oicq-icalingua-plus-plus 1.26.1 → 1.26.3

package/index.d.ts

@@ -1165,6 +1165,9 @@ export class Client extends EventEmitter {
     /** 踢出已登录的设备 */
     delDevLoginInfo(flag: string): Promise<Ret>;
 
+    /** 根据fileid获取私聊文件URL */
+    getC2CFileUrl(fileid: string): Promise<Ret<string>>;
+
     /** 清除 image 和 record 文件夹下的缓存文件 */
     cleanCache(type?: "image" | "record"): Promise<Ret>;
 

package/lib/client-ext.js

@@ -11,19 +11,7 @@ const { timestamp, uin2code, BUF16, BUF0, log } = require("./common");
 const { TimeoutError } = require("./exception");
 const { parseC2CMsg } = require("./message/parser");
 const Writer = require("./wtlogin/writer");
-const _axios = require("axios");
-const http = require("http");
-const https = require("https");
-const API_WAIT_TIME = 45000;
-const axios = _axios.create({
-    httpAgent: new http.Agent({ keepAlive: true }),
-    httpsAgent: new https.Agent({ keepAlive: true }),
-    timeout: API_WAIT_TIME,
-    headers: {
-        'User-Agent': "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.199 Safari/537.36 OICQ/1.23 ILPP/2",
-        'Content-Type': "application/x-www-form-urlencoded"
-    }
-});
+const { buildUrl, getCommonParams, qsignGet, qsignPost, executeWithRetry, sleep } = require("./qsign-api");
 
 /**
  * seqid递增并返回
@@ -377,10 +365,6 @@ Client.prototype.pbGetMsg = async function (force = false, flag = 0, count = 10)
     }
 };
 
-function sleep(time) {
-    return new Promise(resolve => setTimeout(resolve, time));
-} 
-
 class Lock {
     constructor() {
         this.queue = [];
@@ -409,37 +393,22 @@ const requestLock = new Lock();
 
 /**
  * 注册qsign
+ * @param {boolean} [lockAcquired=false] 调用者是否已持有requestLock
  */
-Client.prototype.registerQSign = async function(retry = 0) {
+Client.prototype.registerQSign = async function(lockAcquired = false) {
     if (!this.config.sign_api_addr) return BUF0;
-    let url = this.config.sign_api_addr;
-    if (url[url.length - 1] !== '/') {
-        url += '/';
-    }
-    url += 'register';
-    const params = {
-        ver: this.apk.ver,
-        android_id: this.device.android_id,
-        qimei36: this.device.qimei36 || this.device.qimei16 || this.device.android_id,
-        guid: this.device.guid.toString('hex'),
-        uin: this.uin,
-        key: this.config.sign_api_key,
-    };
-    await requestLock.acquire();
-    const { data } = await axios.get(url,
-        {
-            params,
-        }
-    ).catch((e) => ({ data: { code: -1, msg: e ? e.message : 'failed to connect to qsign api' } }));
-    requestLock.release();
-    if (data.code !== 0) {
-        if (retry < 3) {
-            this.logger.warn(`[qsign][register] ${data.msg}(${data.code}), retry in 1s...`);
-            await sleep(1000);
-            return await this.registerQSign(retry + 1);
-        }
-        data.msg = data.msg || 'unknown error';
-        throw new Error(`[qsign][register] ${data.msg}(${data.code})`);
+    const url = buildUrl(this.config.sign_api_addr, 'register');
+    const params = getCommonParams.call(this);
+    if (!lockAcquired) await requestLock.acquire();
+    try {
+        const data = await executeWithRetry(
+            () => qsignGet(url, params),
+            'register',
+            { throwOnError: true, logger: this.logger }
+        );
+        return data;
+    } finally {
+        if (!lockAcquired) requestLock.release();
     }
 };
 
@@ -469,89 +438,50 @@ Client.prototype.handleSsoCallback = async function(callbackList = []) {
  * @param {number} callbackId
  * @param {Buffer} body
  */
-Client.prototype.submitSsoCallback = async function(cmd, callbackId, body, retry = 0) {
-    let url = this.config.sign_api_addr;
-    if (url[url.length - 1] !== '/') {
-        url += '/';
-    }
-    url += 'submit';
-    const params = {
-        ver: this.apk.ver,
-        android_id: this.device.android_id,
-        androidId: this.device.android_id,
-        qimei36: this.device.qimei36 || this.device.qimei16 || this.device.android_id,
-        guid: this.device.guid.toString('hex'),
-        uin: this.uin,
+Client.prototype.submitSsoCallback = async function(cmd, callbackId, body) {
+    const url = buildUrl(this.config.sign_api_addr, 'submit');
+    const params = getCommonParams.call(this, {
         buffer: body.toString('hex'),
         cmd: cmd,
         callback_id: callbackId,
         callbackId: callbackId,
-        qua: this.apk.qua,
-        key: this.config.sign_api_key
-    };
-    const { data } = await axios.get(url,
-        {
-            params,
-        }
-    ).catch((e) => ({ data: { code: -1, msg: e ? e.message : 'failed to connect to qsign api' } }));
-    if (data.code !== 0) {
-        if (retry < 3) {
-            this.logger.warn(`[qsign][submitSso] ${data.msg}(${data.code}), retry in 1s...`);
-            await sleep(1000);
-            return await this.submitSsoCallback(cmd, callbackId, body, retry + 1);
-        }
-        data.msg = data.msg || 'unknown error';
-        this.logger.warn(`[qsign][submitSso] ${data.msg}(${data.code})`);
-    }
+    });
+    await executeWithRetry(
+        () => qsignGet(url, params),
+        'submitSso',
+        { throwOnError: false, logger: this.logger }
+    );
 }
 
 /**
  * 刷新qsign的token
  */
-Client.prototype.refreshQSignToken = async function(retry = 0) {
+Client.prototype.refreshQSignToken = async function() {
     if (!this.config.sign_api_addr) return;
     if (unsendSso.length > 0) {
         await this.handleSsoCallback(unsendSso.splice(0, unsendSso.length));
     }
-    let url = this.config.sign_api_addr;
-    if (url[url.length - 1] !== '/') {
-        url += '/';
-    }
-    url += 'request_token';
-    const params = {
-        ver: this.apk.ver,
-        uin: this.uin,
-        android_id: this.device.android_id,
-        androidId: this.device.android_id,
-        qimei36: this.device.qimei36 || this.device.qimei16 || this.device.android_id,
-        guid: this.device.guid.toString('hex'),
-        qua: this.apk.qua,
-    };
-    const { data } = await axios.get(url,
+    const url = buildUrl(this.config.sign_api_addr, 'request_token');
+    const params = getCommonParams.call(this);
+    const data = await executeWithRetry(
+        () => qsignGet(url, params),
+        'refreshToken',
         {
-            params,
-        }
-    ).catch((e) => ({ data: { code: -1, msg: e ? e.message : 'failed to connect to qsign api' } }));
-    if (data.code !== 0) {
-        if (data.code === 1 && String(data.msg).includes('not registered')) {
-            try {
-                await this.registerQSign();
-            } catch (e) {
-                this.logger.warn(`${e.message || '[qsign][register] unknown error'}`);
-                console.warn(e);
-            }
-            await sleep(100);
-            return await this.refreshQSignToken(retry);
-        }
-        if (retry < 3) {
-            this.logger.warn(`[qsign][refreshToken] ${data.msg}(${data.code}), retry in 1s...`);
-            await sleep(1000);
-            return await this.refreshQSignToken(retry + 1);
+            throwOnError: false,
+            handleNotRegistered: true,
+            onNotRegistered: async () => {
+                try {
+                    await this.registerQSign();
+                } catch (e) {
+                    this.logger.warn(`${e.message || '[qsign][register] unknown error'}`);
+                    console.warn(e);
+                }
+                await sleep(100);
+            },
+            logger: this.logger,
         }
-        data.msg = data.msg || 'unknown error';
-        this.logger.warn(`[qsign][refreshToken] ${data.msg}(${data.code})`);
-    }
-    if (data.data){
+    );
+    if (data.data) {
         const pkts = data.data.ssoPacketList || data.data.requestCallback || data.data;
         if (Array.isArray(pkts)) {
             await this.handleSsoCallback(pkts);
@@ -575,7 +505,7 @@ Client.prototype.buildSSOReserveField = async function(cmd, body, seq_id = this.
         12: qimei, //qimei (string)
         14: 0, //newconn_flag (uint32)
         15: null, //trace_parent (string)
-        16: String(this.uin), //uid (string)
+        16: this.uid ? String(this.uid) : "", //uid (string)
         18: 0, //imsi (uint32)
         19: 1, //network_type (uint32)
         20: 1, //ip_stack_type (uint32)
@@ -596,7 +526,6 @@ Client.prototype.buildSSOReserveField = async function(cmd, body, seq_id = this.
         }
     }
     if (options.nt_core) { //此时数据包内需用uid取代uin
-        reserveFields[16] = String(this.uid);
         reserveFields[21] |= 32;
         reserveFields[26] = 100;
     }
@@ -611,117 +540,88 @@ Client.prototype.buildSSOReserveField = async function(cmd, body, seq_id = this.
  * @param {string} cmd
  * @param {Buffer} body
  * @param {number} seq_id
- * @param {number} retry 重试次数
  */
-Client.prototype.getSign = async function(cmd, body, seq_id = this.seq_id, retry = 0) {
+Client.prototype.getSign = async function(cmd, body, seq_id = this.seq_id) {
     if (!this.config.sign_api_addr || !this.apk.qua) return BUF0;
-    let url = this.config.sign_api_addr;
-    if (url[url.length - 1] !== '/') {
-        url += '/';
-    }
-    url += 'sign';
+    const url = buildUrl(this.config.sign_api_addr, 'sign');
+    const params = getCommonParams.call(this, {
+        buffer: body.toString('hex'),
+        cmd: cmd,
+        seq: seq_id,
+    });
     await requestLock.acquire();
-    const { data } = await axios.post(url,
-        {
-            ver: this.apk.ver,
-            androidId: this.device.android_id,
-            android_id: this.device.android_id,
-            qimei36: this.device.qimei36 || this.device.qimei16 || this.device.android_id,
-            guid: this.device.guid.toString('hex'),
-            uin: this.uin,
-            buffer: body.toString('hex'),
-            cmd: cmd,
-            seq: seq_id,
-            qua: this.apk.qua,
-            key: this.config.sign_api_key
-        },
-    ).catch((e) => ({ data: { code: -1, msg: e ? e.message : 'failed to connect to qsign api' } }));
-    requestLock.release();
-    if (data.code !== 0) {
-        if (data.code === 1 && String(data.msg).includes('not registered')) {
-            await this.registerQSign();
-            await sleep(1000);
-            return await this.getSign(cmd, body, seq_id, retry);
-        }
-        if (retry < 3) {
-            this.logger.warn(`[qsign][HeadSign] ${data.msg}(${data.code}), retry in 1s...`);
-            await sleep(1000);
-            return await this.getSign(cmd, body, seq_id, retry + 1);
+    try {
+        const data = await executeWithRetry(
+            () => qsignPost(url, params),
+            'HeadSign',
+            {
+                throwOnError: true,
+                handleNotRegistered: true,
+                onNotRegistered: () => this.registerQSign(true),
+                logger: this.logger,
+            }
+        );
+        if (!data.data.sign) {
+            throw new Error(`[qsign][HeadSign] server return invalid response: ${JSON.stringify(data)}`);
         }
-        data.msg = data.msg || 'unknown error';
-        throw new Error(`[qsign][HeadSign] ${data.msg}(${data.code})`);
-    }
-    if (!data.data.sign) {
-        throw new Error(`[qsign][HeadSign] server return invalid response: ${JSON.stringify(data)}`);
-    }
-    if (data.data.requestCallback && data.data.requestCallback.length > 0) {
-        // 成功上线register后再发送SSO包
-        unsendSso.push.apply(unsendSso, data.data.requestCallback);
-        if (this.isOnline()) {
-            setTimeout(() => this.refreshQSignToken(), 100);
-        } else {
-            this.once("internal.registered", async () => {
-                await this.refreshQSignToken();
-            });
+        if (data.data.requestCallback && data.data.requestCallback.length > 0) {
+            // 成功上线register后再发送SSO包
+            unsendSso.push.apply(unsendSso, data.data.requestCallback);
+            if (this.isOnline()) {
+                setTimeout(() => this.refreshQSignToken(), 100);
+            } else {
+                this.once("internal.registered", async () => {
+                    await this.refreshQSignToken();
+                });
+            }
         }
+        return Buffer.from(pb.encode({
+            1: Buffer.from(data.data.sign, "hex"),
+            2: Buffer.from(data.data.token, "hex"),
+            3: Buffer.from(data.data.extra, "hex"),
+        }));
+    } finally {
+        requestLock.release();
     }
-    return Buffer.from(pb.encode({
-        1: Buffer.from(data.data.sign, "hex"),
-        2: Buffer.from(data.data.token, "hex"),
-        3: Buffer.from(data.data.extra, "hex"),
-    }));
 };
 
 /**
  * 获取Tlv544
  * @param {string} cmd
- * @param {number} retry 重试次数
  */
-Client.prototype.getT544 = async function(cmd, retry = 0) {
+Client.prototype.getT544 = async function(cmd) {
     if (!this.config.sign_api_addr || !this.apk.qua) return BUF0;
     if (this.config.force_algo_T544) return BUF0;
-    let url = this.config.sign_api_addr;
-    if (url[url.length - 1] !== '/') {
-        url += '/';
+    // 优先使用custom_energy，避免服务器使用不正确的 salt 组装
+    try {
+        return await this.getT544CustomEnergy(cmd);
+    } catch (e) {
+        this.logger.warn(`[qsign][T544] /custom_energy failed, falling back to /energy: ${e.message || e}`);
     }
-    url += 'energy';
-    const params = {
-        ver: this.apk.ver,
-        androidId: this.device.android_id,
-        android_id: this.device.android_id,
-        qimei36: this.device.qimei36 || this.device.qimei16 || this.device.android_id,
-        guid: this.device.guid.toString('hex'),
-        uin: this.uin,
+    const url = buildUrl(this.config.sign_api_addr, 'energy');
+    const params = getCommonParams.call(this, {
         data: cmd,
-        key: this.config.sign_api_key,
-        version: this.apk.sdkver
-    };
-    const { data } = await axios.get(url,
+        version: this.apk.sdkver,
+    });
+    const data = await executeWithRetry(
+        () => qsignGet(url, params),
+        'T544',
         {
-            params,
-        }
-    ).catch((e) => ({ data: { code: -1, msg: e ? e.message : 'failed to connect to qsign api' } }));
-    if (data.code !== 0) {
-        if (data.code === 1 && String(data.msg).includes('not registered')) {
-            await this.registerQSign();
-            await sleep(1000);
-            return await this.getT544(cmd, retry);
+            throwOnError: true,
+            handleNotRegistered: true,
+            onNotRegistered: () => this.registerQSign(),
+            logger: this.logger,
         }
-        if (retry < 3) {
-            this.logger.warn(`[qsign][T544] ${data.msg}(${data.code}), retry in 1s...`);
-            await sleep(1000);
-            return await this.getT544(cmd, retry + 1);
-        }
-        data.msg = data.msg || 'unknown error';
-        throw new Error(`[qsign][T544] ${data.msg}(${data.code})`);
-    }
+    );
     if (!data.data) {
-        this.logger.warn(`[qsign][T544] server may not support /energy api: ${JSON.stringify(data)}`);
-        return await this.getT544CustomEnergy(cmd);
+        throw new Error(`[qsign][T544] server return invalid response: ${JSON.stringify(data)}`);
     }
-    if (typeof(data.data) === 'string')
+    if (typeof(data.data) === 'string') {
+        if (this.sig.t553 && this.sig.t553.length === 0) {
+            await this.getXwDebugId();
+        }
         return Buffer.from(data.data, 'hex');
-    else if (typeof(data.data.sign) === 'string') {
+    } else if (typeof(data.data.sign) === 'string') {
         if (typeof(data.data.t553) === 'string') this.sig.t553 = Buffer.from(data.data.t553, 'hex');
         return Buffer.from(data.data.sign, 'hex');
     }
@@ -731,20 +631,15 @@ Client.prototype.getT544 = async function(cmd, retry = 0) {
 /**
  * 获取Tlv544 custom_energy
  * @param {string} cmd
- * @param {number} retry 重试次数
  */
-Client.prototype.getT544CustomEnergy = async function(cmd, retry = 0) {
+Client.prototype.getT544CustomEnergy = async function(cmd) {
     if (!this.config.sign_api_addr || !this.apk.qua) return BUF0;
     if (this.config.force_algo_T544) return BUF0;
-    let url = this.config.sign_api_addr;
-    if (url[url.length - 1] !== '/') {
-        url += '/';
-    }
-    url += 'custom_energy';
+    const url = buildUrl(this.config.sign_api_addr, 'custom_energy');
     const salt = new Writer();
     const subCmd = parseInt('0x' + (cmd.split("_")[1] || 9));
     if (["810_9", "810_a", "810_d", "810_f"].includes(cmd)) {
-        salt.writeU32(0)
+        salt.writeU32(this.uin > 2147483647 ? 0xffffffff : 0)
         salt.writeTlv(this.device.guid)
         salt.writeTlv(this.apk.sdkver)
         salt.writeU32(subCmd)
@@ -755,44 +650,87 @@ Client.prototype.getT544CustomEnergy = async function(cmd, retry = 0) {
         salt.writeTlv(this.apk.sdkver)
         salt.writeU32(subCmd)
     }
-    const params = {
-        ver: this.apk.ver,
-        androidId: this.device.android_id,
-        android_id: this.device.android_id,
-        qimei36: this.device.qimei36 || this.device.qimei16 || this.device.android_id,
-        guid: this.device.guid.toString('hex'),
-        uin: this.uin,
+    const params = getCommonParams.call(this, {
         data: cmd,
-        key: this.config.sign_api_key,
-        salt: salt.read().toString('hex')
-    };
-    const { data } = await axios.get(url,
+        salt: salt.read().toString('hex'),
+    });
+    const data = await executeWithRetry(
+        () => qsignGet(url, params),
+        'T544',
         {
-            params,
+            throwOnError: true,
+            handleNotRegistered: true,
+            onNotRegistered: () => this.registerQSign(),
+            logger: this.logger,
         }
-    ).catch((e) => ({ data: { code: -1, msg: e ? e.message : 'failed to connect to qsign api' } }));
-    if (data.code !== 0) {
-        if (data.code === 1 && String(data.msg).includes('not registered')) {
-            await this.registerQSign();
-            await sleep(1000);
-            return await this.getT544CustomEnergy(cmd, retry);
-        }
-        if (retry < 3) {
-            this.logger.warn(`[qsign][T544] ${data.msg}(${data.code}), retry in 1s...`);
-            await sleep(1000);
-            return await this.getT544CustomEnergy(cmd, retry + 1);
-        }
-        data.msg = data.msg || 'unknown error';
-        throw new Error(`[qsign][T544] ${data.msg}(${data.code})`);
-    }
+    );
     if (!data.data) {
         throw new Error(`[qsign][T544] server return invalid response: ${JSON.stringify(data)}`);
     }
-    if (typeof(data.data) === 'string')
+    if (typeof(data.data) === 'string') {
+        if (this.sig.t553 && this.sig.t553.length === 0) {
+            await this.getXwDebugId();
+        }
         return Buffer.from(data.data, 'hex');
-    else if (typeof(data.data.sign) === 'string') {
+    } else if (typeof(data.data.sign) === 'string') {
         if (typeof(data.data.t553) === 'string') this.sig.t553 = Buffer.from(data.data.t553, 'hex');
         return Buffer.from(data.data.sign, 'hex');
     }
     else throw new Error(`[qsign][T544] server return invalid response: ${JSON.stringify(data)}`);
 };
+
+/**
+ * 从服务器获得XwDebugId
+ */
+Client.prototype.getXwDebugId = async function() {
+    if (!this.config.sign_api_addr || !this.apk.qua) return;
+    const url = buildUrl(this.config.sign_api_addr, 'get_xw_debug_id');
+    const params = getCommonParams.call(this);
+    await requestLock.acquire();
+    try {
+        const data = await executeWithRetry(
+            () => qsignGet(url, params),
+            'XwDebugId',
+            {
+                throwOnError: false,
+                handleNotRegistered: true,
+                onNotRegistered: () => this.registerQSign(true),
+                logger: this.logger,
+            }
+        );
+        if (typeof(data.data) === 'string') {
+            this.sig.t553 = Buffer.from(data.data, 'hex');
+            this.logger.info(`[qsign][XwDebugId] updated t553: ${data.data}`);
+        }
+    } finally {
+        requestLock.release();
+    }
+};
+
+/**
+ * 从服务器拉取签名cmd名单
+ */
+Client.prototype.updateCmdWhiteList = async function() {
+    if (!this.config.sign_api_addr || !this.apk.qua) return;
+    const url = buildUrl(this.config.sign_api_addr, 'cmd_whitelist');
+    const params = getCommonParams.call(this);
+    await requestLock.acquire();
+    try {
+        const data = await executeWithRetry(
+            () => qsignGet(url, params),
+            'CmdWhiteList',
+            {
+                throwOnError: false,
+                handleNotRegistered: true,
+                onNotRegistered: () => this.registerQSign(true),
+                logger: this.logger,
+            }
+        );
+        if (data.data && Array.isArray(data.data.list) && data.data.list.length > 0) {
+            this.needSignCmd = data.data.list;
+            this.logger.info(`[qsign][CmdWhiteList] updated needSignCmd list, count: ${this.needSignCmd.length}`);
+        }
+    } finally {
+        requestLock.release();
+    }
+};

package/lib/client.js

@@ -22,7 +22,7 @@ const { WtLogin } = require("./wtlogin/wt");
 const chat = require("./message/chat");
 const multi = require("./message/multi");
 const image = require("./message/image");
-const { Gfs } = require("./message/file");
+const { Gfs, getC2CFileUrlApi } = require("./message/file");
 const { getErrorMessage, TimeoutError } = require("./exception");
 
 function buildApiRet(retcode, data = null, error = null) {
@@ -161,6 +161,7 @@ class Client extends EventEmitter {
     seq_id = 1145 + Math.round(Math.random() * 1419);
     handlers = new Map; //存放响应包的回调
     seq_cache = new Map; //一分钟内的缓存
+    _registerRetryCount = 0; //register失败重试计数
 
     sig = {
         srm_token: BUF0,
@@ -370,6 +371,7 @@ class Client extends EventEmitter {
             else
                 this.password_md5 = md5(String(password));
         }
+        this._registerRetryCount = 0;
         this._connect(() => {
             this._wt.syncTimeDiff();
             this._wt.passwordLogin();
@@ -628,7 +630,7 @@ class Client extends EventEmitter {
         return this._useProtocol(chat.preloadImages, arguments);
     }
 
-    getNTPicURLbyFileid() {
+    getNTPicURLbyFileid(fileid) {
         return this._useProtocol(image.getNTPicURLbyFileidApi, arguments);
     }
 
@@ -640,6 +642,10 @@ class Client extends EventEmitter {
         return this._useProtocol(nessy.delDevLoginInfo, arguments);
     }
 
+    getC2CFileUrl(fileid) {
+        return this._useProtocol(getC2CFileUrlApi, arguments);
+    }
+
     ///////////////////////////////////////////////////
 
     async getCookies(domain) {

package/lib/device.js

@@ -564,6 +564,19 @@ const apk = {
         ssover: 22,
         qua: "V1_AND_SQ_9.1.20_8198_YYB_D",
     },
+
+    //android phone 9.2.80
+    61: {
+        ...DEFAULT_ANDROID_APK_INFO,
+        name: "A9.2.80.90316290",
+        version: "9.2.80.35125",
+        ver: "9.2.80",
+        buildtime: 1762849776,
+        subid: 537348293,
+        sdkver: "6.0.0.2591",
+        ssover: 22,
+        qua: "V1_AND_SQ_9.2.80_13690_YYB_D",
+    },
 };
 
 //apad
@@ -674,6 +687,10 @@ apk[58].subid = 537244932;
 apk[60] = { ...apk[59] };
 apk[60].subid = 537257453;
 
+//apad 9.2.80
+apk[62] = { ...apk[61] };
+apk[62].subid = 537348332;
+
 //ipad
 apk[5] = { ...apk[1] };
 apk[5].subid = 537155074;

package/lib/message/face.js

@@ -347,6 +347,7 @@ const map = {
     415: "/划龙舟",
     416: "/中龙舟",
     417: "/大龙舟",
+    418: "/填罐罐",
 
     419: "/火车",
     420: "/中火车",

package/lib/message/file.js

@@ -426,6 +426,15 @@ async function getC2CFileUrl(fileid) {
     return _url.toString();
 }
 
+/**
+ * @this {import("../ref").Client}
+ * @param {Buffer|string} fileid 
+ */
+async function getC2CFileUrlApi(fileid) {
+    const url = await getC2CFileUrl.call(this, fileid);
+    return { result: 0, data: url };
+}
+
 /**
  * @this {import("../ref").Client}
  * @param {Buffer|string} fileid 
@@ -456,5 +465,5 @@ async function getSyncDeviceFileUrl(fileid) {
 }
 
 module.exports = {
-    getC2CFileUrl, getSyncDeviceFileUrl, Gfs
+    getC2CFileUrl, getC2CFileUrlApi, getSyncDeviceFileUrl, Gfs
 };

package/lib/message/image.js

@@ -56,6 +56,9 @@ const rkey_cache = {
     guildNTPicRkey: { value: '', expire: 0 },
 }
 
+/** @type {Promise<typeof rkey_cache> | null} */
+let rkey_fetching = null;
+
 /**
  * 生成CQ码file字段
  * @param {string} md5 
@@ -627,91 +630,31 @@ async function checkImgUrl(url) {
 }
 
 /**
- * 获取QQNT私聊图URL
- * @this {import("../ref").Client}
- * @param {Object} imgInfo 
- * @param {String} uid
- */
-async function getOffNTPicURL(imgInfo, uid) {
-    if (!uid) uid = String(this.uid || this.uin);
-    const body = pb.encode({
-        1: {
-            1: {
-                1: 1,
-                2: 200,
-            },
-            2: {
-                101: 2,
-                102: 1,
-                200: 1,
-                201: {
-                    1: 2,
-                    2: uid,
-                },
-            },
-            3: {
-                1: 2,
-            },
-        },
-        3: {
-            1: imgInfo,
-            2: {
-                2: {
-                    1: 0,
-                    3: 0,
-                },
-            },
-        },
-    });
-    try {
-        const rsp = await this.sendOidbSvcTrpcTcp("OidbSvcTrpcTcp.0x11c5_200", body);
-        const rkey = rsp[3][1];
-        if (!rkey)
-            throw new Error("rkey不存在");
-        return `https://${rsp[3][3][1]}${rsp[3][3][2]}${rkey}&spec=0`;
-    } catch (e) {
-        this.logger.warn("获取QQNT图片URL失败", e.message);
-        return null;
-    }
-}
-
-/**
- * 获取QQNT群图URL
+ * 获取QQNT图片URL
  * @this {import("../ref").Client}
  * @param {Object} imgInfo 
- * @param {number} gid
+ * @param {number|string} target 群号或UID
+ * @param {boolean} c2c 是否为私聊
  */
-async function getGroupNTPicURL(imgInfo, gid = 284840486) {
+async function getNTPicURL(imgInfo, target, c2c = false) {
+    if (!target) target = c2c ? String(this.uid || this.uin) : 284840486;
     const body = pb.encode({
         1: {
-            1: {
-                1: 1,
-                2: 200,
-            },
+            1: { 1: 1, 2: 200 },
             2: {
-                101: 2,
-                102: 1,
-                200: 2,
-                202: {
-                    1: gid,
-                },
-            },
-            3: {
-                1: 2,
+                101: 2, 102: 1,
+                200: c2c ? 1 : 2,
+                [c2c ? 201 : 202]: c2c ? { 1: 2, 2: String(target) } : { 1: target },
             },
+            3: { 1: 2 },
         },
         3: {
             1: imgInfo,
-            2: {
-                2: {
-                    1: 0,
-                    3: 0,
-                },
-            },
+            2: { 2: { 1: 0, 3: 0 } },
         },
     });
     try {
-        const rsp = await this.sendOidbSvcTrpcTcp("OidbSvcTrpcTcp.0x11c4_200", body);
+        const rsp = await this.sendOidbSvcTrpcTcp(`OidbSvcTrpcTcp.0x11c${c2c ? 5 : 4}_200`, body);
         const rkey = rsp[3][1];
         if (!rkey)
             throw new Error("rkey不存在");
@@ -732,7 +675,7 @@ async function getNTPicRkey() {
     let needRefresh = false;
     for (const key of Object.keys(rkey_cache)) {
         const entry = rkey_cache[key];
-        if (!entry.value || entry.expire <= now) {
+        if (!entry.value || (entry.expire || 0) - now < 600) { // 提前 10 分钟刷新
             needRefresh = true;
             break;
         }
@@ -740,6 +683,21 @@ async function getNTPicRkey() {
     if (!needRefresh) {
         return rkey_cache;
     }
+    // 如果已有请求正在进行中，直接复用其结果
+    if (rkey_fetching) {
+        return rkey_fetching;
+    }
+    rkey_fetching = _fetchNTPicRkey.call(this).finally(() => {
+        rkey_fetching = null;
+    });
+    return rkey_fetching;
+}
+
+/**
+ * 实际执行获取QQNT图片rkey的请求
+ * @this {import("../ref").Client}
+ */
+async function _fetchNTPicRkey() {
     const body = pb.encode({
         1: {
             1: {
@@ -776,36 +734,6 @@ async function getNTPicRkey() {
     return rkey_cache;
 }
 
-/**
- * 获取QQNT群图rkey
- * @deprecated
- * @this {import("../ref").Client}
- */
-async function getGroupNTPicRkey() {
-    const rsp = await getGroupNTPicURL.call(this, {
-        2: "CNL-BhjClnU",
-        3: 1,
-    });
-    if (!rsp)
-        return "&rkey=CAQSKDOc_jvbthUjZrMxJG2jNZ-rIWue47Q3PGKb_GWljzyvOUZOv0-EVao";
-    return '&rkey=' + rsp.match(/&rkey=([^&]+)/)[1];
-}
-
-/**
- * 获取QQNT私聊图rkey
- * @deprecated
- * @this {import("../ref").Client}
- */
-async function getOffNTPicRkey() {
-    const rsp = await getOffNTPicURL.call(this, {
-        2: "CNL-BhjClnU",
-        3: 1,
-    });
-    if (!rsp)
-        return "&rkey=CAQSKDOc_jvbthUjAatuFPQIo-x9wwcDhDGd8SOEu5FyJWNxNMabJTTRpO8";
-    return '&rkey=' + rsp.match(/&rkey=([^&]+)/)[1];
-}
-
 /**
  * 通过fileid获取QQNT图片URL
  * @this {import("../ref").Client}
@@ -839,7 +767,7 @@ async function getNTPicURLbyFileidApi(fileid) {
 module.exports = {
     ImageBuilder, uploadImages, buildImageFileParam,
     groupNTPicDown, offNTPicDown, checkImgUrl,
-    getGroupNTPicURL, getOffNTPicURL,
+    getNTPicURL,
     getNTPicURLbyFileid,
     getNTPicURLbyFileidApi,
 };

package/lib/message/parser.js

@@ -10,7 +10,7 @@ const pb = require("../algo/pb");
 const face = require("./face");
 const { getGroupMsgs } = require("./history");
 const { int32ip2str } = require("../service");
-const { buildImageFileParam, groupNTPicDown, offNTPicDown, checkImgUrl, getOffNTPicURL, getGroupNTPicURL, getNTPicURLbyFileid } = require("./image");
+const { buildImageFileParam, groupNTPicDown, offNTPicDown, checkImgUrl, getNTPicURL, getNTPicURLbyFileid } = require("./image");
 const { Gfs, getC2CFileUrl, getSyncDeviceFileUrl } = require("./file");
 const { getVideoUrl, getPttUrl, getOffNTPttUrl, getGroupNTPttUrl, getOffNTVideoUrl, getGroupNTVideoUrl } = require("./ptt");
 const { genC2CMessageId, genGroupMessageId, timestamp, parseFunString, code2uin, genRandom, unzip } = require("../common");
@@ -589,9 +589,9 @@ class Parser {
             // 图片地址失效，尝试发包获取
             let newURL = null;
             if (dm) { //私聊
-                newURL = await getOffNTPicURL.call(this.c, imgInfo, String(this.uid));
+                newURL = await getNTPicURL.call(this.c, imgInfo, String(this.uid), true);
             } else { //群聊
-                newURL = await getGroupNTPicURL.call(this.c, imgInfo, this.gid);
+                newURL = await getNTPicURL.call(this.c, imgInfo, this.gid);
             }
             if (newURL) {
                 data.url = newURL;

package/lib/oicq.js

@@ -216,8 +216,15 @@ function kickoffListener(data) {
 
 Client.prototype._register = async function () {
     if (!await this._wt.register()) {
+        if (++this._registerRetryCount > 10) {
+            this.logger.error("register重试超过10次，停止重试");
+            this._registerRetryCount = 0;
+            this.terminate();
+            return this.em("system.login.error", { code: -1, message: "上线注册失败，请检查token与协议类型是否匹配" });
+        }
         return this.emit("internal.network", "服务器繁忙(register)");
     }
+    this._registerRetryCount = 0;
     this.status = STATUS_ONLINE;
     if (!this.online_status)
         this.online_status = 11;
@@ -292,6 +299,7 @@ Client.prototype._stopHeartbeat = function () {
  */
 async function onlineListener() {
     this.sync_finished = false;
+    this._registerRetryCount = 0;
     await this._register();
     if (!this.isOnline())
         return;

package/lib/qsign-api.js

@@ -0,0 +1,158 @@
+/**
+ * QSign API 公共模块
+ * 封装所有与 qsign 服务器交互的通用逻辑
+ */
+"use strict";
+
+const _axios = require("axios");
+const http = require("http");
+const https = require("https");
+
+const API_WAIT_TIME = 45000;
+const MAX_RETRY = 3;
+
+const axios = _axios.create({
+    httpAgent: new http.Agent({ keepAlive: true }),
+    httpsAgent: new https.Agent({ keepAlive: true }),
+    timeout: API_WAIT_TIME,
+    headers: {
+        'User-Agent': "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.199 Safari/537.36 OICQ/1.26 ILPP/2",
+        'Content-Type': "application/x-www-form-urlencoded"
+    }
+});
+
+/**
+ * 构建 qsign API URL
+ * @param {string} baseAddr 基础地址
+ * @param {string} endpoint 端点路径
+ * @returns {string}
+ */
+function buildUrl(baseAddr, endpoint) {
+    let url = baseAddr;
+    if (url[url.length - 1] !== '/') {
+        url += '/';
+    }
+    return url + endpoint;
+}
+
+/**
+ * 获取 qsign API 公共参数
+ * @this {import("./ref").Client}
+ * @param {object} [extraParams] 额外参数
+ * @returns {object}
+ */
+function getCommonParams(extraParams = {}) {
+    return {
+        ver: this.apk.ver,
+        android_id: this.device.android_id,
+        androidId: this.device.android_id,
+        qimei36: this.device.qimei36 || this.device.qimei16 || this.device.android_id,
+        guid: this.device.guid.toString('hex'),
+        uin: this.uin,
+        key: this.config.sign_api_key,
+        qua: this.apk.qua,
+        ...extraParams,
+    };
+}
+
+/**
+ * 发送 qsign GET 请求
+ * @param {string} url 
+ * @param {object} params 
+ * @returns {Promise<object>}
+ */
+async function qsignGet(url, params) {
+    const { data } = await axios.get(url, { params })
+        .catch((e) => ({ data: { code: -1, msg: e ? e.message : 'failed to connect to qsign api' } }));
+    return data;
+}
+
+/**
+ * 发送 qsign POST 请求
+ * @param {string} url 
+ * @param {object} body 
+ * @returns {Promise<object>}
+ */
+async function qsignPost(url, body) {
+    const { data } = await axios.post(url, body)
+        .catch((e) => ({ data: { code: -1, msg: e ? e.message : 'failed to connect to qsign api' } }));
+    return data;
+}
+
+/**
+ * 执行带重试的 qsign API 调用
+ * @param {function} apiFn 实际 API 调用函数
+ * @param {string} apiName API 名称（用于日志）
+ * @param {object} options 选项
+ * @param {boolean} [options.throwOnError=false] 是否在失败时抛出错误
+ * @param {boolean} [options.handleNotRegistered=false] 是否处理 "not registered" 错误
+ * @param {function} [options.onNotRegistered] 处理 "not registered" 的回调
+ * @param {number} [options.retry=0] 当前重试次数
+ * @returns {Promise<object>}
+ */
+async function executeWithRetry(apiFn, apiName, options = {}) {
+    const {
+        throwOnError = false,
+        handleNotRegistered = false,
+        onNotRegistered = null,
+        retry = 0,
+        logger = console,
+    } = options;
+
+    const data = await apiFn();
+
+    if (data.code !== 0) {
+        // 处理 "not registered" 错误
+        if (handleNotRegistered && data.code === 1 && String(data.msg).includes('not registered')) {
+            if (retry >= MAX_RETRY) {
+                data.msg = 'not registered after max retries. Original message: ' + data.msg;
+                const errorMsg = `[qsign][${apiName}] ${data.msg}(${data.code})`;
+                if (throwOnError) {
+                    throw new Error(errorMsg);
+                }
+                logger.warn(errorMsg);
+                return data;
+            }
+            if (onNotRegistered) {
+                await onNotRegistered();
+            }
+            await sleep(100);
+            return executeWithRetry(apiFn, apiName, { ...options, retry: retry + 1 });
+        }
+
+        // 重试逻辑
+        if (retry < MAX_RETRY) {
+            logger.warn(`[qsign][${apiName}] ${data.msg}(${data.code}), retry in 1s...`);
+            await sleep(1000);
+            return executeWithRetry(apiFn, apiName, { ...options, retry: retry + 1 });
+        }
+
+        // 最终失败处理
+        data.msg = data.msg || 'unknown error';
+        const errorMsg = `[qsign][${apiName}] ${data.msg}(${data.code})`;
+        if (throwOnError) {
+            throw new Error(errorMsg);
+        }
+        logger.warn(errorMsg);
+    }
+
+    return data;
+}
+
+/**
+ * 延迟函数
+ * @param {number} time 毫秒
+ * @returns {Promise<void>}
+ */
+function sleep(time) {
+    return new Promise(resolve => setTimeout(resolve, time));
+}
+
+module.exports = {
+    buildUrl,
+    getCommonParams,
+    qsignGet,
+    qsignPost,
+    executeWithRetry,
+    sleep,
+};

package/lib/ref.d.ts

@@ -195,6 +195,8 @@ export class Client extends oicq.Client {
     submitSsoCallback(cmd: string, callbackId: number, body: Buffer): Promise<void>;
     refreshQSignToken(): Promise<void>;
     buildSSOReserveField(cmd: string, body: Buffer, seq?: number, options?: SsoOptions): Promise<Buffer>;
+    getXwDebugId(): Promise<void>;
+    updateCmdWhiteList(): Promise<void>;
 }
 
 export * from '../index';

package/lib/wtlogin/login-password.js

@@ -52,6 +52,12 @@ WtLogin.prototype.passwordLogin = async function () {
     } catch {
         this.uid = "";
     }
+    try {
+        await this.c.updateCmdWhiteList();
+    } catch (e) {
+        const message = e.message || "[qsign][CmdWhiteList] 未知错误";
+        this.logger.error(message);
+    }
     try {
         this.t106 = await fs.promises.readFile(path.join(this.dir, "t106"));
         try {

package/lib/wtlogin/tlv.js

@@ -367,7 +367,7 @@ const tlv_map = {
         const salt = new Writer()
         const subCmd = parseInt('0x' + (code.split("_")[1] || 9))
         if (["810_9", "810_a", "810_d", "810_f"].includes(code)) {
-            salt.writeU32(0)
+            salt.writeU32(this.uin > 2147483647 ? 0xffffffff : 0)
             salt.writeTlv(this.device.guid)
             salt.writeTlv(Buffer.from(this.apk.sdkver))
             salt.writeU32(subCmd)

package/lib/wtlogin/wt.js

@@ -206,7 +206,6 @@ class WtLogin {
             this.logger.warn(`Unsupported tlv546 hash type ${hashType}`);
             return Buffer.alloc(0);
         }
-        let inputNum = BigInt("0x" + src.toString("hex"));
         switch (typ) {
             case 1:
                 // TODO
@@ -219,10 +218,15 @@ class WtLogin {
                 let elp = 0, cnt = 0;
                 if (tgt.length === 32) {
                     const start = Date.now();
-                    let hash = createHash("sha256").update(Buffer.from(inputNum.toString(16).padStart(256, "0"), "hex")).digest();
+                    const buf = Buffer.alloc(128);
+                    src.copy(buf, 128 - src.length);
+                    let hash = createHash("sha256").update(buf).digest();
                     while (Buffer.compare(hash, tgt) !== 0) {
-                        inputNum ++;
-                        hash = createHash("sha256").update(Buffer.from(inputNum.toString(16).padStart(256, "0"), "hex")).digest();
+                        for (let i = 127; i >= 0; i--) {
+                            buf[i] = (buf[i] + 1) & 0xFF;
+                            if (buf[i] !== 0) break;
+                        }
+                        hash = createHash("sha256").update(buf).digest();
                         cnt++;
                         if (cnt > 1000000) {
                             this.logger.error("Calculating PoW cost too much time, maybe something wrong");
@@ -230,7 +234,7 @@ class WtLogin {
                         }
                     }
                     ok = true;
-                    dst = Buffer.from(inputNum.toString(16).padStart(256, "0"), "hex");
+                    dst = buf;
                     elp = Date.now() - start;
                     this.logger.info(`Calculating PoW of plus ${cnt} times cost ${elp} ms`);
                 }

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "oicq-icalingua-plus-plus",
   "app_name": "oicq-icalingua-plus-plus",
-  "version": "1.26.1",
-  "app_version": "1.26.1",
-  "upday": "2026/05/17",
+  "version": "1.26.3",
+  "app_version": "1.26.3",
+  "upday": "2026/06/28",
   "protocol_version": "v11",
   "description": "oicq(https://github.com/takayama-lily/oicq) v1 for Icalingua++",
   "main": "index.js",
@@ -21,23 +21,23 @@
   "author": "The Icalingua++ Authors",
   "license": "MPL-2.0",
   "dependencies": {
-    "axios": "^1.2.1",
-    "jsqr": "^1.4.0",
-    "log4js": "^6.3.0",
-    "long": "^4.0.0",
-    "pngjs": "^6.0.0",
-    "probe-image-size": "^7.2.1",
-    "qrcode-terminal": "^0.12.0",
-    "ws": "^7.5.5"
+    "axios": "1.14.0",
+    "jsqr": "1.4.0",
+    "log4js": "6.9.1",
+    "long": "4.0.0",
+    "pngjs": "6.0.0",
+    "probe-image-size": "7.2.3",
+    "qrcode-terminal": "0.12.0",
+    "ws": "7.5.11"
   },
   "devDependencies": {
     "@types/node": "^16.7.13",
-    "@types/probe-image-size": "^7.0.1",
-    "@types/ws": "^7.4.7",
-    "chai": "^4.3.4",
-    "mocha": "^8.4.0",
-    "mockjs": "^1.1.0",
-    "protobufjs": "^6.11.2"
+    "@types/probe-image-size": "7.0.1",
+    "@types/ws": "7.4.7",
+    "chai": "4.5.0",
+    "mocha": "8.4.0",
+    "mockjs": "1.1.0",
+    "protobufjs": "6.11.6"
   },
   "files": [
     "/bin",