dsh-tap 0.20.0

package/scripts/probe-qoder-live.mjs

@@ -0,0 +1,344 @@
+#!/usr/bin/env node
+/**
+ * Live integration probe for the Qoder CN channel (REAL network, own account).
+ *
+ * Device-flow facts were extracted from the official CLI bundle
+ * (@qodercn-ai/qoderclicn 1.1.57, deobfuscated); this script is the manual
+ * calibration step that needs a real login to confirm the live envelopes.
+ *
+ *   node scripts/probe-qoder-live.mjs --login
+ *     Real browser device flow: prints the authorization URL (open it while
+ *     logged in to qoder.cn), polls /api/v1/deviceToken/poll (404 = pending)
+ *     until the token arrives, then pulls userinfo. Tokens never print
+ *     (masked only). Auth store: ~/.dsh/qoder-plugin-auth.json (DSH_HOME
+ *     respected) — one login serves both probe and plugin.
+ *
+ *   node scripts/probe-qoder-live.mjs --catalog
+ *     GET <infer>/api/v2/model/list?Encode=1 with the stored token; dumps raw
+ *     body to docs/probes/qoder-catalog-raw.bin and tries decodings
+ *     (identity / base64 / gzip / deflate / brotli / zstd) to establish the
+ *     Encode=1 format.
+ *
+ *   node scripts/probe-qoder-live.mjs --chat "文本" [--model <key>] [--tools]
+ *     COSY 签名（providers/qoder/cosy.js）+ 加密 POST 到 infer 节点
+ *     （gateway.qoder.com.cn 的 agent_chat_generation），拆 SSE 信封聚合正文
+ *     并落原始证据到 docs/probes/qoder-chat-live-*.json。
+ *     （2026-09-20 起：旧的 api2-v2 OpenAI 面裸 Bearer 形态对本账号 401，
+ *     已废弃——别再改回去。）
+ *
+ *   node scripts/probe-qoder-live.mjs --userinfo   # identity check
+ *   node scripts/probe-qoder-live.mjs --refresh    # force one refresh cycle
+ */
+
+import { writeFileSync, mkdirSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join, dirname } from 'node:path'
+import { randomUUID, createHash, randomBytes } from 'node:crypto'
+import { fileURLToPath } from 'node:url'
+import zlib from 'node:zlib'
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
+const DSH_HOME = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+const AUTH_PATH = join(DSH_HOME, 'qoder-plugin-auth.json')
+const PROBES_DIR = join(ROOT, 'docs', 'probes')
+
+const EP = {
+  openapi: process.env.QODER_OPENAPI ?? 'https://openapi.qoder.com.cn',
+  base: process.env.QODER_BASE ?? 'https://qoder.cn',
+  infer: process.env.QODER_INFER ?? 'https://gateway.qoder.com.cn',
+  modelServer: process.env.QODER_MODEL_SERVER ?? 'https://api2-v2.qoder.sh',
+}
+const CLIENT_ID_PROD = 'e883ade2-e6e3-4d6d-adf7-f92ceff5fdcb'
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000 // bundle 常量：5 分钟
+const POLL_INTERVAL_MS = 1000
+
+const { readJson, writeJson } = await import('../core/json-store.js')
+
+const mask = (t) => (typeof t === 'string' && t.length > 12 ? `${t.slice(0, 6)}…${t.slice(-4)}（${t.length} 字符）` : '(none)')
+const b64url = (buf) => Buffer.from(buf).toString('base64url')
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
+const ensureDir = (p) => mkdirSync(p, { recursive: true })
+
+const mkVerifier = () => {
+  const n = 43 + Math.floor(86 * Math.random())
+  const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~'
+  const bytes = randomBytes(n)
+  return [...bytes].map((b) => charset[b % 66]).join('')
+}
+const mkMachineId = () => randomBytes(24).toString('hex') // 48 hex；bundle 机器 id 形态为长 hex 串
+
+function normalizeExpiry(v) {
+  if (v == null || v === '') return null
+  if (typeof v === 'number' || (typeof v === 'string' && /^\d+$/.test(v.trim()))) {
+    const n = Number(v)
+    if (!Number.isFinite(n) || n <= 0) return null
+    if (n > 1e12) return n
+    if (n > 1e9) return n * 1000
+    return Date.now() + n * 1000
+  }
+  const p = Date.parse(String(v)) // 实测：expires_at 常为 ISO 字符串
+  return Number.isFinite(p) && p > 0 ? p : null
+}
+
+function currentToken() {
+  const store = readJson(AUTH_PATH)
+  const t = store.auth?.accessToken
+  if (!t) { console.error('未登录（先跑 --login）'); process.exit(1) }
+  return { store, token: t }
+}
+
+// ─────────────────────────────────────────────────────────── login
+async function login() {
+  const store = readJson(AUTH_PATH)
+  if (store.auth?.accessToken) {
+    console.log('已有登录态：', store.account ?? '', '令牌至', store.auth.expiresAt ? new Date(store.auth.expiresAt).toISOString() : '(未知)')
+  }
+  const verifier = mkVerifier()
+  const challenge = b64url(createHash('sha256').update(verifier).digest())
+  const nonce = randomUUID()
+  const machineId = store.machine?.machineId ?? mkMachineId()
+
+  const authUrl = `${EP.base}/device/selectAccounts?challenge=${challenge}&challenge_method=S256&nonce=${nonce}&machine_id=${machineId}&client_id=${CLIENT_ID_PROD}`
+  console.log('\n在浏览器打开并完成授权（5 分钟内有效）：\n')
+  console.log(authUrl, '\n')
+
+  const deadline = Date.now() + LOGIN_TIMEOUT_MS
+  let pollCount = 0
+  while (Date.now() < deadline) {
+    pollCount++
+    const url = `${EP.openapi}/api/v1/deviceToken/poll?nonce=${nonce}&verifier=${verifier}&challenge_method=S256`
+    let res, text
+    try {
+      res = await fetch(url, { headers: { Accept: 'application/json' } })
+      text = await res.text().catch(() => '')
+    } catch (err) {
+      console.error(`\n轮询网络错误（第 ${pollCount} 次）：`, err?.cause?.code ?? err?.message)
+      await sleep(POLL_INTERVAL_MS)
+      continue
+    }
+    if (res.status === 404) {
+      if (pollCount % 10 === 1) process.stdout.write(`等待授权…（第 ${pollCount} 次 404）\n`)
+      await sleep(POLL_INTERVAL_MS)
+      continue
+    }
+    let body = null
+    try { body = JSON.parse(text) } catch { /* keep raw */ }
+    if (!res.ok) {
+      console.error(`\n轮询失败 HTTP ${res.status}：`, text.slice(0, 300))
+      if (body && body.errorCode && body.errorCode !== 'NotFound') process.exit(1)
+      await sleep(POLL_INTERVAL_MS)
+      continue
+    }
+    if (body?.token) {
+      console.log(`\n\n登录成功 ✓（第 ${pollCount} 次轮询）`)
+      const auth = {
+        accessToken: body.token,
+        refreshToken: body.refresh_token ?? null,
+        expiresAt: normalizeExpiry(body.expires_at),
+        refreshExpiresAt: normalizeExpiry(body.refresh_token_expires_at),
+        loginMethod: 'browser',
+      }
+      console.log('token 响应键：', Object.keys(body).join(', '))
+      console.log('accessToken：', mask(auth.accessToken))
+      console.log('refreshToken：', mask(auth.refreshToken))
+      let account = null
+      try {
+        const ui = await fetch(`${EP.openapi}/api/v1/userinfo`, { headers: { Accept: 'application/json', Authorization: `Bearer ${auth.accessToken}` } })
+        const ub = await ui.json().catch(() => null)
+        if (ub) {
+          account = { uid: ub.uid ?? ub.user_id ?? ub.id ?? null, name: ub.name ?? ub.username ?? null, email: ub.email ?? null }
+          console.log('userinfo：', JSON.stringify(account))
+          ensureDir(PROBES_DIR)
+          writeFileSync(join(PROBES_DIR, `qoder-userinfo-${Date.now()}.json`), JSON.stringify({ status: ui.status, body: ub }, null, 2))
+        }
+      } catch (e) { console.log('userinfo 拉取失败：', e?.message) }
+      writeJson(AUTH_PATH, { machine: { machineId }, auth, account })
+      console.log('已写入', AUTH_PATH)
+      process.exit(0)
+    }
+    if (pollCount % 10 === 1) console.log(`200 无 token（第 ${pollCount} 次）：`, text.slice(0, 200))
+    await sleep(POLL_INTERVAL_MS)
+  }
+  console.error('\n超时（5 分钟未完成授权）')
+  process.exit(1)
+}
+
+// ─────────────────────────────────────────────────────────── refresh
+async function refresh() {
+  const { store } = currentToken()
+  const rt = store.auth?.refreshToken
+  if (!rt) { console.error('无 refreshToken'); process.exit(1) }
+  const res = await fetch(`${EP.openapi}/api/v1/deviceToken/refresh`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({ refresh_token: rt, machine_id: store.machine?.machineId ?? '' }),
+  })
+  const text = await res.text().catch(() => '')
+  console.log('refresh HTTP', res.status)
+  console.log(text.slice(0, 800))
+  let body = null
+  try { body = JSON.parse(text) } catch { /* raw */ }
+  if (res.ok && body?.device_token) {
+    const auth = {
+      accessToken: body.device_token,
+      refreshToken: body.refresh_token ?? rt,
+      expiresAt: normalizeExpiry(body.expires_at),
+      refreshExpiresAt: normalizeExpiry(body.refresh_token_expires_at),
+      loginMethod: store.auth.loginMethod ?? 'browser',
+    }
+    writeJson(AUTH_PATH, { ...store, auth })
+    console.log('refresh 成功 ✓ 新 accessToken：', mask(auth.accessToken))
+  }
+}
+
+// ─────────────────────────────────────────────────────────── userinfo
+async function userinfo() {
+  const { token } = currentToken()
+  const res = await fetch(`${EP.openapi}/api/v1/userinfo`, { headers: { Accept: 'application/json', Authorization: `Bearer ${token}` } })
+  const text = await res.text().catch(() => '')
+  console.log('userinfo HTTP', res.status)
+  console.log(text.slice(0, 1000))
+  ensureDir(PROBES_DIR)
+  writeFileSync(join(PROBES_DIR, `qoder-userinfo-${Date.now()}.json`), JSON.stringify({ status: res.status, body: text.slice(0, 20000) }, null, 2))
+}
+
+// ─────────────────────────────────────────────────────────── catalog
+async function catalog() {
+  const { token } = currentToken()
+  const url = `${EP.infer}/api/v2/model/list?Encode=1`
+  const res = await fetch(url, { headers: { Accept: '*/*', Authorization: `Bearer ${token}` } })
+  const buf = Buffer.from(await res.arrayBuffer())
+  console.log('catalog HTTP', res.status, 'bytes', buf.length, 'content-type', res.headers.get('content-type'))
+  ensureDir(PROBES_DIR)
+  const rawPath = join(PROBES_DIR, 'qoder-catalog-raw.bin')
+  writeFileSync(rawPath, buf)
+  console.log('原始响应 →', rawPath)
+  const head = buf.subarray(0, 64)
+  console.log('head hex：', head.toString('hex'))
+  console.log('head utf8：', head.toString('utf8').replace(/[^\x20-\x7e]/g, '.'))
+
+  const attempts = []
+  const tryDecode = (name, fn) => {
+    try {
+      const out = fn()
+      attempts.push({ name, ok: true, out, sample: out.subarray(0, 200).toString('utf8').replace(/[^\x20-\x7e\u4e00-\u9fff]/g, '.') })
+    } catch (e) { attempts.push({ name, ok: false, err: String(e?.message ?? e).slice(0, 80) }) }
+  }
+  tryDecode('identity-utf8', () => buf)
+  tryDecode('base64-text', () => Buffer.from(buf.toString('utf8').trim(), 'base64'))
+  tryDecode('gzip', () => zlib.gunzipSync(buf))
+  tryDecode('deflate', () => zlib.inflateSync(buf))
+  tryDecode('brotli', () => zlib.brotliDecompressSync(buf))
+  if (typeof zlib.zstdDecompressSync === 'function') tryDecode('zstd', () => zlib.zstdDecompressSync(buf))
+  for (const a of attempts) {
+    console.log(a.ok ? `  [${a.name}] len=${a.out.length} → ${a.sample.slice(0, 140)}` : `  [${a.name}] 失败：${a.err}`)
+  }
+  const jsonHit = attempts.find((a) => a.ok && /^\s*[[{]/.test(a.sample))
+  if (jsonHit) {
+    console.log('\n★ 可直接解析的 JSON 形态：', jsonHit.name)
+    try {
+      const parsed = JSON.parse(jsonHit.out.toString('utf8'))
+      writeFileSync(join(PROBES_DIR, 'qoder-catalog-decoded.json'), JSON.stringify(parsed, null, 2))
+      const arr = Array.isArray(parsed) ? parsed : (parsed.models ?? parsed.data ?? null)
+      console.log('模型条数：', Array.isArray(arr) ? arr.length : '(非数组，见解码文件)')
+      if (Array.isArray(arr)) console.log('首条键集：', Object.keys(arr[0] ?? {}).join(', '))
+    } catch (e) { console.log('解析失败：', e?.message) }
+  }
+}
+
+// ─────────────────────────────────────────────────────────── chat
+// ─────────────────────────────────────────────────────────── chat
+// 2026-09-20 打通后的真实形态：OpenAI 面（api2-v2，裸 Bearer）对本账号 401
+// 不可用；可用面 = COSY 签名 + WASM 加密 POST 到 infer 节点（region 发现：
+// gateway.qoder.com.cn）的 /algo/api/v2/service/pro/sse/agent_chat_generation，
+// 响应是 SSE 信封（data:{body:"<OpenAI chunk JSON>"}）。签名由插件自带的
+// providers/qoder/cosy.js 完成（手写胶水 + 官方 wasm）。
+async function chat(text, { model, tools, stream }) {
+  const { store, token } = currentToken()
+  const { createCosyRuntime } = await import('../providers/qoder/cosy.js')
+  const cosy = createCosyRuntime({ wasmPath: join(ROOT, 'providers', 'qoder', 'qoder_auth.wasm') })
+  const cred = { accessToken: token, machineId: store.machine?.machineId, uid: store.account?.uid }
+  const payload = {
+    model,
+    stream: true, // 上游恒流式；stream=false 只是本地聚合
+    stream_options: { include_usage: true },
+    messages: [{ role: 'user', content: text }],
+  }
+  if (tools) {
+    payload.tools = [{
+      type: 'function',
+      function: {
+        name: 'get_current_time',
+        description: 'Get the current local time for a given timezone.',
+        parameters: { type: 'object', properties: { timezone: { type: 'string', description: 'IANA timezone, e.g. Asia/Shanghai' } }, required: ['timezone'] },
+      },
+    }]
+    payload.tool_choice = 'auto'
+  }
+  const signed = await cosy.prepareChat(cred, {
+    endpoint: EP.infer, body: JSON.stringify(payload), modelKey: model, modelSource: 'system',
+  })
+  const res = await fetch(signed.url, {
+    method: 'POST',
+    headers: { ...signed.headers, 'Content-Type': 'application/json', Accept: 'text/event-stream' },
+    body: signed.body,
+  })
+  console.log(`chat model=${model} tools=${Boolean(tools)} → HTTP`, res.status, res.headers.get('content-type'), '\n  url:', signed.url)
+  const hdrs = Object.fromEntries([...res.headers].slice(0, 30))
+  const raw = await res.text()
+  // 拆信封：data:{body: "<chunk json>"} / body:"[DONE]" / 尾帧计时
+  let text2 = ''
+  let usage = null
+  const toolCalls = []
+  for (const line of raw.split('\n')) {
+    if (!line.startsWith('data:')) continue
+    let frame
+    try { frame = JSON.parse(line.slice(5)) } catch { continue }
+    if (typeof frame.body !== 'string' || frame.body === '[DONE]') continue
+    let chunk
+    try { chunk = JSON.parse(frame.body) } catch { continue }
+    const d = chunk.choices?.[0]?.delta
+    if (d?.content) text2 += d.content
+    if (d?.tool_calls) toolCalls.push(...d.tool_calls)
+    if (chunk.usage) usage = chunk.usage
+  }
+  console.log('\n聚合正文:', JSON.stringify(text2.slice(0, 500)))
+  if (toolCalls.length) console.log('tool_calls:', JSON.stringify(toolCalls).slice(0, 400))
+  if (usage) console.log('usage:', JSON.stringify(usage))
+  ensureDir(PROBES_DIR)
+  const out = join(PROBES_DIR, `qoder-chat-live-${Date.now()}${stream ? '-stream' : ''}${tools ? '-tools' : ''}.json`)
+  writeFileSync(out, JSON.stringify({ request: payload, signedUrl: signed.url, status: res.status, headers: hdrs, body: raw.slice(0, 200_000) }, null, 2))
+  console.log('\n证据 →', out)
+}
+
+// ─────────────────────────────────────────────────────────── dispatch
+const args = process.argv.slice(2)
+const has = (f) => args.includes(f)
+const val = (f) => { const i = args.indexOf(f); return i >= 0 ? args[i + 1] : undefined }
+
+if (has('--login')) await login()
+else if (has('--refresh')) await refresh()
+else if (has('--userinfo')) await userinfo()
+else if (has('--catalog')) await catalog()
+else if (has('--chat')) {
+  const text = val('--chat') ?? '你好'
+  const model = val('--model') ?? (() => {
+    try {
+      const dec = readJson(join(PROBES_DIR, 'qoder-catalog-decoded.json'))
+      const arr = Array.isArray(dec) ? dec : (dec.models ?? dec.data ?? [])
+      const k = arr?.[0]?.key ?? arr?.[0]?.id
+      if (k) { console.log('（未给 --model，采用目录首条：', k, '）'); return k }
+    } catch { /* */ }
+    return 'auto'
+  })()
+  await chat(text, { model, tools: has('--tools'), stream: !has('--no-stream') })
+  if (has('--tools') && !has('--no-stream')) await chat(text, { model, tools: true, stream: false })
+} else {
+  console.log(`用法：
+  --login            真实设备流登录（浏览器授权）
+  --refresh          强制刷新一次
+  --userinfo         账号信息
+  --catalog          模型目录（Encode=1 解码尝试）
+  --chat "文本" [--model <key>] [--tools] [--no-stream]`)
+  process.exit(1)
+}

package/scripts/probe-qoder-matrix.mjs

@@ -0,0 +1,274 @@
+#!/usr/bin/env node
+/**
+ * Qoder CN — 差分矩阵探测（真实账号，只读对话）。
+ *
+ * 目的：把"上游报错"的触发条件逐变量隔离——同一请求体，只改一个字段，
+ * 看上游是成功回文本还是回业务错误信封。用于回答两个悬案：
+ *   1) Qwen3.8-Flash（qfmodel）为什么报
+ *      {"code":"400","message":"[FAIL]node:oa_qwen-plus-main msg:Execution failed: null"}
+ *      ——而 Qoder 客户端里能用？（变量：reasoning_effort / max_completion_tokens /
+ *      tools / modelSource / 多轮）
+ *   2) "Messages with role 'tool' must be a response to a preceding message with
+ *      'tool_calls'" 的触发形态（工具回灌序列）。
+ *
+ * 用法：
+ *   node scripts/probe-qoder-matrix.mjs --suite flash      # qfmodel 变量矩阵
+ *   node scripts/probe-qoder-matrix.mjs --suite tools      # 工具回灌形态矩阵
+ *   node scripts/probe-qoder-matrix.mjs --suite all
+ *   node scripts/probe-qoder-matrix.mjs --suite flash --only baseline,max_tokens
+ * 证据落 docs/probes/qoder-matrix-<ts>.json（含请求体明文与 SSE 原始响应）。
+ */
+
+import { mkdirSync, writeFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
+const DSH_HOME = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+const AUTH_PATH = join(DSH_HOME, 'qoder-plugin-auth.json')
+const PROBES_DIR = join(ROOT, 'docs', 'probes')
+const INFER = process.env.QODER_INFER ?? 'https://gateway.qoder.com.cn'
+const GAP_MS = Number(process.env.QODER_GAP_MS ?? 1500)
+
+const { readJson } = await import('../core/json-store.js')
+const { createCosyRuntime } = await import('../providers/qoder/cosy.js')
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
+
+function cred() {
+  const store = readJson(AUTH_PATH)
+  const accessToken = store?.auth?.accessToken
+  if (!accessToken) { console.error('未登录：先跑 scripts/probe-qoder-live.mjs --login'); process.exit(1) }
+  return { cred: { accessToken, machineId: store.machine?.machineId, uid: store.account?.uid }, store }
+}
+
+/** SSE 信封 → 结构化结论。 */
+function dissect(raw) {
+  const out = { text: '', reasoning: '', toolCalls: [], finish: null, usage: null, errorObjects: [], frames: 0, done: false, eventErrors: [] }
+  let lastEvent = null
+  for (const line of raw.split('\n')) {
+    const t = line.trim()
+    if (!t) { lastEvent = null; continue }
+    if (t.startsWith('event:')) { lastEvent = t.slice(6).trim(); continue }
+    if (!t.startsWith('data:')) continue
+    const payload = t.slice(5).trim()
+    if (lastEvent === 'error') { out.eventErrors.push(payload.slice(0, 500)); continue }
+    let frame
+    try { frame = JSON.parse(payload) } catch { continue }
+    if (typeof frame?.body !== 'string') continue
+    if (frame.body === '[DONE]') { out.done = true; continue }
+    out.frames++
+    let chunk
+    try { chunk = JSON.parse(frame.body) } catch { out.errorObjects.push({ raw: frame.body.slice(0, 300) }); continue }
+    if (chunk.code !== undefined || (typeof chunk.message === 'string' && !Array.isArray(chunk.choices))) {
+      out.errorObjects.push({ code: chunk.code ?? null, message: chunk.message ?? null, statusCodeValue: frame.statusCodeValue ?? null })
+      continue
+    }
+    const delta = chunk.choices?.[0]?.delta
+    if (delta?.content) out.text += delta.content
+    if (delta?.reasoning_content) out.reasoning += delta.reasoning_content
+    for (const tc of delta?.tool_calls ?? []) out.toolCalls.push(tc)
+    if (chunk.choices?.[0]?.finish_reason) out.finish = chunk.choices[0].finish_reason
+    if (chunk.usage) out.usage = chunk.usage
+  }
+  return out
+}
+
+const WASM_PATH = join(ROOT, 'providers', 'qoder', 'qoder_auth.wasm')
+const cosy = createCosyRuntime({ wasmPath: WASM_PATH })
+
+const evidence = { ts: new Date().toISOString(), infer: INFER, cases: [] }
+
+async function chat(label, bodyObj, { modelSource = 'system', modelKey = bodyObj.model, note } = {}) {
+  const body = JSON.stringify(bodyObj)
+  const signed = await cosy.prepareChat(cred().cred, { endpoint: INFER, body, modelKey, modelSource })
+  let status = 0, raw = '', netErr = null
+  try {
+    const r = await fetch(signed.url, {
+      method: 'POST',
+      headers: { ...signed.headers, 'Content-Type': 'application/json', Accept: 'text/event-stream' },
+      body: signed.body,
+    })
+    status = r.status
+    raw = await r.text()
+  } catch (e) { netErr = String(e?.message ?? e) }
+  const d = dissect(raw)
+  const verdict = d.errorObjects.length || d.eventErrors.length || status !== 200
+    ? `ERROR ${d.errorObjects[0]?.message ?? d.eventErrors[0] ?? `HTTP ${status}`}`
+    : (d.text.trim() ? `OK "${d.text.trim().slice(0, 60)}"` : (d.toolCalls.length ? `OK tools=${d.toolCalls.length}` : 'OK 空文本'))
+  console.log(`\n== ${label}${note ? `（${note}）` : ''}\n   HTTP ${status}${netErr ? ` netErr=${netErr}` : ''} frames=${d.frames} → ${verdict}`)
+  if (d.toolCalls.length) console.log('   tool_calls:', JSON.stringify(d.toolCalls).slice(0, 200))
+  if (d.usage) console.log('   usage:', JSON.stringify(d.usage))
+  evidence.cases.push({ label, note, modelKey, modelSource, request: bodyObj, status, netErr, dissect: { ...d, text: d.text.slice(0, 2000), reasoning: d.reasoning.slice(0, 2000) }, raw: raw.slice(0, 60_000) })
+  await sleep(GAP_MS)
+  return d
+}
+
+const SUITES = {
+  /** qfmodel 变量矩阵：每例只动一个字段。 */
+  async flash() {
+    const base = { model: 'qfmodel', stream: true, stream_options: { include_usage: true }, messages: [{ role: 'user', content: '只回复两个字：收到' }] }
+    await chat('baseline', base, { note: '最小体（对照）' })
+    await chat('regression_max', { ...base, model: 'qmodel_38max' }, { note: '同账号回归对照：38max' })
+    await chat('effort_medium', { ...base, reasoning_effort: 'medium' })
+    await chat('effort_max', { ...base, reasoning_effort: 'max' }, { note: '设置卡里 qfmodel 的现存值' })
+    await chat('max_tokens_default', { ...base, max_completion_tokens: 32768 }, { note: '镜像默认输出上限' })
+    await chat('max_tokens_2048', { ...base, max_completion_tokens: 2048 })
+    await chat('tools_only', { ...base, tools: [{ type: 'function', function: { name: 'get_time', description: '取当前时间', parameters: { type: 'object', properties: { tz: { type: 'string' } }, required: ['tz'] } } }], tool_choice: 'auto' })
+    await chat('multi_turn', { ...base, messages: [{ role: 'system', content: '你是助手' }, { role: 'user', content: '我叫小明' }, { role: 'assistant', content: '好的' }, { role: 'user', content: '我叫什么' }] })
+    await chat('source_user', base, { modelSource: 'user', note: 'X-Model-Source 变量' })
+    await chat('source_unknown', base, { modelSource: 'zzz', note: '未知 source 是否被静默改派' })
+  },
+
+  /** 工具拒绝面是否按模型家族分裂：同一坏体打多个模型。 */
+  async reject() {
+    const bad = (model) => ({
+      model, stream: true, stream_options: { include_usage: true },
+      messages: [
+        { role: 'user', content: '查询时间' },
+        { role: 'tool', tool_call_id: 'call_probe_missing', content: '2026-09-22 05:00:00 +08:00' },
+      ],
+    })
+    for (const m of ['auto', 'qmodel_38max', 'qmodel', 'dmodel', 'gmodel', 'kmodel', 'mmodel']) {
+      await chat(`orphan_tool@${m}`, bad(m), { note: '孤儿 tool 消息（无前置 tool_calls）' })
+    }
+    await chat('mismatch_id@qmodel', {
+      model: 'qmodel', stream: true, stream_options: { include_usage: true },
+      messages: [
+        { role: 'user', content: '现在几点？必须调用工具查询' },
+        { role: 'assistant', content: null, tool_calls: [{ id: 'call_aaa', type: 'function', function: { name: 'get_current_time', arguments: '{"timezone":"Asia/Shanghai"}' } }] },
+        { role: 'tool', tool_call_id: 'call_bbb', content: '2026-09-22 05:00:00 +08:00' },
+      ],
+    }, { note: 'tool_call_id 与前置 tool_calls.id 不匹配' })
+    await chat('partial_results@qmodel', {
+      model: 'qmodel', stream: true, stream_options: { include_usage: true },
+      messages: [
+        { role: 'user', content: '现在几点？必须调用工具查询' },
+        {
+          role: 'assistant', content: null,
+          tool_calls: [
+            { id: 'call_aaa', type: 'function', function: { name: 'get_current_time', arguments: '{"timezone":"Asia/Shanghai"}' } },
+            { id: 'call_bbb', type: 'function', function: { name: 'get_current_time', arguments: '{"timezone":"UTC"}' } },
+          ],
+        },
+        { role: 'tool', tool_call_id: 'call_aaa', content: '2026-09-22 05:00:00 +08:00' },
+      ],
+    }, { note: '双 tool_calls 只回一个结果' })
+  },
+
+  /** 修复策略验证：孤儿 tool / 缺结果的 tool_calls 的替代形态能不能过上游。 */
+  async repair() {
+    const tools = [{ type: 'function', function: { name: 'get_current_time', description: '查询当前时间', parameters: { type: 'object', properties: { timezone: { type: 'string' } }, required: ['timezone'] } } }]
+    const mk = (messages) => ({ model: 'qmodel', stream: true, stream_options: { include_usage: true }, messages, tools, tool_choice: 'auto' })
+    const plain = { role: 'user', content: '你好，请只回复两个字：收到' }
+
+    await chat('drop_orphan_tool', mk([
+      plain,
+      { role: 'assistant', content: null, tool_calls: [{ id: 'call_abc123', type: 'function', function: { name: 'get_current_time', arguments: '{"timezone":"Asia/Shanghai"}' } }] },
+      { role: 'tool', tool_call_id: 'call_abc123', content: '(tool result unavailable: previous attempt was interrupted)' },
+    ]), { note: 'R1：孤儿 tool 直接丢弃后，工具调用已从历史消失' })
+
+    await chat('synthesize_missing_tool_result', mk([
+      plain,
+      { role: 'assistant', content: null, tool_calls: [{ id: 'call_abc123', type: 'function', function: { name: 'get_current_time', arguments: '{"timezone":"Asia/Shanghai"}' } }] },
+      { role: 'tool', tool_call_id: 'call_abc123', content: '(tool result unavailable: previous attempt was interrupted)' },
+      { role: 'user', content: '算了，直接说你好' },
+    ]), { note: 'R2：合成缺失的 tool 结果，保住 assistant.tool_calls 配对' })
+
+    await chat('pure_orphan_without_toolcalls', mk([
+      plain,
+      { role: 'tool', tool_call_id: 'call_zzz', content: '(unavailable)' },
+    ]), { note: 'R3：既无 tool_calls 也无助手消息的纯孤儿 tool' })
+
+    await chat('duplicate_assistant_tool_calls', mk([
+      plain,
+      { role: 'assistant', content: null, tool_calls: [{ id: 'call_abc123', type: 'function', function: { name: 'get_current_time', arguments: '{"timezone":"Asia/Shanghai"}' } }] },
+      { role: 'assistant', content: null, tool_calls: [{ id: 'call_abc123', type: 'function', function: { name: 'get_current_time', arguments: '{"timezone":"Asia/Shanghai"}' } }] },
+      { role: 'tool', tool_call_id: 'call_abc123', content: '2026-09-22 05:00:00 +08:00' },
+    ]), { note: 'R4：重复 assistant（同 id）' })
+  },
+
+  /** 工具回灌形态矩阵：定位 tool 角色报错的触发序列。 */
+  async tools() {
+    const tools = [{ type: 'function', function: { name: 'get_current_time', description: '查询当前时间', parameters: { type: 'object', properties: { timezone: { type: 'string' } }, required: ['timezone'] } } }]
+    const first = await chat('tool_call_gen', {
+      model: 'qmodel', stream: true, stream_options: { include_usage: true },
+      messages: [{ role: 'user', content: '现在几点？必须调用工具查询，时区用 Asia/Shanghai。' }],
+      tools, tool_choice: 'auto',
+    }, { note: '先让模型产 tool_calls（reasoning 模型 qmodel）' })
+
+    const tc = first.toolCalls[0]
+    const callId = tc?.id ?? 'call_probe_1'
+    const name = tc?.function?.name ?? 'get_current_time'
+    const args = '{"timezone":"Asia/Shanghai"}'
+    console.log(`   → 取出 callId=${callId} name=${name} args=${args}`)
+
+    await chat('tool_result_openai_shape', {
+      model: 'qmodel', stream: true, stream_options: { include_usage: true },
+      messages: [
+        { role: 'user', content: '现在几点？必须调用工具查询，时区用 Asia/Shanghai。' },
+        { role: 'assistant', content: null, tool_calls: [{ id: callId, type: 'function', function: { name, arguments: args } }] },
+        { role: 'tool', tool_call_id: callId, content: '2026-09-22 05:00:00 +08:00' },
+      ],
+      tools, tool_choice: 'auto',
+    }, { note: '标准 OpenAI 工具回灌（content:null）' })
+
+    await chat('tool_result_assistant_empty_string', {
+      model: 'qmodel', stream: true, stream_options: { include_usage: true },
+      messages: [
+        { role: 'user', content: '现在几点？必须调用工具查询，时区用 Asia/Shanghai。' },
+        { role: 'assistant', content: '', tool_calls: [{ id: callId, type: 'function', function: { name, arguments: args } }] },
+        { role: 'tool', tool_call_id: callId, content: '2026-09-22 05:00:00 +08:00' },
+      ],
+      tools, tool_choice: 'auto',
+    }, { note: 'assistant content:""（pi-ai 非 reasoning 路径形态）' })
+
+    await chat('tool_result_reasoning_content', {
+      model: 'qmodel', stream: true, stream_options: { include_usage: true },
+      messages: [
+        { role: 'user', content: '现在几点？必须调用工具查询，时区用 Asia/Shanghai。' },
+        { role: 'assistant', content: null, reasoning_content: '用户想知道现在几点，我需要调用工具。', tool_calls: [{ id: callId, type: 'function', function: { name, arguments: args } }] },
+        { role: 'tool', tool_call_id: callId, content: '2026-09-22 05:00:00 +08:00' },
+      ],
+      tools, tool_choice: 'auto',
+    }, { note: 'assistant 带 reasoning_content + tool_calls（pi-ai reasoning 路径形态）' })
+
+    await chat('tool_result_assistant_text', {
+      model: 'qmodel', stream: true, stream_options: { include_usage: true },
+      messages: [
+        { role: 'user', content: '现在几点？必须调用工具查询，时区用 Asia/Shanghai。' },
+        { role: 'assistant', content: '我来查一下。', tool_calls: [{ id: callId, type: 'function', function: { name, arguments: args } }] },
+        { role: 'tool', tool_call_id: callId, content: '2026-09-22 05:00:00 +08:00' },
+      ],
+      tools, tool_choice: 'auto',
+    }, { note: 'assistant 带正文 + tool_calls' })
+
+    await chat('tool_no_preceding_assistant', {
+      model: 'qmodel', stream: true, stream_options: { include_usage: true },
+      messages: [
+        { role: 'user', content: '查询时间' },
+        { role: 'tool', tool_call_id: callId, content: '2026-09-22 05:00:00 +08:00' },
+      ],
+      tools, tool_choice: 'auto',
+    }, { note: '故意坏体：tool 无前置 tool_calls（阳性对照）' })
+  },
+}
+
+const args = process.argv.slice(2)
+const val = (f) => { const i = args.indexOf(f); return i >= 0 ? args[i + 1] : undefined }
+const has = (f) => args.includes(f)
+const suite = val('--suite') ?? 'all'
+
+mkdirSync(PROBES_DIR, { recursive: true })
+const names = suite === 'all' ? ['reject', 'flash', 'tools'] : [suite]
+
+for (const n of names) {
+  if (!SUITES[n]) { console.error(`未知 suite: ${n}（可用：flash / tools / all）`); process.exit(1) }
+  console.log(`\n──────── suite: ${n} ────────`)
+  await SUITES[n]()
+}
+
+const out = join(PROBES_DIR, `qoder-matrix-${Date.now()}.json`)
+writeFileSync(out, JSON.stringify(evidence, null, 2))
+console.log('\n证据 →', out)