@lqc123qwe/car-runtime 1.13.0 → 1.14.0

package/src/load/pool.ts

@@ -0,0 +1,339 @@
+/**
+ * 1.14-S4 · K-POOL-1 模型池网关（D-42：登记 + health 探测 + fallback 链 + retry 策略 + routing/decide 落链）
+ *
+ * 口径：
+ *  - 候选序 = priority 升序（缺省 0）→ weight 降序（缺省 0；D-42：weight 仅作排序 tie-break，
+ *    不做负载均衡调度）→ 登记序（稳定排序）；
+ *  - health 预检（doctor 面同款口径——值不打印）：GET {baseUrl}/models（openai）/
+ *    {baseUrl}/v1/models（anthropic）；**任意 HTTP 状态码 = 传输可达（健康）**——404/401 ≠ 不健康
+ *    （真实连通性以发消息为准，doctor 先例）；网络层失败/超时 = 不健康（按序跳过，fail-visible
+ *    落 routing/decide attempts）；结果 TTL 缓存（防死主端点每请求烧重试预算）；probeImpl 测试注入缝；
+ *  - fallback 链 = **首块前失败才可降级**（已消费 chunk 不可重放——llm.ts §3.5.4 同红线）：
+ *    成员请求抛错（网络/429/5xx 重试耗尽/凭据缺失）或首 chunk 即 error chunk（4xx 业务错，零内容
+ *    消费）→ 按序降级下一候选；流中途失败 = error chunk 原样收口不降级；
+ *  - retry 策略 = 成员级重试（§3.5.4 基线，装配层透传）+ 池级 maxAttempts 候选请求尝试上限
+ *    （缺省 = 端点数；耗尽 = providerUnreachable B080001——runTurn 以 error 收口）；
+ *  - **routing/decide 审计事件**：每次决策一条（payload.type='decide'：selected/reason/retries/
+ *    attempts）——onDecide 回调由宿主接线 SessionLog.append（事件链只追加红线；禁静默换模型）；
+ *    retries = 发起请求且失败的候选数（健康跳过不计，attempts 全量在册）；
+ *  - 成员请求 req.model/maxTokens 按成员改写（成员适配器消费自身 model——usage 按成员模型落账）；
+ *  - 无池配置 = 行为与 1.13 逐字节一致（兼容验收线——池路由零介入）；
+ *  - 明文凭据红线：成员凭据仅收 keyEnv env 变量名引用（config schema 明文键显式拒绝，CR-05）。
+ */
+import { request as httpRequest } from 'node:http'
+import { request as httpsRequest } from 'node:https'
+import type { ModelPoolConfig } from './config.ts'
+import { createAnthropicAdapter, createOpenAICompatAdapter } from '../runtime-core/llm.ts'
+import { CredentialService } from '../runtime-core/credentials.ts'
+import { providerUnreachable } from '../runtime-core/errors.ts'
+import type { LlmAdapter, LlmChunk, LlmRequest } from '../runtime-core/types.ts'
+
+/** 池成员（解析后形态——id 缺省已派生；候选序已定） */
+export interface PoolMember {
+  id: string
+  baseUrl: string
+  model: string
+  adapterId: 'openai-compat' | 'anthropic'
+  keyEnv?: string
+  maxTokens?: number
+  priority?: number
+  weight?: number
+}
+
+/** 候选序：priority 升序（缺省 0）→ weight 降序（缺省 0，D-42 tie-break）→ 登记序（稳定） */
+export function orderPoolMembers(members: PoolMember[]): PoolMember[] {
+  return members
+    .map((m, i) => ({ m, i }))
+    .sort((a, b) => (a.m.priority ?? 0) - (b.m.priority ?? 0) || (b.m.weight ?? 0) - (a.m.weight ?? 0) || a.i - b.i)
+    .map(x => x.m)
+}
+
+/** config modelPool → 池成员（id 缺省 ep-1..N 派生；重复 id 显式拒绝；候选序就位） */
+export function resolveModelPoolMembers(pool: ModelPoolConfig): { members: PoolMember[]; error?: string } {
+  const seen = new Set<string>()
+  const members: PoolMember[] = []
+  for (const [i, ep] of pool.endpoints.entries()) {
+    const id = ep.id ?? `ep-${i + 1}`
+    if (seen.has(id)) {
+      return { members: [], error: `CAR-E-CONFIG: 模型池端点 id "${id}" 重复（routing/decide 落链定位歧义禁入）` }
+    }
+    seen.add(id)
+    members.push({
+      id,
+      baseUrl: ep.baseUrl,
+      model: ep.model,
+      adapterId: ep.adapterId ?? 'openai-compat',
+      ...(ep.keyEnv !== undefined ? { keyEnv: ep.keyEnv } : {}),
+      ...(ep.maxTokens !== undefined ? { maxTokens: ep.maxTokens } : {}),
+      ...(ep.priority !== undefined ? { priority: ep.priority } : {}),
+      ...(ep.weight !== undefined ? { weight: ep.weight } : {}),
+    })
+  }
+  return { members: orderPoolMembers(members) }
+}
+
+// ==================== health 预检（doctor 面同款口径） ====================
+
+export interface PoolMemberHealth {
+  /** 传输可达（任意 HTTP 状态码）= true；网络层失败/超时 = false */
+  ok: boolean
+  status?: number
+  latencyMs: number
+  /** 不健康原因类别（值不打印纪律——只出类别） */
+  errorCategory?: string
+}
+
+/** node:http(s) GET 状态码（1.8-BUG-1 出站通道口径——全局 fetch/undici win32 退出断言预防） */
+function httpGetStatus(url: string, signal: AbortSignal): Promise<number> {
+  return new Promise((resolve, reject) => {
+    try {
+      const u = new URL(url)
+      const mod = u.protocol === 'https:' ? httpsRequest : httpRequest
+      const req = mod(u, { method: 'GET', headers: { accept: 'application/json' } }, res => {
+        res.resume() // 排干 body——连接收口
+        resolve(res.statusCode ?? 0)
+      })
+      const onAbort = () => { try { req.destroy(new Error('aborted')) } catch { /* 已完成 */ } }
+      if (signal.aborted) onAbort()
+      else signal.addEventListener('abort', onAbort, { once: true })
+      req.on('error', reject)
+      req.end()
+    } catch (e) { reject(e) }
+  })
+}
+
+/** 单端点 health 探测（doctor/池预检复用；值不打印——只出状态/延迟/类别） */
+export async function probePoolMember(
+  member: Pick<PoolMember, 'baseUrl' | 'adapterId'>,
+  opts: { timeoutMs?: number } = {},
+): Promise<PoolMemberHealth> {
+  const base = member.baseUrl.replace(/\/+$/, '')
+  const url = member.adapterId === 'anthropic' ? `${base}/v1/models` : `${base}/models`
+  const t0 = Date.now()
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 4000)
+  try {
+    const status = await httpGetStatus(url, controller.signal)
+    return { ok: true, status, latencyMs: Date.now() - t0 }
+  } catch (e) {
+    const aborted = (e as Error).name === 'AbortError' || String((e as Error).message).includes('aborted')
+    return { ok: false, latencyMs: Date.now() - t0, errorCategory: aborted ? 'timeout' : 'network-error' }
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+// ==================== 路由引擎（fallback 链 + retry 上限 + routing/decide） ====================
+
+/** 逐候选结果（attempts 全量在册——健康跳过与请求失败都显性化） */
+export interface RoutingAttempt {
+  id: string
+  outcome: 'selected' | 'failed' | 'skipped-unhealthy'
+  /** 失败/跳过类别（错误码/名称，值不打印） */
+  detail?: string
+}
+
+/** 路由决策（routing/decide 事件 payload 源——每次请求一条） */
+export interface RoutingDecision {
+  /** 选中端点 id（耗尽 = null） */
+  selected: string | null
+  /** 首位候选选中 = primary；降级选中 = fallback；全部不可用 = exhausted */
+  reason: 'primary' | 'fallback' | 'exhausted'
+  /** 降级重试次数 = 发起请求且失败的候选数（健康跳过不计——attempts 全量在册） */
+  retries: number
+  attempts: RoutingAttempt[]
+  turnId?: string
+  sessionId?: string
+}
+
+export interface PoolAdapterOptions {
+  id?: string
+  /** 成员与适配器（装配层产出的候选序） */
+  members: Array<{ member: PoolMember; adapter: LlmAdapter }>
+  /** health 预检（enabled 缺省 true；probeImpl 测试注入缝——缺省真实 GET 探测） */
+  probe?: { enabled?: boolean; timeoutMs?: number; ttlMs?: number; probeImpl?: typeof probePoolMember }
+  /** 候选请求尝试上限（缺省 = 成员数） */
+  maxAttempts?: number
+  /** routing/decide 审计回调（宿主接线 SessionLog.append——禁静默换模型红线） */
+  onDecide?: (d: RoutingDecision) => void
+}
+
+const errorCategory = (e: unknown): string => {
+  const err = e as { slug?: string; name?: string }
+  return err.slug ?? err.name ?? 'unknown'
+}
+
+export function createModelPoolAdapter(opts: PoolAdapterOptions): LlmAdapter & { id: string; members: PoolMember[] } {
+  const ordered = opts.members
+  const maxAttempts = opts.maxAttempts ?? ordered.length
+  const probeEnabled = opts.probe?.enabled !== false
+  const probeFn = opts.probe?.probeImpl ?? probePoolMember
+  const probeTimeoutMs = opts.probe?.timeoutMs ?? 4000
+  const ttlMs = opts.probe?.ttlMs ?? 30_000
+  const healthCache = new Map<string, { ok: boolean; at: number; category?: string }>()
+  const id = opts.id ?? 'model-pool'
+
+  const healthOf = async (m: PoolMember): Promise<{ ok: boolean; category?: string }> => {
+    const hit = healthCache.get(m.id)
+    if (hit && Date.now() - hit.at < ttlMs) {
+      return { ok: hit.ok, ...(hit.category !== undefined ? { category: hit.category } : {}) }
+    }
+    const h = await probeFn(m, { timeoutMs: probeTimeoutMs })
+    const entry = { ok: h.ok, at: Date.now(), ...(h.errorCategory !== undefined ? { category: h.errorCategory } : {}) }
+    healthCache.set(m.id, entry)
+    return { ok: entry.ok, ...(entry.category !== undefined ? { category: entry.category } : {}) }
+  }
+
+  const withMeta = (d: Omit<RoutingDecision, 'turnId' | 'sessionId'>, req: LlmRequest): RoutingDecision => ({
+    ...d,
+    ...(req.metadata?.turnId !== undefined ? { turnId: req.metadata.turnId } : {}),
+    ...(req.metadata?.sessionId !== undefined ? { sessionId: req.metadata.sessionId } : {}),
+  })
+
+  return {
+    id,
+    members: ordered.map(x => x.member),
+    chat(req: LlmRequest): AsyncIterable<LlmChunk> {
+      return (async function* () {
+        const attempts: RoutingAttempt[] = []
+        let failedCount = 0
+        let requestAttempts = 0
+        for (const [pos, entry] of ordered.entries()) {
+          if (requestAttempts >= maxAttempts) break
+          if (probeEnabled) {
+            const h = await healthOf(entry.member)
+            if (!h.ok) {
+              attempts.push({ id: entry.member.id, outcome: 'skipped-unhealthy', ...(h.category !== undefined ? { detail: h.category } : {}) })
+              continue
+            }
+          }
+          requestAttempts++
+          // 成员请求：req.model/maxTokens 按成员改写（usage 按成员模型落账）
+          let it: AsyncIterator<LlmChunk>
+          try {
+            it = entry.adapter.chat({
+              ...req,
+              model: entry.member.model,
+              ...(entry.member.maxTokens != null ? { maxTokens: entry.member.maxTokens } : {}),
+            })[Symbol.asyncIterator]()
+          } catch (e) {
+            // 适配器同步抛错（契约违规/装配错误）= 候选不可用，降级下一候选
+            attempts.push({ id: entry.member.id, outcome: 'failed', detail: errorCategory(e) })
+            failedCount++
+            continue
+          }
+          try {
+            let first: IteratorResult<LlmChunk>
+            try {
+              first = await it.next()
+            } catch (e) {
+              // 首块前失败（网络/429/5xx 重试耗尽/凭据缺失）→ 降级下一候选
+              attempts.push({ id: entry.member.id, outcome: 'failed', detail: errorCategory(e) })
+              failedCount++
+              continue
+            }
+            if (first.done || !first.value) {
+              attempts.push({ id: entry.member.id, outcome: 'failed', detail: 'empty-stream' })
+              failedCount++
+              continue
+            }
+            const fc = first.value
+            // 首 chunk 即 error chunk 且零内容消费（4xx 业务错）→ 候选不可用，降级（零 chunk 已出——可重放安全）
+            const errorOnly = fc.finishReason === 'error' && fc.delta === undefined && fc.toolCallDelta === undefined
+            if (errorOnly) {
+              attempts.push({ id: entry.member.id, outcome: 'failed', detail: fc.error ? 'http-4xx' : 'error-chunk' })
+              failedCount++
+              continue
+            }
+            // 选中：routing/decide 落链（禁静默换模型——选中端点/原因/重试次数显性化）
+            attempts.push({ id: entry.member.id, outcome: 'selected' })
+            opts.onDecide?.(withMeta({
+              selected: entry.member.id,
+              reason: pos === 0 ? 'primary' : 'fallback',
+              retries: failedCount,
+              attempts,
+            }, req))
+            yield fc
+            while (true) {
+              const r = await it.next()
+              if (r.done) break
+              yield r.value // 流中途失败 = error chunk 原样收口（已消费 chunk 不可重放——不降级）
+            }
+            return
+          } finally {
+            // 成员迭代器收口（首 chunk 后未耗尽路径——4xx 降级/取消/异常；自然结束路径 no-op）
+            await it.return?.(undefined)
+          }
+        }
+        // 耗尽：决策落链 + B080001（runTurn error 收口——BD-04）
+        opts.onDecide?.(withMeta({ selected: null, reason: 'exhausted', retries: failedCount, attempts }, req))
+        const summary = attempts.map(a => `${a.id}:${a.outcome}${a.detail ? `(${a.detail})` : ''}`).join(', ') || '无候选'
+        throw providerUnreachable(`模型池全部候选不可用（${summary}）`)
+      })()
+    },
+  }
+}
+
+// ==================== 池装配层（config → 成员适配器 → 路由适配器） ====================
+
+export interface ModelPoolAssemblyOptions {
+  pool: ModelPoolConfig
+  /** 共享凭据服务（成员级 keyEnv 经 credentialEnvVars 精确候选） */
+  credentials?: CredentialService
+  /** 测试注入（成员适配器 fetch/退避——缺省真实通道） */
+  fetchImpl?: typeof fetch
+  timeoutMs?: number
+  firstByteMs?: number
+  retries?: number
+  backoffMs?: number[]
+  sleep?: (ms: number) => Promise<void>
+  /** routing/decide 审计回调（透传路由引擎） */
+  onDecide?: (d: RoutingDecision) => void
+}
+
+/** 池装配：config 解析（候选序/重复拒绝）→ 成员适配器（内置两族 + keyEnv）→ 路由适配器 */
+export function assembleModelPool(opts: ModelPoolAssemblyOptions): {
+  adapter: LlmAdapter & { id: string; members: PoolMember[] }
+  members: PoolMember[]
+} {
+  const { members, error } = resolveModelPoolMembers(opts.pool)
+  if (error) throw new Error(error)
+  const entries = members.map(m => ({
+    member: m,
+    adapter: (m.adapterId === 'anthropic'
+      ? createAnthropicAdapter({
+          baseUrl: m.baseUrl,
+          credentials: opts.credentials,
+          ...(m.keyEnv !== undefined ? { credentialEnvVars: [m.keyEnv] } : {}),
+          ...(opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}),
+          ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),
+          ...(opts.firstByteMs !== undefined ? { firstByteMs: opts.firstByteMs } : {}),
+          ...(opts.retries !== undefined ? { retries: opts.retries } : {}),
+          ...(opts.backoffMs !== undefined ? { backoffMs: opts.backoffMs } : {}),
+          ...(opts.sleep ? { sleep: opts.sleep } : {}),
+        })
+      : createOpenAICompatAdapter({
+          baseUrl: m.baseUrl,
+          credentials: opts.credentials,
+          provider: 'openai-compat',
+          ...(m.keyEnv !== undefined ? { credentialEnvVars: [m.keyEnv] } : {}),
+          ...(opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}),
+          ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),
+          ...(opts.firstByteMs !== undefined ? { firstByteMs: opts.firstByteMs } : {}),
+          ...(opts.retries !== undefined ? { retries: opts.retries } : {}),
+          ...(opts.backoffMs !== undefined ? { backoffMs: opts.backoffMs } : {}),
+          ...(opts.sleep ? { sleep: opts.sleep } : {}),
+        })),
+  }))
+  const adapter = createModelPoolAdapter({
+    members: entries,
+    probe: {
+      ...(opts.pool.probe?.enabled !== undefined ? { enabled: opts.pool.probe.enabled } : {}),
+      ...(opts.pool.probe?.timeoutMs !== undefined ? { timeoutMs: opts.pool.probe.timeoutMs } : {}),
+      ...(opts.pool.probe?.ttlMs !== undefined ? { ttlMs: opts.pool.probe.ttlMs } : {}),
+    },
+    ...(opts.pool.maxAttempts !== undefined ? { maxAttempts: opts.pool.maxAttempts } : {}),
+    ...(opts.onDecide ? { onDecide: opts.onDecide } : {}),
+  })
+  return { adapter, members }
+}

package/src/loop/stop.ts

@@ -72,12 +72,13 @@ export class TurnAborted extends Error {
  * 在 JSONL，聚合由事实行求和而非运行时状态；字段非数值容错跳过不吞计数）。无 usage 事件
  * 返回 undefined → turnEnd meta 不带 usage 键（缺省=未采集，旧格式向后兼容）。
  */
-function turnUsageFrom(log: SessionLog, turnId: string): { input: number; output: number; cacheRead: number; cacheCreation: number; requests: number } | undefined {
+function turnUsageFrom(log: SessionLog, turnId: string): { input: number; output: number; cacheRead: number; cacheCreation: number; requests: number; segments?: { reasoningTokens: number } } | undefined {
   let input = 0
   let output = 0
   let cacheRead = 0
   let cacheCreation = 0
   let requests = 0
+  let reasoning: number | undefined
   for (const e of log.events) {
     if (e.kind !== 'usage' || e.turnId !== turnId) continue
     const p = (e.payload ?? {}) as Record<string, unknown>
@@ -85,9 +86,14 @@ function turnUsageFrom(log: SessionLog, turnId: string): { input: number; output
     if (typeof p.output === 'number') output += p.output
     if (typeof p.cacheRead === 'number') cacheRead += p.cacheRead
     if (typeof p.cacheCreation === 'number') cacheCreation += p.cacheCreation
+    // 1.14-S3（K-MP-2b / D-41）：分段聚合——任一请求携带 segments.reasoningTokens 即求和；
+    // 全 turn 无分段事实 = meta.usage 不带 segments 键（禁估算补造）
+    const seg = (p.segments ?? null) as { reasoningTokens?: unknown } | null
+    if (seg && typeof seg.reasoningTokens === 'number') reasoning = (reasoning ?? 0) + seg.reasoningTokens
     requests++
   }
-  return requests ? { input, output, cacheRead, cacheCreation, requests } : undefined
+  if (!requests) return undefined
+  return { input, output, cacheRead, cacheCreation, requests, ...(reasoning !== undefined ? { segments: { reasoningTokens: reasoning } } : {}) }
 }
 
 export async function runTurn(opts: {

package/src/runtime-core/chatStep.ts

@@ -117,6 +117,8 @@ export async function chatStep(opts: ChatStepOptions): Promise<ChatStepResult> {
       output: usage.outputTokens,
       cacheRead: usage.cacheReadTokens,
       cacheCreation: usage.cacheCreationTokens,
+      // 1.14-S3（K-MP-2b / D-41）：分段事实随事件落链——无分段 = 不带键（禁估算）
+      ...(usage.segments ? { segments: usage.segments } : {}),
       providerRaw: usage.providerRaw,
     })
   }

package/src/runtime-core/credentials.ts

@@ -28,6 +28,8 @@ export interface CredentialResolveOptions {
   keychainReader?: (service: string) => string | null
   /** reveal 审计回调（值不入参——审计全量留痕但零明文） */
   audit?: (event: { action: 'resolve' | 'reveal'; provider: string; source: CredentialSource; origin: string }) => void
+  /** 1.14-S4（K-POOL-1）：显式 env 变量候选（modelPool keyEnv 精确引用——替代 provider 缺省表；keychain 链保持在前） */
+  envVarCandidates?: string[]
 }
 
 /** provider → 候选 env 变量（按序检索；CAR_LLM_API_KEY 为通用兜底） */
@@ -107,7 +109,8 @@ export class CredentialService {
 
     const allowEnv = opts.allowEnvFallback === true || env.CAR_ALLOW_ENV_CREDENTIALS === '1'
     if (allowEnv) {
-      const candidates = providerEnvVars(provider)
+      // 1.14-S4（K-POOL-1）：显式候选（keyEnv 精确引用）压过 provider 缺省表——用户点名变量即显式意见
+      const candidates = opts.envVarCandidates?.length ? opts.envVarCandidates : providerEnvVars(provider)
       for (const name of candidates) {
         searched.push(`env:${name}`)
         if (env[name]) {

package/src/runtime-core/llm.ts

@@ -25,6 +25,11 @@
  *    解析「先摘 evt.usage 再判 choice」（空 choices 尾包不再被吞）；anthropic message_start（input 侧）
  *    + message_delta（output 侧）两包合并（message_delta 缺席 = output 不完整，整条不落）；
  *    归一口径 §1.1（openai 减法 / anthropic 透传 + cache_creation），畸形/缺失整条不落（禁补造）。
+ *  - 1.14-S1（K-MP-1 / D-39）：思考参数透传——LlmRequest.reasoning.effort 按家族映射：
+ *    openai-compat = `reasoning_effort`；anthropic = `thinking:{type:'enabled',budget_tokens}`
+ *    （ANTHROPIC_THINKING_BUDGET 表）；**off / 缺席 = 字节面不下发**；未知 effort 值显式报错
+ *    （CAR-E-LLM-REASONING，fail-visible 禁静默忽略——宿主越型传入防线）；anthropic 侧
+ *    budget ≥ max_tokens 违反 API 约束 → 显式报错提示调高（禁静默改写 max_tokens）。
  */
 import { CarM8Error, providerUnreachable } from './errors.ts'
 import { CredentialService } from './credentials.ts'
@@ -72,6 +77,22 @@ export class AdapterRegistry {
   }
 }
 
+// ==================== 1.14-S1（K-MP-1 / D-39）思考参数映射 ====================
+
+/** 归一思考档位：缺席/off → undefined（不下发）；low/medium/high 原样；未知值 fail-visible（宿主越型传入防线） */
+export function normalizeReasoningEffort(effort: unknown): 'off' | 'low' | 'medium' | 'high' | undefined {
+  if (effort === undefined || effort === null) return undefined
+  if (effort === 'off' || effort === 'low' || effort === 'medium' || effort === 'high') return effort
+  throw new Error(`CAR-E-LLM-REASONING: 未知思考档位 "${String(effort)}"（合法：off/low/medium/high；off/缺席 = 不下发）`)
+}
+
+/** anthropic effort → thinking.budget_tokens 映射（D-39 登记表）；off/缺席不下发 */
+const ANTHROPIC_THINKING_BUDGET: Record<'low' | 'medium' | 'high', number> = {
+  low: 2048,
+  medium: 8192,
+  high: 16384,
+}
+
 // ==================== finishReason 不可变守卫（SDK 边界） ====================
 
 /** 首个 finishReason 定格；适配器后续给出不同值 = 契约违规显式抛错（不改写不吞没） */
@@ -264,6 +285,8 @@ export interface OpenAICompatOptions {
   /** 凭据服务与 provider 名（Bearer token 来源） */
   credentials?: CredentialService
   provider?: string
+  /** 1.14-S4（K-POOL-1）：成员级凭据 env 变量名引用（modelPool keyEnv——resolve 精确候选；keychain 链保持在前） */
+  credentialEnvVars?: string[]
   fetchImpl?: typeof fetch
   /** §3.5.4 基线：总 120s / 首字节 30s / 2 次退避 1s-2s（测试可注入缩短） */
   timeoutMs?: number
@@ -288,6 +311,9 @@ class Retryable extends Error {}
  * 1.11-S1（D-33 / 计量设计 §1.1）：openai usage 归一——prompt_tokens 含 cached，inputTokens
  * 必须做减法（prompt − prompt_tokens_details.cached_tokens）；cache_creation 恒 0（无对应字段，
  * 登记不估算）。usage 对象缺席/畸形（两侧主字段任一非数值）= 整条不落（缺失口径，禁补造）。
+ * 1.14-S3（K-MP-2b / D-41）：分段计量——completion_tokens_details.reasoning_tokens（思考输出
+ * 细分，provider 真实事实）数值才采（segments.reasoningTokens）；details/字段缺席或非数值 =
+ * segments 不带键（禁估算补造）。
  */
 function normalizeOpenAIUsage(u: unknown, model: string, adapterId: string): LlmUsage | undefined {
   if (!u || typeof u !== 'object') return undefined
@@ -295,6 +321,8 @@ function normalizeOpenAIUsage(u: unknown, model: string, adapterId: string): Llm
   if (typeof r.prompt_tokens !== 'number' || typeof r.completion_tokens !== 'number') return undefined
   const details = (r.prompt_tokens_details ?? null) as Record<string, unknown> | null
   const cached = details && typeof details.cached_tokens === 'number' ? details.cached_tokens : 0
+  const compDetails = (r.completion_tokens_details ?? null) as Record<string, unknown> | null
+  const reasoning = compDetails && typeof compDetails.reasoning_tokens === 'number' ? compDetails.reasoning_tokens : undefined
   return {
     inputTokens: r.prompt_tokens - cached,
     outputTokens: r.completion_tokens,
@@ -303,6 +331,7 @@ function normalizeOpenAIUsage(u: unknown, model: string, adapterId: string): Llm
     model,
     adapterId,
     providerRaw: u,
+    ...(reasoning !== undefined ? { segments: { reasoningTokens: reasoning } } : {}),
   }
 }
 
@@ -394,6 +423,10 @@ export function createOpenAICompatAdapter(opts: OpenAICompatOptions): LlmAdapter
   const firstByteMs = opts.firstByteMs ?? 30_000
   const retries = opts.retries ?? 2
   const backoffMs = opts.backoffMs ?? [1_000, 2_000]
+  // 1.14-S4（K-POOL-1）：成员级 keyEnv 精确候选——keyEnv 引用即显式意见（env 通道开启；候选=仅该变量，keychain 链保持在前）
+  const credResolveOpts = opts.credentialEnvVars?.length
+    ? { envVarCandidates: opts.credentialEnvVars, allowEnvFallback: true }
+    : {}
 
   const toOpenAI = (req: LlmRequest, apiKey: string) => ({
     // 1.4-BUG-1：method: 'POST' 缺失——M8 最小实现潜伏缺陷（注入式 fetch 的单测忽略 method，
@@ -406,6 +439,11 @@ export function createOpenAICompatAdapter(opts: OpenAICompatOptions): LlmAdapter
     body: JSON.stringify({
       model: req.model,
       stream: true,
+      // 1.14-S1（K-MP-1 / D-39）：思考参数——effort 非 off/缺席才下发 reasoning_effort（off = 字节面零痕迹）
+      ...(normalizeReasoningEffort(req.reasoning?.effort) !== undefined &&
+        normalizeReasoningEffort(req.reasoning?.effort) !== 'off'
+        ? { reasoning_effort: normalizeReasoningEffort(req.reasoning?.effort) }
+        : {}),
       // 1.11-S1（D-33 / 计量设计 §9-2 推荐A）：usage 采集默认开启；第三方网关不兼容时的
       // 回退方案（baseUrl 白名单）登记可回退项——不支持网关走缺失口径（禁估算补造）
       stream_options: { include_usage: true },
@@ -439,7 +477,7 @@ export function createOpenAICompatAdapter(opts: OpenAICompatOptions): LlmAdapter
         buildRequest: async () => {
           let apiKey = ''
           if (opts.credentials) {
-            const ref = opts.credentials.resolve(opts.provider ?? id, {})
+            const ref = opts.credentials.resolve(opts.provider ?? id, credResolveOpts)
             apiKey = opts.credentials.reveal(ref, {})
           }
           return toOpenAI(req, apiKey)
@@ -470,6 +508,8 @@ export interface AnthropicAdapterOptions {
   sleep?: (ms: number) => Promise<void>
   /** D-20：Anthropic API max_tokens 必填——req.maxTokens 缺席时取此缺省（provider 差异登记，缺省 4096） */
   defaultMaxTokens?: number
+  /** 1.14-S4（K-POOL-1）：成员级凭据 env 变量名引用（modelPool keyEnv——resolve 精确候选；keychain 链保持在前） */
+  credentialEnvVars?: string[]
 }
 
 /** stop_reason → CAR finishReason（未映射 fail-visible——openai FINISH_MAP 同纪律） */
@@ -495,6 +535,8 @@ function mergeAnthropicUsage(
 ): LlmUsage | undefined {
   if (!start || !delta) return undefined
   if (typeof start.input_tokens !== 'number' || typeof delta.output_tokens !== 'number') return undefined
+  // 1.14-S3（K-MP-2b / D-41）：anthropic 无输出细分事实（thinking 计入 output_tokens）→
+  // segments 不带键（禁估算补造——桌面色条退化单色，登记口径）
   return {
     inputTokens: start.input_tokens,
     outputTokens: delta.output_tokens,
@@ -545,6 +587,15 @@ function toAnthropic(req: LlmRequest, apiKey: string) {
     }
   }
   flushToolResults()
+  // 1.14-S1（K-MP-1 / D-39）：思考参数——effort → thinking.budget_tokens（ANTHROPIC_THINKING_BUDGET 表）；
+  // off/缺席不下发；budget ≥ max_tokens 违反 Messages API 约束（max_tokens 必须大于 budget_tokens）→
+  // 显式报错提示调高（fail-visible，禁静默改写 max_tokens）
+  const reasoningEffort = normalizeReasoningEffort(req.reasoning?.effort)
+  const thinkingBudget = reasoningEffort && reasoningEffort !== 'off' ? ANTHROPIC_THINKING_BUDGET[reasoningEffort] : undefined
+  const maxTokens = req.maxTokens ?? 4096
+  if (thinkingBudget !== undefined && thinkingBudget >= maxTokens) {
+    throw new Error(`CAR-E-LLM-REASONING: thinking budget_tokens(${thinkingBudget}) 必须小于 max_tokens(${maxTokens})——请调高 maxTokens（禁静默改写请求参数）`)
+  }
   return {
     method: 'POST' as const,
     headers: {
@@ -555,7 +606,8 @@ function toAnthropic(req: LlmRequest, apiKey: string) {
     body: JSON.stringify({
       model: req.model,
       stream: true,
-      max_tokens: req.maxTokens ?? 4096,
+      max_tokens: maxTokens,
+      ...(thinkingBudget !== undefined ? { thinking: { type: 'enabled', budget_tokens: thinkingBudget } } : {}),
       ...(system.length ? { system: system.join('\n\n') } : {}),
       messages: turns,
       ...(req.tools.length
@@ -639,6 +691,10 @@ export function createAnthropicAdapter(opts: AnthropicAdapterOptions): LlmAdapte
   const firstByteMs = opts.firstByteMs ?? 30_000
   const retries = opts.retries ?? 2
   const backoffMs = opts.backoffMs ?? [1_000, 2_000]
+  // 1.14-S4（K-POOL-1）：成员级 keyEnv 精确候选（同 openai-compat 口径）
+  const credResolveOpts = opts.credentialEnvVars?.length
+    ? { envVarCandidates: opts.credentialEnvVars, allowEnvFallback: true }
+    : {}
 
   return {
     id,
@@ -650,7 +706,7 @@ export function createAnthropicAdapter(opts: AnthropicAdapterOptions): LlmAdapte
         buildRequest: async () => {
           let apiKey = ''
           if (opts.credentials) {
-            const ref = opts.credentials.resolve(opts.provider ?? id, {})
+            const ref = opts.credentials.resolve(opts.provider ?? id, credResolveOpts)
             apiKey = opts.credentials.reveal(ref, {})
           }
           return toAnthropic(req, apiKey)

package/src/runtime-core/types.ts

@@ -25,6 +25,10 @@ export interface LlmRequest {
   /** 1.4-S4（D-19）：turn 取消信号（runTurn 的 {aborted} 形态透传）——适配器在 attempt 前 /
    *  chunk 间隙检查；外部取消 ≠ 失败（不 retry、不产 error chunk，静默收口由 chatStep 抛 TurnAborted） */
   signal?: { aborted: boolean }
+  /** 1.14-S1（K-MP-1 / D-39）：思考参数——适配器按家族映射（openai-compat = reasoning_effort；
+   *  anthropic = thinking.budget_tokens）；**off / 缺席 = 不下发该字段**（字节面零痕迹，非「effort:none」）；
+   *  模型思考档位（模型级思考如 R1）为宿主侧模型元数据事实源（桌面 models:meta），内核不做档位判断 */
+  reasoning?: { effort: 'off' | 'low' | 'medium' | 'high' }
 }
 
 /** 工具调用流式增量（跨 chunk 聚合出完整 ToolCall） */
@@ -53,6 +57,13 @@ export interface LlmUsage {
   adapterId: string
   /** provider 原始 usage 对象（anthropic 为 messageStart/messageDelta 两原始片段） */
   providerRaw: unknown
+  /**
+   * 1.14-S3（K-MP-2b / D-41）：请求分段计量——仅采 provider 真实返回的分段事实（归一化后），
+   * **无分段事实 = 不带键（禁静态估算，桌面色条退化单色不造假）**。v1 分段 = reasoningTokens
+   * （openai completion_tokens_details.reasoning_tokens——K-MP-1 思考参数的计量配套，thinking
+   * 输出细分；anthropic thinking 计入 output_tokens 无细分事实 → 缺省不带键，登记）。
+   */
+  segments?: { reasoningTokens?: number }
 }
 
 /** 流式块（finishReason 一经产生不可被任何中间层改写） */

package/src/seam.ts

@@ -17,6 +17,11 @@
  *   只读载入面；载入/校验单一权威在内核，桌面禁自实现哈希重算）+ K-S3-3 exportForensicsBundle/verifyBundle 出面
  *   （取证包导出 + 读回重验；断链即中止语义随本面）。恢复面 K-S3-2 零登记确认：SessionLog.fromEvents 自 M5 DEC-4
  *   起已随本面可达（fork.ts 生产调用点），S2 D-S2-6 前提修正登记（S3 执行期发现）。
+ * 加法登记：1.14.0 —— PluginManager 装载报告面（K-S4-1 / D-43）：loadPlugins 出面（六阶段流水线
+ *   discover/verify/parse/validate/topo/register——LoadReportVO 结构化 VO，verify/topo 真值取代 v0.1 桌面
+ *   mountPlugin 组合呈现的 SKIPPED 标注）+ ReloadManager 出面（热重载 epoch 击穿 + invalidate 语义随本面）+
+ *   verifyPluginFile 出面（签名校验挂载点——宿主自有装载路径可复用同一签名门；minisign 轨唯一实装，sigstore
+ *   主轨维持 verifier 骨架期预留——D-43 裁决：登记 strict 期限不引入 sigstore 依赖，engines 硬不兼容见评估报告）。
  */
 export { SessionLog, loadSessionLog, deriveSessionId, type SessionEvent, type EventKind, type Actor } from './session/log.ts'
 export { SessionFileStore } from './session/store.ts'
@@ -42,3 +47,6 @@ export type { McpClientSpanHandle, PtcRelayHandle } from './runtime-core/trace.t
 // —— 1.13.0：桌面 S3 治理面（文件安全/审计/取证）——
 export { redact, type RedactionResult } from './runtime-core/redaction.ts'
 export { exportForensicsBundle, verifyBundle, type ForensicsBundle, type ExportMeta } from './session/export.ts'
+// —— 1.14.0（K-S4-1 / D-43）：PluginManager 装载报告面 + 签名校验挂载点 ——
+export { loadPlugins, ReloadManager, type LoadReportVO, type LoadPluginsResult, type LoadPluginsOptions, type LoadStage, type StageStatus, type PeerConflictChain } from './load/report.ts'
+export { verifyPluginFile, type SignatureGateOptions, type SigGateResult } from './load/sigGate.ts'