mslxdff 0.1.236 → 0.1.238

package/src/providers/dispatcher.js

@@ -1,148 +1,148 @@
- import { appendEvent } from "../logs.js";
- import { splitModelId, DEFAULT_PROVIDER, joinModelId } from "./model-id.js";
- import { isModelAllowed as stateIsAllowed, loadProviderAllowedModels as stateLoadAllowed, loadProviderAllowAnyModels as stateLoadAllowAny } from "../state.js";
-// 定制预热名单：registry customProviders + 默认 opencode；openrouter/自配 generic 不预热（按需自拉）
-// agentrouter 已于 2026-10-21 随 registry 一并摘除（见 src/providers/registry.js 注释）。
-const CUSTOM_PREHEAT_IDS = new Set(["opencode", "workbuddy", "traework", "cline", "codearts", "qoder", "globalqwenwork", "qwenwork", "zcode", "raccoon"]);
- function isPreheatDisabled() {
-   const raw = process.env.MSLXDFF_PREHEAT;
-   if (raw === undefined || raw === null || raw === "") return false;
-   const s = String(raw).trim().toLowerCase();
-   return s === "0" || s === "off" || s === "false" || s === "no" || s === "disable" || s === "disabled";
- }
-
-// 多供应商 dispatcher：把多个 Provider 聚合成一个 `upstream` 形状（chat/preheat/close），
-// 按 body.model 的前缀路由到对应供应商，转发上游前剥掉前缀只发原始 id。
-// 纯化：第二参可注入纯函数 isAllowed/getAllowed/getAllowAny，便于单测不读盘
-export function createProviderDispatcher(providers = [], opts = {}) {
-  const byId = new Map(providers.map((p) => [p.id, p]));
-  // 纯化注入：第二参可为 {isAllowed, getAllowedModels, getAllowAny} 或直接函数 isAllowed
-  let isAllowedFn, getAllowedFn, getAllowAnyFn;
-  if (typeof opts === "function") {
-    isAllowedFn = opts;
-    getAllowedFn = stateLoadAllowed;
-    getAllowAnyFn = stateLoadAllowAny;
-  } else {
-    isAllowedFn = opts.isAllowed || stateIsAllowed;
-    getAllowedFn = opts.getAllowedModels || stateLoadAllowed;
-    getAllowAnyFn = opts.getAllowAny || stateLoadAllowAny;
-  }
-
-  function resolve(model) {
-    const split = splitModelId(model, providers.map((p) => p.id));
-    return {
-      provider: byId.get(split.provider) ?? byId.get(DEFAULT_PROVIDER) ?? providers[0],
-      raw: split.raw,
-      prefixed: split.prefixed,
-    };
-  }
-
-  async function chat(body, opts = {}) {
-    let { provider, raw } = resolve(body?.model);
-    if (!provider) throw new Error(`no provider for model ${body?.model ?? "(empty)"}`);
-    let workbuddyUid = opts?.workbuddyUid ? String(opts.workbuddyUid).trim() : "";
-    // model 前缀钉死：workbuddy/<uid>:<rawId>  -> 剥 uid，rawId 为真实模型
-    if (provider.id === "workbuddy" && typeof raw === "string" && raw.includes(":")) {
-      const idx = raw.indexOf(":");
-      const uidPart = raw.slice(0, idx).trim();
-      const modelPart = raw.slice(idx + 1).trim();
-      if (uidPart && modelPart) {
-        if (!workbuddyUid) workbuddyUid = uidPart;
-        raw = modelPart;
-      }
-    }
-    if (!isAllowedFn(provider.id, raw)) {
-      const allowed = getAllowedFn(provider.id) || [];
-      const msg = `model not allowed for provider "${provider.id}": "${raw}" — allowed: ${allowed.join(", ") || "(none)"} (use: mslxdff -provider ${provider.id} allowlist add <model>)`;
-      appendEvent({ type: "provider-model-state", provider: provider.id, model: body?.model, rawModel: raw, state: "blocked", reason: "allowlist", status: 403 });
-      return new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json", "x-mslxdff-allowlist": "1" } });
-    }
-    const forwarded = raw === body?.model ? body : { ...body, model: raw };
-    // ADR-0008：本请求携带瞬时共享 key（shareKeys 由组员侧按 header 解析后传入）。
-    const sharedKeys = opts?.shareKeys?.[provider.id];
-    const startedAt = Date.now();
-    let res;
-    try {
-      if (sharedKeys && sharedKeys.length && typeof provider.chatWithKeys === "function") {
-        res = await provider.chatWithKeys(forwarded, sharedKeys, opts);
-      } else if (provider.id === "workbuddy" && workbuddyUid) {
-        res = await provider.chat(forwarded, { ...opts, workbuddyUid });
-      } else {
-        res = await provider.chat(forwarded, opts);
-      }
-    } catch (err) {
-      appendEvent({ type: "provider-model-state", provider: provider.id, model: body?.model, rawModel: raw, state: "upstream-error", error: String(err?.message || err), durationMs: Date.now() - startedAt });
-      throw err;
-    }
-    appendEvent({
-      type: "provider-model-state",
-      provider: provider.id,
-      model: body?.model,
-      rawModel: raw,
-      status: res?.status,
-      state: res?.status === 429 ? "limited" : res?.ok ? "ok" : "upstream-error",
-      durationMs: Date.now() - startedAt,
-    });
-    return res;
-  }
-
-  // 聚合所有供应商的模型列表；默认供应商（opencode）裸 id，其它带前缀
-  // 若某供应商设置了 allowlist（非空），则仅暴露白名单内的模型（按 raw id 匹配）
-  async function listModels() {
-    const out = [];
-    const seen = new Set();
-    for (const p of providers) {
-      let list;
-      try {
-        list = (await p.listModels?.()) ?? [];
-      } catch {
-        list = [];
-      }
-      const allowed = getAllowedFn(p.id) || [];
-      const allowAny = getAllowAnyFn(p.id);
-      const allowedSet = allowed.length ? new Set(allowed) : null;
-      // 空名单且不允许任意模型 => 该供应商不暴露任何模型（安全默认）
-      if (!allowedSet && !allowAny) continue;
-      for (const m of list) {
-        if (!m || !m.id) continue;
-        if (seen.has(m.id)) continue;
-        if (allowedSet) {
-          // m.id 已是带前缀的对外 id，需剥回 raw 再比对
-          const { raw } = splitModelId(m.id, providers.map((x) => x.id));
-          const rawNorm = String(raw || "").trim();
-          if (!allowedSet.has(rawNorm)) continue;
-          // 对于 opencode 裸 id，rawNorm 即 m.id 本身
-        }
-        seen.add(m.id);
-        out.push(m);
-      }
-    }
-    return out;
-  }
-
-  // 预热定制供应商 + 默认供应商（opencode）：registry 名单 8 家 + opencode 共 9 家并发各打一次；
-  // openrouter/用户自配 generic 不在此列（按需首次请求自拉）。单家失败静默，不拖累启动。
-  async function preheat() {
-    if (isPreheatDisabled()) return { ok: true, skipped: true };
-    const targets = providers.filter((p) => p && typeof p.preheat === "function" && CUSTOM_PREHEAT_IDS.has(p.id));
-    if (!targets.length) return { ok: false, skipped: true };
-    const settled = await Promise.all(targets.map(async (p) => {
-      try {
-        const r = await p.preheat();
-        return { id: p.id, ...(r && typeof r === "object" ? r : { ok: false }) };
-      } catch {
-        return { id: p.id, ok: false, error: "preheat failed" };
-      }
-    }));
-    const okCount = settled.filter((r) => r && r.ok).length;
-    return { ok: okCount > 0, results: settled, okCount, total: settled.length };
-  }
-
-  async function close() {
-    for (const p of providers) {
-      try { await p.close?.(); } catch {}
-    }
-  }
-
-  return { providers, byId, resolve, listModels, chat, preheat, close, joinModelId };
+ import { appendEvent } from "../logs.js";
+ import { splitModelId, DEFAULT_PROVIDER, joinModelId } from "./model-id.js";
+ import { isModelAllowed as stateIsAllowed, loadProviderAllowedModels as stateLoadAllowed, loadProviderAllowAnyModels as stateLoadAllowAny } from "../state.js";
+// 定制预热名单：registry customProviders + 默认 opencode；openrouter/自配 generic 不预热（按需自拉）
+// agentrouter 已于 2026-10-21 随 registry 一并摘除（见 src/providers/registry.js 注释）。
+const CUSTOM_PREHEAT_IDS = new Set(["opencode", "workbuddy", "traework", "cline", "codearts", "qoder", "globalqwenwork", "qwenwork", "zcode", "raccoon"]);
+ function isPreheatDisabled() {
+   const raw = process.env.MSLXDFF_PREHEAT;
+   if (raw === undefined || raw === null || raw === "") return false;
+   const s = String(raw).trim().toLowerCase();
+   return s === "0" || s === "off" || s === "false" || s === "no" || s === "disable" || s === "disabled";
+ }
+
+// 多供应商 dispatcher：把多个 Provider 聚合成一个 `upstream` 形状（chat/preheat/close），
+// 按 body.model 的前缀路由到对应供应商，转发上游前剥掉前缀只发原始 id。
+// 纯化：第二参可注入纯函数 isAllowed/getAllowed/getAllowAny，便于单测不读盘
+export function createProviderDispatcher(providers = [], opts = {}) {
+  const byId = new Map(providers.map((p) => [p.id, p]));
+  // 纯化注入：第二参可为 {isAllowed, getAllowedModels, getAllowAny} 或直接函数 isAllowed
+  let isAllowedFn, getAllowedFn, getAllowAnyFn;
+  if (typeof opts === "function") {
+    isAllowedFn = opts;
+    getAllowedFn = stateLoadAllowed;
+    getAllowAnyFn = stateLoadAllowAny;
+  } else {
+    isAllowedFn = opts.isAllowed || stateIsAllowed;
+    getAllowedFn = opts.getAllowedModels || stateLoadAllowed;
+    getAllowAnyFn = opts.getAllowAny || stateLoadAllowAny;
+  }
+
+  function resolve(model) {
+    const split = splitModelId(model, providers.map((p) => p.id));
+    return {
+      provider: byId.get(split.provider) ?? byId.get(DEFAULT_PROVIDER) ?? providers[0],
+      raw: split.raw,
+      prefixed: split.prefixed,
+    };
+  }
+
+  async function chat(body, opts = {}) {
+    let { provider, raw } = resolve(body?.model);
+    if (!provider) throw new Error(`no provider for model ${body?.model ?? "(empty)"}`);
+    let workbuddyUid = opts?.workbuddyUid ? String(opts.workbuddyUid).trim() : "";
+    // model 前缀钉死：workbuddy/<uid>:<rawId>  -> 剥 uid，rawId 为真实模型
+    if (provider.id === "workbuddy" && typeof raw === "string" && raw.includes(":")) {
+      const idx = raw.indexOf(":");
+      const uidPart = raw.slice(0, idx).trim();
+      const modelPart = raw.slice(idx + 1).trim();
+      if (uidPart && modelPart) {
+        if (!workbuddyUid) workbuddyUid = uidPart;
+        raw = modelPart;
+      }
+    }
+    if (!isAllowedFn(provider.id, raw)) {
+      const allowed = getAllowedFn(provider.id) || [];
+      const msg = `model not allowed for provider "${provider.id}": "${raw}" — allowed: ${allowed.join(", ") || "(none)"} (use: mslxdff -provider ${provider.id} allowlist add <model>)`;
+      appendEvent({ type: "provider-model-state", provider: provider.id, model: body?.model, rawModel: raw, state: "blocked", reason: "allowlist", status: 403 });
+      return new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json", "x-mslxdff-allowlist": "1" } });
+    }
+    const forwarded = raw === body?.model ? body : { ...body, model: raw };
+    // ADR-0008：本请求携带瞬时共享 key（shareKeys 由组员侧按 header 解析后传入）。
+    const sharedKeys = opts?.shareKeys?.[provider.id];
+    const startedAt = Date.now();
+    let res;
+    try {
+      if (sharedKeys && sharedKeys.length && typeof provider.chatWithKeys === "function") {
+        res = await provider.chatWithKeys(forwarded, sharedKeys, opts);
+      } else if (provider.id === "workbuddy" && workbuddyUid) {
+        res = await provider.chat(forwarded, { ...opts, workbuddyUid });
+      } else {
+        res = await provider.chat(forwarded, opts);
+      }
+    } catch (err) {
+      appendEvent({ type: "provider-model-state", provider: provider.id, model: body?.model, rawModel: raw, state: "upstream-error", error: String(err?.message || err), durationMs: Date.now() - startedAt });
+      throw err;
+    }
+    appendEvent({
+      type: "provider-model-state",
+      provider: provider.id,
+      model: body?.model,
+      rawModel: raw,
+      status: res?.status,
+      state: res?.status === 429 ? "limited" : res?.ok ? "ok" : "upstream-error",
+      durationMs: Date.now() - startedAt,
+    });
+    return res;
+  }
+
+  // 聚合所有供应商的模型列表；默认供应商（opencode）裸 id，其它带前缀
+  // 若某供应商设置了 allowlist（非空），则仅暴露白名单内的模型（按 raw id 匹配）
+  async function listModels() {
+    const out = [];
+    const seen = new Set();
+    for (const p of providers) {
+      let list;
+      try {
+        list = (await p.listModels?.()) ?? [];
+      } catch {
+        list = [];
+      }
+      const allowed = getAllowedFn(p.id) || [];
+      const allowAny = getAllowAnyFn(p.id);
+      const allowedSet = allowed.length ? new Set(allowed) : null;
+      // 空名单且不允许任意模型 => 该供应商不暴露任何模型（安全默认）
+      if (!allowedSet && !allowAny) continue;
+      for (const m of list) {
+        if (!m || !m.id) continue;
+        if (seen.has(m.id)) continue;
+        if (allowedSet) {
+          // m.id 已是带前缀的对外 id，需剥回 raw 再比对
+          const { raw } = splitModelId(m.id, providers.map((x) => x.id));
+          const rawNorm = String(raw || "").trim();
+          if (!allowedSet.has(rawNorm)) continue;
+          // 对于 opencode 裸 id，rawNorm 即 m.id 本身
+        }
+        seen.add(m.id);
+        out.push(m);
+      }
+    }
+    return out;
+  }
+
+  // 预热定制供应商 + 默认供应商（opencode）：registry 名单 8 家 + opencode 共 9 家并发各打一次；
+  // openrouter/用户自配 generic 不在此列（按需首次请求自拉）。单家失败静默，不拖累启动。
+  async function preheat() {
+    if (isPreheatDisabled()) return { ok: true, skipped: true };
+    const targets = providers.filter((p) => p && typeof p.preheat === "function" && CUSTOM_PREHEAT_IDS.has(p.id));
+    if (!targets.length) return { ok: false, skipped: true };
+    const settled = await Promise.all(targets.map(async (p) => {
+      try {
+        const r = await p.preheat();
+        return { id: p.id, ...(r && typeof r === "object" ? r : { ok: false }) };
+      } catch {
+        return { id: p.id, ok: false, error: "preheat failed" };
+      }
+    }));
+    const okCount = settled.filter((r) => r && r.ok).length;
+    return { ok: okCount > 0, results: settled, okCount, total: settled.length };
+  }
+
+  async function close() {
+    for (const p of providers) {
+      try { await p.close?.(); } catch {}
+    }
+  }
+
+  return { providers, byId, resolve, listModels, chat, preheat, close, joinModelId };
 }

package/src/providers/globalqwenwork/cosy.js

@@ -1,123 +1,123 @@
-// cosy.js（COSY 会话 + 签名头）— vendor 自 src/providers/qwenwork/cosy.js 逐字搬；
-// 本目录 import 全为相对路径，自动绑定本目录 constants/crypto/rsa。线上头 x-qwenwork-* 与 cn 同名，**禁止改名**（实测 .ai 接受）。
-// 关键不变式（改动即 403）：
-//  · identity/payload 都必须 key 升序紧凑 JSON（sortedCompact）
-//  · 签名 = md5(payloadB64 \n cosyKey \n date \n body \n pathSig)，pathSig 去 /algo 前缀、不含 query
-//  · authorization = `Bearer COSY.${payloadB64}.${sig}`；payloadB64 是**标准 base64（带 padding）**
-//  · 同一 requestId 重放会被上游判 `code 103 Duplicate request`
-import { uuid, b64, b64url, utf8, aesCbcEncrypt, md5 } from "./crypto.js";
-import { rsaPkcs1Encrypt } from "./rsa.js";
-import {
-  COSY_VERSION, IDE_VERSION, RELEASE_VERSION, BUILD, CLIENT_TYPE,
-  BUSINESS_PRODUCT, BUSINESS_TYPE, SCENE, MACHINE_OS, UA,
-} from "./constants.js";
-
-const cache = new Map();
-
-function sortedCompact(obj) {
-  const keys = Object.keys(obj).sort();
-  let out = "{";
-  for (let i = 0; i < keys.length; i++) {
-    if (i > 0) out += ",";
-    out += JSON.stringify(keys[i]) + ":" + JSON.stringify(obj[keys[i]]);
-  }
-  return out + "}";
-}
-
-function newSession(account) {
-  const machineID = uuid();
-  const seed = (uuid() + uuid()).slice(0, 50);
-  const machineToken = b64url(utf8(seed));
-  const machineType = uuid().replace(/-/g, "").slice(0, 18);
-  const tempKey = uuid().replace(/-/g, "").slice(0, 16);
-
-  const identity = sortedCompact({
-    uid: account.uid || "",
-    aid: account.uid || "",
-    name: account.nickname || "",
-    email: account.email || "",
-    security_oauth_token: account.accessToken,
-  });
-
-  return {
-    machineID,
-    machineToken,
-    machineType,
-    tempKey,
-    cosyKey: rsaPkcs1Encrypt(utf8(tempKey)),
-    info: b64(aesCbcEncrypt(utf8(identity), utf8(tempKey))),
-    accessToken: account.accessToken,
-  };
-}
-
-export function sessionFor(account) {
-  if (!account || !account.accessToken) throw new Error("cosy: empty access token");
-  const key = account.id || account.uid || account.accessToken.slice(0, 16);
-  const hit = cache.get(key);
-  if (hit && hit.accessToken === account.accessToken) return hit;
-  if (cache.size > 128) cache.clear();
-  const sess = newSession(account);
-  cache.set(key, sess);
-  return sess;
-}
-
-export function invalidateSession(account) {
-  const key = account && (account.id || account.uid);
-  if (key) cache.delete(key);
-}
-
-function pathSig(rawURL) {
-  const u = new URL(rawURL);
-  let p = u.pathname;
-  if (p.startsWith("/algo")) p = p.slice("/algo".length);
-  return p;
-}
-
-export function signHeaders(account, body, rawURL, modelKey, accept) {
-  const sess = sessionFor(account);
-  const payload = sortedCompact({
-    cosyVersion: COSY_VERSION,
-    ideVersion: IDE_VERSION,
-    info: sess.info,
-    requestId: uuid(),
-    version: "v1",
-  });
-  const payloadB64 = b64(utf8(payload));
-  const date = Math.floor(Date.now() / 1000).toString();
-  const sig = md5(`${payloadB64}\n${sess.cosyKey}\n${date}\n${body}\n${pathSig(rawURL)}`);
-
-  const headers = {
-    accept: accept || "text/event-stream",
-    "content-type": "application/json",
-    "user-agent": UA,
-    "x-request-id": uuid(),
-    "x-qwenwork-version": IDE_VERSION,
-    "x-qwenwork-release-version": RELEASE_VERSION,
-    "x-qwenwork-build": BUILD,
-    "x-qwenwork-platform": "win32",
-    "x-qwenwork-arch": "x64",
-    "x-qwenwork-channel": "stable",
-    "cosy-version": COSY_VERSION,
-    "cosy-clienttype": CLIENT_TYPE,
-    "cosy-business-product": BUSINESS_PRODUCT,
-    "cosy-business-type": BUSINESS_TYPE,
-    "cosy-scene": SCENE,
-    "cosy-machineos": MACHINE_OS,
-    "login-version": "v2",
-    authorization: `Bearer COSY.${payloadB64}.${sig}`,
-    "cosy-key": sess.cosyKey,
-    "cosy-user": account.uid || "",
-    "cosy-date": date,
-    "cosy-machineid": sess.machineID,
-    "accept-encoding": "identity",
-    connection: "keep-alive",
-    "cache-control": "no-cache",
-  };
-  if (modelKey) {
-    headers["x-model-key"] = modelKey;
-    headers["x-model-source"] = "system";
-  }
-  return headers;
-}
-
-// globalqwenwork 变体（国际站 gateway.qwenwork.ai）：协议与 cn 逐字同构，2026-10-01 现网实测签名/请求 200 — 见 docs/adr/0041-globalqwenwork-international-provider.md
+// cosy.js（COSY 会话 + 签名头）— vendor 自 src/providers/qwenwork/cosy.js 逐字搬；
+// 本目录 import 全为相对路径，自动绑定本目录 constants/crypto/rsa。线上头 x-qwenwork-* 与 cn 同名，**禁止改名**（实测 .ai 接受）。
+// 关键不变式（改动即 403）：
+//  · identity/payload 都必须 key 升序紧凑 JSON（sortedCompact）
+//  · 签名 = md5(payloadB64 \n cosyKey \n date \n body \n pathSig)，pathSig 去 /algo 前缀、不含 query
+//  · authorization = `Bearer COSY.${payloadB64}.${sig}`；payloadB64 是**标准 base64（带 padding）**
+//  · 同一 requestId 重放会被上游判 `code 103 Duplicate request`
+import { uuid, b64, b64url, utf8, aesCbcEncrypt, md5 } from "./crypto.js";
+import { rsaPkcs1Encrypt } from "./rsa.js";
+import {
+  COSY_VERSION, IDE_VERSION, RELEASE_VERSION, BUILD, CLIENT_TYPE,
+  BUSINESS_PRODUCT, BUSINESS_TYPE, SCENE, MACHINE_OS, UA,
+} from "./constants.js";
+
+const cache = new Map();
+
+function sortedCompact(obj) {
+  const keys = Object.keys(obj).sort();
+  let out = "{";
+  for (let i = 0; i < keys.length; i++) {
+    if (i > 0) out += ",";
+    out += JSON.stringify(keys[i]) + ":" + JSON.stringify(obj[keys[i]]);
+  }
+  return out + "}";
+}
+
+function newSession(account) {
+  const machineID = uuid();
+  const seed = (uuid() + uuid()).slice(0, 50);
+  const machineToken = b64url(utf8(seed));
+  const machineType = uuid().replace(/-/g, "").slice(0, 18);
+  const tempKey = uuid().replace(/-/g, "").slice(0, 16);
+
+  const identity = sortedCompact({
+    uid: account.uid || "",
+    aid: account.uid || "",
+    name: account.nickname || "",
+    email: account.email || "",
+    security_oauth_token: account.accessToken,
+  });
+
+  return {
+    machineID,
+    machineToken,
+    machineType,
+    tempKey,
+    cosyKey: rsaPkcs1Encrypt(utf8(tempKey)),
+    info: b64(aesCbcEncrypt(utf8(identity), utf8(tempKey))),
+    accessToken: account.accessToken,
+  };
+}
+
+export function sessionFor(account) {
+  if (!account || !account.accessToken) throw new Error("cosy: empty access token");
+  const key = account.id || account.uid || account.accessToken.slice(0, 16);
+  const hit = cache.get(key);
+  if (hit && hit.accessToken === account.accessToken) return hit;
+  if (cache.size > 128) cache.clear();
+  const sess = newSession(account);
+  cache.set(key, sess);
+  return sess;
+}
+
+export function invalidateSession(account) {
+  const key = account && (account.id || account.uid);
+  if (key) cache.delete(key);
+}
+
+function pathSig(rawURL) {
+  const u = new URL(rawURL);
+  let p = u.pathname;
+  if (p.startsWith("/algo")) p = p.slice("/algo".length);
+  return p;
+}
+
+export function signHeaders(account, body, rawURL, modelKey, accept) {
+  const sess = sessionFor(account);
+  const payload = sortedCompact({
+    cosyVersion: COSY_VERSION,
+    ideVersion: IDE_VERSION,
+    info: sess.info,
+    requestId: uuid(),
+    version: "v1",
+  });
+  const payloadB64 = b64(utf8(payload));
+  const date = Math.floor(Date.now() / 1000).toString();
+  const sig = md5(`${payloadB64}\n${sess.cosyKey}\n${date}\n${body}\n${pathSig(rawURL)}`);
+
+  const headers = {
+    accept: accept || "text/event-stream",
+    "content-type": "application/json",
+    "user-agent": UA,
+    "x-request-id": uuid(),
+    "x-qwenwork-version": IDE_VERSION,
+    "x-qwenwork-release-version": RELEASE_VERSION,
+    "x-qwenwork-build": BUILD,
+    "x-qwenwork-platform": "win32",
+    "x-qwenwork-arch": "x64",
+    "x-qwenwork-channel": "stable",
+    "cosy-version": COSY_VERSION,
+    "cosy-clienttype": CLIENT_TYPE,
+    "cosy-business-product": BUSINESS_PRODUCT,
+    "cosy-business-type": BUSINESS_TYPE,
+    "cosy-scene": SCENE,
+    "cosy-machineos": MACHINE_OS,
+    "login-version": "v2",
+    authorization: `Bearer COSY.${payloadB64}.${sig}`,
+    "cosy-key": sess.cosyKey,
+    "cosy-user": account.uid || "",
+    "cosy-date": date,
+    "cosy-machineid": sess.machineID,
+    "accept-encoding": "identity",
+    connection: "keep-alive",
+    "cache-control": "no-cache",
+  };
+  if (modelKey) {
+    headers["x-model-key"] = modelKey;
+    headers["x-model-source"] = "system";
+  }
+  return headers;
+}
+
+// globalqwenwork 变体（国际站 gateway.qwenwork.ai）：协议与 cn 逐字同构，2026-10-01 现网实测签名/请求 200 — 见 docs/adr/0041-globalqwenwork-international-provider.md