feat: 更新Web端支持，强制使用HTTP/2并调整TLS拨号器以兼容IPv4

.gitignore

@@ -74,3 +74,4 @@ chat.deepseek.com.har.txt
 chat.deepseek.com2.har.txt
 chat.deepseek.com/
 chat.deepseek.com3.har
+chat.deepseek.com_2026_07_14_20_56_28.har

docs/web-endpoint-upgrade.md

@@ -321,7 +321,8 @@ func (p *HIFPoller) GetHeaders() map[string]string  // 获取当前HIF头部
 
 ```
 ClientHello: HelloSafari_Auto
-ALPN: 强制 http/1.1 (forceHTTP11ALPN)
+ALPN: h2 + http/1.1 (setSafariALPN，与真实 Safari 一致)
+ForceAttemptHTTP2: true
 ```
 
 ### Web端
@@ -332,6 +333,11 @@ ALPN: 自然协商 (支持 h2 和 http/1.1)
 ForceAttemptHTTP2: true
 ```
 
+> chat.deepseek.com 现已要求 HTTP/2：HTTP/1.1 客户端会收到服务端返回的 h2
+> SETTINGS 帧，被 Go 的 http.Transport 解析为 "malformed HTTP response"。
+> 因此两个平台均通过 ALPN 协商 h2 并 `ForceAttemptHTTP2: true`。Android 端
+> 早期曾强制 http/1.1，现已对齐真实 Safari 行为改用 h2。
+
 实现位于 `internal/deepseek/transport/transport.go`：
 
 ```go
@@ -339,7 +345,7 @@ func TLSDialerForPlatform(platform string) func(...) {
     if platform == "web" {
         return chromeTLSDialer(dialContext)  // Chrome + HTTP/2
     }
-    return safariTLSDialer(dialContext)      // Safari + HTTP/1.1
+    return safariTLSDialer(dialContext)      // Safari + HTTP/2
 }
 ```
 
@@ -350,7 +356,7 @@ func TLSDialerForPlatform(platform string) func(...) {
 ### 6.1 设置面板切换
 
 访问 WebUI 设置页面，在"接口平台"选项中选择：
-- **Android端（默认）**：使用Safari TLS指纹，device_id为固定值
+- **Android端（默认）**：使用Safari TLS指纹 + HTTP/2，device_id为固定值
 - **Web端（Chrome浏览器）**：使用Chrome TLS指纹+HTTP/2，动态生成数美device_id，轮询HIF头部
 
 切换后**立即生效**，无需重启服务。

internal/deepseek/hif/hif.go

@@ -37,11 +37,13 @@ type HIFPoller struct {
 }
 
 // NewHIFPoller creates a new HIFPoller using web-platform TLS fingerprinting.
+// 拨号器强制 IPv4：HuggingFace Spaces 等环境没有 IPv6 出口，
+// hif-dliq/hif-leim 常解析到 IPv6，会导致 "network is unreachable" 反复重试。
 func NewHIFPoller() *HIFPoller {
 	return &HIFPoller{
 		stopCh:   make(chan struct{}),
-		client:   trans.NewWithPlatform(15*time.Second, "web"),
-		fallback: trans.NewFallbackClientWithPlatform(15*time.Second, nil, "web"),
+		client:   trans.NewWithDialContextAndPlatform(15*time.Second, trans.IPv4DialContext, "web"),
+		fallback: trans.NewFallbackClientWithPlatform(15*time.Second, trans.IPv4DialContext, "web"),
 	}
 }
 

internal/deepseek/protocol/constants.go

@@ -135,7 +135,7 @@ func buildBaseHeaders(client clientConstants, overrides map[string]string) map[s
 	return out
 }
 
-const webUserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
+const webUserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0"
 
 func userAgentForPlatform(client clientConstants) string {
 	if client.Platform == "web" {
@@ -215,7 +215,7 @@ func UserAgent() string {
 // config but need to be added dynamically for the web platform.
 func WebExtraHeaders() map[string]string {
 	return map[string]string{
-		"sec-ch-ua":          `"Chromium";v="137", "Not/A)Brand";v="24"`,
+		"sec-ch-ua":          `"Not;A=Brand";v="8", "Chromium";v="150", "Microsoft Edge";v="150"`,
 		"sec-ch-ua-mobile":   "?0",
 		"sec-ch-ua-platform": `"Windows"`,
 		"origin":             "https://chat.deepseek.com",

internal/deepseek/protocol/constants_shared.json

@@ -2,7 +2,7 @@
   "client": {
     "name": "DeepSeek",
     "platform": "android",
-    "version": "2.1.5",
+    "version": "2.2.2",
     "android_api_level": "32",
     "locale": "zh_CN"
   },

internal/deepseek/protocol/constants_web.json

@@ -2,7 +2,7 @@
   "client": {
     "name": "DeepSeek",
     "platform": "web",
-    "version": "2.0.0",
+    "version": "2.2.0",
     "locale": "zh_CN"
   },
   "base_headers": {
@@ -11,11 +11,12 @@
     "Content-Type": "application/json",
     "accept-encoding": "gzip, deflate, br, zstd",
     "accept-charset": "UTF-8",
-    "x-app-version": "2.0.0",
+    "x-app-version": "2.2.0",
+    "x-client-bundle-id": "com.deepseek.chat",
     "x-client-locale": "zh_CN",
     "x-client-platform": "web",
     "x-client-timezone-offset": "28800",
-    "x-client-version": "2.0.0"
+    "x-client-version": "2.2.0"
   },
   "skip_contains_patterns": [
     "quasi_status",

internal/deepseek/transport/transport.go

@@ -39,9 +39,10 @@ func NewWithDialContextAndPlatform(timeout time.Duration, dialContext DialContex
 		dialContext = (&net.Dialer{Timeout: 15 * time.Second, KeepAlive: 30 * time.Second}).DialContext
 	}
 	tlsDialer := TLSDialerForPlatform(platform, dialContext)
-	forceHTTP2 := platform == "web"
+	// chat.deepseek.com 现已要求 HTTP/2（HTTP/1.1 会被服务端返回的 h2 SETTINGS 帧
+	// 击穿为 "malformed HTTP response"），因此所有平台都强制尝试 h2。
 	base := &http.Transport{
-		ForceAttemptHTTP2:   forceHTTP2,
+		ForceAttemptHTTP2:   true,
 		MaxIdleConns:        200,
 		MaxIdleConnsPerHost: 100,
 		IdleConnTimeout:     90 * time.Second,
@@ -68,9 +69,10 @@ func NewFallbackClientWithPlatform(timeout time.Duration, dialContext DialContex
 	if dialContext == nil {
 		dialContext = (&net.Dialer{Timeout: 15 * time.Second, KeepAlive: 30 * time.Second}).DialContext
 	}
-	forceHTTP2 := platform == "web"
+	// 同主 transport：所有平台强制尝试 h2，保证 utls 指纹请求失败回退到 std
+	// transport 时仍能与要求 HTTP/2 的 chat.deepseek.com 通信。
 	base := &http.Transport{
-		ForceAttemptHTTP2:   forceHTTP2,
+		ForceAttemptHTTP2:   true,
 		MaxIdleConns:        200,
 		MaxIdleConnsPerHost: 100,
 		IdleConnTimeout:     90 * time.Second,
@@ -84,8 +86,9 @@ func NewFallbackClientWithPlatform(timeout time.Duration, dialContext DialContex
 }
 
 // TLSDialerForPlatform returns the appropriate TLS dialer based on the platform.
-// "web" uses Chrome TLS fingerprinting with HTTP/2 support;
-// all other values (including "android") use Safari TLS fingerprinting with HTTP/1.1 only.
+// "web" uses Chrome TLS fingerprinting; all other values (including "android")
+// use Safari TLS fingerprinting. Both negotiate HTTP/2 via ALPN, since
+// chat.deepseek.com now requires HTTP/2.
 func TLSDialerForPlatform(platform string, dialContext DialContextFunc) func(ctx context.Context, network, addr string) (net.Conn, error) {
 	if platform == "web" {
 		return chromeTLSDialer(dialContext)
@@ -127,7 +130,9 @@ func safariTLSDialer(dialContext DialContextFunc) func(ctx context.Context, netw
 		host, _, _ := net.SplitHostPort(addr)
 		uCfg := &utls.Config{ServerName: host}
 		uConn := utls.UClient(plainConn, uCfg, utls.HelloSafari_Auto)
-		if err := forceHTTP11ALPN(uConn); err != nil {
+		// 真实 Safari 协商 HTTP/2；显式声明 h2+http/1.1，避免被 HelloSafari_Auto
+		// 的默认 ALPN 漏掉 h2，导致服务端按 HTTP/1.1 应答而被 h2-only 端点拒绝。
+		if err := setSafariALPN(uConn); err != nil {
 			_ = plainConn.Close()
 			return nil, err
 		}
@@ -136,15 +141,12 @@ func safariTLSDialer(dialContext DialContextFunc) func(ctx context.Context, netw
 			_ = plainConn.Close()
 			return nil, err
 		}
-		if negotiated := uConn.ConnectionState().NegotiatedProtocol; negotiated != "" && negotiated != "http/1.1" {
-			_ = uConn.Close()
-			return nil, fmt.Errorf("unexpected ALPN protocol negotiated: %s", negotiated)
-		}
 		return uConn, nil
 	}
 }
 
-func forceHTTP11ALPN(uConn *utls.UConn) error {
+// setSafariALPN 显式把 ALPN 设为 h2 + http/1.1，与真实 Safari 行为一致。
+func setSafariALPN(uConn *utls.UConn) error {
 	if err := uConn.BuildHandshakeState(); err != nil {
 		return err
 	}
@@ -153,8 +155,46 @@ func forceHTTP11ALPN(uConn *utls.UConn) error {
 		if !ok {
 			continue
 		}
-		alpnExt.AlpnProtocols = []string{"http/1.1"}
+		alpnExt.AlpnProtocols = []string{"h2", "http/1.1"}
 		return nil
 	}
 	return nil
 }
+
+// IPv4DialContext 仅拨号解析到的 IPv4 地址。用于 HuggingFace Spaces 等
+// 没有 IPv6 出口的部署：标准 Happy Eyeballs 在某些纯 IPv6 解析结果下会反复
+// 拨 IPv6 拿到 "network is unreachable"，这里显式跳过 IPv6。
+func IPv4DialContext(ctx context.Context, network, addr string) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, err
+	}
+	// 已经是 IP 直连时，IPv4 直接拨，IPv6 直接放弃。
+	if ip := net.ParseIP(host); ip != nil {
+		if ip.To4() == nil {
+			return nil, fmt.Errorf("ipv4-only dialer: %s is not IPv4", host)
+		}
+		d := &net.Dialer{Timeout: 15 * time.Second, KeepAlive: 30 * time.Second}
+		return d.DialContext(ctx, "tcp4", net.JoinHostPort(host, port))
+	}
+	ips, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+	if err != nil {
+		return nil, err
+	}
+	var lastErr error
+	d := &net.Dialer{Timeout: 15 * time.Second, KeepAlive: 30 * time.Second}
+	for _, ip := range ips {
+		if ip.IP.To4() == nil {
+			continue
+		}
+		conn, derr := d.DialContext(ctx, "tcp4", net.JoinHostPort(ip.IP.String(), port))
+		if derr == nil {
+			return conn, nil
+		}
+		lastErr = derr
+	}
+	if lastErr != nil {
+		return nil, lastErr
+	}
+	return nil, fmt.Errorf("ipv4-only dialer: no IPv4 address resolved for %s", host)
+}