@jsonstudio/rcc 0.89.1086 → 0.89.1136

package/dist/server/runtime/http-server/daemon-admin-routes.js

@@ -2,10 +2,24 @@ import { registerStatusRoutes } from './daemon-admin/status-handler.js';
 import { registerCredentialRoutes } from './daemon-admin/credentials-handler.js';
 import { registerQuotaRoutes } from './daemon-admin/quota-handler.js';
 import { registerProviderRoutes } from './daemon-admin/providers-handler.js';
+import { registerRestartRoutes } from './daemon-admin/restart-handler.js';
+import { registerStatsRoutes } from './daemon-admin/stats-handler.js';
+import { extractApiKeyFromRequest } from './middleware.js';
 export function isLocalRequest(req) {
     const ip = req.socket?.remoteAddress || '';
     return ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
 }
+export function isDaemonAdminRequestAllowed(req, expectedApiKey) {
+    if (isLocalRequest(req)) {
+        return true;
+    }
+    const expected = typeof expectedApiKey === 'string' ? expectedApiKey.trim() : '';
+    if (!expected) {
+        return false;
+    }
+    const provided = extractApiKeyFromRequest(req);
+    return Boolean(provided && provided === expected);
+}
 export function rejectNonLocal(req, res) {
     if (isLocalRequest(req)) {
         return false;
@@ -13,15 +27,26 @@ export function rejectNonLocal(req, res) {
     res.status(403).json({ error: { message: 'forbidden', code: 'forbidden' } });
     return true;
 }
+export function rejectNonLocalOrUnauthorizedAdmin(req, res, expectedApiKey) {
+    if (isDaemonAdminRequestAllowed(req, expectedApiKey)) {
+        return false;
+    }
+    res.status(403).json({ error: { message: 'forbidden', code: 'forbidden' } });
+    return true;
+}
 export function registerDaemonAdminRoutes(options) {
     const { app } = options;
     // Daemon / manager 状态
     registerStatusRoutes(app, options);
+    // Token usage / provider stats
+    registerStatsRoutes(app, options);
     // Credentials / token 视图
     registerCredentialRoutes(app, options);
     // Quota / 429 冷却视图
     registerQuotaRoutes(app, options);
     // Providers 运行时 + Config V2 视图
     registerProviderRoutes(app, options);
+    // Reload / restart runtime (reload config from disk)
+    registerRestartRoutes(app, options);
 }
 //# sourceMappingURL=daemon-admin-routes.js.map

package/dist/server/runtime/http-server/daemon-admin-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-admin-routes.js","sourceRoot":"","sources":["../../../../src/server/runtime/http-server/daemon-admin-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAkB7E,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;IAC3C,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa;IACxD,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgC;IACxE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAExB,sBAAsB;IACtB,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEnC,yBAAyB;IACzB,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEvC,mBAAmB;IACnB,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAElC,+BAA+B;IAC/B,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"daemon-admin-routes.js","sourceRoot":"","sources":["../../../../src/server/runtime/http-server/daemon-admin-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAqC3D,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;IAC3C,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAY,EAAE,cAAuB;IAC/E,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC,QAAQ,IAAI,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa;IACxD,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,GAAY,EACZ,GAAa,EACb,cAAuB;IAEvB,IAAI,2BAA2B,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgC;IACxE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAExB,sBAAsB;IACtB,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEnC,+BAA+B;IAC/B,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAElC,yBAAyB;IACzB,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEvC,mBAAmB;IACnB,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAElC,+BAA+B;IAC/B,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAErC,qDAAqD;IACrD,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC"}

package/dist/server/runtime/http-server/executor-provider.js

@@ -23,6 +23,13 @@ export function shouldRetryProviderError(error) {
     if (!error || typeof error !== 'object') {
         return false;
     }
+    // Deterministic context overflow: retrying the *same* model will keep failing,
+    // but a different model/provider in the same route pool might accept it.
+    // This matches the virtual-router strategy: if a target is over its context window,
+    // switch to the next candidate before giving up.
+    if (isPromptTooLongError(error)) {
+        return true;
+    }
     // virtualRouterSeriesCooldown 表示 provider 已经把 alias 从池子里拉黑，需要切换到下一位。
     // 这类错误仍然属于「可恢复」，因为虚拟路由会根据 cooldown 信息选择新的目标。
     if (hasVirtualRouterSeriesCooldown(error)) {
@@ -41,6 +48,55 @@ export function shouldRetryProviderError(error) {
     }
     return false;
 }
+function isPromptTooLongError(error) {
+    const status = extractErrorStatusCode(error);
+    // Most upstreams return 400 for context overflow; keep this narrow to avoid retries on generic 400s.
+    // Some error shims only expose the message (or nest status inside response.data.error.status),
+    // so allow missing status when the message is a strong match.
+    if (status !== undefined && status !== 400) {
+        return false;
+    }
+    const messages = [];
+    const rawMessage = error.message;
+    if (typeof rawMessage === 'string' && rawMessage.trim()) {
+        messages.push(rawMessage);
+    }
+    const upstreamMessage = error.upstreamMessage;
+    if (typeof upstreamMessage === 'string' && upstreamMessage.trim()) {
+        messages.push(upstreamMessage);
+    }
+    const details = error.details;
+    if (details && typeof details === 'object') {
+        const msg = details.upstreamMessage;
+        if (typeof msg === 'string' && msg.trim()) {
+            messages.push(msg);
+        }
+    }
+    const response = error.response;
+    if (response && typeof response === 'object') {
+        const data = response.data;
+        if (data && typeof data === 'object') {
+            const err = data.error;
+            if (err && typeof err === 'object') {
+                const msg = err.message;
+                if (typeof msg === 'string' && msg.trim()) {
+                    messages.push(msg);
+                }
+            }
+        }
+    }
+    const combined = messages.join(' | ').toLowerCase();
+    if (!combined) {
+        return false;
+    }
+    return (combined.includes('prompt is too long') ||
+        combined.includes('maximum context') ||
+        combined.includes('max context') ||
+        combined.includes('context length') ||
+        combined.includes('context_window_exceeded') ||
+        combined.includes('token limit') ||
+        combined.includes('too many tokens'));
+}
 export function extractErrorStatusCode(error) {
     if (!error || typeof error !== 'object') {
         return undefined;
@@ -60,6 +116,14 @@ export function extractErrorStatusCode(error) {
         if (typeof nestedStatus === 'number') {
             statusCandidates.push(nestedStatus);
         }
+        const upstreamStatus = detailStatus.upstreamStatus;
+        if (typeof upstreamStatus === 'number') {
+            statusCandidates.push(upstreamStatus);
+        }
+        const upstreamStatusSnake = detailStatus.upstream_status;
+        if (typeof upstreamStatusSnake === 'number') {
+            statusCandidates.push(upstreamStatusSnake);
+        }
     }
     const response = error.response;
     if (response && typeof response === 'object') {
@@ -71,6 +135,16 @@ export function extractErrorStatusCode(error) {
         if (typeof respStatusCode === 'number') {
             statusCandidates.push(respStatusCode);
         }
+        const data = response.data;
+        if (data && typeof data === 'object') {
+            const errNode = data.error;
+            if (errNode && typeof errNode === 'object') {
+                const nested = errNode.status;
+                if (typeof nested === 'number') {
+                    statusCandidates.push(nested);
+                }
+            }
+        }
     }
     const explicit = statusCandidates.find((candidate) => typeof candidate === 'number');
     if (typeof explicit === 'number') {

package/dist/server/runtime/http-server/executor-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"executor-provider.js","sourceRoot":"","sources":["../../../../src/server/runtime/http-server/executor-provider.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAI,OAAqD,CAAC,2BAA2B,CAAC;IACxG,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,YAId,CAAC;IACF,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,MAAM,YAAY,GAAG,MAAM,KAAK,mBAAmB,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC;IAClG,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qEAAqE;IACrE,6CAA6C;IAC7C,IAAI,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,aAAa,GAAG,KAAsB,CAAC;IAC7C,IAAI,aAAa,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,gBAAgB,GAA8B,EAAE,CAAC;IACvD,MAAM,YAAY,GAAI,KAAkC,CAAC,UAAU,CAAC;IACpE,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,eAAe,GAAI,KAA8B,CAAC,MAAM,CAAC;IAC/D,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACxC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,YAAY,GAAI,KAA+B,CAAC,OAAO,CAAC;IAC9D,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,YAAY,GAAI,YAAqC,CAAC,MAAM,CAAC;QACnE,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAI,KAAgC,CAAC,QAAQ,CAAC;IAC5D,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAI,QAAiC,CAAC,MAAM,CAAC;QAC7D,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,cAAc,GAAI,QAAqC,CAAC,UAAU,CAAC;QACzE,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;YACvC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC;IAC1G,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,IAAI,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAQ,KAA6B,CAAC,OAAO,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}
+{"version":3,"file":"executor-provider.js","sourceRoot":"","sources":["../../../../src/server/runtime/http-server/executor-provider.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAI,OAAqD,CAAC,2BAA2B,CAAC;IACxG,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,YAId,CAAC;IACF,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,MAAM,YAAY,GAAG,MAAM,KAAK,mBAAmB,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC;IAClG,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,+EAA+E;IAC/E,yEAAyE;IACzE,oFAAoF;IACpF,iDAAiD;IACjD,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,qEAAqE;IACrE,6CAA6C;IAC7C,IAAI,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,aAAa,GAAG,KAAsB,CAAC;IAC7C,IAAI,aAAa,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC7C,qGAAqG;IACrG,+FAA+F;IAC/F,8DAA8D;IAC9D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAI,KAA+B,CAAC,OAAO,CAAC;IAC5D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,eAAe,GAAI,KAAuC,CAAC,eAAe,CAAC;IACjF,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAI,OAAyC,CAAC,eAAe,CAAC;QACvE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAI,KAAgC,CAAC,QAAQ,CAAC;IAC5D,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAI,QAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,GAAG,GAAI,IAA4B,CAAC,KAAK,CAAC;YAChD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAI,GAA6B,CAAC,OAAO,CAAC;gBACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACvC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACpC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;QAChC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACnC,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC5C,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;QAChC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,gBAAgB,GAA8B,EAAE,CAAC;IACvD,MAAM,YAAY,GAAI,KAAkC,CAAC,UAAU,CAAC;IACpE,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,eAAe,GAAI,KAA8B,CAAC,MAAM,CAAC;IAC/D,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACxC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,YAAY,GAAI,KAA+B,CAAC,OAAO,CAAC;IAC9D,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,YAAY,GAAI,YAAqC,CAAC,MAAM,CAAC;QACnE,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,cAAc,GAAI,YAA6C,CAAC,cAAc,CAAC;QACrF,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;YACvC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,mBAAmB,GAAI,YAA8C,CAAC,eAAe,CAAC;QAC5F,IAAI,OAAO,mBAAmB,KAAK,QAAQ,EAAE,CAAC;YAC5C,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAI,KAAgC,CAAC,QAAQ,CAAC;IAC5D,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAI,QAAiC,CAAC,MAAM,CAAC;QAC7D,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,cAAc,GAAI,QAAqC,CAAC,UAAU,CAAC;QACzE,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;YACvC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,IAAI,GAAI,QAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,OAAO,GAAI,IAA4B,CAAC,KAAK,CAAC;YACpD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAI,OAAgC,CAAC,MAAM,CAAC;gBACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC;IAC1G,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,IAAI,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAQ,KAA6B,CAAC,OAAO,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/server/runtime/http-server/index.d.ts

@@ -18,6 +18,7 @@ import type { ServerConfigV2, ServerStatusV2 } from './types.js';
 export declare class RouteCodexHttpServer {
     private app;
     private server?;
+    private activeSockets;
     private config;
     private errorHandling;
     private _isInitialized;
@@ -39,12 +40,15 @@ export declare class RouteCodexHttpServer {
     private readonly coloredLogger;
     private managerDaemon;
     private readonly stats;
+    private restartChain;
     constructor(config: ServerConfigV2);
     private resolveVirtualRouterInput;
     private getModuleDependencies;
     /**
      * Register Daemon Admin UI route.
-     * Serves docs/daemon-admin-ui.html as a static page; localhost-only.
+     * Serves docs/daemon-admin-ui.html as a static page.
+     * - If `httpserver.apikey` is not configured: localhost-only.
+     * - If `httpserver.apikey` is configured: allow remote UI access (API calls still require apikey).
      */
     private registerDaemonAdminUiRoute;
     private getErrorHandlingShim;
@@ -63,10 +67,12 @@ export declare class RouteCodexHttpServer {
     private bootstrapVirtualRouter;
     private ensureHubPipelineCtor;
     private isPipelineReady;
+    private isQuotaRoutingEnabled;
     /**
      * 初始化服务器
      */
     initialize(): Promise<void>;
+    private restartRuntimeFromDisk;
     /**
      * 启动服务器
      */

package/dist/server/runtime/http-server/index.js

@@ -33,6 +33,7 @@ import { HealthManagerModule } from '../../../manager/modules/health/index.js';
 import { RoutingStateManagerModule } from '../../../manager/modules/routing/index.js';
 import { TokenManagerModule } from '../../../manager/modules/token/index.js';
 import { StatsManager } from './stats-manager.js';
+import { loadRouteCodexConfig } from '../../../config/routecodex-config-loader.js';
 /**
  * RouteCodex Server V2
  *
@@ -41,6 +42,7 @@ import { StatsManager } from './stats-manager.js';
 export class RouteCodexHttpServer {
     app;
     server;
+    activeSockets = new Set();
     config;
     errorHandling;
     _isInitialized = false;
@@ -63,6 +65,7 @@ export class RouteCodexHttpServer {
     coloredLogger = createServerColoredLogger();
     managerDaemon = null;
     stats = new StatsManager();
+    restartChain = Promise.resolve();
     constructor(config) {
         this.config = config;
         this.app = express();
@@ -107,14 +110,18 @@ export class RouteCodexHttpServer {
     }
     /**
      * Register Daemon Admin UI route.
-     * Serves docs/daemon-admin-ui.html as a static page; localhost-only.
+     * Serves docs/daemon-admin-ui.html as a static page.
+     * - If `httpserver.apikey` is not configured: localhost-only.
+     * - If `httpserver.apikey` is configured: allow remote UI access (API calls still require apikey).
      */
     registerDaemonAdminUiRoute() {
         this.app.get('/daemon/admin', async (req, res) => {
             try {
                 const ip = req.socket?.remoteAddress || '';
-                const allowed = ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
-                if (!allowed) {
+                const isLocal = ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
+                const expectedKey = typeof this.config?.server?.apikey === 'string' ? this.config.server.apikey.trim() : '';
+                const hasConfiguredKey = Boolean(expectedKey);
+                if (!isLocal && !hasConfiguredKey) {
                     res.status(403).json({ error: { message: 'forbidden', code: 'forbidden' } });
                     return;
                 }
@@ -131,6 +138,10 @@ export class RouteCodexHttpServer {
                     html = await fs.readFile(fallback, 'utf8');
                 }
                 res.setHeader('Content-Type', 'text/html; charset=utf-8');
+                // Avoid stale admin UI in browsers / proxies after upgrades.
+                res.setHeader('Cache-Control', 'no-store, max-age=0');
+                res.setHeader('Pragma', 'no-cache');
+                res.setHeader('X-RouteCodex-Version', String(process.env.ROUTECODEX_VERSION || 'dev'));
                 res.send(html);
             }
             catch (error) {
@@ -345,6 +356,13 @@ export class RouteCodexHttpServer {
     isPipelineReady() {
         return Boolean(this.hubPipeline);
     }
+    isQuotaRoutingEnabled() {
+        const flag = this.config.server.quotaRoutingEnabled;
+        if (typeof flag === 'boolean') {
+            return flag;
+        }
+        return true;
+    }
     /**
      * 初始化服务器
      */
@@ -357,7 +375,7 @@ export class RouteCodexHttpServer {
             // 初始化 ManagerDaemon 骨架（当前模块为占位实现，不改变行为）
             if (!this.managerDaemon) {
                 const serverId = `${this.config.server.host}:${this.config.server.port}`;
-                const daemon = new ManagerDaemon({ serverId });
+                const daemon = new ManagerDaemon({ serverId, quotaRoutingEnabled: this.isQuotaRoutingEnabled() });
                 daemon.registerModule(new TokenManagerModule());
                 daemon.registerModule(new RoutingStateManagerModule());
                 daemon.registerModule(new HealthManagerModule());
@@ -385,6 +403,7 @@ export class RouteCodexHttpServer {
                 buildHandlerContext: () => this.buildHandlerContext(),
                 getPipelineReady: () => this.isPipelineReady(),
                 handleError: (error, context) => this.handleError(error, context),
+                restartRuntimeFromDisk: async () => await this.restartRuntimeFromDisk(),
                 getHealthSnapshot: () => {
                     const healthModule = this.managerDaemon?.getModule('health');
                     return healthModule?.getCurrentSnapshot() ?? null;
@@ -400,6 +419,10 @@ export class RouteCodexHttpServer {
                 },
                 getManagerDaemon: () => this.managerDaemon,
                 getVirtualRouterArtifacts: () => this.currentRouterArtifacts,
+                getStatsSnapshot: () => ({
+                    session: this.stats.snapshot(Math.round(process.uptime() * 1000)),
+                    historical: this.stats.snapshotHistorical()
+                }),
                 getServerId: () => `${this.config.server.host}:${this.config.server.port}`
             });
             this._isInitialized = true;
@@ -410,6 +433,38 @@ export class RouteCodexHttpServer {
             throw error;
         }
     }
+    async restartRuntimeFromDisk() {
+        // Serialize restarts to avoid racing provider disposals / hub updates.
+        const run = async () => {
+            const loaded = await loadRouteCodexConfig(this.config?.configPath);
+            const userConfig = asRecord(loaded.userConfig) ?? {};
+            const httpServerNode = asRecord(userConfig.httpserver) ??
+                asRecord(asRecord(userConfig.modules)?.httpserver)?.config ??
+                null;
+            const nextApiKey = httpServerNode ? (typeof httpServerNode.apikey === 'string' ? String(httpServerNode.apikey).trim() : '') : '';
+            const nextHost = httpServerNode ? (typeof httpServerNode.host === 'string' ? String(httpServerNode.host).trim() : '') : '';
+            const nextPort = httpServerNode ? (typeof httpServerNode.port === 'number' ? Number(httpServerNode.port) : NaN) : NaN;
+            const warnings = [];
+            // Best-effort: allow rotating apikey at runtime by mutating config object.
+            if (typeof nextApiKey === 'string' && nextApiKey !== String(this.config.server.apikey || '')) {
+                this.config.server.apikey = nextApiKey || undefined;
+            }
+            // host/port changes require rebind; record warnings but do not attempt to re-listen.
+            if (nextHost && nextHost !== this.config.server.host) {
+                warnings.push(`httpserver.host changed to "${nextHost}" but live server keeps "${this.config.server.host}" until process restart`);
+            }
+            if (Number.isFinite(nextPort) && nextPort > 0 && nextPort !== this.config.server.port) {
+                warnings.push(`httpserver.port changed to ${nextPort} but live server keeps ${this.config.server.port} until process restart`);
+            }
+            // Keep the server's configPath aligned with what was loaded.
+            this.config.configPath = loaded.configPath;
+            await this.reloadRuntime(loaded.userConfig, { providerProfiles: loaded.providerProfiles });
+            return { reloadedAt: Date.now(), configPath: loaded.configPath, ...(warnings.length ? { warnings } : {}) };
+        };
+        const slot = this.restartChain.then(run);
+        this.restartChain = slot.then(() => undefined, () => undefined);
+        return await slot;
+    }
     /**
      * 启动服务器
      */
@@ -423,6 +478,22 @@ export class RouteCodexHttpServer {
                 console.log(`[RouteCodexHttpServer] Server started on ${this.config.server.host}:${this.config.server.port}`);
                 resolve();
             });
+            // In test runners (Jest), prevent the listen handle from keeping the process alive
+            // in case some keep-alive sockets linger.
+            if (process.env.JEST_WORKER_ID || process.env.NODE_ENV === 'test') {
+                try {
+                    this.server.unref?.();
+                }
+                catch {
+                    // ignore
+                }
+            }
+            this.server.on('connection', (socket) => {
+                this.activeSockets.add(socket);
+                socket.on('close', () => {
+                    this.activeSockets.delete(socket);
+                });
+            });
             this.server.on('error', async (error) => {
                 await this.handleError(error, 'server_start');
                 reject(error);
@@ -434,6 +505,24 @@ export class RouteCodexHttpServer {
      */
     async stop() {
         if (this.server) {
+            // Best-effort: close any open keep-alive sockets so server.close can finish.
+            for (const socket of this.activeSockets) {
+                try {
+                    socket.destroy();
+                }
+                catch {
+                    // ignore
+                }
+            }
+            this.activeSockets.clear();
+            try {
+                const srv = this.server;
+                srv.closeIdleConnections?.();
+                srv.closeAllConnections?.();
+            }
+            catch {
+                // ignore
+            }
             return new Promise(resolve => {
                 this.server?.close(async () => {
                     this._isRunning = false;
@@ -450,6 +539,13 @@ export class RouteCodexHttpServer {
                     catch {
                         // ignore manager shutdown failures
                     }
+                    try {
+                        this.server?.removeAllListeners();
+                    }
+                    catch {
+                        // ignore
+                    }
+                    this.server = undefined;
                     await this.errorHandling.destroy();
                     try {
                         const uptimeMs = Math.round(process.uptime() * 1000);
@@ -551,15 +647,24 @@ export class RouteCodexHttpServer {
             hubConfig.routingStateStore = routingStateStore;
         }
         const quotaModule = this.managerDaemon?.getModule('provider-quota');
-        const quotaFlagRaw = String(process.env.ROUTECODEX_QUOTA_ENABLED || '').trim().toLowerCase();
-        const quotaEnabled = quotaFlagRaw === '1' || quotaFlagRaw === 'true';
-        if (quotaEnabled && quotaModule && typeof quotaModule.getQuotaView === 'function') {
+        if (this.isQuotaRoutingEnabled() && quotaModule && typeof quotaModule.getQuotaView === 'function') {
             hubConfig.quotaView = quotaModule.getQuotaView();
         }
         if (!this.hubPipeline) {
             this.hubPipeline = new hubCtor(hubConfig);
         }
         else {
+            const existing = this.hubPipeline;
+            try {
+                existing.updateRuntimeDeps?.({
+                    ...(healthStore ? { healthStore } : {}),
+                    ...(routingStateStore ? { routingStateStore } : {}),
+                    ...('quotaView' in hubConfig ? { quotaView: hubConfig.quotaView } : {})
+                });
+            }
+            catch {
+                // best-effort: runtime deps updates must never block reload
+            }
             this.hubPipeline.updateVirtualRouterConfig(bootstrapArtifacts.config);
         }
         await this.initializeProviderRuntimes(bootstrapArtifacts);
@@ -577,17 +682,51 @@ export class RouteCodexHttpServer {
         }
         await this.disposeProviders();
         this.providerKeyToRuntimeKey.clear();
+        const quotaModule = this.managerDaemon?.getModule('provider-quota');
+        // Multiple providerKeys may share the same runtimeKey (single provider handle with multiple models).
+        // Quota is tracked by providerKey, so we need a stable way to derive authType for every key,
+        // even when the handle has already been created for this runtimeKey.
+        const runtimeKeyAuthType = new Map();
         for (const [providerKey, runtime] of Object.entries(runtimeMap)) {
             if (!runtime) {
                 continue;
             }
             const runtimeKey = runtime.runtimeKey || providerKey;
+            const authTypeFromRuntime = runtime && runtime.auth && typeof runtime.auth.type === 'string'
+                ? String(runtime.auth.type).trim()
+                : null;
             if (!this.providerHandles.has(runtimeKey)) {
                 const resolvedRuntime = await this.materializeRuntimeProfile(runtime);
                 const patchedRuntime = this.applyProviderProfileOverrides(resolvedRuntime);
+                try {
+                    const authTypeFromPatched = patchedRuntime && patchedRuntime.auth && typeof patchedRuntime.auth.type === 'string'
+                        ? String(patchedRuntime.auth.type).trim()
+                        : null;
+                    if (authTypeFromPatched) {
+                        runtimeKeyAuthType.set(runtimeKey, authTypeFromPatched);
+                    }
+                    else if (authTypeFromRuntime) {
+                        runtimeKeyAuthType.set(runtimeKey, authTypeFromRuntime);
+                    }
+                    else if (!runtimeKeyAuthType.has(runtimeKey)) {
+                        runtimeKeyAuthType.set(runtimeKey, null);
+                    }
+                }
+                catch {
+                    // ignore authType derivation failures
+                }
                 const handle = await this.createProviderHandle(runtimeKey, patchedRuntime);
                 this.providerHandles.set(runtimeKey, handle);
             }
+            // Register static quota metadata for every providerKey (not just per runtimeKey).
+            // Use the runtimeKey authType when available so shared runtimeKey models inherit correct policy.
+            try {
+                const authType = runtimeKeyAuthType.get(runtimeKey) ?? authTypeFromRuntime;
+                quotaModule?.registerProviderStaticConfig?.(providerKey, { authType: authType ?? null });
+            }
+            catch {
+                // best-effort: quota static config registration must never block runtime init
+            }
             this.providerKeyToRuntimeKey.set(providerKey, runtimeKey);
         }
     }
@@ -756,16 +895,16 @@ export class RouteCodexHttpServer {
             // snapshot failure should not block request path
         }
         const pipelineLabel = 'hub';
-        let iterationMetadata = initialMetadata;
-        let followupTriggered = false;
+        const iterationMetadata = initialMetadata;
+        const _followupTriggered = false;
         // Provider 级别不再在单个 HTTP 请求内执行重复尝试，
         // 429/配额/熔断逻辑统一交由 llmswitch-core VirtualRouter 处理。
-        const maxAttempts = 1;
-        let attempt = 0;
+        const _maxAttempts = 1;
+        let _attempt = 0;
         const originalBodySnapshot = this.cloneRequestPayload(input.body);
         const excludedProviderKeys = new Set();
         while (true) {
-            attempt += 1;
+            _attempt += 1;
             // 每次尝试前重置请求 body，避免上一轮 HubPipeline 的就地改写导致
             // 第二轮出现 ChatEnvelopeValidationError(messages_missing) 之类的问题。
             if (originalBodySnapshot && typeof originalBodySnapshot === 'object') {
@@ -907,7 +1046,7 @@ export class RouteCodexHttpServer {
                 });
                 const usage = this.extractUsageFromResult(converted, mergedMetadata);
                 const quotaModule = this.managerDaemon?.getModule('provider-quota');
-                if (quotaModule) {
+                if (this.isQuotaRoutingEnabled() && quotaModule) {
                     const totalTokens = typeof usage?.total_tokens === 'number' && Number.isFinite(usage.total_tokens)
                         ? Math.max(0, usage.total_tokens)
                         : Math.max(0, (typeof usage?.prompt_tokens === 'number' && Number.isFinite(usage.prompt_tokens) ? usage.prompt_tokens : 0) +
@@ -929,6 +1068,24 @@ export class RouteCodexHttpServer {
                     }
                 }
                 this.stats.recordCompletion(input.requestId, { usage, error: false });
+                // 回传 session_id 和 conversation_id 到响应头（如果存在）
+                const sessionId = typeof mergedMetadata.sessionId === "string" && mergedMetadata.sessionId.trim()
+                    ? mergedMetadata.sessionId.trim()
+                    : undefined;
+                const conversationId = typeof mergedMetadata.conversationId === "string" && mergedMetadata.conversationId.trim()
+                    ? mergedMetadata.conversationId.trim()
+                    : undefined;
+                if (sessionId || conversationId) {
+                    if (!converted.headers) {
+                        converted.headers = {};
+                    }
+                    if (sessionId && !converted.headers["session_id"]) {
+                        converted.headers["session_id"] = sessionId;
+                    }
+                    if (conversationId && !converted.headers["conversation_id"]) {
+                        converted.headers["conversation_id"] = conversationId;
+                    }
+                }
                 return converted;
             }
             catch (error) {
@@ -941,7 +1098,7 @@ export class RouteCodexHttpServer {
                     providerLabel
                 });
                 const quotaModule = this.managerDaemon?.getModule('provider-quota');
-                if (quotaModule) {
+                if (this.isQuotaRoutingEnabled() && quotaModule) {
                     try {
                         quotaModule.recordProviderUsage({ providerKey: target.providerKey, requestedTokens: 0 });
                     }