-machinetype": sess.machineType,
+    "cosy-machinetoken": sess.machineToken,
+    "cosy-machineos": MACHINE_OS,
     "cosy-clienttype": "5",
+    "cosy-clientip": "127.0.0.1",
+    "cosy-bodyhash": bodyHash,
+    "cosy-bodylength": String(Buffer.byteLength(body)),
+    "cosy-sigpath": pathSig,
+    "cosy-organization-id": sess.identity?.organizationId || "",
+    "cosy-organization-tags": "",
     "cosy-date": date,
     "cosy-user": sess.identity.uid,
     "cosy-key": sess.cosyKey,
     "cache-control": "no-cache",
     "accept": accept || "application/json",
+    "accept-encoding": "identity",
     "authorization": bearer,
     "cosy-version": VERSION,
     "cosy-machineid": sess.machineId,
-    "cosy-machinetoken": sess.machineToken,
     "login-version": "v2",
-    "user-agent": "Go-http-client/2.0",
-    "cosy-scene": "assistant",
-    "cosy-business-product": "ide",
-    "cosy-business-type": "agent",
+    "user-agent": CLI_UA,
+    "x-request-id": correlation?.requestId || newUUID(),
+    ...(correlation?.sessionId ? { "x-session-id": String(correlation.sessionId) } : {}),
   };
 }