billion-context 0.1.53 → 0.1.54-pr.245.89

package/README.md

@@ -148,6 +148,23 @@ bili --no-auto-update        # disable self-update for this run
 
 Flags override env vars and the config file. `bili --help` lists them all.
 
+### Remote agents (`--host`)
+
+By default the proxy binds `127.0.0.1` and only accepts loopback
+connections. To serve agents on other machines, bind a non-loopback host:
+
+```bash
+bili --host 0.0.0.0           # all interfaces (or use your LAN IP)
+```
+
+- Remote agents point their model `baseURL` at `http://<this-host>:<port>/bili/…`.
+- MITM-mode `CONNECT` then also accepts remote clients — for **whitelisted
+  model hosts only**. Blind tunnels to arbitrary hosts stay loopback-only, so
+  the proxy can never be used as an open relay.
+- There is **no authentication**: only do this on a trusted LAN or behind a
+  firewall. The `/__bili/` management endpoints remain loopback-only.
+- A startup `[security]` warning reminds you of the above.
+
 ### Debugging
 
 Three ways to enable verbose logging (priority: flag > env > config):

package/README.zh-CN.md

@@ -133,6 +133,21 @@ bili --no-auto-update        # 本次启动禁用自动更新
 
 参数优先级高于环境变量和配置文件。`bili --help` 列出全部。
 
+### 远程 agent（`--host`）
+
+默认绑定 `127.0.0.1`，只接受本机连接。要给其他机器上的 agent 用，绑定非 loopback 地址:
+
+```bash
+bili --host 0.0.0.0           # 所有网卡(或直接用局域网 IP)
+```
+
+- 远程 agent 把模型 `baseURL` 指向 `http://<本机IP>:<端口>/bili/…`。
+- MITM 模式的 `CONNECT` 也会接受远程客户端 —— 但仅限**白名单内的模型域名**;
+  到任意主机的盲隧道仍仅限本机，代理不会沦为开放中继。
+- **没有任何鉴权**: 只应在可信局域网或防火墙内使用。`/__bili/` 管理
+  端点仍仅限本机访问。
+- 启动时的 `[security]` 警告会提醒上述事项。
+
 ### 调试
 
 三种方式打开详细日志(优先级:参数 > 环境变量 > 配置):

package/dist/index.js

@@ -50295,6 +50295,7 @@ async function* runCompressLoop(upstream, ctx, requestBody, requestOptions, adap
       const calls = [];
       let usage = {};
       let finishReason;
+      let sawDone = false;
       let suppressCompletion = false;
       for await (const ev of adapter.parseStream(currentUpstream, round)) {
         if (signal?.aborted) break;
@@ -50332,6 +50333,7 @@ async function* runCompressLoop(upstream, ctx, requestBody, requestOptions, adap
             cachedTokens: ev.cachedTokens
           };
         } else if (ev.kind === "done") {
+          sawDone = true;
           finishReason = ev.finishReason;
           suppressCompletion = ev.suppressCompletion === true;
         } else if (ev.kind === "meta") {
@@ -50453,6 +50455,15 @@ async function* runCompressLoop(upstream, ctx, requestBody, requestOptions, adap
       }
       const reRequest = proxyResults.length > 0 && realCalls === 0;
       if (!reRequest) {
+        if (!sawDone) {
+          const partialText = assistantText.length;
+          const partialReasoning = assistantReasoning.length;
+          const msg = `upstream stream truncated (no completion event; round ${round}, ${partialText} text chars + ${partialReasoning} reasoning chars received)`;
+          ctx.log(`[acp-loop] round ${round}: ${msg}`);
+          log("error", `[acp-loop] ${msg}`);
+          yield adapter.emitError(msg);
+          return;
+        }
         if (!suppressCompletion) {
           yield adapter.emitCompletion({ finishReason, usage });
         }
@@ -50534,7 +50545,91 @@ async function* runCompressLoop(upstream, ctx, requestBody, requestOptions, adap
   }
 }
 
+// src/util.ts
+import { createHash as createHash4 } from "crypto";
+function hashId2(s3) {
+  return createHash4("sha256").update(s3, "utf8").digest("hex").slice(0, 16);
+}
+function isLoopbackAddress(addr) {
+  return !!addr && (addr.startsWith("127.") || addr === "::1" || addr.startsWith("::ffff:127."));
+}
+function usageTotals(protocol, usage) {
+  const num3 = (v2) => typeof v2 === "number" && Number.isFinite(v2) ? v2 : void 0;
+  if (protocol === "anthropic") {
+    const fresh = num3(usage["input_tokens"]);
+    const read = num3(usage["cache_read_input_tokens"]);
+    const creation = num3(usage["cache_creation_input_tokens"]);
+    const any = fresh !== void 0 || read !== void 0 || creation !== void 0;
+    return {
+      total: any ? (fresh ?? 0) + (read ?? 0) + (creation ?? 0) : void 0,
+      cached: read
+    };
+  }
+  if (protocol === "openai") {
+    return {
+      total: num3(usage["prompt_tokens"]),
+      cached: num3(usage["prompt_tokens_details"]?.["cached_tokens"])
+    };
+  }
+  return {
+    total: num3(usage["input_tokens"]),
+    cached: num3(usage["input_tokens_details"]?.["cached_tokens"])
+  };
+}
+var CONTEXT_OVERFLOW_PATTERNS = [
+  /context_length_exceeded/i,
+  /context length exceeded/i,
+  /maximum context length/i,
+  /max context length/i,
+  /maximum context size/i,
+  /exceeds the context window/i,
+  /exceeded model token limit/i,
+  /prompt is too long/i,
+  /prompt_too_long/i,
+  /prompt_is_too_long/i,
+  /request_too_large/i,
+  /token limit exceeded/i
+];
+function toTokenNumber(s3) {
+  const n = parseInt(s3.replace(/,/g, ""), 10);
+  return Number.isFinite(n) && n >= 1e3 ? n : void 0;
+}
+function parseOverflowWindow(text) {
+  let m2 = text.match(/>\s*(\d[\d,]*)\s*maximum/i);
+  if (m2) return toTokenNumber(m2[1]);
+  m2 = text.match(/maximum context length is (\d[\d,]*)/i) ?? text.match(/maximum context length of (\d[\d,]*)/i) ?? text.match(/maximum context size (?:is|of) (\d[\d,]*)/i) ?? text.match(/(?:maximum|max)\s+(?:context\s+)?length\s+(?:is\s+)?(\d[\d,]*)/i) ?? text.match(/limit of (\d[\d,]*)\s*token/i) ?? text.match(/(\d[\d,]*)\s*maximum\b/i);
+  if (m2) return toTokenNumber(m2[1]);
+  return void 0;
+}
+function inspectContextOverflow(status, bodyText) {
+  const message = (bodyText ?? "").slice(0, 300);
+  if (status !== 400 && status !== 413) return { isOverflow: false, message };
+  if (!bodyText) return { isOverflow: false, message };
+  const isOverflow = CONTEXT_OVERFLOW_PATTERNS.some((p2) => p2.test(bodyText));
+  if (!isOverflow) return { isOverflow: false, message };
+  return { isOverflow: true, window: parseOverflowWindow(bodyText), message };
+}
+function reserveOutputHeadroom(window2, maxOutput) {
+  if (Number.isFinite(window2) && window2 > 0 && Number.isFinite(maxOutput) && maxOutput > 0 && maxOutput < window2) {
+    return window2 - maxOutput;
+  }
+  return window2;
+}
+function shouldReserveOutputHeadroom(protocol) {
+  return protocol !== "anthropic";
+}
+
 // src/loop/adapter-responses.ts
+var RESPONSES_ITEM_ID_MAX = 64;
+function sanitizeResponsesInputIds(input) {
+  if (!Array.isArray(input)) return;
+  for (const item of input) {
+    const rec = item;
+    if (typeof rec?.id === "string" && rec.id.length > RESPONSES_ITEM_ID_MAX) {
+      rec.id = `msg-fix-${hashId2(rec.id)}`;
+    }
+  }
+}
 function rewriteItemEvent(type, obj, mapped) {
   const item = { ...obj.item ?? {}, id: mapped.id };
   return Buffer.from(`event: ${type}
@@ -50766,7 +50861,7 @@ function createResponsesAdapter(textProtocol, projection) {
             yield { kind: "meta", chunk: rawBuf, firstRoundOnly: false };
           } else if (item?.type === "message" && round > 1 && !suppressTextLifecycle) {
             const origId = typeof item.id === "string" ? item.id : "";
-            const mapped = { id: `msg-proxy-${round}-${origId || outputIndex}`, index: outputIndex++ };
+            const mapped = { id: `msg-proxy-${round}-${hashId2(origId || String(outputIndex))}`, index: outputIndex++ };
             if (origId) remapped.set(origId, mapped);
             yield { kind: "meta", chunk: rewriteItemEvent(type, obj, mapped), firstRoundOnly: false };
           } else if (item?.type !== "message" || !suppressTextLifecycle) {
@@ -52017,80 +52112,6 @@ data: ${JSON.stringify({ type: "message_stop" })}
   }
 }
 
-// src/util.ts
-import { createHash as createHash4 } from "crypto";
-function hashId2(s3) {
-  return createHash4("sha256").update(s3, "utf8").digest("hex").slice(0, 16);
-}
-function isLoopbackAddress(addr) {
-  return !!addr && (addr.startsWith("127.") || addr === "::1" || addr.startsWith("::ffff:127."));
-}
-function usageTotals(protocol, usage) {
-  const num3 = (v2) => typeof v2 === "number" && Number.isFinite(v2) ? v2 : void 0;
-  if (protocol === "anthropic") {
-    const fresh = num3(usage["input_tokens"]);
-    const read = num3(usage["cache_read_input_tokens"]);
-    const creation = num3(usage["cache_creation_input_tokens"]);
-    const any = fresh !== void 0 || read !== void 0 || creation !== void 0;
-    return {
-      total: any ? (fresh ?? 0) + (read ?? 0) + (creation ?? 0) : void 0,
-      cached: read
-    };
-  }
-  if (protocol === "openai") {
-    return {
-      total: num3(usage["prompt_tokens"]),
-      cached: num3(usage["prompt_tokens_details"]?.["cached_tokens"])
-    };
-  }
-  return {
-    total: num3(usage["input_tokens"]),
-    cached: num3(usage["input_tokens_details"]?.["cached_tokens"])
-  };
-}
-var CONTEXT_OVERFLOW_PATTERNS = [
-  /context_length_exceeded/i,
-  /context length exceeded/i,
-  /maximum context length/i,
-  /max context length/i,
-  /maximum context size/i,
-  /exceeds the context window/i,
-  /exceeded model token limit/i,
-  /prompt is too long/i,
-  /prompt_too_long/i,
-  /prompt_is_too_long/i,
-  /request_too_large/i,
-  /token limit exceeded/i
-];
-function toTokenNumber(s3) {
-  const n = parseInt(s3.replace(/,/g, ""), 10);
-  return Number.isFinite(n) && n >= 1e3 ? n : void 0;
-}
-function parseOverflowWindow(text) {
-  let m2 = text.match(/>\s*(\d[\d,]*)\s*maximum/i);
-  if (m2) return toTokenNumber(m2[1]);
-  m2 = text.match(/maximum context length is (\d[\d,]*)/i) ?? text.match(/maximum context length of (\d[\d,]*)/i) ?? text.match(/maximum context size (?:is|of) (\d[\d,]*)/i) ?? text.match(/(?:maximum|max)\s+(?:context\s+)?length\s+(?:is\s+)?(\d[\d,]*)/i) ?? text.match(/limit of (\d[\d,]*)\s*token/i) ?? text.match(/(\d[\d,]*)\s*maximum\b/i);
-  if (m2) return toTokenNumber(m2[1]);
-  return void 0;
-}
-function inspectContextOverflow(status, bodyText) {
-  const message = (bodyText ?? "").slice(0, 300);
-  if (status !== 400 && status !== 413) return { isOverflow: false, message };
-  if (!bodyText) return { isOverflow: false, message };
-  const isOverflow = CONTEXT_OVERFLOW_PATTERNS.some((p2) => p2.test(bodyText));
-  if (!isOverflow) return { isOverflow: false, message };
-  return { isOverflow: true, window: parseOverflowWindow(bodyText), message };
-}
-function reserveOutputHeadroom(window2, maxOutput) {
-  if (Number.isFinite(window2) && window2 > 0 && Number.isFinite(maxOutput) && maxOutput > 0 && maxOutput < window2) {
-    return window2 - maxOutput;
-  }
-  return window2;
-}
-function shouldReserveOutputHeadroom(protocol) {
-  return protocol !== "anthropic";
-}
-
 // src/session-id.ts
 function extractKey(headers) {
   const auth = headers["authorization"];
@@ -53217,17 +53238,23 @@ function isMitmHost(host, extraDomains = []) {
   return all.some((d) => h === d || h.endsWith("." + d));
 }
 function setupMitm(server, extraDomains = [], log2 = () => {
-}, resolveProxyUrl) {
+}, resolveProxyUrl, allowRemoteClients = false) {
   ensureRootCA();
   server.on("connect", (req, clientSocket, head) => {
-    if (!isLoopbackAddress(clientSocket.remoteAddress)) {
-      log2(`CONNECT ${req.url} rejected: non-loopback client ${clientSocket.remoteAddress}`);
+    const remote = !isLoopbackAddress(clientSocket.remoteAddress);
+    if (remote && !allowRemoteClients) {
+      log2(`CONNECT ${req.url} rejected: non-loopback client ${clientSocket.remoteAddress} (bind a non-loopback --host to allow remote clients)`);
       clientSocket.end("HTTP/1.1 403 Forbidden\r\n\r\n");
       return;
     }
     const { hostname, port } = parseHostPort(req.url ?? "");
     const targetPort = port || 443;
     if (!isMitmHost(hostname, extraDomains)) {
+      if (remote) {
+        log2(`CONNECT ${req.url} rejected: remote client ${clientSocket.remoteAddress} tunneling non-whitelisted host`);
+        clientSocket.end("HTTP/1.1 403 Forbidden\r\n\r\n");
+        return;
+      }
       const proxyUrl = resolveProxyUrl?.(hostname);
       tunnelThrough(clientSocket, hostname, targetPort, head, log2, proxyUrl);
       return;
@@ -54147,10 +54174,12 @@ Content-Length: ${Buffer.byteLength(body)}\r
     );
   });
   if (opts.mitm.enabled) {
-    setupMitm(server, opts.mitm.domains, (msg) => log2("info", msg), (host) => resolveProxy(opts.routes, opts.proxy, `https://${host}`, opts.proxyFallback));
+    const allowRemoteConnect = opts.host === "0.0.0.0" || opts.host === "::" || !isLoopbackAddress(opts.host);
+    setupMitm(server, opts.mitm.domains, (msg) => log2("info", msg), (host) => resolveProxy(opts.routes, opts.proxy, `https://${host}`, opts.proxyFallback), allowRemoteConnect);
   }
   server.listen(opts.port, opts.host, () => {
-    const displayHost = opts.host === "0.0.0.0" ? "localhost" : opts.host;
+    const nonLoopbackBind = opts.host === "0.0.0.0" || opts.host === "::" || !isLoopbackAddress(opts.host);
+    const displayHost = nonLoopbackBind ? opts.host : opts.host === "0.0.0.0" ? "localhost" : opts.host;
     try {
       fs6.mkdirSync(stateDir(), { recursive: true });
       const originHost = opts.host === "0.0.0.0" || opts.host === "::" || opts.host === "localhost" ? "127.0.0.1" : opts.host.includes(":") && !opts.host.startsWith("[") ? `[${opts.host}]` : opts.host;
@@ -54163,6 +54192,12 @@ Content-Length: ${Buffer.byteLength(body)}\r
       "info",
       `acp-proxy listening on http://${displayHost}:${opts.port} \u2014 web UI: http://${displayHost}:${opts.port}/__bili/ \u2014 zero-config: prefix any baseURL with http://${displayHost}:${opts.port}/bili/` + (nOverrides ? ` \u2014 context overrides for ${nOverrides} upstream URL(s)` : "") + (opts.mitm.enabled ? ` \u2014 MITM proxy on (whitelist)${opts.mitm.domains.length ? ` +${opts.mitm.domains.join(",")}` : ""}` : "")
     );
+    if (nonLoopbackBind) {
+      log2(
+        "warn",
+        `[security] bound to ${opts.host} \u2014 proxy endpoints (/bili/, CONNECT for whitelisted model hosts) are reachable from the network with NO authentication; /__bili/ management endpoints stay loopback-only. Restrict access with a firewall on untrusted networks. Remote agents: point baseURL at http://<this-host>:${opts.port}/bili/`
+      );
+    }
     if (opts.debug) {
       log2("info", `[debug] build features: raw-HTTP-capture(on) | remote_compaction_v2-strip(on) | cert-MITM-launcher(on) | strip-acp-summary(on) \u2014 seeing this line confirms the launcher build (not registry 0.1.34)`);
     }
@@ -54684,6 +54719,7 @@ function prepareResponses(parsed, req, opts, core, config, prompts, log2, sessio
   let responsesProjection;
   let rebuiltInput = parsed.input;
   let toolsOut = parsed.tools;
+  sanitizeResponsesInputIds(parsed.input);
   const shouldInject = opts.compress.injectTool;
   const injectTools = shouldInject && !pluginMode;
   const responsesTextProtocol = FORCE_TEXT_PROTOCOL || resolveCompressProtocol(opts.routes, session.meta.upstreamOrigin) === "marker";