@jsonstudio/rcc 0.90.814 → 0.90.872

package/node_modules/ajv/lib/core.ts

@@ -107,6 +107,7 @@ export interface CurrentOptions {
   timestamp?: "string" | "date" // JTD only
   parseDate?: boolean // JTD only
   allowDate?: boolean // JTD only
+  specialNumbers?: "fast" | "null" // JTD only
   $comment?:
     | true
     | ((comment: string, schemaPath?: string, rootSchema?: AnySchemaObject) => unknown)

package/node_modules/ajv/lib/vocabularies/validation/pattern.ts

@@ -1,6 +1,7 @@
 import type {CodeKeywordDefinition, ErrorObject, KeywordErrorDefinition} from "../../types"
 import type {KeywordCxt} from "../../compile/validate"
 import {usePattern} from "../code"
+import {useFunc} from "../../compile/util"
 import {_, str} from "../../compile/codegen"
 
 export type PatternError = ErrorObject<"pattern", {pattern: string}, string | {$data: string}>
@@ -17,11 +18,21 @@ const def: CodeKeywordDefinition = {
   $data: true,
   error,
   code(cxt: KeywordCxt) {
-    const {data, $data, schema, schemaCode, it} = cxt
-    // TODO regexp should be wrapped in try/catchs
+    const {gen, data, $data, schema, schemaCode, it} = cxt
     const u = it.opts.unicodeRegExp ? "u" : ""
-    const regExp = $data ? _`(new RegExp(${schemaCode}, ${u}))` : usePattern(cxt, schema)
-    cxt.fail$data(_`!${regExp}.test(${data})`)
+    if ($data) {
+      const {regExp} = it.opts.code
+      const regExpCode = regExp.code === "new RegExp" ? _`new RegExp` : useFunc(gen, regExp)
+      const valid = gen.let("valid")
+      gen.try(
+        () => gen.assign(valid, _`${regExpCode}(${schemaCode}, ${u}).test(${data})`),
+        () => gen.assign(valid, false)
+      )
+      cxt.fail$data(_`!${valid}`)
+    } else {
+      const regExp = usePattern(cxt, schema)
+      cxt.fail$data(_`!${regExp}.test(${data})`)
+    }
   },
 }
 

package/node_modules/ajv/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ajv",
-  "version": "8.17.1",
+  "version": "8.18.0",
   "description": "Another JSON Schema Validator",
   "main": "dist/ajv.js",
   "types": "dist/ajv.d.ts",
@@ -9,6 +9,7 @@
     "dist/",
     ".runkit_example.js"
   ],
+  "sideEffects": false,
   "scripts": {
     "eslint": "eslint \"lib/**/*.ts\" \"spec/**/*.*s\" --ignore-pattern spec/JSON-Schema-Test-Suite",
     "prettier:write": "prettier --write \"./**/*.{json,yaml,js,ts}\"",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsonstudio/rcc",
-  "version": "0.90.814",
+  "version": "0.90.872",
   "description": "Multi-provider OpenAI proxy server with anthropic/responses/chat support (release)",
   "type": "module",
   "main": "dist/index.js",
@@ -52,8 +52,9 @@
     "verify:repo-sanity": "node scripts/ci/repo-sanity.mjs",
     "verify:llmswitch-rustification-audit": "node scripts/ci/llmswitch-rustification-audit.mjs",
     "verify:file-line-limit": "node scripts/ci/check-file-line-limit.mjs",
+    "audit:silent-failure": "node scripts/ci/silent-failure-audit.mjs",
     "vr:dryrun": "node scripts/virtual-router-dryrun.mjs",
-    "test:routing-instructions": "npm run jest:run -- --runTestsByPath tests/token-daemon/token-daemon.auto-refresh-noninteractive.spec.ts tests/token-daemon/token-daemon.refresh-ahead.spec.ts tests/commands/oauth-command.qwen-auto.spec.ts tests/token-daemon/interactive-refresh.spec.ts tests/server/runtime/request-executor.single-attempt.spec.ts tests/server/runtime/executor-provider.retryable.spec.ts tests/server/runtime/http-server/executor/usage-aggregator.spec.ts tests/providers/auth/tokenfile-auth.iflow.spec.ts tests/providers/auth/antigravity-user-agent.unit.test.ts tests/providers/auth/antigravity-fingerprint.unit.test.ts tests/providers/auth/antigravity-warmup.unit.test.ts tests/providers/core/runtime/gemini-cli-http-provider.unit.test.ts tests/providers/core/runtime/deepseek-http-provider.unit.test.ts tests/providers/core/runtime/antigravity-quota-client.unit.test.ts tests/manager/quota/provider-quota-center.spec.ts tests/manager/quota/provider-quota-store.spec.ts tests/manager/quota/quota-manager-refresh.spec.ts tests/manager/quota/provider-quota-daemon-module.spec.ts tests/manager/quota/provider-key-normalization.spec.ts tests/server/http-server/daemon-admin.e2e.spec.ts tests/server/http-server/session-client-routes.spec.ts tests/server/http-server/quota-view-injection.spec.ts tests/server/http-server/quota-refresh-triggers.e2e.spec.ts tests/server/http-server/hub-policy-injection.spec.ts tests/server/http-server/session-header-injection.spec.ts tests/server/http-server/session-dir.spec.ts tests/server/handlers/sse-timeout.spec.ts tests/utils/is-direct-execution.test.ts tests/utils/windows-netstat.test.ts tests/servertool/virtual-router-context-fallback.spec.ts tests/servertool/virtual-router-longcontext-fallback.spec.ts tests/servertool/virtual-router-series-cooldown.spec.ts tests/servertool/recursive-detection-guard.spec.ts tests/servertool/routing-instructions.spec.ts tests/servertool/stop-message-sample-replay.spec.ts tests/servertool/stop-message-auto.spec.ts tests/servertool/stopmessage-session-scope.spec.ts tests/servertool/stopmessage-anthropic-stop-sequence.spec.ts tests/servertool/stopmessage-compaction-false-positive.spec.ts tests/servertool/servertool-progress-logging.spec.ts tests/servertool/servertool-clock.spec.ts tests/servertool/antigravity-thought-signature-bootstrap.spec.ts tests/compat/tabglm-claude-code-profile.spec.ts tests/compat/antigravity-thought-signature.spec.ts tests/sharedmodule/mcp-tool-descriptions.spec.ts tests/sharedmodule/virtual-router-hit-log.spec.ts tests/sharedmodule/virtual-router-routing-model-validation.spec.ts tests/unified-hub/hub-v1-single-path-imports.spec.ts",
+    "test:routing-instructions": "npm run jest:run -- --runTestsByPath tests/token-daemon/token-daemon.auto-refresh-noninteractive.spec.ts tests/token-daemon/token-daemon.refresh-ahead.spec.ts tests/commands/oauth-command.qwen-auto.spec.ts tests/token-daemon/interactive-refresh.spec.ts tests/server/runtime/request-executor.single-attempt.spec.ts tests/server/runtime/executor-provider.retryable.spec.ts tests/server/runtime/http-server/executor/usage-aggregator.spec.ts tests/providers/auth/tokenfile-auth.iflow.spec.ts tests/providers/auth/antigravity-user-agent.unit.test.ts tests/providers/auth/antigravity-fingerprint.unit.test.ts tests/providers/auth/antigravity-warmup.unit.test.ts tests/providers/core/runtime/gemini-cli-http-provider.unit.test.ts tests/providers/core/runtime/deepseek-http-provider.unit.test.ts tests/providers/core/runtime/antigravity-quota-client.unit.test.ts tests/manager/quota/provider-quota-center.spec.ts tests/manager/quota/provider-quota-store.spec.ts tests/manager/quota/quota-manager-refresh.spec.ts tests/manager/quota/provider-quota-daemon-module.spec.ts tests/manager/quota/provider-key-normalization.spec.ts tests/server/http-server/daemon-admin.e2e.spec.ts tests/server/http-server/session-client-routes.spec.ts tests/server/http-server/quota-view-injection.spec.ts tests/server/http-server/quota-refresh-triggers.e2e.spec.ts tests/server/http-server/hub-policy-injection.spec.ts tests/server/http-server/session-header-injection.spec.ts tests/server/http-server/session-dir.spec.ts tests/server/handlers/sse-timeout.spec.ts tests/utils/is-direct-execution.test.ts tests/utils/windows-netstat.test.ts tests/servertool/virtual-router-context-fallback.spec.ts tests/servertool/virtual-router-longcontext-fallback.spec.ts tests/servertool/virtual-router-series-cooldown.spec.ts tests/servertool/recursive-detection-guard.spec.ts tests/servertool/routing-instructions.spec.ts tests/servertool/stop-message-sample-replay.spec.ts tests/servertool/stop-message-auto.spec.ts tests/servertool/stopmessage-session-scope.spec.ts tests/servertool/stopmessage-anthropic-stop-sequence.spec.ts tests/servertool/stopmessage-compaction-false-positive.spec.ts tests/servertool/servertool-progress-logging.spec.ts tests/servertool/servertool-clock.spec.ts tests/servertool/antigravity-thought-signature-bootstrap.spec.ts tests/compat/tabglm-claude-code-profile.spec.ts tests/compat/antigravity-thought-signature.spec.ts tests/sharedmodule/mcp-tool-descriptions.spec.ts tests/sharedmodule/virtual-router-hit-log.spec.ts tests/sharedmodule/virtual-router-routing-model-validation.spec.ts tests/unified-hub/hub-v1-single-path-imports.spec.ts tests/sharedmodule/tool-governor-exec-command-guard.spec.ts",
     "test:cli": "npm run jest:run -- --runTestsByPath tests/cli/camoufox-command.spec.ts tests/cli/clean-command.spec.ts tests/cli/code-command.spec.ts tests/cli/config-command.spec.ts tests/cli/env-command.spec.ts tests/cli/env-output.spec.ts tests/cli/examples-command.spec.ts tests/cli/port-command.spec.ts tests/cli/port-utils.spec.ts tests/cli/restart-command.spec.ts tests/cli/smoke.spec.ts tests/cli/start-command.spec.ts tests/cli/status-command.spec.ts tests/cli/stop-command.spec.ts",
     "test:watch": "npm run jest:run -- --watch",
     "test:coverage": "npm run jest:run -- --coverage",
@@ -129,7 +130,7 @@
     "duplication:fix": "node scripts/duplicate-code-handler.mjs --threshold 5 --auto-fix true",
     "dup:scan": "node scripts/duplicate-code-handler.mjs --threshold 5 --output reports",
     "dup:auto-fix": "node scripts/duplicate-code-handler.mjs --threshold 5 --output reports --auto-fix true",
-    "secrets:check": "echo 'Secrets check temporarily disabled'",
+    "secrets:check": "node scripts/ci/secrets-check.mjs",
     "format:check": "prettier --check src/**/*.{ts,js,json}",
     "format:fix": "prettier --write src/**/*.{ts,js,json}",
     "verify:split-args": "node scripts/verify-toolcall-arg-splitting.mjs",
@@ -155,22 +156,21 @@
     "mock:clean": "node scripts/mock-provider/clean.mjs",
     "publish:rcc": "node scripts/publish-rcc.mjs",
     "pack:rcc": "node scripts/pack-rcc.mjs",
-    "build:rccx": "npm run build:min && node scripts/pack-mode.mjs --name @jsonstudio/rccx --bin rccx",
-    "compare:codex:rccx": "node scripts/compare-codex-rccx.mjs",
     "fix:cli-permission": "node scripts/ensure-cli-executable.mjs",
-    "fix:cli-shim": "node scripts/ensure-cli-command-shim.mjs"
+    "fix:cli-shim": "node scripts/ensure-cli-command-shim.mjs",
+    "public:rcc": "npm run publish:rcc --"
   },
   "dependencies": {
     "@ai-sdk/anthropic": "^3.0.58",
     "@ai-sdk/openai": "^3.0.41",
     "@anthropic-ai/sdk": "^0.65.0",
-    "@jsonstudio/llms": "0.6.4299",
+    "@jsonstudio/llms": "0.6.4305",
     "@lmstudio/sdk": "^1.5.0",
     "@radix-ui/react-switch": "^1.2.6",
     "@types/socket.io": "^3.0.1",
     "ai": "^6.0.116",
-    "ajv": "^8.17.1",
-    "axios": "^1.12.2",
+    "ajv": "^8.18.0",
+    "axios": "^1.14.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.1",
     "cors": "^2.8.5",
@@ -238,5 +238,10 @@
   },
   "bundleDependencies": [
     "@jsonstudio/llms"
-  ]
+  ],
+  "overrides": {
+    "path-to-regexp": "0.1.13",
+    "qs": "6.15.0",
+    "socket.io-parser": "4.2.6"
+  }
 }

package/scripts/ci/repo-sanity.mjs

@@ -61,6 +61,7 @@ function isForbiddenTrackedPath(p) {
   if (p.startsWith('.iflow/')) return true;
   if (p === '.secrets.baseline') return true;
   if (p.endsWith('/.DS_Store') || p === '.DS_Store') return true;
+  if (/(^|\/)[^/]+\.bak\d*$/i.test(p)) return true;
   return false;
 }
 
@@ -134,6 +135,8 @@ function checkTrackedSecrets() {
   const patterns = [
     // OpenAI-style API keys.
     { label: 'openai_sk', mode: 'E', pattern: String.raw`sk-[A-Za-z0-9]{20,}` },
+    // OpenRouter API keys.
+    { label: 'openrouter_sk', mode: 'E', pattern: String.raw`sk-or-v1-[A-Za-z0-9]{32,}` },
     // Google API keys.
     { label: 'google_api_key', mode: 'E', pattern: String.raw`AIza[0-9A-Za-z\-_]{20,}` },
     // GitHub classic personal access tokens.
@@ -149,8 +152,26 @@ function checkTrackedSecrets() {
     const out = spawnSync(
       'git',
       entry.mode === 'F'
-        ? ['grep', '-nF', '-e', entry.pattern, '--', '.', ':(exclude)scripts/ci/repo-sanity.mjs']
-        : ['grep', '-nE', '-e', entry.pattern, '--', '.', ':(exclude)scripts/ci/repo-sanity.mjs'],
+        ? [
+          'grep',
+          '-nF',
+          '-e',
+          entry.pattern,
+          '--',
+          '.',
+          ':(exclude)scripts/ci/repo-sanity.mjs',
+          ':(exclude)scripts/ci/secrets-check.mjs'
+        ]
+        : [
+          'grep',
+          '-nE',
+          '-e',
+          entry.pattern,
+          '--',
+          '.',
+          ':(exclude)scripts/ci/repo-sanity.mjs',
+          ':(exclude)scripts/ci/secrets-check.mjs'
+        ],
       { encoding: 'utf8' }
     );
     // git grep exits with 1 when no matches; 0 when matches; >1 for errors.

package/scripts/ci/secrets-check.mjs

@@ -0,0 +1,48 @@
+import { spawnSync } from 'node:child_process';
+
+const patterns = [
+  { label: 'openai_sk', mode: 'E', pattern: String.raw`sk-[A-Za-z0-9]{20,}` },
+  { label: 'openrouter_sk', mode: 'E', pattern: String.raw`sk-or-v1-[A-Za-z0-9]{32,}` },
+  { label: 'google_api_key', mode: 'E', pattern: String.raw`AIza[0-9A-Za-z\-_]{20,}` },
+  { label: 'github_pat', mode: 'E', pattern: String.raw`ghp_[A-Za-z0-9]{30,}` },
+  { label: 'private_key', mode: 'F', pattern: '-----BEGIN PRIVATE KEY-----' },
+  { label: 'rsa_private_key', mode: 'F', pattern: '-----BEGIN RSA PRIVATE KEY-----' },
+  { label: 'ec_private_key', mode: 'F', pattern: '-----BEGIN EC PRIVATE KEY-----' }
+];
+
+function runGitGrep(entry) {
+  const args =
+    entry.mode === 'F'
+      ? ['grep', '-nF', '-e', entry.pattern, '--', '.', ':(exclude)scripts/ci/repo-sanity.mjs', ':(exclude)scripts/ci/secrets-check.mjs']
+      : ['grep', '-nE', '-e', entry.pattern, '--', '.', ':(exclude)scripts/ci/repo-sanity.mjs', ':(exclude)scripts/ci/secrets-check.mjs'];
+  const out = spawnSync('git', args, { encoding: 'utf8' });
+  if ((out.status ?? 0) > 1) {
+    throw new Error(`git grep failed for ${entry.label}: ${out.stderr || out.stdout}`);
+  }
+  if (out.status !== 0) {
+    return [];
+  }
+  return String(out.stdout || '')
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => `[${entry.label}] ${line}`);
+}
+
+const hits = [];
+for (const entry of patterns) {
+  hits.push(...runGitGrep(entry));
+}
+
+if (hits.length) {
+  console.error('[secrets-check] potential secrets detected in tracked files:');
+  for (const line of hits.slice(0, 200)) {
+    console.error(`- ${line}`);
+  }
+  if (hits.length > 200) {
+    console.error(`- ... (${hits.length - 200} more)`);
+  }
+  process.exit(2);
+}
+
+console.log('[secrets-check] ok');

package/scripts/ci/silent-failure-audit.mjs

@@ -0,0 +1,192 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+
+const roots = ['src', 'sharedmodule/llmswitch-core/src'];
+const includeExt = /\.(ts|tsx|js|mjs|cjs|rs)$/;
+const args = new Set(process.argv.slice(2));
+const failOnRisk = args.has('--fail-on-risk');
+const jsonOutput = args.has('--json');
+
+const NOISE_HINT_RE = /\b(ignore|best[- ]effort|non-blocking|swallow|fallback)\b/i;
+const HAS_HANDLED_RE =
+  /\b(throw|console\.(warn|error|info)|logger\.(warn|warning|error|info)|report\w*Error|logProcessLifecycle|log\w*NonBlocking|emit\w*|record\w*Error)\b/;
+
+function walk(dir, out) {
+  if (!fs.existsSync(dir)) return;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name.startsWith('.')) continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      walk(full, out);
+      continue;
+    }
+    if (includeExt.test(entry.name)) out.push(full);
+  }
+}
+
+function lineOf(source, index) {
+  let line = 1;
+  for (let i = 0; i < index; i++) {
+    if (source.charCodeAt(i) === 10) line += 1;
+  }
+  return line;
+}
+
+function findBlockEnd(source, openBraceIndex) {
+  let depth = 0;
+  let inS = false;
+  let inD = false;
+  let inT = false;
+  let escaped = false;
+  let inLineComment = false;
+  let inBlockComment = false;
+  for (let i = openBraceIndex; i < source.length; i += 1) {
+    const ch = source[i];
+    const nx = source[i + 1];
+    if (inLineComment) {
+      if (ch === '\n') inLineComment = false;
+      continue;
+    }
+    if (inBlockComment) {
+      if (ch === '*' && nx === '/') {
+        inBlockComment = false;
+        i += 1;
+      }
+      continue;
+    }
+    if (inS) {
+      if (!escaped && ch === '\\') {
+        escaped = true;
+        continue;
+      }
+      if (!escaped && ch === "'") inS = false;
+      escaped = false;
+      continue;
+    }
+    if (inD) {
+      if (!escaped && ch === '\\') {
+        escaped = true;
+        continue;
+      }
+      if (!escaped && ch === '"') inD = false;
+      escaped = false;
+      continue;
+    }
+    if (inT) {
+      if (!escaped && ch === '\\') {
+        escaped = true;
+        continue;
+      }
+      if (!escaped && ch === '`') inT = false;
+      escaped = false;
+      continue;
+    }
+    if (ch === '/' && nx === '/') {
+      inLineComment = true;
+      i += 1;
+      continue;
+    }
+    if (ch === '/' && nx === '*') {
+      inBlockComment = true;
+      i += 1;
+      continue;
+    }
+    if (ch === "'") {
+      inS = true;
+      continue;
+    }
+    if (ch === '"') {
+      inD = true;
+      continue;
+    }
+    if (ch === '`') {
+      inT = true;
+      continue;
+    }
+    if (ch === '{') {
+      depth += 1;
+      continue;
+    }
+    if (ch === '}') {
+      depth -= 1;
+      if (depth === 0) return i;
+    }
+  }
+  return -1;
+}
+
+const files = [];
+for (const root of roots) walk(root, files);
+
+const catchRisk = [];
+const promiseCatchRisk = [];
+const catchRe = /catch\s*(\([^)]*\))?\s*\{/g;
+const promiseCatchRe = /\.catch\(\s*(\([^)]*\)\s*=>\s*)?(\{\s*\}|undefined|null)?\s*\)/g;
+
+for (const file of files) {
+  const source = fs.readFileSync(file, 'utf8');
+
+  let m;
+  while ((m = catchRe.exec(source)) !== null) {
+    const open = source.indexOf('{', m.index);
+    if (open < 0) continue;
+    const end = findBlockEnd(source, open);
+    if (end < 0) continue;
+    const body = source.slice(open + 1, end).trim();
+    const hasHandled = HAS_HANDLED_RE.test(body);
+    const noopOnly = /^(?:\/\*[\s\S]*?\*\/|\/\/.*|\s|;|return\s*;)*$/.test(body);
+    const looksSwallow = !hasHandled && (noopOnly || NOISE_HINT_RE.test(body));
+    if (looksSwallow) {
+      catchRisk.push({
+        file,
+        line: lineOf(source, m.index),
+        snippet: body.split('\n').slice(0, 3).join(' ').slice(0, 180)
+      });
+    }
+    catchRe.lastIndex = end + 1;
+  }
+
+  while ((m = promiseCatchRe.exec(source)) !== null) {
+    promiseCatchRisk.push({ file, line: lineOf(source, m.index), snippet: m[0] });
+  }
+}
+
+const byFile = new Map();
+for (const row of catchRisk) {
+  byFile.set(row.file, (byFile.get(row.file) || 0) + 1);
+}
+const topFiles = [...byFile.entries()]
+  .sort((a, b) => b[1] - a[1])
+  .slice(0, 40)
+  .map(([file, count]) => ({ file, count }));
+
+const report = {
+  roots,
+  scannedFiles: files.length,
+  catchRiskCount: catchRisk.length,
+  promiseCatchRiskCount: promiseCatchRisk.length,
+  topFiles,
+  sample: catchRisk.slice(0, 120)
+};
+
+if (jsonOutput) {
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+} else {
+  console.log(`[silent-failure-audit] scanned files=${report.scannedFiles}`);
+  console.log(
+    `[silent-failure-audit] risky catch blocks=${report.catchRiskCount}, risky promise.catch=${report.promiseCatchRiskCount}`
+  );
+  console.log('[silent-failure-audit] top files:');
+  for (const row of topFiles) {
+    console.log(`  - ${row.count}  ${row.file}`);
+  }
+  console.log('[silent-failure-audit] sample:');
+  for (const row of report.sample.slice(0, 30)) {
+    console.log(`  - ${row.file}:${row.line}  ${row.snippet}`);
+  }
+}
+
+if (failOnRisk && (report.catchRiskCount > 0 || report.promiseCatchRiskCount > 0)) {
+  process.exit(2);
+}

package/scripts/mock-provider/run-regressions.mjs

@@ -198,6 +198,7 @@ async function createServer(configPath, port, snapshotRoot) {
     HOME: isolatedHome,
     USERPROFILE: isolatedHome,
     ROUTECODEX_USE_MOCK: '1',
+    ROUTECODEX_ALLOW_MOCK_RUNTIME: '1',
     ROUTECODEX_MOCK_CONFIG_PATH: configPath,
     ROUTECODEX_MOCK_SAMPLES_DIR: MOCK_SAMPLES_DIR,
     ROUTECODEX_MOCK_VALIDATE_NAMES: '1',

package/scripts/pack-mode.mjs

@@ -62,18 +62,36 @@ function installLocalLlmsFromTarball() {
     if ((pack.status ?? 0) !== 0) {
       throw new Error(`npm pack ${localLlmsDir} failed`);
     }
-    const lines = String(pack.stdout || '')
-      .split('\n')
-      .map((line) => line.trim())
-      .filter(Boolean);
-    const tarballName = lines[lines.length - 1];
-    if (!tarballName) {
-      throw new Error('npm pack local llms produced empty tarball name');
-    }
-    const tarballPath = path.join(tmpDir, tarballName);
-    if (!exists(tarballPath)) {
-      throw new Error(`local llms tarball missing: ${tarballPath}`);
+
+    const streamText = `${String(pack.stdout || '')}\n${String(pack.stderr || '')}`;
+    const candidates = Array.from(
+      new Set(
+        streamText
+          .split(/\s+/)
+          .map((token) => token.trim())
+          .filter((token) => token.endsWith('.tgz'))
+      )
+    );
+
+    const tarballsInTmp = (() => {
+      try {
+        return fs.readdirSync(tmpDir)
+          .filter((name) => name.endsWith('.tgz'))
+          .map((name) => path.join(tmpDir, name));
+      } catch {
+        return [];
+      }
+    })();
+
+    const resolvedCandidates = candidates
+      .map((token) => (path.isAbsolute(token) ? token : path.join(tmpDir, token)))
+      .filter((candidatePath) => exists(candidatePath));
+
+    const tarballPath = resolvedCandidates[0] || tarballsInTmp[0] || '';
+    if (!tarballPath) {
+      throw new Error(`local llms tarball missing (stdout=${JSON.stringify(String(pack.stdout || '').trim())})`);
     }
+
     runNpm(['install', '--no-audit', '--no-fund', '--no-save', tarballPath]);
   } finally {
     fs.rmSync(tmpDir, { recursive: true, force: true });
@@ -108,13 +126,10 @@ function readLocalLlmsVersion() {
 
 const isDevPkg = args.name === 'routecodex';
 const isRcc = args.name === 'rcc' || args.name === '@jsonstudio/rcc';
-const isRccx = args.name === '@jsonstudio/rccx';
 
 let hadDevLink = false;
-if (!isRccx) {
-  hadDevLink = isSymlink(llmsPath);
-  runEnsureMode('release');
-}
+hadDevLink = isSymlink(llmsPath);
+runEnsureMode('release');
 
 const original = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
 fs.writeFileSync(backupPath, JSON.stringify(original, null, 2));
@@ -138,7 +153,7 @@ try {
   mutated.name = args.name;
   mutated.bin = { [args.bin]: 'dist/cli.js' };
   // Ensure description mentions mode
-  const suffix = (isRcc || isRccx) ? ' (release)' : ' (dev)';
+  const suffix = isRcc ? ' (release)' : ' (dev)';
   mutated.description = String(original.description || 'RouteCodex')
     .replace(/\s*\((dev|release)\)$/, '')
     .concat(suffix);
@@ -189,25 +204,6 @@ try {
       }
       mutated.files = baseFiles;
     }
-  } else if (isRccx) {
-    // rccx: wasm-backed llms 核心，通过 npm alias 将 @jsonstudio/llms 指向 wasm 引擎包。
-    mutated.bundledDependencies = [];
-    mutated.bundleDependencies = [];
-
-    const deps = { ...(original.dependencies || {}) };
-    // 移除原有 TS 版 llms 直连依赖
-    if (deps['@jsonstudio/llms']) {
-      delete deps['@jsonstudio/llms'];
-    }
-    // 推断 wasm 引擎版本，若未声明则使用本地 llms-engine 缺省版本
-    const engineVersion = deps['@jsonstudio/llms-engine'] || '^0.3.0';
-    deps['@jsonstudio/llms-engine'] = engineVersion;
-    // 通过 npm alias 保持 import 形状不变
-    deps['@jsonstudio/llms'] = `npm:@jsonstudio/llms-engine@${engineVersion}`;
-    deps.ajv = deps.ajv || '^8.17.1';
-    deps.zod = deps.zod || '^3.23.8';
-
-    mutated.dependencies = deps;
   }
   fs.writeFileSync(pkgPath, JSON.stringify(mutated, null, 2));
 

package/scripts/publish-rcc.mjs

@@ -6,98 +6,76 @@ import { fileURLToPath } from 'node:url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PROJECT_ROOT = path.resolve(__dirname, '..');
-const PACK_SCRIPT = path.join(PROJECT_ROOT, 'scripts', 'pack-mode.mjs');
 const pkgPath = path.join(PROJECT_ROOT, 'package.json');
-const llmsPath = path.join(PROJECT_ROOT, 'node_modules', '@jsonstudio', 'llms');
-const localLlmsPkgPath = path.join(PROJECT_ROOT, 'sharedmodule', 'llmswitch-core', 'package.json');
 
 function parseArgs(argv) {
-  const out = {};
+  const out = { passthrough: [] };
   for (let i = 2; i < argv.length; i++) {
     const a = argv[i];
     if (a === '--llms-tgz') { out.llmsTgz = argv[++i]; continue; }
     if (a === '--llms-version') { out.llmsVersion = argv[++i]; continue; }
+    if (a === '--tag') { out.tag = argv[++i]; continue; }
+    if (a === '--dry-run') { out.dryRun = true; continue; }
+    out.passthrough.push(a);
   }
   return out;
 }
 
-function exists(p) {
-  try {
-    fs.accessSync(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 function run(command, args, options = {}) {
-  const res = spawnSync(command, args, { stdio: 'inherit', ...options });
+  const res = spawnSync(command, args, { stdio: 'inherit', cwd: PROJECT_ROOT, ...options });
   if ((res.status ?? 0) !== 0) {
     throw new Error(`${command} ${args.join(' ')} failed`);
   }
 }
 
+function readPkgVersion() {
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+  return String(pkg.version || '').trim();
+}
+
 try {
   const args = parseArgs(process.argv);
-  const llmsTgz = String(args.llmsTgz || process.env.RCC_LLMS_TGZ || '').trim();
-  const llmsVersion = String(
-    args.llmsVersion ||
-    process.env.RCC_LLMS_VERSION ||
-    (exists(localLlmsPkgPath) ? JSON.parse(fs.readFileSync(localLlmsPkgPath, 'utf-8')).version : '')
-  ).trim();
 
-  const hadDevLink = (() => {
-    try {
-      return fs.lstatSync(llmsPath).isSymbolicLink();
-    } catch {
-      return false;
-    }
-  })();
+  // 始终内联本地 llms，避免发布流程改动全局 llms link。
+  const env = {
+    ...process.env,
+    RCC_LLMS_INLINE_LOCAL: process.env.RCC_LLMS_INLINE_LOCAL ?? '1'
+  };
 
-  if (llmsTgz) {
-    if (!exists(llmsTgz)) {
-      throw new Error(`--llms-tgz not found: ${llmsTgz}`);
-    }
-    if (hadDevLink) {
-      run(process.execPath, [path.join(PROJECT_ROOT, 'scripts', 'link-llmswitch.mjs'), 'unlink'], { cwd: PROJECT_ROOT });
-    }
-    run('npm', ['install', '--no-audit', '--no-fund', '--no-save', llmsTgz], { cwd: PROJECT_ROOT });
+  const packArgs = ['run', 'pack:rcc', '--'];
+  if (args.llmsTgz) {
+    packArgs.push('--llms-tgz', String(args.llmsTgz));
+  }
+  if (args.llmsVersion) {
+    packArgs.push('--llms-version', String(args.llmsVersion));
   }
 
-  // 1) 使用 release 模式构建 dist。若存在本地 sharedmodule/llmswitch-core，则 release 也以其为唯一真源。
-  run('npm', ['run', 'build:min'], {
-    cwd: PROJECT_ROOT,
-    env: { ...process.env, BUILD_MODE: 'release', ...(llmsVersion ? { RCC_LLMS_VERSION: llmsVersion } : {}) }
-  });
+  run('npm', packArgs, { env });
 
-  // 2) 通过 pack-mode 生成 rcc tarball（内部会临时切换 package.json.name/bin，并同步 llms 版本声明）
-  run(
-    process.execPath,
-    [PACK_SCRIPT, '--name', '@jsonstudio/rcc', '--bin', 'rcc'],
-    { cwd: PROJECT_ROOT, env: { ...process.env, ...(llmsVersion ? { RCC_LLMS_VERSION: llmsVersion } : {}) } }
-  );
+  const version = readPkgVersion();
+  if (!version) {
+    throw new Error('failed to read version from package.json after pack:rcc');
+  }
 
-  // 构建过程中版本号可能被 bump（gen-build-info 会 auto-bump），因此需要在 pack 之后重新读取版本号
-  const updatedPkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
-  const version = updatedPkg.version;
   const tarballName = `jsonstudio-rcc-${version}.tgz`;
   const tarballPath = path.join(PROJECT_ROOT, tarballName);
-
   if (!fs.existsSync(tarballPath)) {
     throw new Error(`tarball not found: ${tarballPath}`);
   }
 
-  // 3) 发布 npm 包
-  run('npm', ['publish', tarballName], { cwd: PROJECT_ROOT });
-
-  // 4) 发布结束后恢复 dev 模式（routecodex 约定始终为 dev CLI；rcc 发布时才切 release）。
-  if (hadDevLink) {
-    run('npm', ['run', 'llmswitch:ensure'], {
-      cwd: PROJECT_ROOT,
-      env: { ...process.env, BUILD_MODE: 'dev' }
-    });
+  const publishArgs = ['publish', tarballName];
+  if (args.tag) {
+    publishArgs.push('--tag', String(args.tag));
   }
+  if (args.dryRun) {
+    publishArgs.push('--dry-run');
+  }
+  if (args.passthrough.length > 0) {
+    publishArgs.push(...args.passthrough);
+  }
+
+  run('npm', publishArgs);
 } catch (err) {
-  console.error('[publish-rcc] failed:', err.message);
+  console.error('[publish-rcc] failed:', err instanceof Error ? err.message : String(err));
   process.exit(1);
 }