feat: update platform handling and add web support

- Updated Android client version to 2.1.5 in constants_shared.json.
- Introduced new constants_web.json for web platform configuration.
- Enhanced transport layer to support platform-specific TLS settings.
- Added platform configuration handling in settings update and read requests.
- Implemented platform selection UI in the web interface.
- Updated localization files for platform settings.
- Added Shumei device ID generation logic for web platform.
- Introduced confusion mapping and encryption for device ID generation.

.gitignore

@@ -70,4 +70,6 @@ data/
 .roomodes
 
 deepseek2api旧版/
-chat.deepseek.com_2026_05_30_09_34_45.har.txt
+chat.deepseek.com.har.txt
+chat.deepseek.com11.har.txt
+chat.deepseek.com/

internal/config/codec.go

@@ -51,6 +51,9 @@ func (c Config) MarshalJSON() ([]byte, error) {
 	if strings.TrimSpace(c.Vercel.Token) != "" || strings.TrimSpace(c.Vercel.ProjectID) != "" || strings.TrimSpace(c.Vercel.TeamID) != "" {
 		m["vercel"] = NormalizeVercelConfig(c.Vercel)
 	}
+	if strings.TrimSpace(c.Platform.Mode) != "" {
+		m["platform"] = c.Platform
+	}
 	if c.VercelSyncHash != "" {
 		m["_vercel_sync_hash"] = c.VercelSyncHash
 	}
@@ -132,6 +135,10 @@ func (c *Config) UnmarshalJSON(b []byte) error {
 			if err := json.Unmarshal(v, &c.Vercel); err != nil {
 				return fmt.Errorf("invalid field %q: %w", k, err)
 			}
+		case "platform":
+			if err := json.Unmarshal(v, &c.Platform); err != nil {
+				return fmt.Errorf("invalid field %q: %w", k, err)
+			}
 		case "_vercel_sync_hash":
 			if err := json.Unmarshal(v, &c.VercelSyncHash); err != nil {
 				return fmt.Errorf("invalid field %q: %w", k, err)
@@ -172,6 +179,7 @@ func (c Config) Clone() Config {
 			Prompt:  c.ThinkingInjection.Prompt,
 		},
 		Vercel:           c.Vercel,
+		Platform:         c.Platform,
 		VercelSyncHash:   c.VercelSyncHash,
 		VercelSyncTime:   c.VercelSyncTime,
 		AdditionalFields: map[string]any{},

internal/config/config.go

@@ -21,6 +21,7 @@ type Config struct {
 	CurrentInputFile  CurrentInputFileConfig  `json:"current_input_file,omitempty"`
 	ThinkingInjection ThinkingInjectionConfig `json:"thinking_injection,omitempty"`
 	Vercel            VercelConfig            `json:"vercel,omitempty"`
+	Platform          PlatformConfig          `json:"platform,omitempty"`
 	VercelSyncHash    string                  `json:"_vercel_sync_hash,omitempty"`
 	VercelSyncTime    int64                   `json:"_vercel_sync_time,omitempty"`
 	AdditionalFields  map[string]any          `json:"-"`
@@ -34,7 +35,7 @@ type Account struct {
 	Password string `json:"password,omitempty"`
 	Token    string `json:"token,omitempty"`
 	ProxyID  string `json:"proxy_id,omitempty"`
-	Role     string `json:"role,omitempty"`  // "normal" (default) or "standby"
+	Role     string `json:"role,omitempty"`   // "normal" (default) or "standby"
 	Banned   bool   `json:"banned,omitempty"` // true when USER_IS_BANNED detected
 }
 
@@ -188,6 +189,10 @@ type VercelConfig struct {
 	TeamID    string `json:"team_id,omitempty"`
 }
 
+type PlatformConfig struct {
+	Mode string `json:"mode,omitempty"` // "android" (default) or "web"
+}
+
 func NormalizeVercelConfig(v VercelConfig) VercelConfig {
 	return VercelConfig{
 		Token:     strings.TrimSpace(v.Token),
@@ -202,3 +207,22 @@ func (c *Config) ClearVercelCredentials() {
 	}
 	c.Vercel = VercelConfig{}
 }
+
+func (c *Config) PlatformMode() string {
+	if c == nil {
+		return "android"
+	}
+	mode := strings.TrimSpace(strings.ToLower(c.Platform.Mode))
+	if mode == "web" {
+		return "web"
+	}
+	return "android"
+}
+
+func (c *Config) IsWebPlatform() bool {
+	return c.PlatformMode() == "web"
+}
+
+func (c *Config) IsAndroidPlatform() bool {
+	return c.PlatformMode() == "android"
+}

internal/config/store_accessors.go

@@ -186,6 +186,20 @@ func (s *Store) RuntimeBackupReleaseCount() int {
 	return 2
 }
 
+func (s *Store) PlatformMode() string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.cfg.PlatformMode()
+}
+
+func (s *Store) IsWebPlatform() bool {
+	return s.PlatformMode() == "web"
+}
+
+func (s *Store) IsAndroidPlatform() bool {
+	return s.PlatformMode() == "android"
+}
+
 // SetAccountBanned marks an account as banned or unbanned. Returns the updated account.
 func (s *Store) SetAccountBanned(identifier string, banned bool) (Account, error) {
 	identifier = strings.TrimSpace(identifier)

internal/config/validation.go

@@ -30,6 +30,9 @@ func ValidateConfig(c Config) error {
 	if err := ValidateAccountProxyReferences(c.Accounts, c.Proxies); err != nil {
 		return err
 	}
+	if err := ValidatePlatformConfig(c.Platform); err != nil {
+		return err
+	}
 	return nil
 }
 
@@ -154,3 +157,13 @@ func ValidateAutoDeleteMode(mode string) error {
 		return fmt.Errorf("auto_delete.mode must be one of none, single, all")
 	}
 }
+
+func ValidatePlatformConfig(platform PlatformConfig) error {
+	mode := strings.ToLower(strings.TrimSpace(platform.Mode))
+	switch mode {
+	case "", "android", "web":
+		return nil
+	default:
+		return fmt.Errorf("platform.mode must be one of android, web")
+	}
+}

internal/deepseek/client/client_auth.go

@@ -11,14 +11,26 @@ import (
 
 	"ds2api/internal/auth"
 	"ds2api/internal/config"
+	"ds2api/internal/shumei"
 )
 
 func (c *Client) Login(ctx context.Context, acc config.Account) (string, error) {
 	clients := c.requestClientsForAccount(acc)
+	platform := c.Store.PlatformMode()
 	payload := map[string]any{
-		"password":  strings.TrimSpace(acc.Password),
-		"device_id": "android_device",
-		"os":        "android",
+		"password": strings.TrimSpace(acc.Password),
+	}
+	if platform == "web" {
+		deviceID, err := shumei.GetDeviceID(ctx)
+		if err != nil {
+			config.Logger.Warn("[login] shumei device_id failed, using fallback", "error", err)
+			deviceID = "web_device"
+		}
+		payload["device_id"] = deviceID
+		payload["os"] = "web"
+	} else {
+		payload["device_id"] = "android_device"
+		payload["os"] = "android"
 	}
 	if email := strings.TrimSpace(acc.Email); email != "" {
 		payload["email"] = email
@@ -164,6 +176,17 @@ func (c *Client) authHeaders(token string) map[string]string {
 		headers[k] = v
 	}
 	headers["authorization"] = "Bearer " + token
+
+	if dsprotocol.IsWebPlatform() {
+		for k, v := range dsprotocol.WebExtraHeaders() {
+			headers[k] = v
+		}
+		if hifHeaders := c.getHIFHeaders(); len(hifHeaders) > 0 {
+			for k, v := range hifHeaders {
+				headers[k] = v
+			}
+		}
+	}
 	return headers
 }
 

internal/deepseek/client/client_completion.go

@@ -17,6 +17,13 @@ func (c *Client) CallCompletion(ctx context.Context, a *auth.RequestAuth, payloa
 	clients := c.requestClientsForAuth(ctx, a)
 	headers := c.authHeaders(a.DeepSeekToken)
 	headers["x-ds-pow-response"] = powResp
+
+	if dsprotocol.IsWebPlatform() {
+		for k, v := range dsprotocol.WebExtraHeaders() {
+			headers[k] = v
+		}
+	}
+
 	captureSession := c.capture.Start("deepseek_completion", dsprotocol.DeepSeekCompletionURL, a.AccountID, payload)
 	resp, err := c.streamPostOnce(ctx, clients.stream, dsprotocol.DeepSeekCompletionURL, headers, payload)
 	if err != nil {

internal/deepseek/client/client_continue.go

@@ -56,6 +56,11 @@ func (c *Client) callContinue(ctx context.Context, a *auth.RequestAuth, sessionI
 	clients := c.requestClientsForAuth(ctx, a)
 	headers := c.authHeaders(a.DeepSeekToken)
 	headers["x-ds-pow-response"] = powResp
+	if dsprotocol.IsWebPlatform() {
+		for k, v := range dsprotocol.WebExtraHeaders() {
+			headers[k] = v
+		}
+	}
 	payload := map[string]any{
 		"chat_session_id":    sessionID,
 		"message_id":         responseMessageID,

internal/deepseek/client/client_core.go

@@ -8,9 +8,12 @@ import (
 
 	"ds2api/internal/auth"
 	"ds2api/internal/config"
+	dsprotocol "ds2api/internal/deepseek/protocol"
 	trans "ds2api/internal/deepseek/transport"
 	"ds2api/internal/devcapture"
 	"ds2api/internal/util"
+
+	"ds2api/internal/deepseek/hif"
 )
 
 // intFrom is a package-internal alias for the shared util version.
@@ -25,23 +28,72 @@ type Client struct {
 	fallback   *http.Client
 	fallbackS  *http.Client
 	maxRetries int
+	hifPoller  *hif.HIFPoller
 
 	proxyClientsMu sync.RWMutex
 	proxyClients   map[string]requestClients
 }
 
 func NewClient(store *config.Store, resolver *auth.Resolver) *Client {
-	return &Client{
+	c := &Client{
 		Store:        store,
 		Auth:         resolver,
 		capture:      devcapture.Global(),
-		regular:      trans.New(60 * time.Second),
-		stream:       trans.New(0),
-		fallback:     &http.Client{Timeout: 60 * time.Second},
-		fallbackS:    &http.Client{Timeout: 0},
 		maxRetries:   3,
 		proxyClients: map[string]requestClients{},
 	}
+	platform := "android"
+	if store != nil {
+		platform = store.PlatformMode()
+	}
+	dsprotocol.ApplyPlatform(platform)
+	c.regular = trans.NewWithPlatform(60*time.Second, platform)
+	c.stream = trans.NewWithPlatform(0, platform)
+	c.fallback = trans.NewFallbackClientWithPlatform(60*time.Second, nil, platform)
+	c.fallbackS = trans.NewFallbackClientWithPlatform(0, nil, platform)
+
+	if platform == "web" {
+		c.hifPoller = hif.NewHIFPoller()
+		c.hifPoller.Start()
+	}
+
+	return c
+}
+
+// RefreshTransport recreates the transport clients based on the current platform mode.
+func (c *Client) RefreshTransport() {
+	platform := c.Store.PlatformMode()
+	c.regular = trans.NewWithPlatform(60*time.Second, platform)
+	c.stream = trans.NewWithPlatform(0, platform)
+	c.fallback = trans.NewFallbackClientWithPlatform(60*time.Second, nil, platform)
+	c.fallbackS = trans.NewFallbackClientWithPlatform(0, nil, platform)
+
+	c.proxyClientsMu.Lock()
+	c.proxyClients = map[string]requestClients{}
+	c.proxyClientsMu.Unlock()
+}
+
+// SetPlatform switches the client to the given platform ("android" or "web"),
+// updating protocol constants, transport clients, and the HIF poller.
+func (c *Client) SetPlatform(platform string) {
+	dsprotocol.ApplyPlatform(platform)
+	c.RefreshTransport()
+
+	if platform == "web" && c.hifPoller == nil {
+		c.hifPoller = hif.NewHIFPoller()
+		c.hifPoller.Start()
+	} else if platform != "web" && c.hifPoller != nil {
+		c.hifPoller.Stop()
+		c.hifPoller = nil
+	}
+}
+
+// getHIFHeaders returns the current HIF headers from the poller, if active.
+func (c *Client) getHIFHeaders() map[string]string {
+	if c.hifPoller == nil {
+		return nil
+	}
+	return c.hifPoller.GetHeaders()
 }
 
 // PreloadPow 保留兼容接口，纯 Go 实现无需预加载。

internal/deepseek/client/proxy.go

@@ -157,11 +157,12 @@ func (c *Client) requestClientsForAccount(acc config.Account) requestClients {
 		return c.defaultRequestClients()
 	}
 
+	platform := c.Store.PlatformMode()
 	bundle := requestClients{
-		regular:   trans.NewWithDialContext(60*time.Second, dialContext),
-		stream:    trans.NewWithDialContext(0, dialContext),
-		fallback:  trans.NewFallbackClient(60*time.Second, dialContext),
-		fallbackS: trans.NewFallbackClient(0, dialContext),
+		regular:   trans.NewWithDialContextAndPlatform(60*time.Second, dialContext, platform),
+		stream:    trans.NewWithDialContextAndPlatform(0, dialContext, platform),
+		fallback:  trans.NewFallbackClientWithPlatform(60*time.Second, dialContext, platform),
+		fallbackS: trans.NewFallbackClientWithPlatform(0, dialContext, platform),
 	}
 
 	c.proxyClientsMu.Lock()

internal/deepseek/hif/hif.go

@@ -0,0 +1,183 @@
+package hif
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+	"sync"
+	"time"
+
+	"ds2api/internal/config"
+	dsprotocol "ds2api/internal/deepseek/protocol"
+	trans "ds2api/internal/deepseek/transport"
+)
+
+const (
+	dliqURL         = "https://hif-dliq.deepseek.com/query"
+	leimURL         = "https://hif-leim.deepseek.com/query"
+	defaultTTL      = 600 // seconds
+	initialInterval = 1 * time.Second
+	maxInterval     = 600 * time.Second
+	backoffFactor   = 2
+)
+
+// HIFPoller polls the DeepSeek HIF endpoints for x-hif-dliq and x-hif-leim header values.
+type HIFPoller struct {
+	mu       sync.RWMutex
+	dliq     string
+	leim     string
+	dliqAt   time.Time
+	leimAt   time.Time
+	stopCh   chan struct{}
+	client   *trans.Client
+	fallback *http.Client
+}
+
+// NewHIFPoller creates a new HIFPoller using web-platform TLS fingerprinting.
+func NewHIFPoller() *HIFPoller {
+	return &HIFPoller{
+		stopCh:   make(chan struct{}),
+		client:   trans.NewWithPlatform(15*time.Second, "web"),
+		fallback: trans.NewFallbackClientWithPlatform(15*time.Second, nil, "web"),
+	}
+}
+
+// Start begins the polling goroutines for both HIF header values.
+func (p *HIFPoller) Start() {
+	go p.pollLoop("dliq", dliqURL)
+	go p.pollLoop("leim", leimURL)
+}
+
+// Stop terminates the polling goroutines.
+func (p *HIFPoller) Stop() {
+	close(p.stopCh)
+}
+
+// GetHeaders returns the current HIF headers to add to requests.
+func (p *HIFPoller) GetHeaders() map[string]string {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	headers := make(map[string]string)
+	if p.dliq != "" {
+		headers["x-hif-dliq"] = p.dliq
+	}
+	if p.leim != "" {
+		headers["x-hif-leim"] = p.leim
+	}
+	return headers
+}
+
+func (p *HIFPoller) pollLoop(kind, url string) {
+	interval := initialInterval
+	for {
+		select {
+		case <-p.stopCh:
+			return
+		default:
+		}
+
+		value, ttl, err := p.query(url)
+		if err != nil {
+			config.Logger.Warn("[hif] query failed", "kind", kind, "error", err, "retry_after", interval)
+			select {
+			case <-p.stopCh:
+				return
+			case <-time.After(interval):
+			}
+			interval = time.Duration(float64(interval) * float64(backoffFactor))
+			if interval > maxInterval {
+				interval = maxInterval
+			}
+			continue
+		}
+
+		p.mu.Lock()
+		if kind == "dliq" {
+			p.dliq = value
+			p.dliqAt = time.Now()
+		} else {
+			p.leim = value
+			p.leimAt = time.Now()
+		}
+		p.mu.Unlock()
+
+		config.Logger.Info("[hif] query success", "kind", kind, "ttl", ttl)
+		interval = initialInterval
+
+		sleepDuration := time.Duration(ttl) * time.Second
+		select {
+		case <-p.stopCh:
+			return
+		case <-time.After(sleepDuration):
+		}
+	}
+}
+
+func (p *HIFPoller) query(url string) (value string, ttl int, err error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return "", defaultTTL, err
+	}
+
+	for k, v := range dsprotocol.BaseHeaders {
+		req.Header.Set(k, v)
+	}
+	for k, v := range dsprotocol.WebExtraHeaders() {
+		req.Header.Set(k, v)
+	}
+	req.Header.Set("User-Agent", dsprotocol.UserAgent())
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := p.client.Do(req)
+	if err != nil {
+		req2, reqErr := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+		if reqErr != nil {
+			return "", defaultTTL, err
+		}
+		for k, v := range req.Header {
+			req2.Header[k] = v
+		}
+		resp, err = p.fallback.Do(req2)
+		if err != nil {
+			return "", defaultTTL, err
+		}
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	ttl = defaultTTL
+	if ttlStr := resp.Header.Get("x-hif-ttl"); ttlStr != "" {
+		if n, e := strconv.Atoi(ttlStr); e == nil && n > 0 {
+			ttl = n
+		}
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", defaultTTL, err
+	}
+
+	var result struct {
+		Code int `json:"code"`
+		Data struct {
+			BizCode int `json:"biz_code"`
+			BizData struct {
+				Value string `json:"value"`
+			} `json:"biz_data"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(body, &result); err != nil {
+		return "", defaultTTL, err
+	}
+
+	if result.Data.BizCode != 0 || result.Data.BizData.Value == "" {
+		return "", defaultTTL, fmt.Errorf("hif query returned biz_code=%d", result.Data.BizCode)
+	}
+
+	return result.Data.BizData.Value, ttl, nil
+}

internal/deepseek/hif/hif_test.go

@@ -0,0 +1,291 @@
+package hif
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestNewHIFPollerCreation(t *testing.T) {
+	p := NewHIFPoller()
+	if p == nil {
+		t.Fatal("expected non-nil poller")
+	}
+	headers := p.GetHeaders()
+	if len(headers) != 0 {
+		t.Fatalf("expected empty headers on fresh poller, got %v", headers)
+	}
+}
+
+func TestGetHeadersReturnsCachedValues(t *testing.T) {
+	p := NewHIFPoller()
+	p.mu.Lock()
+	p.dliq = "dliq-value-123"
+	p.leim = "leim-value-456"
+	p.mu.Unlock()
+
+	headers := p.GetHeaders()
+	if headers["x-hif-dliq"] != "dliq-value-123" {
+		t.Fatalf("expected x-hif-dliq=dliq-value-123, got %q", headers["x-hif-dliq"])
+	}
+	if headers["x-hif-leim"] != "leim-value-456" {
+		t.Fatalf("expected x-hif-leim=leim-value-456, got %q", headers["x-hif-leim"])
+	}
+}
+
+func TestGetHeadersOmitsEmptyValues(t *testing.T) {
+	p := NewHIFPoller()
+	p.mu.Lock()
+	p.dliq = "only-dliq"
+	p.mu.Unlock()
+
+	headers := p.GetHeaders()
+	if _, ok := headers["x-hif-leim"]; ok {
+		t.Fatal("expected x-hif-leim to be omitted when empty")
+	}
+	if headers["x-hif-dliq"] != "only-dliq" {
+		t.Fatalf("expected x-hif-dliq=only-dliq, got %q", headers["x-hif-dliq"])
+	}
+}
+
+func TestQueryParsesResponse(t *testing.T) {
+	responseBody := map[string]any{
+		"code": 0,
+		"msg":  "",
+		"data": map[string]any{
+			"biz_code": 0,
+			"biz_msg":  "",
+			"biz_data": map[string]any{
+				"value": "test-hif-token",
+			},
+		},
+	}
+	body, _ := json.Marshal(responseBody)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("x-hif-ttl", "300")
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write(body)
+	}))
+	defer server.Close()
+
+	p := NewHIFPoller()
+	value, ttl, err := p.query(server.URL)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if value != "test-hif-token" {
+		t.Fatalf("expected value=test-hif-token, got %q", value)
+	}
+	if ttl != 300 {
+		t.Fatalf("expected ttl=300, got %d", ttl)
+	}
+}
+
+func TestQueryFallsBackToDefaultTTL(t *testing.T) {
+	responseBody := map[string]any{
+		"code": 0,
+		"data": map[string]any{
+			"biz_code": 0,
+			"biz_data": map[string]any{
+				"value": "val",
+			},
+		},
+	}
+	body, _ := json.Marshal(responseBody)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write(body)
+	}))
+	defer server.Close()
+
+	p := NewHIFPoller()
+	_, ttl, err := p.query(server.URL)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if ttl != defaultTTL {
+		t.Fatalf("expected default ttl=%d, got %d", defaultTTL, ttl)
+	}
+}
+
+func TestQueryReturnsErrorOnBadBizCode(t *testing.T) {
+	responseBody := map[string]any{
+		"code": 0,
+		"data": map[string]any{
+			"biz_code": 1,
+			"biz_msg":  "failed",
+			"biz_data": map[string]any{
+				"value": "",
+			},
+		},
+	}
+	body, _ := json.Marshal(responseBody)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write(body)
+	}))
+	defer server.Close()
+
+	p := NewHIFPoller()
+	_, _, err := p.query(server.URL)
+	if err == nil {
+		t.Fatal("expected error for non-zero biz_code")
+	}
+}
+
+func TestQueryReturnsErrorOnEmptyValue(t *testing.T) {
+	responseBody := map[string]any{
+		"code": 0,
+		"data": map[string]any{
+			"biz_code": 0,
+			"biz_data": map[string]any{
+				"value": "",
+			},
+		},
+	}
+	body, _ := json.Marshal(responseBody)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write(body)
+	}))
+	defer server.Close()
+
+	p := NewHIFPoller()
+	_, _, err := p.query(server.URL)
+	if err == nil {
+		t.Fatal("expected error for empty value")
+	}
+}
+
+func TestStopTerminatesPollLoop(t *testing.T) {
+	p := NewHIFPoller()
+	p.Stop()
+	// Stop should not panic when called once
+}
+
+func TestPollLoopUpdatesValue(t *testing.T) {
+	callCount := 0
+	var mu sync.Mutex
+
+	responseBody := map[string]any{
+		"code": 0,
+		"data": map[string]any{
+			"biz_code": 0,
+			"biz_data": map[string]any{
+				"value": "polled-value",
+			},
+		},
+	}
+	body, _ := json.Marshal(responseBody)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		callCount++
+		mu.Unlock()
+		w.Header().Set("x-hif-ttl", "1")
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write(body)
+	}))
+	defer server.Close()
+
+	p := NewHIFPoller()
+	// Override URLs by testing pollLoop directly with the test server URL
+	go p.pollLoop("dliq", server.URL)
+
+	// Wait for at least one successful poll
+	deadline := time.After(5 * time.Second)
+	for {
+		p.mu.RLock()
+		val := p.dliq
+		p.mu.RUnlock()
+		if val == "polled-value" {
+			break
+		}
+		select {
+		case <-deadline:
+			p.Stop()
+			t.Fatal("timed out waiting for pollLoop to update dliq value")
+		case <-time.After(50 * time.Millisecond):
+		}
+	}
+
+	p.Stop()
+
+	p.mu.RLock()
+	val := p.dliq
+	p.mu.RUnlock()
+	if val != "polled-value" {
+		t.Fatalf("expected dliq=polled-value, got %q", val)
+	}
+}
+
+func TestQuerySendsCorrectHeaders(t *testing.T) {
+	responseBody := map[string]any{
+		"code": 0,
+		"data": map[string]any{
+			"biz_code": 0,
+			"biz_data": map[string]any{
+				"value": "v",
+			},
+		},
+	}
+	body, _ := json.Marshal(responseBody)
+
+	var gotUA string
+	var gotAccept string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotUA = r.Header.Get("User-Agent")
+		gotAccept = r.Header.Get("Accept")
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write(body)
+	}))
+	defer server.Close()
+
+	p := NewHIFPoller()
+	_, _, err := p.query(server.URL)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if gotUA == "" {
+		t.Fatal("expected User-Agent header to be set")
+	}
+	if !strings.Contains(gotAccept, "application/json") {
+		t.Fatalf("expected Accept to contain application/json, got %q", gotAccept)
+	}
+}
+
+func TestQueryHandlesInvalidJSON(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, "not-json")
+	}))
+	defer server.Close()
+
+	p := NewHIFPoller()
+	_, _, err := p.query(server.URL)
+	if err == nil {
+		t.Fatal("expected error for invalid JSON response")
+	}
+}
+
+func TestQueryHandlesServerError(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer server.Close()
+
+	p := NewHIFPoller()
+	_, _, err := p.query(server.URL)
+	if err == nil {
+		t.Fatal("expected error for server returning non-success biz response")
+	}
+}

internal/deepseek/protocol/constants.go

@@ -4,6 +4,7 @@ import (
 	_ "embed"
 	"encoding/json"
 	"fmt"
+	"strings"
 )
 
 const (
@@ -45,6 +46,7 @@ var defaultSkipExactPaths = []string{
 }
 
 var ClientVersion string
+var currentPlatform = "android"
 var BaseHeaders = map[string]string{}
 var SkipContainsPatterns = cloneStringSlice(defaultSkipContainsPatterns)
 var SkipExactPathSet = toStringSet(defaultSkipExactPaths)
@@ -67,6 +69,9 @@ type sharedConstants struct {
 //go:embed constants_shared.json
 var sharedConstantsJSON []byte
 
+//go:embed constants_web.json
+var webConstantsJSON []byte
+
 func init() {
 	cfg := sharedConstants{}
 	if err := json.Unmarshal(sharedConstantsJSON, &cfg); err != nil {
@@ -113,13 +118,7 @@ func buildBaseHeaders(client clientConstants, overrides map[string]string) map[s
 		}
 		out[k] = v
 	}
-	if client.Name != "" && client.Version != "" {
-		userAgent := client.Name + "/" + client.Version
-		if client.Platform == "android" && client.AndroidAPILevel != "" {
-			userAgent += " Android/" + client.AndroidAPILevel
-		}
-		out["User-Agent"] = userAgent
-	}
+	out["User-Agent"] = userAgentForPlatform(client)
 	if client.Platform != "" {
 		out["x-client-platform"] = client.Platform
 	}
@@ -132,6 +131,69 @@ func buildBaseHeaders(client clientConstants, overrides map[string]string) map[s
 	return out
 }
 
+const webUserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
+
+func userAgentForPlatform(client clientConstants) string {
+	if client.Platform == "web" {
+		return webUserAgent
+	}
+	if client.Name != "" && client.Version != "" {
+		ua := client.Name + "/" + client.Version
+		if client.Platform == "android" && client.AndroidAPILevel != "" {
+			ua += " Android/" + client.AndroidAPILevel
+		}
+		return ua
+	}
+	return ""
+}
+
+// ApplyPlatform reloads constants for the given platform ("android" or "web").
+func ApplyPlatform(platform string) {
+	p := strings.ToLower(platform)
+	var data []byte
+	switch p {
+	case "web":
+		data = webConstantsJSON
+	default:
+		data = sharedConstantsJSON
+		p = "android"
+	}
+	cfg := sharedConstants{}
+	if err := json.Unmarshal(data, &cfg); err != nil {
+		panic(fmt.Errorf("load DeepSeek %s constants: %w", p, err))
+	}
+	currentPlatform = p
+	applySharedConstants(cfg)
+}
+
+// IsWebPlatform returns whether the current platform is web.
+func IsWebPlatform() bool {
+	return currentPlatform == "web"
+}
+
+// UserAgent returns the appropriate User-Agent string based on the current platform.
+func UserAgent() string {
+	if currentPlatform == "web" {
+		return webUserAgent
+	}
+	return "DeepSeek/" + ClientVersion
+}
+
+// WebExtraHeaders returns browser-specific headers that are not in the JSON
+// config but need to be added dynamically for the web platform.
+func WebExtraHeaders() map[string]string {
+	return map[string]string{
+		"sec-ch-ua":          `"Chromium";v="137", "Not/A)Brand";v="24"`,
+		"sec-ch-ua-mobile":   "?0",
+		"sec-ch-ua-platform": `"Windows"`,
+		"origin":             "https://chat.deepseek.com",
+		"referer":            "https://chat.deepseek.com/",
+		"sec-fetch-dest":     "empty",
+		"sec-fetch-mode":     "cors",
+		"sec-fetch-site":     "same-origin",
+	}
+}
+
 func cloneStringMap(in map[string]string) map[string]string {
 	out := make(map[string]string, len(in))
 	for k, v := range in {

internal/deepseek/protocol/constants_shared.json

@@ -2,7 +2,7 @@
   "client": {
     "name": "DeepSeek",
     "platform": "android",
-    "version": "2.1.2",
+    "version": "2.1.5",
     "android_api_level": "32",
     "locale": "zh_CN"
   },

internal/deepseek/protocol/constants_web.json

@@ -0,0 +1,32 @@
+{
+  "client": {
+    "name": "DeepSeek",
+    "platform": "web",
+    "version": "2.0.0",
+    "locale": "zh_CN"
+  },
+  "base_headers": {
+    "Host": "chat.deepseek.com",
+    "Accept": "*/*",
+    "Content-Type": "application/json",
+    "accept-encoding": "gzip, deflate, br, zstd",
+    "accept-charset": "UTF-8",
+    "x-app-version": "2.0.0",
+    "x-client-locale": "zh_CN",
+    "x-client-platform": "web",
+    "x-client-timezone-offset": "28800",
+    "x-client-version": "2.0.0"
+  },
+  "skip_contains_patterns": [
+    "quasi_status",
+    "elapsed_secs",
+    "pending_fragment",
+    "conversation_mode",
+    "fragments/-1/status",
+    "fragments/-2/status",
+    "fragments/-3/status"
+  ],
+  "skip_exact_paths": [
+    "response/search_status"
+  ]
+}

internal/deepseek/transport/transport.go

@@ -26,17 +26,27 @@ func New(timeout time.Duration) *Client {
 }
 
 func NewWithDialContext(timeout time.Duration, dialContext DialContextFunc) *Client {
+	return NewWithDialContextAndPlatform(timeout, dialContext, "android")
+}
+
+func NewWithPlatform(timeout time.Duration, platform string) *Client {
+	return NewWithDialContextAndPlatform(timeout, nil, platform)
+}
+
+func NewWithDialContextAndPlatform(timeout time.Duration, dialContext DialContextFunc, platform string) *Client {
 	useEnvProxy := dialContext == nil
 	if dialContext == nil {
 		dialContext = (&net.Dialer{Timeout: 15 * time.Second, KeepAlive: 30 * time.Second}).DialContext
 	}
+	tlsDialer := TLSDialerForPlatform(platform, dialContext)
+	forceHTTP2 := platform == "web"
 	base := &http.Transport{
-		ForceAttemptHTTP2:   false,
+		ForceAttemptHTTP2:   forceHTTP2,
 		MaxIdleConns:        200,
 		MaxIdleConnsPerHost: 100,
 		IdleConnTimeout:     90 * time.Second,
 		DialContext:         dialContext,
-		DialTLSContext:      safariTLSDialer(dialContext),
+		DialTLSContext:      tlsDialer,
 		TLSClientConfig:     &tls.Config{MinVersion: tls.VersionTLS12},
 	}
 	if useEnvProxy {
@@ -50,12 +60,17 @@ func (c *Client) Do(req *http.Request) (*http.Response, error) {
 }
 
 func NewFallbackClient(timeout time.Duration, dialContext DialContextFunc) *http.Client {
+	return NewFallbackClientWithPlatform(timeout, dialContext, "android")
+}
+
+func NewFallbackClientWithPlatform(timeout time.Duration, dialContext DialContextFunc, platform string) *http.Client {
 	useEnvProxy := dialContext == nil
 	if dialContext == nil {
 		dialContext = (&net.Dialer{Timeout: 15 * time.Second, KeepAlive: 30 * time.Second}).DialContext
 	}
+	forceHTTP2 := platform == "web"
 	base := &http.Transport{
-		ForceAttemptHTTP2:   false,
+		ForceAttemptHTTP2:   forceHTTP2,
 		MaxIdleConns:        200,
 		MaxIdleConnsPerHost: 100,
 		IdleConnTimeout:     90 * time.Second,
@@ -68,6 +83,38 @@ func NewFallbackClient(timeout time.Duration, dialContext DialContextFunc) *http
 	return &http.Client{Timeout: timeout, Transport: base}
 }
 
+// TLSDialerForPlatform returns the appropriate TLS dialer based on the platform.
+// "web" uses Chrome TLS fingerprinting with HTTP/2 support;
+// all other values (including "android") use Safari TLS fingerprinting with HTTP/1.1 only.
+func TLSDialerForPlatform(platform string, dialContext DialContextFunc) func(ctx context.Context, network, addr string) (net.Conn, error) {
+	if platform == "web" {
+		return chromeTLSDialer(dialContext)
+	}
+	return safariTLSDialer(dialContext)
+}
+
+func chromeTLSDialer(dialContext DialContextFunc) func(ctx context.Context, network, addr string) (net.Conn, error) {
+	if dialContext == nil {
+		dialContext = (&net.Dialer{Timeout: 15 * time.Second, KeepAlive: 30 * time.Second}).DialContext
+	}
+	return func(ctx context.Context, network, addr string) (net.Conn, error) {
+		plainConn, err := dialContext(ctx, network, addr)
+		if err != nil {
+			return nil, err
+		}
+		host, _, _ := net.SplitHostPort(addr)
+		uCfg := &utls.Config{ServerName: host}
+		uConn := utls.UClient(plainConn, uCfg, utls.HelloChrome_Auto)
+		// Do NOT force HTTP/1.1 ALPN; allow natural ALPN negotiation (h2 or http/1.1).
+		err = uConn.HandshakeContext(ctx)
+		if err != nil {
+			_ = plainConn.Close()
+			return nil, err
+		}
+		return uConn, nil
+	}
+}
+
 func safariTLSDialer(dialContext DialContextFunc) func(ctx context.Context, network, addr string) (net.Conn, error) {
 	if dialContext == nil {
 		dialContext = (&net.Dialer{Timeout: 15 * time.Second, KeepAlive: 30 * time.Second}).DialContext

internal/httpapi/admin/accounts/handler_accounts_testing_test.go

@@ -62,6 +62,8 @@ func (m *testingDSMock) GetSessionCountForToken(_ context.Context, _ string) (*d
 	return &dsclient.SessionStats{Success: true}, nil
 }
 
+func (m *testingDSMock) SetPlatform(_ string) {}
+
 func TestTestAccount_BatchModeOnlyCreatesSession(t *testing.T) {
 	t.Setenv("DS2API_CONFIG_JSON", `{"accounts":[{"email":"batch@example.com","password":"pwd","token":""}]}`)
 	store := config.LoadStore()
@@ -167,6 +169,8 @@ func (m *completionPayloadDSMock) GetSessionCountForToken(_ context.Context, _ s
 	return &dsclient.SessionStats{Success: true}, nil
 }
 
+func (m *completionPayloadDSMock) SetPlatform(_ string) {}
+
 func TestTestAccount_MessageModeUsesExpertModelTypeForExpertModel(t *testing.T) {
 	t.Setenv("DS2API_CONFIG_JSON", `{"accounts":[{"email":"batch@example.com","password":"pwd","token":"seed-token"}]}`)
 	store := config.LoadStore()

internal/httpapi/admin/proxies/test_http_helpers_test.go

@@ -35,6 +35,7 @@ func (m *testingDSMock) DeleteAllSessionsForToken(_ context.Context, _ string) e
 func (m *testingDSMock) GetSessionCountForToken(_ context.Context, _ string) (*dsclient.SessionStats, error) {
 	return &dsclient.SessionStats{}, nil
 }
+func (m *testingDSMock) SetPlatform(_ string) {}
 
 func newHTTPAdminHarness(t *testing.T, rawConfig string, ds adminshared.DeepSeekCaller) http.Handler {
 	t.Helper()

internal/httpapi/admin/settings/handler_settings_parse.go

@@ -21,7 +21,7 @@ func boolFrom(v any) bool {
 	}
 }
 
-func parseSettingsUpdateRequest(req map[string]any) (*config.AdminConfig, *config.RuntimeConfig, *config.ResponsesConfig, *config.EmbeddingsConfig, *config.AutoDeleteConfig, *config.CurrentInputFileConfig, *config.ThinkingInjectionConfig, map[string]string, error) {
+func parseSettingsUpdateRequest(req map[string]any) (*config.AdminConfig, *config.RuntimeConfig, *config.ResponsesConfig, *config.EmbeddingsConfig, *config.AutoDeleteConfig, *config.CurrentInputFileConfig, *config.ThinkingInjectionConfig, *config.PlatformConfig, map[string]string, error) {
 	var (
 		adminCfg        *config.AdminConfig
 		runtimeCfg      *config.RuntimeConfig
@@ -30,6 +30,7 @@ func parseSettingsUpdateRequest(req map[string]any) (*config.AdminConfig, *confi
 		autoDeleteCfg   *config.AutoDeleteConfig
 		currentInputCfg *config.CurrentInputFileConfig
 		thinkingInjCfg  *config.ThinkingInjectionConfig
+		platformCfg     *config.PlatformConfig
 		aliasMap        map[string]string
 	)
 
@@ -38,7 +39,7 @@ func parseSettingsUpdateRequest(req map[string]any) (*config.AdminConfig, *confi
 		if v, exists := raw["jwt_expire_hours"]; exists {
 			n := intFrom(v)
 			if err := config.ValidateIntRange("admin.jwt_expire_hours", n, 1, 720, true); err != nil {
-				return nil, nil, nil, nil, nil, nil, nil, nil, err
+				return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 			}
 			cfg.JWTExpireHours = n
 		}
@@ -50,40 +51,40 @@ func parseSettingsUpdateRequest(req map[string]any) (*config.AdminConfig, *confi
 		if v, exists := raw["account_max_inflight"]; exists {
 			n := intFrom(v)
 			if err := config.ValidateIntRange("runtime.account_max_inflight", n, 1, 256, true); err != nil {
-				return nil, nil, nil, nil, nil, nil, nil, nil, err
+				return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 			}
 			cfg.AccountMaxInflight = n
 		}
 		if v, exists := raw["account_max_queue"]; exists {
 			n := intFrom(v)
 			if err := config.ValidateIntRange("runtime.account_max_queue", n, 1, 200000, true); err != nil {
-				return nil, nil, nil, nil, nil, nil, nil, nil, err
+				return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 			}
 			cfg.AccountMaxQueue = n
 		}
 		if v, exists := raw["global_max_inflight"]; exists {
 			n := intFrom(v)
 			if err := config.ValidateIntRange("runtime.global_max_inflight", n, 1, 200000, true); err != nil {
-				return nil, nil, nil, nil, nil, nil, nil, nil, err
+				return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 			}
 			cfg.GlobalMaxInflight = n
 		}
 		if v, exists := raw["token_refresh_interval_hours"]; exists {
 			n := intFrom(v)
 			if err := config.ValidateIntRange("runtime.token_refresh_interval_hours", n, 1, 720, true); err != nil {
-				return nil, nil, nil, nil, nil, nil, nil, nil, err
+				return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 			}
 			cfg.TokenRefreshIntervalHours = n
 		}
 		if v, exists := raw["backup_release_count"]; exists {
 			n := intFrom(v)
 			if err := config.ValidateIntRange("runtime.backup_release_count", n, 1, 100, true); err != nil {
-				return nil, nil, nil, nil, nil, nil, nil, nil, err
+				return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 			}
 			cfg.BackupReleaseCount = n
 		}
 		if cfg.AccountMaxInflight > 0 && cfg.GlobalMaxInflight > 0 && cfg.GlobalMaxInflight < cfg.AccountMaxInflight {
-			return nil, nil, nil, nil, nil, nil, nil, nil, fmt.Errorf("runtime.global_max_inflight must be >= runtime.account_max_inflight")
+			return nil, nil, nil, nil, nil, nil, nil, nil, nil, fmt.Errorf("runtime.global_max_inflight must be >= runtime.account_max_inflight")
 		}
 		runtimeCfg = cfg
 	}
@@ -93,7 +94,7 @@ func parseSettingsUpdateRequest(req map[string]any) (*config.AdminConfig, *confi
 		if v, exists := raw["store_ttl_seconds"]; exists {
 			n := intFrom(v)
 			if err := config.ValidateIntRange("responses.store_ttl_seconds", n, 30, 86400, true); err != nil {
-				return nil, nil, nil, nil, nil, nil, nil, nil, err
+				return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 			}
 			cfg.StoreTTLSeconds = n
 		}
@@ -105,7 +106,7 @@ func parseSettingsUpdateRequest(req map[string]any) (*config.AdminConfig, *confi
 		if v, exists := raw["provider"]; exists {
 			p := strings.TrimSpace(fmt.Sprintf("%v", v))
 			if err := config.ValidateTrimmedString("embeddings.provider", p, false); err != nil {
-				return nil, nil, nil, nil, nil, nil, nil, nil, err
+				return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 			}
 			cfg.Provider = p
 		}
@@ -131,7 +132,7 @@ func parseSettingsUpdateRequest(req map[string]any) (*config.AdminConfig, *confi
 		if v, exists := raw["mode"]; exists {
 			mode := strings.ToLower(strings.TrimSpace(fmt.Sprintf("%v", v)))
 			if err := config.ValidateAutoDeleteMode(mode); err != nil {
-				return nil, nil, nil, nil, nil, nil, nil, nil, err
+				return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 			}
 			if mode == "" {
 				mode = "none"
@@ -153,12 +154,12 @@ func parseSettingsUpdateRequest(req map[string]any) (*config.AdminConfig, *confi
 		if v, exists := raw["min_chars"]; exists {
 			n := intFrom(v)
 			if err := config.ValidateIntRange("current_input_file.min_chars", n, 0, 100000000, true); err != nil {
-				return nil, nil, nil, nil, nil, nil, nil, nil, err
+				return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 			}
 			cfg.MinChars = n
 		}
 		if err := config.ValidateCurrentInputFileConfig(*cfg); err != nil {
-			return nil, nil, nil, nil, nil, nil, nil, nil, err
+			return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 		}
 		currentInputCfg = cfg
 	}
@@ -175,5 +176,17 @@ func parseSettingsUpdateRequest(req map[string]any) (*config.AdminConfig, *confi
 		thinkingInjCfg = cfg
 	}
 
-	return adminCfg, runtimeCfg, respCfg, embCfg, autoDeleteCfg, currentInputCfg, thinkingInjCfg, aliasMap, nil
+	if raw, ok := req["platform"].(map[string]any); ok {
+		cfg := &config.PlatformConfig{}
+		if v, exists := raw["mode"]; exists {
+			mode := strings.ToLower(strings.TrimSpace(fmt.Sprintf("%v", v)))
+			if err := config.ValidatePlatformConfig(config.PlatformConfig{Mode: mode}); err != nil {
+				return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
+			}
+			cfg.Mode = mode
+		}
+		platformCfg = cfg
+	}
+
+	return adminCfg, runtimeCfg, respCfg, embCfg, autoDeleteCfg, currentInputCfg, thinkingInjCfg, platformCfg, aliasMap, nil
 }

internal/httpapi/admin/settings/handler_settings_read.go

@@ -38,6 +38,7 @@ func (h *Handler) getSettings(w http.ResponseWriter, _ *http.Request) {
 				"prompt":  snap.ThinkingInjection.Prompt,
 			},
 			"model_aliases": snap.ModelAliases,
+			"platform":      snap.Platform,
 		},
 		"admin": map[string]any{
 			"has_password_hash":        strings.TrimSpace(snap.Admin.PasswordHash) != "",
@@ -64,7 +65,10 @@ func (h *Handler) getSettings(w http.ResponseWriter, _ *http.Request) {
 			"prompt":         h.Store.ThinkingInjectionPrompt(),
 			"default_prompt": promptcompat.DefaultThinkingInjectionPrompt,
 		},
-		"model_aliases":     snap.ModelAliases,
+		"model_aliases": snap.ModelAliases,
+		"platform": map[string]any{
+			"mode": h.Store.PlatformMode(),
+		},
 		"env_backed":        h.Store.IsEnvBacked(),
 		"needs_vercel_sync": needsSync,
 	})

internal/httpapi/admin/settings/handler_settings_runtime.go

@@ -36,6 +36,13 @@ func (h *Handler) applyRuntimeSettings() {
 	h.Pool.ApplyRuntimeLimits(maxPer, maxQueue, global)
 }
 
+func (h *Handler) applyPlatformChange() {
+	if h == nil || h.Store == nil || h.DS == nil {
+		return
+	}
+	h.DS.SetPlatform(h.Store.PlatformMode())
+}
+
 func defaultRuntimeRecommended(accountCount, maxPer int) int {
 	if maxPer <= 0 {
 		maxPer = 1

internal/httpapi/admin/settings/handler_settings_write.go

@@ -17,7 +17,7 @@ func (h *Handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	adminCfg, runtimeCfg, responsesCfg, embeddingsCfg, autoDeleteCfg, currentInputCfg, thinkingInjCfg, aliasMap, err := parseSettingsUpdateRequest(req)
+	adminCfg, runtimeCfg, responsesCfg, embeddingsCfg, autoDeleteCfg, currentInputCfg, thinkingInjCfg, platformCfg, aliasMap, err := parseSettingsUpdateRequest(req)
 	if err != nil {
 		writeJSON(w, http.StatusBadRequest, map[string]any{"detail": err.Error()})
 		return
@@ -85,6 +85,9 @@ func (h *Handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 		if aliasMap != nil {
 			c.ModelAliases = aliasMap
 		}
+		if platformCfg != nil {
+			c.Platform.Mode = platformCfg.Mode
+		}
 		return nil
 	}); err != nil {
 		writeJSON(w, http.StatusInternalServerError, map[string]any{"detail": err.Error()})
@@ -92,6 +95,7 @@ func (h *Handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	}
 
 	h.applyRuntimeSettings()
+	h.applyPlatformChange()
 	needsSync := config.IsVercel() || h.Store.IsEnvBacked()
 	writeJSON(w, http.StatusOK, map[string]any{
 		"success":             true,

internal/httpapi/admin/shared/deps.go

@@ -41,6 +41,7 @@ type ConfigStore interface {
 	AutoDeleteSessions() bool
 	SetAccountBanned(identifier string, banned bool) (config.Account, error)
 	SetAccountRole(identifier string, role string) (config.Account, error)
+	PlatformMode() string
 	ActiveNormalAccounts() int
 	TotalNormalAccounts() int
 	PromoteStandbyAccounts(n int) []string
@@ -63,6 +64,7 @@ type DeepSeekCaller interface {
 	CallCompletion(ctx context.Context, a *auth.RequestAuth, payload map[string]any, powResp string, maxAttempts int) (*http.Response, error)
 	GetSessionCountForToken(ctx context.Context, token string) (*dsclient.SessionStats, error)
 	DeleteAllSessionsForToken(ctx context.Context, token string) error
+	SetPlatform(platform string)
 }
 
 var _ ConfigStore = (*config.Store)(nil)

internal/httpapi/admin/test_bridge_test.go

@@ -82,6 +82,8 @@ func (m *testingDSMock) GetSessionCountForToken(_ context.Context, _ string) (*d
 	return &dsclient.SessionStats{}, nil
 }
 
+func (m *testingDSMock) SetPlatform(_ string) {}
+
 func (h *Handler) configHandler() *adminconfig.Handler {
 	return &adminconfig.Handler{Store: h.Store, Pool: h.Pool, DS: h.DS, OpenAI: h.OpenAI, ChatHistory: h.ChatHistory}
 }

internal/shumei/api.go

@@ -0,0 +1,94 @@
+package shumei
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+)
+
+// callDeviceAPI POSTs the encrypted payload to the Shumei device profile API
+// and returns the deviceId from the response.
+func callDeviceAPI(ctx context.Context, ep, data string) (string, error) {
+	payload := map[string]any{
+		"appId":        appId,
+		"organization": organization,
+		"ep":           ep,
+		"data":         data,
+		"os":           "web",
+		"encode":       5,
+		"compress":     2,
+	}
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return "", fmt.Errorf("marshal payload: %w", err)
+	}
+
+	url := "https://" + apiHost + apiPath
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
+	if err != nil {
+		return "", fmt.Errorf("create request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36")
+	req.Header.Set("Origin", "https://chat.deepseek.com")
+	req.Header.Set("Referer", "https://chat.deepseek.com/")
+
+	resp, err := httpDoer.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("http post: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("unexpected status %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	var result map[string]any
+	if err := json.Unmarshal(respBody, &result); err != nil {
+		return "", fmt.Errorf("parse response: %w", err)
+	}
+
+	code, _ := result["code"].(float64)
+	if int(code) != 1100 {
+		return "", fmt.Errorf("api error code %v: %s", result["code"], string(respBody))
+	}
+
+	detail, _ := result["detail"].(map[string]any)
+	deviceID, _ := detail["deviceId"].(string)
+	if deviceID == "" {
+		return "", fmt.Errorf("missing deviceId in response: %s", string(respBody))
+	}
+
+	return deviceID, nil
+}
+
+// httpDoer is the HTTP client used for Shumei API calls.
+// Initialized in init() using the project's Chrome TLS transport.
+var httpDoer httpDoerInterface
+
+type httpDoerInterface interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+func init() {
+	httpDoer = &http.Client{Timeout: defaultHTTPTimeout}
+}
+
+// SetHTTPDoer allows overriding the HTTP client (e.g. for testing or
+// to use the project's Chrome TLS transport).
+func SetHTTPDoer(d httpDoerInterface) {
+	if d != nil {
+		httpDoer = d
+	}
+}
+
+const defaultHTTPTimeout = 15 * time.Second

internal/shumei/confusion.go

@@ -0,0 +1,51 @@
+package shumei
+
+// confusionEntry maps an original field name to its DES key and obfuscated name.
+type confusionEntry struct {
+	desKey     string
+	obfuscated string
+}
+
+// confusionMapping is Configuration A for organization P9usCUBauxft8eAmUXaZ.
+var confusionMapping = map[string]confusionEntry{
+	"appId":        {"q8zb1bs1", "vw"},
+	"canvas":       {"qy1d6fmu", "mi"},
+	"organization": {"ht432iov", "tj"},
+	"os":           {"i7g8jtql", "vh"},
+	"platform":     {"mcbmtg5y", "ye"},
+	"plugins":      {"j916a142", "vc"},
+	"referer":      {"rf149ntc", "hv"},
+	"res":          {"rbtd2cl6", "pi"},
+	"sdkver":       {"rw74ssux", "xh"},
+	"status":       {"4xx5u0ww", "uu"},
+	"subVersion":   {"9wg0vhb9", "xi"},
+	"svm":          {"mqcala0h", "nu"},
+	"time":         {"8e224y3f", "gw"},
+	"timezone":     {"3w9lg8pr", "oi"},
+	"rtype":        {"rx7ob4gc", "na"},
+	"tn":           {"ilnts67v", "nb"},
+	"trees":        {"al8x9zt7", "hc"},
+	"ua":           {"z5jc9qyp", "wr"},
+	"url":          {"6tbl1wpw", "no"},
+	"vpw":          {"xzvnu5jt", "st"},
+}
+
+// applyConfusion encrypts each field value with its DES key using ECB mode,
+// base64-encodes the result, and renames the field to its obfuscated name.
+// Fields not in the mapping are dropped.
+func applyConfusion(data map[string]string) map[string]string {
+	out := make(map[string]string, len(data))
+	for field, value := range data {
+		entry, ok := confusionMapping[field]
+		if !ok {
+			continue
+		}
+		encrypted, err := desEncryptECB(entry.desKey, value)
+		if err != nil {
+			// Skip fields that fail to encrypt
+			continue
+		}
+		out[entry.obfuscated] = encrypted
+	}
+	return out
+}

internal/shumei/crypto.go

@@ -0,0 +1,124 @@
+package shumei
+
+import (
+	"bytes"
+	"compress/gzip"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/des"
+	"crypto/md5"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/pem"
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// generateUUID returns a random UUID v4 string.
+func generateUUID() string {
+	b := make([]byte, 16)
+	_, _ = rand.Read(b)
+	b[6] = (b[6] & 0x0f) | 0x40 // version 4
+	b[8] = (b[8] & 0x3f) | 0x80 // variant 10
+	return fmt.Sprintf("%08x-%04x-%04x-%04x-%012x",
+		b[0:4], b[4:6], b[6:8], b[8:10], b[10:16])
+}
+
+// rsaEncryptUID encrypts uid with the Shumei RSA public key using PKCS#1 v1.5
+// and returns the result as a hex-encoded string.
+func rsaEncryptUID(uid string) (string, error) {
+	block, _ := pem.Decode([]byte("-----BEGIN PUBLIC KEY-----\n" + rsaPublicKey + "\n-----END PUBLIC KEY-----"))
+	if block == nil {
+		return "", fmt.Errorf("failed to decode PEM block")
+	}
+	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
+	if err != nil {
+		return "", fmt.Errorf("parse PKIX public key: %w", err)
+	}
+	rsaPub, ok := pub.(*rsa.PublicKey)
+	if !ok {
+		return "", fmt.Errorf("not an RSA public key")
+	}
+	ciphertext, err := rsa.EncryptPKCS1v15(rand.Reader, rsaPub, []byte(uid))
+	if err != nil {
+		return "", fmt.Errorf("RSA encrypt: %w", err)
+	}
+	return hex.EncodeToString(ciphertext), nil
+}
+
+// desEncryptECB encrypts plaintext with DES in ECB mode using the given key
+// (8-byte string). The plaintext is zero-padded to a multiple of 8 bytes.
+// Returns the base64-encoded ciphertext.
+func desEncryptECB(key, plaintext string) (string, error) {
+	block, err := des.NewCipher([]byte(key))
+	if err != nil {
+		return "", fmt.Errorf("des new cipher: %w", err)
+	}
+	src := []byte(plaintext)
+	// Zero-pad to block size
+	if rem := len(src) % des.BlockSize; rem != 0 {
+		src = append(src, make([]byte, des.BlockSize-rem)...)
+	}
+	dst := make([]byte, len(src))
+	for i := 0; i < len(src); i += des.BlockSize {
+		block.Encrypt(dst[i:i+des.BlockSize], src[i:i+des.BlockSize])
+	}
+	return base64.StdEncoding.EncodeToString(dst), nil
+}
+
+// aesEncryptCBC encrypts plaintext with AES-CBC using the given key and IV,
+// applying zero-padding to a multiple of the block size.
+func aesEncryptCBC(key, iv, plaintext []byte) ([]byte, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, fmt.Errorf("aes new cipher: %w", err)
+	}
+	// Zero-pad to block size
+	bs := aes.BlockSize
+	if rem := len(plaintext) % bs; rem != 0 {
+		plaintext = append(plaintext, make([]byte, bs-rem)...)
+	}
+	ciphertext := make([]byte, len(plaintext))
+	mode := cipher.NewCBCEncrypter(block, iv)
+	mode.CryptBlocks(ciphertext, plaintext)
+	return ciphertext, nil
+}
+
+// computeTN computes the integrity check: MD5 of sorted key=value pairs
+// joined by "&".
+func computeTN(data map[string]string) string {
+	keys := make([]string, 0, len(data))
+	for k := range data {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	var b strings.Builder
+	for i, k := range keys {
+		if i > 0 {
+			b.WriteByte('&')
+		}
+		b.WriteString(k)
+		b.WriteByte('=')
+		b.WriteString(data[k])
+	}
+	hash := md5.Sum([]byte(b.String()))
+	return hex.EncodeToString(hash[:])
+}
+
+// gzipCompress compresses data with gzip.
+func gzipCompress(data []byte) ([]byte, error) {
+	var buf bytes.Buffer
+	w := gzip.NewWriter(&buf)
+	if _, err := w.Write(data); err != nil {
+		_ = w.Close()
+		return nil, fmt.Errorf("gzip write: %w", err)
+	}
+	if err := w.Close(); err != nil {
+		return nil, fmt.Errorf("gzip close: %w", err)
+	}
+	return buf.Bytes(), nil
+}

internal/shumei/device_id.go

@@ -0,0 +1,121 @@
+package shumei
+
+import (
+	"context"
+	"crypto/md5"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"time"
+)
+
+const (
+	rsaPublicKey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDetfEgYD4aE1ZjmWJ6/jnPurhzI+yeRoJHWrnNtQMte3stQ4VjG3yu21FuN75E6cDpA9KtDXwcB2M/FiGUAe3G0rNotbWI8+SjZfUbW/OILFTzY0uaeEkmVGW5WyJ6weQbbr1xTCPa2OO3YIMeZljWUYHG5h21WAm/PATg8im8cQIDAQAB"
+	organization = "P9usCUBauxft8eAmUXaZ"
+	appId        = "default"
+	apiHost      = "fp-it-acc.portal101.cn"
+	apiPath      = "/deviceprofile/v4"
+	sdkVersion   = "3.0.0"
+	subVersion   = "1.0.0"
+	aesIV        = "0102030405060708"
+)
+
+// GetDeviceID generates a Shumei device_id for web platform login.
+// It returns the device ID prefixed with "B".
+func GetDeviceID(ctx context.Context) (string, error) {
+	// 1. Generate UUID v4
+	uid := generateUUID()
+
+	// 2. Compute priId = md5(uid)[:16]
+	hash := md5.Sum([]byte(uid))
+	priId := hex.EncodeToString(hash[:])[:16]
+
+	// 3. RSA encrypt uid
+	ep, err := rsaEncryptUID(uid)
+	if err != nil {
+		return "", fmt.Errorf("rsa encrypt: %w", err)
+	}
+
+	// 4. Build fingerprint data
+	fpData := buildFingerprintData(uid)
+
+	// 5. Apply DES confusion (encrypt + rename fields)
+	confused := applyConfusion(fpData)
+
+	// 6. Compute tn (integrity check) and add remaining fields
+	tn := computeTN(confused)
+	confused["nb"] = tn // "tn" maps to "nb" in confusion
+	confused["protocol"] = "-1"
+
+	// 7. JSON marshal, gzip, AES-CBC encrypt
+	data, err := encryptPayload(confused, priId)
+	if err != nil {
+		return "", fmt.Errorf("encrypt payload: %w", err)
+	}
+
+	// 8. Call API
+	deviceID, err := callDeviceAPI(ctx, ep, data)
+	if err != nil {
+		return "", fmt.Errorf("call api: %w", err)
+	}
+
+	return "B" + deviceID, nil
+}
+
+// buildFingerprintData constructs the fingerprint fields with realistic but
+// minimal values suitable for server-side use.
+func buildFingerprintData(uid string) map[string]string {
+	now := time.Now()
+	return map[string]string{
+		"appId":        appId,
+		"organization": organization,
+		"os":           "web",
+		"sdkver":       sdkVersion,
+		"subVersion":   subVersion,
+		"platform":     "Win32",
+		"ua":           "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
+		"timezone":     "-480",
+		"res":          "1920_1080_24_1",
+		"canvas":       generateCanvasHash(),
+		"plugins":      "",
+		"referer":      "https://chat.deepseek.com/",
+		"url":          "https://chat.deepseek.com/",
+		"status":       "",
+		"vpw":          uid,
+		"svm":          fmt.Sprintf("%d", now.UnixMilli()),
+		"trees":        uid,
+		"rtype":        "1",
+	}
+}
+
+// generateCanvasHash returns a deterministic but random-looking MD5 hash
+// for the canvas fingerprint field.
+func generateCanvasHash() string {
+	h := md5.Sum([]byte("shumei-canvas-fp-v1"))
+	return hex.EncodeToString(h[:])
+}
+
+// encryptPayload marshals the confused data to JSON, gzip-compresses it,
+// then AES-CBC encrypts with the given key and a fixed IV.
+// Returns the base64-encoded ciphertext.
+func encryptPayload(data map[string]string, priId string) (string, error) {
+	jsonData, err := json.Marshal(data)
+	if err != nil {
+		return "", fmt.Errorf("json marshal: %w", err)
+	}
+
+	compressed, err := gzipCompress(jsonData)
+	if err != nil {
+		return "", fmt.Errorf("gzip compress: %w", err)
+	}
+
+	// AES-CBC encrypt: key = priId (16 bytes), IV = fixed
+	key := []byte(priId)
+	iv := []byte(aesIV)
+	ciphertext, err := aesEncryptCBC(key, iv, compressed)
+	if err != nil {
+		return "", fmt.Errorf("aes encrypt: %w", err)
+	}
+
+	return hex.EncodeToString(ciphertext), nil
+}

webui/src/features/settings/PlatformSection.jsx

@@ -0,0 +1,43 @@
+export default function PlatformSection({ t, form, setForm }) {
+    return (
+        <div className="bg-card border border-border rounded-xl p-5 space-y-4">
+            <h3 className="font-semibold">{t('settings.platformTitle')}</h3>
+            <p className="text-sm text-muted-foreground">{t('settings.platformDescription')}</p>
+            <div className="flex gap-4">
+                <label className="flex items-center gap-2 cursor-pointer">
+                    <input
+                        type="radio"
+                        name="platform-mode"
+                        value="android"
+                        checked={form.platform.mode === 'android'}
+                        onChange={() => setForm((prev) => ({
+                            ...prev,
+                            platform: { ...prev.platform, mode: 'android' },
+                        }))}
+                        className="w-4 h-4"
+                    />
+                    <span className="text-sm">{t('settings.platformAndroid')}</span>
+                </label>
+                <label className="flex items-center gap-2 cursor-pointer">
+                    <input
+                        type="radio"
+                        name="platform-mode"
+                        value="web"
+                        checked={form.platform.mode === 'web'}
+                        onChange={() => setForm((prev) => ({
+                            ...prev,
+                            platform: { ...prev.platform, mode: 'web' },
+                        }))}
+                        className="w-4 h-4"
+                    />
+                    <span className="text-sm">{t('settings.platformWeb')}</span>
+                </label>
+            </div>
+            {form.platform.mode === 'web' && (
+                <p className="text-xs text-amber-600 dark:text-amber-400">
+                    {t('settings.platformWebNotice')}
+                </p>
+            )}
+        </div>
+    )
+}

webui/src/features/settings/SettingsContainer.jsx

@@ -3,6 +3,7 @@ import { AlertTriangle, Save } from 'lucide-react'
 import { useI18n } from '../../i18n'
 import { useSettingsForm } from './useSettingsForm'
 import SecuritySection from './SecuritySection'
+import PlatformSection from './PlatformSection'
 import RuntimeSection from './RuntimeSection'
 import BehaviorSection from './BehaviorSection'
 import CurrentInputFileSection from './CurrentInputFileSection'
@@ -91,6 +92,8 @@ export default function SettingsContainer({ onRefresh, onMessage, authFetch, onF
                 onUpdatePassword={updatePassword}
             />
 
+            <PlatformSection t={t} form={form} setForm={setForm} />
+
             <RuntimeSection t={t} form={form} setForm={setForm} />
 
             <BehaviorSection t={t} form={form} setForm={setForm} />

webui/src/features/settings/useSettingsForm.js

@@ -16,6 +16,7 @@ const DEFAULT_FORM = {
     responses: { store_ttl_seconds: 900 },
     embeddings: { provider: '' },
     auto_delete: { mode: 'none' },
+    platform: { mode: 'android' },
     current_input_file: { enabled: true, min_chars: 0 },
     thinking_injection: { enabled: true, prompt: '', default_prompt: '' },
     model_aliases_text: '{}',
@@ -56,6 +57,7 @@ function fromServerForm(data) {
     const responsesSource = snapshot.responses || data.responses || {}
     const embeddingsSource = snapshot.embeddings || data.embeddings || {}
     const autoDeleteSource = snapshot.auto_delete || data.auto_delete || {}
+    const platformSource = snapshot.platform || data.platform || {}
     const currentInputSource = snapshot.current_input_file || data.current_input_file || {}
     const thinkingSource = snapshot.thinking_injection || data.thinking_injection || {}
     const modelAliasesSource = snapshot.model_aliases || data.model_aliases || {}
@@ -78,6 +80,9 @@ function fromServerForm(data) {
         auto_delete: {
             mode: normalizeAutoDeleteMode(autoDeleteSource),
         },
+        platform: {
+            mode: platformSource?.mode || 'android',
+        },
         current_input_file: {
             enabled: currentInputFileEnabled,
             min_chars: Number(currentInputSource?.min_chars ?? 0),
@@ -105,6 +110,7 @@ function toServerPayload(form) {
         responses: { store_ttl_seconds: Number(form.responses.store_ttl_seconds) },
         embeddings: { provider: String(form.embeddings.provider || '').trim() },
         auto_delete: { mode: normalizeAutoDeleteMode(form.auto_delete) },
+        platform: { mode: String(form.platform.mode || 'android') },
         current_input_file: {
             enabled: currentInputFileEnabled,
             min_chars: Number(form.current_input_file?.min_chars ?? 0),

webui/src/locales/en.json

@@ -444,6 +444,11 @@
         "autoDeleteSingleDesc": "Delete only the remote session created by this request.",
         "autoDeleteAllDesc": "Delete every remote session for the account after the request completes.",
         "autoDeleteWarning": "This mode deletes remote chat records. Use with caution.",
+        "platformTitle": "API Platform",
+        "platformDescription": "Choose whether to use the Android or Web endpoint to communicate with DeepSeek. Requires service restart after switching.",
+        "platformAndroid": "Android (Default)",
+        "platformWeb": "Web (Chrome Browser)",
+        "platformWebNotice": "The Web endpoint uses Chrome browser fingerprint and TLS characteristics, requiring additional device ID generation and HIF header polling.",
         "backupTitle": "Backup & Restore",
         "loadExport": "Load current export",
         "downloadExport": "Download backup file",

webui/src/locales/zh.json

@@ -444,6 +444,11 @@
         "autoDeleteSingleDesc": "请求结束后只删除本次请求创建的远端会话。",
         "autoDeleteAllDesc": "请求结束后清空该账号的全部远端会话。",
         "autoDeleteWarning": "当前模式会删除远端聊天记录，请谨慎使用。",
+        "platformTitle": "接口平台",
+        "platformDescription": "选择使用 Android 端还是 Web 端接口与 DeepSeek 通信。切换后需重启服务生效。",
+        "platformAndroid": "Android 端（默认）",
+        "platformWeb": "Web 端（Chrome 浏览器）",
+        "platformWebNotice": "Web 端接口使用 Chrome 浏览器指纹和 TLS 特征，需要额外的设备ID生成和HIF头部轮询。",
         "backupTitle": "备份与恢复",
         "loadExport": "加载当前导出",
         "downloadExport": "下载备份文件",