billion-context 0.1.132 → 0.1.133

package/README.md

@@ -810,6 +810,30 @@ The file auto-rotates at 10 MB (renamed to `bili.log.old`). Cache-hit stats
 per request are logged as `[acp-usage] round N input=X cached=Y (cache hit Z%)`
 so you can measure prefix-cache health directly from the log.
 
+### Chaining bili instances (bili → bili)
+
+When one bili's upstream is another bili (`client → A → B → LLM`), only the
+instance closest to the client should run the compression pipeline — a second
+pass would double-compress and corrupt session state. Any of three signals on
+the inbound request makes the downstream instance pass it through **verbatim**
+(no tool/tag injection, no acp-loop, no session state):
+
+- `x-bili-hop` — stamped with the processing instance's id on every processed
+  emission (#300). Clients never send this header, so its presence always means
+  "came from a bili".
+- `x-bili-sig` — sha256 digest of the exact emitted body bytes (#1078). Proves
+  no middlebox rewrote the request in transit; on mismatch the downstream
+  instance passes through anyway, because it must not process content it did
+  not produce.
+- ACP artifacts in the body (render tags / context-management tool names) —
+  fallback for relays that strip bili's headers.
+
+Every detection logs a prominent `[chain]` line (to `bili.log` and stderr)
+naming the signal that fired. Older versions that stamp only `x-bili-hop` keep
+working unchanged. If a third-party relay in your chain rewrites or strips
+request bodies/headers, a `[chain]` warning on the downstream instance is the
+safety mechanism working, not an error.
+
 ### Self-update
 
 The proxy checks npm for a newer version on startup and every 3 minutes. When a

package/README.zh-CN.md

@@ -402,6 +402,16 @@ bili --host 0.0.0.0           # 所有网卡(或直接用局域网 IP)
 
 文件超过 10 MB 自动轮转(重命名为 `bili.log.old`)。每个请求的缓存命中统计会以 `[acp-usage] round N input=X cached=Y (cache hit Z%)` 打印,可直接从日志衡量前缀缓存健康度。
 
+### 串联多个 bili(bili → bili)
+
+当一个 bili 的 upstream 指向另一个 bili(`客户端 → A → B → LLM`)时,只有离客户端最近的那个实例应该执行压缩管线——二次处理会重复压缩并破坏会话状态。入站请求上任意一个信号命中,下游实例都会**原样透传**该请求(不注入工具/标签、不跑 acp-loop、不建会话状态):
+
+- `x-bili-hop` —— 处理方实例在每次处理后的转发上盖自己的实例 id(#300)。客户端永远不会发这个头,所以它的出现一定意味着"来自某个 bili"。
+- `x-bili-sig` —— 转发体字节的 sha256 摘要(#1078)。用来证明请求在途中没有被中间设备改写;摘要不符时下游同样直接透传,因为它不能处理自己没有产出的内容。
+- 请求体中的 ACP 产物(render 标签 / 上下文管理工具名)—— 针对会剥掉 bili 请求头的中转站的兜底检测。
+
+每次命中都会在 `bili.log`(及 stderr)打一条醒目的 `[chain]` 日志,标明触发信号。只盖 `x-bili-hop` 的旧版本行为不变。如果你的链路里有第三方中转站会改写或剥离请求体/头,下游实例出现的 `[chain]` 警告是安全机制在工作,不是错误。
+
 ### 自动更新
 
 代理启动时和每 3 分钟检查 npm 是否有新版本。发现新版本就全局安装(`npm install -g`)并打印通知 —— **重启 `bili` 才能生效**。

package/dist/index.js

@@ -50569,7 +50569,7 @@ function rejectLegacyRoute(key, value) {
 import http from "http";
 import fs11 from "fs";
 import path18 from "path";
-import { createHash as createHash8, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash9, randomUUID as randomUUID4 } from "crypto";
 import { performance as performance2 } from "perf_hooks";
 
 // src/compress-settings.ts
@@ -70492,6 +70492,35 @@ function anthropicBetaContextWindow(headers) {
   return best;
 }
 
+// src/server/chain-sig.ts
+import { createHash as createHash8, timingSafeEqual } from "crypto";
+var BILI_SIG_HEADER = "x-bili-sig";
+var SIG_FORMAT = /^sha256:([0-9a-f]{64})$/;
+function sha256Hex(body) {
+  return createHash8("sha256").update(typeof body === "string" ? Buffer.from(body, "utf8") : body).digest("hex");
+}
+function stampChainSig(headers, body) {
+  headers[BILI_SIG_HEADER] = `sha256:${sha256Hex(body)}`;
+}
+function verifyChainSig(header, rawBody) {
+  if (header === void 0) return "absent";
+  const m2 = SIG_FORMAT.exec(header);
+  if (!m2) return "mismatch";
+  const expected = Buffer.from(m2[1], "hex");
+  const actual = createHash8("sha256").update(rawBody).digest();
+  return timingSafeEqual(expected, actual) ? "verified" : "mismatch";
+}
+var ACP_TAG_RE = /\x3cacp\s+tokens=\\?"[0-9]+(?:\.[0-9]+)?K?\\?"\s+type=\\?"[^\\"]*\\?"\s*\x3em[0-9]{1,8}\x3c\/acp\x3e/;
+function detectAcpArtifacts(body) {
+  if (body.length === 0) return false;
+  const tagSeed = body.includes("<acp ");
+  const toolSeed = body.includes('"acp_status"') && body.includes('"search_context"');
+  if (!tagSeed && !toolSeed) return false;
+  const text = body.toString("utf8");
+  if (tagSeed && ACP_TAG_RE.test(text)) return true;
+  return toolSeed;
+}
+
 // src/server/headers.ts
 function safeSessionId(id) {
   return (id ?? "unknown").replace(/[^a-zA-Z0-9._-]/g, "_");
@@ -71236,6 +71265,20 @@ async function handle(req, res, opts, core, config, log2, instanceId, instanceSt
     const selfLoop = hopMarker === instanceId;
     log2("warn", selfLoop ? `[chain] inbound request carries THIS instance's ${BILI_HOP_HEADER} marker (${hopMarker}) \u2014 self-loop detected. Passing through without processing; check your upstream config (it may point back to this instance).` : `[chain] inbound request carries ${BILI_HOP_HEADER} from another bili instance (${hopMarker}) \u2014 bili\u2192bili chain detected. Passing through without processing to avoid double compression; keep only one bili instance in the chain.`);
   }
+  const chainSig = headerValue2(req, BILI_SIG_HEADER);
+  const hasAcpArtifacts = hopMarker === void 0 && chainSig === void 0 && bodyBuffer.length > 0 && detectAcpArtifacts(bodyBuffer);
+  if (hopMarker !== void 0 && chainSig !== void 0) {
+    if (verifyChainSig(chainSig, bodyBuffer) === "mismatch") {
+      log2("warn", `[chain] ${BILI_HOP_HEADER} (${hopMarker}) present but ${BILI_SIG_HEADER} does not match the received body \u2014 a middlebox rewrote the request in transit. Passing through without processing.`);
+    } else {
+      log2("debug", `[chain] ${BILI_SIG_HEADER} verified for ${BILI_HOP_HEADER}=${hopMarker}`);
+    }
+  } else if (hopMarker === void 0 && chainSig !== void 0) {
+    log2("warn", `[chain] inbound request carries ${BILI_SIG_HEADER} but no ${BILI_HOP_HEADER} \u2014 a middlebox likely stripped the hop header. Passing through without processing.`);
+  } else if (hasAcpArtifacts) {
+    log2("warn", `[chain] inbound request carries ACP compression artifacts but neither ${BILI_HOP_HEADER} nor ${BILI_SIG_HEADER} \u2014 a middlebox likely stripped bili's headers. Passing through without processing.`);
+  }
+  const chainDetected = hopMarker !== void 0 || chainSig !== void 0 || hasAcpArtifacts;
   if (headerValue2(req, BILI_PLUGIN_BYPASS_HEADER) === "1") {
     log2("debug", `bypass: ${req.method ?? "?"} ${maskUrlForLog(req.url ?? "")} \u2014 raw passthrough (legacy in-process compression)`);
     await forward(req, res, opts, bodyBuffer, null, core, config, log2, route, instanceId, void 0);
@@ -71358,10 +71401,10 @@ ${bodyBuffer.toString("utf8")}`);
   let prepared = null;
   let forwarded = false;
   const routePassthrough = !opts.passthrough && findRoute(opts.routes, route?.rewrittenUrl)?.passthrough === true;
-  if (routePassthrough && hopMarker === void 0 && protocol && parsed) {
+  if (routePassthrough && !chainDetected && protocol && parsed) {
     log2("info", `[route-passthrough] ${maskUrlsInText(route?.rewrittenUrl ?? "")} matches a passthrough route \u2014 forwarding verbatim, kernel bypassed`);
   }
-  if (!opts.passthrough && !routePassthrough && hopMarker === void 0 && protocol && parsed && typeof parsed === "object") {
+  if (!opts.passthrough && !routePassthrough && !chainDetected && protocol && parsed && typeof parsed === "object") {
     const sessionHeader = headerValue2(req, opts.sessionHeader);
     let pluginAgent = pluginAgentHeader(req.headers);
     let pluginConversation = pluginConversationHeader(req.headers);
@@ -72656,7 +72699,7 @@ async function preflightCompressIfNeeded(prepared, runPrepare, req, inboundBody,
       return failFast(502, "no part of the conversation is compressible (nothing left to fold)", false);
     }
   }
-  const deadEndKey = `${model}\0${limit}\0${createHash8("sha256").update(inboundBody).digest("hex")}`;
+  const deadEndKey = `${model}\0${limit}\0${createHash9("sha256").update(inboundBody).digest("hex")}`;
   const deadEnd = session.metadata.preflightDeadEnd;
   if (deadEnd && typeof deadEnd === "object") {
     const de2 = deadEnd;
@@ -72783,6 +72826,9 @@ async function forward(req, res, opts, body, prepared, core, config, log2, route
       }
     }
   }
+  if (prepared !== null && req.method !== "GET" && req.method !== "HEAD") {
+    stampChainSig(headers, wireBody);
+  }
   const wireTransform = compatProtocol ? (b2) => {
     if (compatRoles) applyCompatRolesJson(b2, compatProtocol, compatRoles);
     return b2;
@@ -72920,7 +72966,9 @@ ${bodyText}`);
           if (fixed.rewritten === 0) return "other";
           let r;
           try {
-            r = await fetchWithTimeout(upstreamUrl, { ...init, body: fixed.body }, void 0, clientAbort.signal);
+            const retryHeaders = prepared !== null ? { ...headers } : headers;
+            if (prepared !== null) stampChainSig(retryHeaders, fixed.body);
+            r = await fetchWithTimeout(upstreamUrl, { ...init, headers: retryHeaders, body: fixed.body }, void 0, clientAbort.signal);
           } catch {
             return "other";
           }
@@ -73411,11 +73459,13 @@ async function resolveFakeCompletion(stream2, opts) {
       opts.log("warn", `[${sid}] fake completion (tool-call XML, no tool block); retry ${attempt}/${max} with corrective hint`);
       let r;
       try {
+        const retryHeaders = { ...opts.reqHeaders };
+        stampChainSig(retryHeaders, hinted);
         r = await fetchWithTimeout(
           opts.upstreamUrl,
           {
             method: "POST",
-            headers: opts.reqHeaders,
+            headers: retryHeaders,
             body: hinted,
             ...opts.proxyUrl ? { dispatcher: proxyDispatcher(opts.proxyUrl) } : {}
           },