whalegate v1.0.2

v1.0.2

• Fix (regression in v1.0.0 and v1.0.1): with Cloudflare Worker egress on, every request failed with client error (ProxyConnect): tunnel error: unexpected end of file. Dropping reqwest also dropped the ring crypto provider that rustls relied on, so opening the WebSocket to the Worker panicked inside the tunnel task (no log line, the connection just closed). rustls now declares ring itself, and a test checks a default crypto provider exists.
• If you are on v1.0.0 or v1.0.1 with Worker egress on, update to this version (or turn egress off until you do).

whalegate v1.0.1

v1.0.1

• Fingerprint consistency: x-client-locale now follows the account's browser languages (bookmarklet accounts with en-US send en_US; others keep vi), and sign-up uses the same locale, timezone and accept-language as later chats instead of fixed en_US / 25200.
• New accounts lean on recent browsers (Chrome 149/148/147, Edge 148/147) instead of an even spread over ten versions. Existing accounts keep exactly the browser they had; new seeds are tagged v2:.
• Edge 147 and 148 added (their sec-ch-ua checked against Chromium's GREASE algorithm). Bookmarklet accounts from a real Edge 145–146 now map to Edge 147 instead of 144.
• One WEB_VERSION constant for x-client-version / __appVersion.
• Faster SSE parsing (no copy of the remaining buffer per line), store flush without cloning all accounts, upload cache capped at 4096 entries.

whalegate v1.0.0

v1.0.0

• One HTTP stack: reqwest is gone; every outbound call (GitHub update check and download, nodejs.org, Cloudflare API, Chrome CDP, image fetch) now uses wreq through one shared client in src/http.rs. Connections and TLS setup are reused instead of building a new client per call, the dependency tree is smaller and builds are faster.
• The SSRF guard for image URLs works on wreq::Uri and still checks every redirect hop; CDP calls to Chrome now time out after 5s instead of hanging.
• Code layout: src/server.rs (≈4,900 lines) is split into src/server/ — mod.rs (state, store, router), dsml.rs (tool-call parsing), openai.rs, accounts.rs, login.rs, admin.rs. No behaviour change.
• Version 1.0.0: no breaking changes from v0.5.38; data directory, settings and API stay the same.

whalegate v0.5.38

v0.5.38

• Fix: stray < calls> / <｜ calls> (and lines like <｜ rooms: …) no longer show up in the assistant's text before a tool call. The model web sometimes drops the ｜｜DSML｜｜ part of the tool-call opener; whalegate now recognises that opener, holds it back while streaming and removes it from the text that precedes the parsed tool call. Plain text such as x < calls> y and ordinary XML are left alone. Found in a real dsh session log (7 of 321 assistant messages).
• i18n: the IP đầu ra settings tab and the Cloudflare popup are now fully translated into English and Chinese, including the lines that carry numbers (per-Worker status, quota, tunnel counters) and the ? help.
• Docs: the README (English, Vietnamese, Chinese) now describes the Cloudflare Worker egress route, several Workers, the ①→②→③ route order and the new settings DS_EGRESS_ON, DS_EGRESS_WORKERS, DS_EGRESS_DAILY_LIMIT.
• Included from v0.5.37 (see its notes): several Cloudflare Workers pinned per account, tabbed Settings with a route diagram, themed scrollbars, and the default context window of 256K tokens.

whalegate v0.5.37

v0.5.37

• Several Cloudflare Workers. The Cloudflare button can now add a Worker on a second (third…) Cloudflare account (+ Thêm Worker bằng account Cloudflare khác, up to 8). Each DeepSeek account is pinned to one Worker by its fingerprint seed, so its IP does not jump between runs, and its Chrome window uses the same Worker as its requests. The popup shows IP, colo and quota per Worker. The old single DS_EGRESS_URL / DS_EGRESS_KEY setting is migrated automatically into the new DS_EGRESS_WORKERS list (usage history is kept).
• Settings reorganised. The dialog is wider and split into tabs. The IP đầu ra tab explains the three routes an account can take, in order: ① own proxy → ② Cloudflare Worker → ③ direct from your home IP, with a small diagram that shows which ones are active. Long descriptions are folded behind a ? button. Scrollbars now match the theme.
• Smaller default context window: 256K tokens (was 512K). DS_CONTEXT_TOKENS is now 256000 and DS_PROMPT_MAX_CHARS is 912000 (was 1822000), so the window dsh is told about and the point where the gateway trims history stay consistent. Reason: the web app accepts ≥512K, but very large prompts are the most conspicuous thing an account sends, and we have seen accounts get muted or suspended; staying at half the size is a precaution to lower the chance of being scanned and flagged. This is a precaution, not a proven cause. If you set these values yourself in Settings, your values are kept; re-run the dsh setup to sync its window.
• Fix: setting up a Worker on a Cloudflare account without a workers.dev address failed with register a workers.dev subdomain. The address is now registered automatically.
• Fix: clicking the dimmed area outside a popup no longer closes it.
• Fix: in Settings, an edited row now turns unsaved, and the ↺ button works.
• Known limit: an account's Chrome window uses ② or ③ only; it does not go through the own proxy ①.

whalegate v0.5.36

v0.5.36

• Fix: setting up the Cloudflare Worker on an account that has no workers.dev address yet failed with register a workers.dev subdomain. whalegate now registers one automatically (a random wg-xxxxxxxx name) and deploys again. The wrangler token is never written to the log.
• Dashboard: clicking the dimmed area outside a popup no longer closes it; use the X or the buttons inside.

whalegate v0.5.35

v0.5.35

• Fix: the DeepSeek refused the login message came back after every page reload (and after the account was deleted) because it was kept in the service's memory for good. It now lives for 2 minutes, and is cleared when you start a new login or delete an account.
• Repository housekeeping: a test fixture that held a real IP address was replaced with a documentation address and removed from the history (the v0.5.33 and v0.5.34 tags were moved to the cleaned commits; the code that ships is unchanged).

whalegate v0.5.34

v0.5.34

Login in the account's own Chrome is now watched, and a suspended account is shown as such.

• Login refusals reach the dashboard. While an account's Chrome window is open, whalegate reads the /users/login reply. When DeepSeek refuses (wrong password, device risk, suspension…) the reason shows up as a dashboard message, in the log, and in the account's status. Captured from the real site: a suspended account answers biz_code 10 / USER_IS_BANNED ("Do vi phạm, tài khoản của bạn đã tạm thời bị đình chỉ").
• Suspended accounts are closed out for you. On USER_IS_BANNED the window closes by itself, nothing is saved, the account is switched off in the pool and the dashboard shows it struck through with a suspended label (no pointless log in again button). A later successful login or verify lifts the mark. A chat answer of 40012 is shown the same way.
• No more silent login as somebody else. When you log in again for a specific account and the window ends up signed in as a different DeepSeek user, nothing is saved, no password is remembered, the wrong DeepSeek session is wiped from that profile and the account says so. A profile that another account already uses is no longer reused: a fresh machine is opened instead.
• Sign-in pre-fill never uses a masked label as the email, and the fill happens before whalegate starts recording what you type.
• Verify recognises a muted account; its status text is translated.
• Fix: remembered credentials could silently fail to save if the data folder was recreated at the wrong moment.

whalegate v0.5.33

v0.5.33

Cloudflare Worker egress, muted accounts, gentler failover.

Cloudflare Worker as the egress IP

• New cloudflare button on the dashboard: finds Node.js (or downloads it from nodejs.org and checks its SHA-256), runs wrangler login (you only press Allow), deploys the ds-egress Worker, sets its key, switches it on and measures the egress IP. It also lists the Worker with an ON/OFF switch, check and remove, and counts the connections sent through it against the daily quota of your plan (Free = 100,000).
• It is a TCP tunnel, not URL rewriting: whalegate runs a local CONNECT proxy that reaches the Worker over a WebSocket and the Worker opens the socket to DeepSeek. TLS stays end-to-end, so the TLS/HTTP2 fingerprint is still the emulated Chrome. Both whalegate's HTTP client and every account Chrome window (sign in, sign up, open Chrome, device refresh) use it; WebRTC UDP leaks are blocked in those windows.
• Targets that sit on Cloudflare's own IP ranges (hCaptcha, many CDNs) cannot be reached from a Worker, so they are connected directly from your machine. The dialog shows how many went direct. Note that hCaptcha therefore sees your IP while DeepSeek sees Cloudflare's.
• Mind Cloudflare's terms: using a Worker as a general TCP proxy may breach them. The key is required, mail ports are blocked, and only DeepSeek-bound traffic is meant to use it. Egress IPs rotate inside Cloudflare's range, so one account may change IP between requests.
• Files: worker/egress.js, worker/deploy-egress.sh, tests in worker/egress.test.mjs.

Accounts

• Muted accounts (biz_code 5, mute_until) rest until the mute ends, say so on the dashboard and in verify, and no longer count as failures.
• Open Chrome button on every account that has its own Chrome: the same profile, session and fingerprint, so you can solve a captcha yourself; closing the window saves the session and lifts a hCaptcha rest. Logged-out accounts only show log in again, which closes the window by itself when you are in.
• The sign-in form is pre-filled with the email and password you typed the last time (kept in ~/.whalegate/credentials.json, mode 0600, never in backups, removed with the account); whalegate never presses Sign in for you.
• The dashboard no longer swallows clicks: the account list is not redrawn while the pointer is down.

Fewer rate limits and captchas

• A continuation now waits for the account that holds the session (up to ~35 s, e.g. the 6-calls-per-30-s burst window) instead of resending the whole context to another account, and after a rate limit it stays on the same account when the context is large. Challenges log their provider.
• New settings: Requests/minute per account (DS_MAX_RPM), Web-like background traffic (DS_WEB_BOOT, now switchable live), Cloudflare Worker URL / key / on-off / daily quota.
• Debug export lists the hidden settings and each account's rate-limit state; the Worker key is redacted.

whalegate v0.5.32

v0.5.32

Muted accounts are recognised.

• When DeepSeek answers a completion with biz_code 5 "user is muted" (mute_until), the account now rests until exactly that time and the dashboard says why ("DeepSeek muted this account until …"). Before, it was treated as a generic error: the fail streak grew and the account was retried every few minutes. A mute does not count as a failure, does not disable the account, and is skipped like a logged-out account while another one can answer.
• Status texts for muted and rate-limited accounts are translated (en / 中文).