@jsonstudio/rcc 0.89.1205 → 0.89.1457

package/dist/server/runtime/http-server/index.js

@@ -12,7 +12,6 @@ import { ErrorHandlingCenter } from 'rcc-errorhandling';
 import { ProviderFactory } from '../../../providers/core/runtime/provider-factory.js';
 import { PipelineDebugLogger as PipelineDebugLoggerImpl } from '../../../modules/pipeline/utils/debug-logger.js';
 import { attachProviderRuntimeMetadata } from '../../../providers/core/runtime/provider-runtime-metadata.js';
-import { extractAnthropicToolAliasMap } from './anthropic-tool-alias.js';
 import { AuthFileResolver } from '../../../config/auth-file-resolver.js';
 import { buildProviderProfiles } from '../../../providers/profile/provider-profile-loader.js';
 import { isStageLoggingEnabled, logPipelineStage } from '../../utils/stage-logger.js';
@@ -21,7 +20,7 @@ import { registerHttpRoutes, registerOAuthPortalRoute } from './routes.js';
 import { mapProviderProtocol, normalizeProviderType, resolveProviderIdentity, asRecord } from './provider-utils.js';
 import { resolveRepoRoot } from './llmswitch-loader.js';
 import { enhanceProviderRequestId } from '../../utils/request-id-manager.js';
-import { convertProviderResponse as bridgeConvertProviderResponse, createSnapshotRecorder as bridgeCreateSnapshotRecorder, rebindResponsesConversationRequestId, bootstrapVirtualRouterConfig, getHubPipelineCtor } from '../../../modules/llmswitch/bridge.js';
+import { convertProviderResponse as bridgeConvertProviderResponse, createSnapshotRecorder as bridgeCreateSnapshotRecorder, rebindResponsesConversationRequestId, extractSessionIdentifiersFromMetadata, bootstrapVirtualRouterConfig, getHubPipelineCtor } from '../../../modules/llmswitch/bridge.js';
 import { initializeRouteErrorHub, reportRouteError } from '../../../error-handling/route-error-hub.js';
 import { writeClientSnapshot } from '../../../providers/core/utils/snapshot-writer.js';
 import { createServerColoredLogger } from './colored-logger.js';
@@ -32,11 +31,45 @@ import { ManagerDaemon } from '../../../manager/index.js';
 import { HealthManagerModule } from '../../../manager/modules/health/index.js';
 import { RoutingStateManagerModule } from '../../../manager/modules/routing/index.js';
 import { TokenManagerModule } from '../../../manager/modules/token/index.js';
+import { ensureServerScopedSessionDir } from './session-dir.js';
 import { StatsManager } from './stats-manager.js';
 import { loadRouteCodexConfig } from '../../../config/routecodex-config-loader.js';
 import { buildInfo } from '../../../build-info.js';
 import { recordHubShadowCompareDiff, resolveHubShadowCompareConfig, shouldRunHubShadowCompare } from './hub-shadow-compare.js';
+import { recordLlmsEngineShadowDiff, isLlmsEngineShadowEnabledForSubpath, resolveLlmsEngineShadowConfig, shouldRunLlmsEngineShadowForSubpath } from '../../../utils/llms-engine-shadow.js';
 import { resolveLlmswitchCoreVersion } from '../../../utils/runtime-versions.js';
+const DEFAULT_MAX_PROVIDER_ATTEMPTS = 6;
+const DEFAULT_ANTIGRAVITY_MAX_PROVIDER_ATTEMPTS = 20;
+function resolveMaxProviderAttempts() {
+    const raw = String(process.env.ROUTECODEX_MAX_PROVIDER_ATTEMPTS || process.env.RCC_MAX_PROVIDER_ATTEMPTS || '')
+        .trim()
+        .toLowerCase();
+    const parsed = raw ? Number.parseInt(raw, 10) : NaN;
+    const candidate = Number.isFinite(parsed) ? parsed : DEFAULT_MAX_PROVIDER_ATTEMPTS;
+    return Math.max(1, Math.min(20, candidate));
+}
+function resolveAntigravityMaxProviderAttempts() {
+    const raw = String(process.env.ROUTECODEX_ANTIGRAVITY_MAX_PROVIDER_ATTEMPTS || process.env.RCC_ANTIGRAVITY_MAX_PROVIDER_ATTEMPTS || '')
+        .trim()
+        .toLowerCase();
+    const parsed = raw ? Number.parseInt(raw, 10) : NaN;
+    const candidate = Number.isFinite(parsed) ? parsed : DEFAULT_ANTIGRAVITY_MAX_PROVIDER_ATTEMPTS;
+    return Math.max(1, Math.min(60, candidate));
+}
+function isAntigravityProviderKey(providerKey) {
+    return typeof providerKey === 'string' && providerKey.startsWith('antigravity.');
+}
+function extractStatusCodeFromError(err) {
+    if (!err || typeof err !== 'object')
+        return undefined;
+    const direct = err.statusCode;
+    if (typeof direct === 'number')
+        return direct;
+    const nested = err.status;
+    if (typeof nested === 'number')
+        return nested;
+    return undefined;
+}
 /**
  * RouteCodex Server V2
  *
@@ -52,7 +85,6 @@ export class RouteCodexHttpServer {
     _isRunning = false;
     // Runtime state
     hubPipeline = null;
-    hubShadowComparePipeline = null;
     providerHandles = new Map();
     providerKeyToRuntimeKey = new Map();
     pipelineLogger = createNoopPipelineLogger();
@@ -71,17 +103,18 @@ export class RouteCodexHttpServer {
     stats = new StatsManager();
     restartChain = Promise.resolve();
     hubShadowCompareConfig = resolveHubShadowCompareConfig();
+    llmsEngineShadowConfig = resolveLlmsEngineShadowConfig();
     hubPolicyMode = null;
+    hubPipelineEngineShadow = null;
+    hubPipelineConfigForShadow = null;
     constructor(config) {
         this.config = config;
         this.app = express();
         this.errorHandling = new QuietErrorHandlingCenter();
         this.stageLoggingEnabled = isStageLoggingEnabled();
         this.repoRoot = resolveRepoRoot(import.meta.url);
-        const envFlag = (process.env.ROUTECODEX_USE_HUB_PIPELINE || '').trim().toLowerCase();
-        if (config.pipeline?.useHubPipeline === false || envFlag === '0' || envFlag === 'false') {
-            console.warn('[RouteCodexHttpServer] Super pipeline has been removed; falling back to Hub pipeline.');
-        }
+        // Ensure session-scoped routing state does not leak across server instances.
+        ensureServerScopedSessionDir(`${this.config.server.host}:${this.config.server.port}`);
         try {
             this.pipelineLogger = new PipelineDebugLoggerImpl({ colored: this.coloredLogger }, { enableConsoleLogging: true });
         }
@@ -117,20 +150,11 @@ export class RouteCodexHttpServer {
     /**
      * Register Daemon Admin UI route.
      * Serves docs/daemon-admin-ui.html as a static page.
-     * - If `httpserver.apikey` is not configured: localhost-only.
-     * - If `httpserver.apikey` is configured: allow remote UI access (API calls still require apikey).
+     * Note: daemon-admin UI/API now uses password login (stored at ~/.routecodex/login) instead of httpserver.apikey.
      */
     registerDaemonAdminUiRoute() {
         this.app.get('/daemon/admin', async (req, res) => {
             try {
-                const ip = req.socket?.remoteAddress || '';
-                const isLocal = ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
-                const expectedKey = typeof this.config?.server?.apikey === 'string' ? this.config.server.apikey.trim() : '';
-                const hasConfiguredKey = Boolean(expectedKey);
-                if (!isLocal && !hasConfiguredKey) {
-                    res.status(403).json({ error: { message: 'forbidden', code: 'forbidden' } });
-                    return;
-                }
                 const fs = await import('node:fs/promises');
                 let html = '';
                 try {
@@ -359,6 +383,46 @@ export class RouteCodexHttpServer {
         this.hubPipelineCtor = ctorFactory;
         return this.hubPipelineCtor;
     }
+    async ensureHubPipelineEngineShadow() {
+        if (this.hubPipelineEngineShadow) {
+            return this.hubPipelineEngineShadow;
+        }
+        if (!this.hubPipelineConfigForShadow) {
+            throw new Error('Hub pipeline shadow config is not initialized');
+        }
+        const baseConfig = this.hubPipelineConfigForShadow;
+        const shadowConfig = { ...baseConfig };
+        // Avoid double side effects when shadow-running the pipeline: keep reads, drop writes.
+        const routingStateStore = baseConfig.routingStateStore;
+        if (routingStateStore && typeof routingStateStore.loadSync === 'function') {
+            shadowConfig.routingStateStore = {
+                loadSync: routingStateStore.loadSync.bind(routingStateStore),
+                saveAsync: () => { }
+            };
+        }
+        const healthStore = baseConfig.healthStore;
+        if (healthStore && typeof healthStore.loadInitialSnapshot === 'function') {
+            shadowConfig.healthStore = {
+                loadInitialSnapshot: healthStore.loadInitialSnapshot.bind(healthStore)
+            };
+        }
+        const quotaViewReadOnly = baseConfig.quotaViewReadOnly;
+        if (typeof quotaViewReadOnly === 'function') {
+            shadowConfig.quotaView = quotaViewReadOnly;
+        }
+        const bridge = (await import('../../../modules/llmswitch/bridge.js'));
+        const getCtor = bridge.getHubPipelineCtorForImpl;
+        if (typeof getCtor !== 'function') {
+            throw new Error('llmswitch bridge does not expose getHubPipelineCtorForImpl');
+        }
+        const ctorFactory = await getCtor('engine');
+        const hubCtor = ctorFactory;
+        if (!('virtualRouter' in shadowConfig)) {
+            throw new Error('HubPipeline shadow config missing virtualRouter');
+        }
+        this.hubPipelineEngineShadow = new hubCtor(shadowConfig);
+        return this.hubPipelineEngineShadow;
+    }
     isPipelineReady() {
         return Boolean(this.hubPipeline);
     }
@@ -671,6 +735,40 @@ export class RouteCodexHttpServer {
                 ...(Number.isFinite(sampleRate) ? { sampleRate } : {})
             };
         }
+        // Unified Hub Framework V1: tool surface rollout toggle (enforce by default in dev).
+        // - Disable via env: ROUTECODEX_HUB_TOOL_SURFACE_MODE=off
+        // - Observe via env: ROUTECODEX_HUB_TOOL_SURFACE_MODE=observe
+        // - Shadow (diff-only, no rewrites) via env: ROUTECODEX_HUB_TOOL_SURFACE_MODE=shadow
+        // - Enforce (rewrite outbound payload) via env: ROUTECODEX_HUB_TOOL_SURFACE_MODE=enforce
+        const toolSurfaceModeRaw = String(process.env.ROUTECODEX_HUB_TOOL_SURFACE_MODE || '').trim().toLowerCase();
+        const toolSurfaceMode = toolSurfaceModeRaw === 'off' || toolSurfaceModeRaw === '0' || toolSurfaceModeRaw === 'false'
+            ? null
+            : toolSurfaceModeRaw === 'observe' || toolSurfaceModeRaw === 'shadow' || toolSurfaceModeRaw === 'enforce'
+                ? toolSurfaceModeRaw
+                : buildInfo.mode === 'dev'
+                    ? 'enforce'
+                    : null;
+        if (toolSurfaceMode) {
+            const sampleRateRaw = String(process.env.ROUTECODEX_HUB_TOOL_SURFACE_SAMPLE_RATE || '').trim();
+            const sampleRate = sampleRateRaw ? Number(sampleRateRaw) : undefined;
+            hubConfig.toolSurface = {
+                mode: toolSurfaceMode,
+                ...(Number.isFinite(sampleRate) ? { sampleRate } : {})
+            };
+            // Also export the resolved mode to env so llmswitch-core response conversion
+            // (convertProviderResponse) can observe tool surface mismatches consistently.
+            if (!process.env.ROUTECODEX_HUB_TOOL_SURFACE_MODE) {
+                process.env.ROUTECODEX_HUB_TOOL_SURFACE_MODE = toolSurfaceMode;
+            }
+        }
+        // Unified Hub Framework V1: followup (servertool) shadow compare toggle.
+        // Implemented in llmswitch-core servertool engine; controlled by env for progressive rollout.
+        // Default: shadow in dev builds; off in release builds.
+        if (!process.env.ROUTECODEX_HUB_FOLLOWUP_MODE) {
+            if (buildInfo.mode === 'dev') {
+                process.env.ROUTECODEX_HUB_FOLLOWUP_MODE = 'shadow';
+            }
+        }
         const healthModule = this.managerDaemon?.getModule('health');
         const healthStore = healthModule?.getHealthStore();
         if (healthStore) {
@@ -684,6 +782,9 @@ export class RouteCodexHttpServer {
         const quotaModule = this.managerDaemon?.getModule('provider-quota');
         if (this.isQuotaRoutingEnabled() && quotaModule && typeof quotaModule.getQuotaView === 'function') {
             hubConfig.quotaView = quotaModule.getQuotaView();
+            if (typeof quotaModule.getQuotaViewReadOnly === 'function') {
+                hubConfig.quotaViewReadOnly = quotaModule.getQuotaViewReadOnly();
+            }
         }
         if (!this.hubPipeline) {
             this.hubPipeline = new hubCtor(hubConfig);
@@ -702,37 +803,9 @@ export class RouteCodexHttpServer {
             }
             this.hubPipeline.updateVirtualRouterConfig(bootstrapArtifacts.config);
         }
-        // Unified Hub Framework V1: optional shadow compare pipeline (same runtime deps, same config).
-        // Used to execute baseline runs without contending with the main pipeline instance.
-        if (this.hubShadowCompareConfig.enabled) {
-            if (!this.hubShadowComparePipeline) {
-                this.hubShadowComparePipeline = new hubCtor(hubConfig);
-            }
-            else {
-                const existingShadow = this.hubShadowComparePipeline;
-                try {
-                    existingShadow.updateRuntimeDeps?.({
-                        ...(healthStore ? { healthStore } : {}),
-                        ...(routingStateStore ? { routingStateStore } : {}),
-                        ...('quotaView' in hubConfig ? { quotaView: hubConfig.quotaView } : {})
-                    });
-                }
-                catch {
-                    // best-effort: runtime deps updates must never block reload
-                }
-                this.hubShadowComparePipeline.updateVirtualRouterConfig(bootstrapArtifacts.config);
-            }
-        }
-        else if (this.hubShadowComparePipeline) {
-            try {
-                const shadow = this.hubShadowComparePipeline;
-                shadow.dispose?.();
-            }
-            catch {
-                // ignore dispose failures
-            }
-            this.hubShadowComparePipeline = null;
-        }
+        // llms-engine shadow: capture the latest hub config and reset shadow pipeline to avoid stale deps.
+        this.hubPipelineConfigForShadow = hubConfig;
+        this.hubPipelineEngineShadow = null;
         await this.initializeProviderRuntimes(bootstrapArtifacts);
     }
     buildHandlerContext() {
@@ -962,11 +1035,12 @@ export class RouteCodexHttpServer {
         }
         const pipelineLabel = 'hub';
         const iterationMetadata = initialMetadata;
-        const _followupTriggered = false;
-        // 单次 HTTP 请求内最多做一次 failover（不在 Provider 层做重试）：
+        // _followupTriggered = false;
+        // 单次 HTTP 请求内允许多次 failover（不在 Provider 层做重试）：
         // - 让 VirtualRouter 根据 excludedProviderKeys 跳过失败目标
         // - 避免客户端“一次就断”导致对话破裂（尤其是 429 / prompt too long 等可恢复错误）
-        const maxAttempts = 2;
+        // - 通过 env 允许按部署/客户端调整：ROUTECODEX_MAX_PROVIDER_ATTEMPTS / RCC_MAX_PROVIDER_ATTEMPTS
+        let maxAttempts = resolveMaxProviderAttempts();
         let attempt = 0;
         let firstError = null;
         const originalBodySnapshot = this.cloneRequestPayload(input.body);
@@ -1039,9 +1113,14 @@ export class RouteCodexHttpServer {
                 providerId: providerIdToken,
                 model: rawModel
             });
-            if (providerProtocol === 'openai-responses') {
+            // /v1/responses tool loop depends on a stable requestId mapping between:
+            // - inbound conversion capture (uses the initial requestId), and
+            // - outbound response record (may run after requestId enhancement).
+            // Enhancement happens for all providers, so rebind must be keyed off the client endpoint,
+            // not the providerProtocol (which can be gemini-chat/anthropic-messages/etc.).
+            if (String(input.entryEndpoint || '').startsWith('/v1/responses')) {
                 try {
-                    await rebindResponsesConversationRequestId(pipelineResult.requestId, enhancedRequestId);
+                    await rebindResponsesConversationRequestId(providerRequestId, enhancedRequestId);
                 }
                 catch {
                     /* ignore rebind failures */
@@ -1102,12 +1181,22 @@ export class RouteCodexHttpServer {
                 });
                 const wantsStreamBase = Boolean(input.metadata?.inboundStream ?? input.metadata?.stream);
                 const normalized = this.normalizeProviderResponse(providerResponse);
+                const pipelineResultAny = pipelineResult;
                 const converted = await this.convertProviderResponseIfNeeded({
                     entryEndpoint: input.entryEndpoint,
                     providerType: handle.providerType,
                     requestId: input.requestId,
                     wantsStream: wantsStreamBase,
                     originalRequest: originalRequestSnapshot,
+                    requestSemantics: (pipelineResultAny?.processedRequest &&
+                        pipelineResultAny.processedRequest.semantics &&
+                        typeof pipelineResultAny.processedRequest.semantics === 'object')
+                        ? pipelineResultAny.processedRequest.semantics
+                        : (pipelineResultAny?.standardizedRequest &&
+                            pipelineResultAny.standardizedRequest.semantics &&
+                            typeof pipelineResultAny.standardizedRequest.semantics === 'object')
+                            ? pipelineResultAny.standardizedRequest.semantics
+                            : undefined,
                     processMode: pipelineResult.processMode,
                     response: normalized,
                     pipelineMetadata: mergedMetadata
@@ -1140,9 +1229,13 @@ export class RouteCodexHttpServer {
                 const sessionId = typeof mergedMetadata.sessionId === "string" && mergedMetadata.sessionId.trim()
                     ? mergedMetadata.sessionId.trim()
                     : undefined;
-                const conversationId = typeof mergedMetadata.conversationId === "string" && mergedMetadata.conversationId.trim()
+                let conversationId = typeof mergedMetadata.conversationId === "string" && mergedMetadata.conversationId.trim()
                     ? mergedMetadata.conversationId.trim()
                     : undefined;
+                // 对称补齐：如果只有 session_id，则回传 conversation_id=session_id
+                if (!conversationId && sessionId) {
+                    conversationId = sessionId;
+                }
                 if (sessionId || conversationId) {
                     if (!converted.headers) {
                         converted.headers = {};
@@ -1165,6 +1258,9 @@ export class RouteCodexHttpServer {
                     model: providerModel,
                     providerLabel
                 });
+                if (isAntigravityProviderKey(target.providerKey) && extractStatusCodeFromError(error) === 429) {
+                    maxAttempts = Math.max(maxAttempts, resolveAntigravityMaxProviderAttempts());
+                }
                 const quotaModule = this.managerDaemon?.getModule('provider-quota');
                 if (this.isQuotaRoutingEnabled() && quotaModule) {
                     try {
@@ -1205,11 +1301,18 @@ export class RouteCodexHttpServer {
             throw new Error('Hub pipeline runtime is not initialized');
         }
         const payload = asRecord(input.body);
+        const isInternalFollowup = asRecord(metadata.__rt)?.serverToolFollowup === true;
+        const wantsShadowCompare = !isInternalFollowup && shouldRunHubShadowCompare(this.hubShadowCompareConfig);
         const pipelineInput = {
             ...input,
+            id: input.requestId,
+            endpoint: input.entryEndpoint,
             metadata: {
                 ...metadata,
-                logger: this.coloredLogger
+                logger: this.coloredLogger,
+                ...(wantsShadowCompare
+                    ? { __hubShadowCompare: { baselineMode: this.hubShadowCompareConfig.baselineMode } }
+                    : {})
             },
             payload
         };
@@ -1225,13 +1328,23 @@ export class RouteCodexHttpServer {
         const derivedRequestId = typeof resultRecord.requestId === 'string'
             ? resultRecord.requestId
             : input.requestId;
+        const llmsEngineShadowEnabled = !isInternalFollowup &&
+            isLlmsEngineShadowEnabledForSubpath(this.llmsEngineShadowConfig, 'conversion/hub/pipeline');
+        if (llmsEngineShadowEnabled) {
+            // Fail fast: if shadow is enabled for this module, engine core must be available.
+            await this.ensureHubPipelineEngineShadow();
+        }
+        const wantsLlmsEngineShadow = llmsEngineShadowEnabled &&
+            shouldRunLlmsEngineShadowForSubpath(this.llmsEngineShadowConfig, 'conversion/hub/pipeline');
         // Unified Hub Framework V1: runtime black-box shadow compare (baseline policy vs current policy).
-        // - baseline run uses the same input but overrides policy mode
+        // - baseline payload is computed in the SAME hub pipeline execution (single-pass)
         // - only writes errorsample when diff exists
-        // - baseline run disables hub snapshots to avoid polluting codex-samples
         try {
-            const isInternalFollowup = metadata.serverToolFollowup === true;
-            if (!isInternalFollowup && shouldRunHubShadowCompare(this.hubShadowCompareConfig)) {
+            const shadow = result.metadata?.hubShadowCompare;
+            const baselineProviderPayload = shadow && typeof shadow === 'object' && !Array.isArray(shadow)
+                ? shadow.baselineProviderPayload
+                : undefined;
+            if (wantsShadowCompare && baselineProviderPayload && typeof baselineProviderPayload === 'object') {
                 const entryEndpoint = String(input.entryEndpoint || '/v1/chat/completions');
                 const routeHint = typeof metadata.routeHint === 'string'
                     ? String(metadata.routeHint)
@@ -1260,31 +1373,17 @@ export class RouteCodexHttpServer {
                 };
                 void (async () => {
                     try {
-                        const baselineMeta = {
-                            ...(pipelineInput.metadata ?? {}),
-                            __hubPolicyOverride: { mode: this.hubShadowCompareConfig.baselineMode },
-                            __disableHubSnapshots: true
-                        };
-                        const baselineInput = {
-                            ...pipelineInput,
-                            // Ensure baseline run uses the exact same HubPipeline requestId as the candidate run.
-                            // Otherwise internal requestId fields (e.g. responsesContext.requestId) will differ and
-                            // produce noisy diffs even when providerPayload is otherwise identical.
-                            id: derivedRequestId,
-                            endpoint: entryEndpoint,
-                            metadata: baselineMeta
-                        };
-                        const baselinePipeline = this.hubShadowComparePipeline || this.hubPipeline;
-                        const baseline = await baselinePipeline.execute(baselineInput);
                         const baselineOut = {
-                            providerPayload: cloneJsonSafe(baseline.providerPayload),
-                            target: cloneJsonSafe(baseline.target),
+                            providerPayload: cloneJsonSafe(baselineProviderPayload),
+                            target: shadow && typeof shadow === 'object' && !Array.isArray(shadow) && shadow.baselineTarget
+                                ? cloneJsonSafe(shadow.baselineTarget)
+                                : cloneJsonSafe(result.target),
                             metadata: {
-                                entryEndpoint: baseline.metadata?.entryEndpoint,
-                                providerProtocol: baseline.metadata?.providerProtocol,
-                                processMode: baseline.metadata?.processMode,
-                                stream: baseline.metadata?.stream,
-                                routeHint: baseline.metadata?.routeHint
+                                entryEndpoint: result.metadata?.entryEndpoint,
+                                providerProtocol: result.metadata?.providerProtocol,
+                                processMode: result.metadata?.processMode,
+                                stream: result.metadata?.stream,
+                                routeHint: result.metadata?.routeHint
                             }
                         };
                         await recordHubShadowCompareDiff({
@@ -1293,7 +1392,7 @@ export class RouteCodexHttpServer {
                             routeHint,
                             excludedProviderKeys,
                             baselineMode: this.hubShadowCompareConfig.baselineMode,
-                            candidateMode: this.hubPolicyMode ?? undefined,
+                            candidateMode: typeof shadow?.candidateMode === 'string' ? shadow.candidateMode : (this.hubPolicyMode ?? undefined),
                             baselineOut,
                             candidateOut
                         });
@@ -1308,6 +1407,77 @@ export class RouteCodexHttpServer {
         catch {
             // best-effort only
         }
+        // llms-engine: runtime black-box shadow compare (TS vs engine) for hub pipeline.
+        if (wantsLlmsEngineShadow) {
+            const cloneJsonSafe = (value) => {
+                try {
+                    return JSON.parse(JSON.stringify(value));
+                }
+                catch {
+                    return value;
+                }
+            };
+            const entryEndpoint = String(input.entryEndpoint || '/v1/chat/completions');
+            const routeHint = typeof metadata.routeHint === 'string'
+                ? String(metadata.routeHint)
+                : undefined;
+            const baselineOut = {
+                providerPayload: cloneJsonSafe(result.providerPayload),
+                target: cloneJsonSafe(result.target),
+                metadata: {
+                    entryEndpoint: result.metadata?.entryEndpoint,
+                    providerProtocol: result.metadata?.providerProtocol,
+                    processMode: result.metadata?.processMode,
+                    stream: result.metadata?.stream,
+                    routeHint: result.metadata?.routeHint
+                }
+            };
+            void (async () => {
+                try {
+                    const shadowPipeline = await this.ensureHubPipelineEngineShadow();
+                    const shadowRequestId = `${input.requestId}__llms_engine_shadow`;
+                    const baseMeta = pipelineInput.metadata;
+                    const shadowInput = {
+                        ...pipelineInput,
+                        id: shadowRequestId,
+                        endpoint: input.entryEndpoint,
+                        metadata: {
+                            ...(baseMeta && typeof baseMeta === 'object' ? baseMeta : {}),
+                            __llmsEngineShadow: { baselineRequestId: derivedRequestId, entryEndpoint, routeHint }
+                        },
+                        payload: cloneJsonSafe(payload)
+                    };
+                    const shadowResult = await shadowPipeline.execute(shadowInput);
+                    if (!shadowResult?.providerPayload || !shadowResult?.target) {
+                        return;
+                    }
+                    const candidateOut = {
+                        providerPayload: cloneJsonSafe(shadowResult.providerPayload),
+                        target: cloneJsonSafe(shadowResult.target),
+                        metadata: {
+                            entryEndpoint: shadowResult.metadata?.entryEndpoint,
+                            providerProtocol: shadowResult.metadata?.providerProtocol,
+                            processMode: shadowResult.metadata?.processMode,
+                            stream: shadowResult.metadata?.stream,
+                            routeHint: shadowResult.metadata?.routeHint
+                        }
+                    };
+                    await recordLlmsEngineShadowDiff({
+                        group: 'hub-pipeline',
+                        requestId: derivedRequestId,
+                        subpath: 'conversion/hub/pipeline',
+                        baselineImpl: 'ts',
+                        candidateImpl: 'engine',
+                        baselineOut,
+                        candidateOut
+                    });
+                }
+                catch (error) {
+                    // eslint-disable-next-line no-console
+                    console.error('[llms-engine-shadow] hub pipeline shadow failed:', error);
+                }
+            })();
+        }
         return {
             requestId: derivedRequestId,
             providerPayload: result.providerPayload,
@@ -1376,19 +1546,12 @@ export class RouteCodexHttpServer {
         }
         // 在 Host 入口统一解析会话标识，后续 HubPipeline / servertool 等模块仅依赖
         // sessionId / conversationId 字段，不再重复解析 clientHeaders。
-        try {
-            // eslint-disable-next-line @typescript-eslint/no-var-requires
-            const { extractSessionIdentifiersFromMetadata } = require('../../../../sharedmodule/llmswitch-core/dist/conversion/hub/pipeline/session-identifiers.js');
-            const identifiers = extractSessionIdentifiersFromMetadata(metadata);
-            if (identifiers.sessionId) {
-                metadata.sessionId = identifiers.sessionId;
-            }
-            if (identifiers.conversationId) {
-                metadata.conversationId = identifiers.conversationId;
-            }
+        const identifiers = extractSessionIdentifiersFromMetadata(metadata);
+        if (identifiers.sessionId) {
+            metadata.sessionId = identifiers.sessionId;
         }
-        catch {
-            // best-effort：解析失败时不影响主流程
+        if (identifiers.conversationId) {
+            metadata.conversationId = identifiers.conversationId;
         }
         return metadata;
     }
@@ -1532,7 +1695,6 @@ export class RouteCodexHttpServer {
         try {
             const providerProtocol = mapProviderProtocol(options.providerType);
             const metadataBag = asRecord(options.pipelineMetadata);
-            const aliasMap = extractAnthropicToolAliasMap(metadataBag);
             const originalModelId = this.extractClientModelId(metadataBag, options.originalRequest);
             // 以 HubPipeline metadata 为基础构建 AdapterContext，确保诸如
             // capturedChatRequest / webSearch / routeHint 等字段在响应侧可见，
@@ -1550,12 +1712,6 @@ export class RouteCodexHttpServer {
             baseContext.providerProtocol = providerProtocol;
             baseContext.originalModelId = originalModelId;
             const adapterContext = baseContext;
-            // 将 serverToolFollowup 等标记从 pipelineMetadata 透传到 AdapterContext，
-            // 便于 convertProviderResponse 正确识别内部二跳请求并跳过 servertool。
-            if (metadataBag && Object.prototype.hasOwnProperty.call(metadataBag, 'serverToolFollowup')) {
-                adapterContext.serverToolFollowup = metadataBag
-                    .serverToolFollowup;
-            }
             const compatProfile = metadataBag &&
                 typeof metadataBag === 'object' &&
                 metadataBag.target &&
@@ -1566,21 +1722,6 @@ export class RouteCodexHttpServer {
             if (compatProfile && compatProfile.trim()) {
                 adapterContext.compatibilityProfile = compatProfile.trim();
             }
-            if (aliasMap) {
-                adapterContext.anthropicToolNameMap = aliasMap;
-            }
-            if (metadataBag && typeof metadataBag === 'object') {
-                const webSearchConfig = metadataBag.webSearch;
-                if (webSearchConfig && typeof webSearchConfig === 'object') {
-                    adapterContext.webSearch = webSearchConfig;
-                }
-                if (metadataBag.forceWebSearch === true) {
-                    adapterContext.forceWebSearch = true;
-                }
-                if (metadataBag.forceVision === true) {
-                    adapterContext.forceVision = true;
-                }
-            }
             const stageRecorder = await bridgeCreateSnapshotRecorder(adapterContext, typeof adapterContext.entryEndpoint === 'string'
                 ? adapterContext.entryEndpoint
                 : options.entryEndpoint || entry);
@@ -1600,7 +1741,6 @@ export class RouteCodexHttpServer {
             const reenterPipeline = async (reenterOpts) => {
                 const nestedEntry = reenterOpts.entryEndpoint || options.entryEndpoint || entry;
                 const nestedExtra = asRecord(reenterOpts.metadata) ?? {};
-                const nestedEntryLower = nestedEntry.toLowerCase();
                 // 基于首次 HubPipeline metadata + 调用方注入的 metadata 构建新的请求 metadata。
                 // 不在 Host 层编码 servertool/web_search 等语义，由 llmswitch-core 负责。
                 const nestedMetadata = {
@@ -1612,25 +1752,20 @@ export class RouteCodexHttpServer {
                 };
                 // servertool followup 是内部二跳请求：不应继承客户端 headers 偏好（尤其是 Accept），
                 // 否则会导致上游返回非 SSE 响应而被当作 SSE 解析，出现“空回复”。
-                if (nestedMetadata.serverToolFollowup === true) {
-                    delete nestedMetadata.clientHeaders;
-                    delete nestedMetadata.clientRequestId;
-                }
-                // 针对 reenterPipeline 的入口端点，纠正 providerProtocol，避免沿用外层协议。
-                if (nestedEntryLower.includes('/v1/chat/completions')) {
-                    nestedMetadata.providerProtocol = 'openai-chat';
-                }
-                else if (nestedEntryLower.includes('/v1/responses')) {
-                    nestedMetadata.providerProtocol = 'openai-responses';
+                // E1: merge internal runtime metadata carrier (`__rt`) instead of clobbering it.
+                try {
+                    const baseRt = asRecord(metadataBag?.__rt) ?? {};
+                    const extraRt = asRecord(nestedExtra?.__rt) ?? {};
+                    if (Object.keys(baseRt).length || Object.keys(extraRt).length) {
+                        nestedMetadata.__rt = { ...baseRt, ...extraRt };
+                    }
                 }
-                else if (nestedEntryLower.includes('/v1/messages')) {
-                    nestedMetadata.providerProtocol = 'anthropic-messages';
+                catch {
+                    // best-effort
                 }
-                const followupProtocol = typeof nestedExtra.serverToolFollowupProtocol === 'string'
-                    ? nestedExtra.serverToolFollowupProtocol
-                    : undefined;
-                if (followupProtocol) {
-                    nestedMetadata.providerProtocol = followupProtocol;
+                if (asRecord(nestedMetadata.__rt)?.serverToolFollowup === true) {
+                    delete nestedMetadata.clientHeaders;
+                    delete nestedMetadata.clientRequestId;
                 }
                 const nestedInput = {
                     entryEndpoint: nestedEntry,
@@ -1653,6 +1788,7 @@ export class RouteCodexHttpServer {
                 context: adapterContext,
                 entryEndpoint: options.entryEndpoint || entry,
                 wantsStream: options.wantsStream,
+                requestSemantics: options.requestSemantics,
                 providerInvoker,
                 stageRecorder,
                 reenterPipeline
@@ -1674,12 +1810,21 @@ export class RouteCodexHttpServer {
             const errRecord = err;
             const errCode = typeof errRecord.code === 'string' ? errRecord.code : undefined;
             const errName = typeof errRecord.name === 'string' ? errRecord.name : undefined;
+            const statusCandidate = typeof errRecord.status === 'number'
+                ? errRecord.status
+                : typeof errRecord.statusCode === 'number'
+                    ? errRecord.statusCode
+                    : undefined;
             const isSseDecodeError = errCode === 'SSE_DECODE_ERROR' ||
                 (errName === 'ProviderProtocolError' && message.toLowerCase().includes('sse'));
             const isServerToolFollowupError = errCode === 'SERVERTOOL_FOLLOWUP_FAILED' ||
                 errCode === 'SERVERTOOL_EMPTY_FOLLOWUP' ||
                 (typeof errCode === 'string' && errCode.startsWith('SERVERTOOL_'));
-            if (isSseDecodeError || isServerToolFollowupError) {
+            const isProviderProtocolError = errName === 'ProviderProtocolError';
+            // If we need to stream a client response, conversion failures are fatal: there is no safe fallback
+            // that preserves protocol correctness.
+            const isStreamingConversion = Boolean(options.wantsStream && (needsAnthropicConversion || needsResponsesConversion || needsChatConversion));
+            if (isSseDecodeError || isServerToolFollowupError || isStreamingConversion || (isProviderProtocolError && typeof statusCandidate === 'number')) {
                 console.error('[RouteCodexHttpServer] Fatal conversion error, bubbling as HTTP error', error);
                 throw error;
             }