...make it actually work!

.env.example

@@ -48,16 +48,22 @@ PORT=4000
 # Bounded retry budget (B10): total upstream attempts per request (the failed
 # token is excluded from the retry pick while any other token is available)
 #DEEPSEEKER_MAX_UPSTREAM_ATTEMPTS=3
-# DeepSeek Android client version sent as x-client-version (B11); bump it when
-# the upstream app moves instead of carrying one stale string for all tokens
-#DEEPSEEKER_CLIENT_VERSION=2.4.5
+# DeepSeek web client version sent as x-client-version (B11); bump it when
+# the web app moves instead of carrying one stale string for all tokens
+#DEEPSEEKER_CLIENT_VERSION=2.7.1
+# Custom browser User-Agent for PC profile
+#DEEPSEEKER_BROWSER_USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/157.0.0.0 Safari/537.36"
+# Browser platform for PC profile ('Windows', 'Linux', 'macOS')
+#DEEPSEEKER_BROWSER_PLATFORM=Windows
 
 # --- Token pool scheduler v2 (B3; optional; defaults shown) ---
 # Seconds a 429'd token cools down before it automatically rejoins the pool
 #DEEPSEEKER_RATE_LIMIT_COOLDOWN=60
 # Soft per-token concurrency cap: tokens at the cap are only used when no
 # under-cap token is available (spreads load, prevents stampedes)
-#DEEPSEEKER_TOKEN_CONCURRENCY=8
+#DEEPSEEKER_TOKEN_CONCURRENCY=1
+# Quiet window call gap (seconds, [gap/2, gap] randomized quiet window after each turn)
+#DEEPSEEKER_CALL_GAP_SECONDS=4.0
 
 # --- Token lifecycle: quarantine (P0-3; optional; default shown) ---
 # Consecutive 403s (with no successful turn in between) that take a token out
@@ -68,6 +74,10 @@ PORT=4000
 # --- Backup WAF cookie tunables (optional; only needed if reverting to backup cookie generation) ---
 # Where the WAF cookie file is stored (Docker sets this to the volume)
 #DEEPSEEKER_COOKIE_PATH=/app/data/aws_cookies_deepseek.json
+# Optional manual WAF cookie string or JSON (overrides cookie generation)
+#DEEPSEEKER_WAF_COOKIE="aws-waf-token=...; ds_session_id=..."
+# Playwright headless mode (true by default)
+#DEEPSEEKER_COOKIE_HEADLESS=true
 # Cookie regeneration attempts, per-cycle timeout (s), and fail-fast cooldown (s)
 #DEEPSEEKER_COOKIE_ATTEMPTS=2
 #DEEPSEEKER_COOKIE_TIMEOUT=120
@@ -82,3 +92,43 @@ PORT=4000
 # --- DSH fix: context recovery for agent harnesses --------------------------
 # DEEPSEEKER_MAX_USER_MESSAGE_TOKENS=900000   (tail-truncate cap for the latest user message)
 # DEEPSEEKER_PROMPT_OVERHEAD_TOKENS=4096      (tool-schema + expansion overhead in the rollover estimate)
+
+# --- Tool schemas format & caching ---
+# Raw JSON schema tools format (<tools> block + structured properties + SHA-256 cache)
+# Optional and disabled by default (false) for standard compatibility. Set to true to enable.
+#DEEPSEEKER_TOOLS_SCHEMA_AS_IS=false
+
+# --- System prompt mirroring ---
+# Mirror all system prompt messages into [SYSTEM] on continuation turns (prevents model role drift)
+# Disabled by default (false). Set to true to duplicate initial system prompt on subsequent turns.
+#DEEPSEEKER_MIRROR_SYSTEM=false
+
+# --- HIF token attestation & overrides (PC/Browser profile) ---
+# URL for fetching x-hif-leim token
+#DEEPSEEKER_HIF_URL=https://hif-leim.deepseek.com/query
+# URL for fetching x-hif-dliq token
+#DEEPSEEKER_HIF_DLIQ_URL=https://hif-dliq.deepseek.com/query
+# Whether HIF token fetching is enabled
+#DEEPSEEKER_HIF_ENABLED=true
+
+# --- Claude Code auto-mode classifier mock ---
+# Intercept security monitor prompts from Claude Code auto mode and return
+# a mock severity (e.g. <severity>5) without calling upstream models. Default is false.
+#DEEPSEEKER_AUTO_MODE_MOCK=false
+# Optional fixed severity (0-9) instead of random
+#DEEPSEEKER_AUTO_MODE_SEVERITY=
+# Optional fixed custom response string
+#DEEPSEEKER_AUTO_MODE_RESPONSE=
+
+# --- Fast Startup mode (small VPS optimization) ---
+# If enabled, generates a single shared Shumei device ID for all accounts at startup
+# instead of isolating Shumei IDs per account. Default is false (per-account isolation).
+#DEEPSEEKER_FAST_START=false
+
+# Run browser in non-headless (visible) mode during startup warmup / cookie generation
+# for maximum anti-bot stealth (requires a display or xvfb). Default is false (runs headless).
+#DEEPSEEKER_WARMUP_NON_HEADLESS=false
+
+# --- Sessions persistence (in-memory mode) ---
+# Set to false to disable writing sessions/session_map to SQLite (kept in RAM until server restart)
+#DEEPSEEKER_PERSIST_SESSIONS=false

README.md

@@ -147,6 +147,7 @@ Then:
 
 ```bash
 uv sync
+uv run patchright install chromium          # or --with-deps on Linux
 source .venv/bin/activate   # or activate.fish / activate.zsh
 cp .env.example .env
 uv run deeperseeker
@@ -157,11 +158,12 @@ uv run deeperseeker
 ```bash
 python3 -m venv .venv
 pip install -r requirements.txt
+patchright install chromium                 # or --with-deps on Linux
 cp .env.example .env
 python3 app.py
 ```
 
-> **Note:** thanks to PR <https://github.com/AmanCode22/deeperseeker/pull/16> by [@alan7383](https://github.com/alan7383), Playwright and Chromium are deprecated and kept as backup (DeepSeek does not enforce AWS WAF on requests using Android client headers). You no longer need to run `playwright install chromium` or `xvfb-run` unless reverting to the backup cookie mechanism — and it saves RAM and is much more stable than cookie harvesting.
+> **Note:** DeeperSeeker replicates the desktop PC Chrome client 1-to-1, including Sec-CH-UA hints, WebAssembly PoW challenge solving, Shumei device token forwarding, and HIF attestation tokens. Bypassing DeepSeek's Cloudflare / AWS WAF protection and acquiring Shumei device identifiers requires Patchright (stealth-hardened Playwright) and Chromium installed on the system (simply run the install command above).
 
 ## Auth token setup
 
@@ -195,6 +197,8 @@ Copy `.env.example` to `.env` and edit your secret values. The table below is th
 | `DEEPSEEKER_MAX_UPSTREAM_ATTEMPTS` | Retries of one turn across the pool before the upstream error is surfaced to the client | `3` |
 | `DEEPSEEKER_MAX_USER_MESSAGE_TOKENS` | Hard cap for the latest user message inside a prompt; above it the message is tail-truncated with a marker instead of failing upstream | `900000` |
 | `DEEPSEEKER_PROMPT_OVERHEAD_TOKENS` | Flat overhead added to the rollover estimate for tool schemas, system expansion and summaries the raw history does not show | `4096` |
+| `DEEPSEEKER_FAST_START` | Shared Shumei ID on startup across accounts (fast boot) | `false` |
+| `DEEPSEEKER_WARMUP_NON_HEADLESS` | Run browser in non-headless (visible) mode during startup warmup / cookie generation for maximum stealth | `false` |
 | `DEEPSEEKER_MODE` | `bridge` (reverse-engineered web session) or `official` (official API passthrough). Explicit only — nothing falls back on its own | `bridge` |
 | `DEEPSEEKER_OFFICIAL_API_KEY` | Official API key used when mode is `official` (from platform.deepseek.com). Required in official mode | unset |
 | `DEEPSEEKER_OFFICIAL_BASE` | Official API base URL override in official mode | `https://api.deepseek.com` |

README.zh-CN.md

@@ -118,6 +118,7 @@ powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | ie
 
 ```bash
 uv sync
+uv run patchright install chromium          # 安装浏览器内核（Linux 上如缺少系统依赖可加 --with-deps）
 source .venv/bin/activate   # 或 activate.fish / activate.zsh
 cp .env.example .env
 uv run deeperseeker
@@ -128,11 +129,12 @@ uv run deeperseeker
 ```bash
 python3 -m venv .venv
 pip install -r requirements.txt
+patchright install chromium                 # 安装浏览器内核（Linux 上如缺少系统依赖可加 --with-deps）
 cp .env.example .env
 python3 app.py
 ```
 
-> **说明：** 感谢 [@alan7383](https://github.com/alan7383) 的 PR <https://github.com/AmanCode22/deeperseeker/pull/16>，Playwright 与 Chromium 已弃用并仅作后备保留（DeepSeek 不会对使用 Android 客户端头信息的请求执行 AWS WAF）。除非回退到后备的 cookie 采集机制，否则不再需要运行 `playwright install chromium` 或 `xvfb-run`——而且这样更省内存，也比 cookie 采集稳定得多。
+> **说明：** DeeperSeeker 1:1 模拟桌面端 Chrome 客户端，包括 Sec-CH-UA hints、WebAssembly PoW 挑战求解、数美（Shumei）设备令牌转发与 HIF 认证令牌。绕过 DeepSeek 最新的 Cloudflare / AWS WAF 护盾以及获取数美设备标识需要系统安装 Patchright（防检测加固版 Playwright）及 Chromium 内核（执行上述安装命令即可）。
 
 ## 认证令牌配置
 
@@ -166,6 +168,8 @@ python3 app.py
 | `DEEPSEEKER_MAX_UPSTREAM_ATTEMPTS` | 一轮对话在池内的重试次数，用尽后才把上游错误返回给客户端 | `3` |
 | `DEEPSEEKER_MAX_USER_MESSAGE_TOKENS` | 提示内最新一条用户消息的硬上限；超过后按尾部截断并加标记，而不是让上游失败 | `900000` |
 | `DEEPSEEKER_PROMPT_OVERHEAD_TOKENS` | 滚动估算时加上的固定开销，覆盖工具模式、系统扩写与原始历史中看不到的摘要 | `4096` |
+| `DEEPSEEKER_FAST_START` | 启动时跨账号共享数美设备 ID（快速启动） | `false` |
+| `DEEPSEEKER_WARMUP_NON_HEADLESS` | 启动预热/采集时以有头（可见）模式运行浏览器，获得最强抗检测能力 | `false` |
 | `DEEPSEEKER_MODE` | `bridge`（逆向网页会话）或 `official`（官方 API 直通）。必须显式设置——没有任何自动回退 | `bridge` |
 | `DEEPSEEKER_OFFICIAL_API_KEY` | `official` 模式使用的官方 API 密钥（来自 platform.deepseek.com）。官方模式下必填 | 未设置 |
 | `DEEPSEEKER_OFFICIAL_BASE` | 官方模式下官方 API 基址覆盖 | `https://api.deepseek.com` |