mslxdff 0.1.124 → 0.1.126

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mslxdff",
-  "version": "0.1.124",
+  "version": "0.1.126",
   "description": "测试项目，请勿使用。",
   "type": "module",
   "bin": {

package/src/cli/commands/group.js

@@ -2,6 +2,7 @@ import { createGroupsService, createBansService, refreshGroupMembers, syncPeersF
 import { createPeersService } from "../../peers.js";
 import { loadToken, loadGroupsJoined, saveGroupsJoined } from "../../state.js";
 import { groupIs, markJoined, probeHealth, syncAllJoinedGroups } from "../group-helpers.js";
+import { joinGroupCore } from "../join-core.js";
 import { errMsg } from "../util.js";
 import { argValue } from "../policy.js";
 import { compatFetch, timeoutSignal } from "../../compat.js";
@@ -149,49 +150,24 @@ export async function handleAddToGroup(args) {
   const isBroadband = rawArgs.includes("--broadband");
   const filtered = rawArgs.filter((a) => a !== "--broadband");
   const [leaderHost, name] = filtered;
-  if (!leaderHost || !name || filtered.length > 2) {
+  if (filtered.length > 2) {
     console.error("usage: mslxdff -addtogroup <leader-host> <name> [--broadband]");
     process.exit(1);
   }
-  const groups = createGroupsService({});
-  const peers = createPeersService({});
-  const myToken = (await loadToken()).token;
-  const leaderUrl = leaderHost.includes("://")
-    ? leaderHost.replace(/\/+$/, "")
-    : `http://${leaderHost}${leaderHost.includes(":") ? "" : ":8989"}`;
-  const kind = isBroadband ? "broadband" : "static";
-  let joinBody;
-  if (isBroadband) {
-    const relayId = `relay://${myToken.slice(0, 8)}`;
-    joinBody = { name, key: name, leaderUrl, url: relayId, token: myToken, kind: "broadband" };
-  } else {
-    const { effectivePort } = await import("../policy.js");
-    const myPort = effectivePort(args);
-    joinBody = { name, key: name, leaderUrl, myPort, token: myToken, kind: "static" };
+  if (!leaderHost || !name) {
+    // 缺参数 → 手机宽带接入向导（默认 broadband：手机无公网入站，只出站）
+    const { runJoinWizard } = await import("../join-wizard.js");
+    const r = await runJoinWizard({ leaderInput: leaderHost || null, groupName: name || null });
+    process.exit(r.ok ? 0 : 1);
   }
-  try {
-    const res = await compatFetch(`${leaderUrl}/v1/groups/join`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(joinBody),
-    });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      throw new Error(`join failed (HTTP ${res.status}): ${text}`);
-    }
-    const data = await res.json();
-    const myUrl = data.you?.url || joinBody.url || "";
-    const memberName = isBroadband ? myUrl : myUrl;
-    markJoined({ name, leaderUrl, myUrl, memberName, kind });
-    const synced = await syncAllJoinedGroups({ peers, groups });
-    const s = synced.find((x) => x.name === name);
-    console.log(`joined group "${name}" at ${leaderUrl}${isBroadband ? " [broadband]" : ""}`);
-    if (s?.error) console.log(`  local failover setup failed: ${s.error}`);
-    else console.log(`  ${s?.added ?? 0} failover target(s) configured${isBroadband ? " (broadband via leader, local 127.0.0.1)" : ""}`);
-  } catch (err) {
-    console.error(`join failed: ${err.message}`);
+  const r = await joinGroupCore({ leaderHost, name, isBroadband, args });
+  if (!r.ok) {
+    console.error(`join failed: ${r.error}`);
     process.exit(1);
   }
+  console.log(`joined group "${name}" at ${r.leaderUrl}${isBroadband ? " [broadband]" : ""}`);
+  if (r.syncError) console.log(`  local failover setup failed: ${r.syncError}`);
+  else console.log(`  ${r.added ?? 0} failover target(s) configured${isBroadband ? " (broadband via leader, local 127.0.0.1)" : ""}`);
   process.exit(0);
 }
 

package/src/cli/help.js

@@ -29,7 +29,7 @@ Usage:
   mslxdff -workbuddy checkin        daily 100 credits（双域幂等，已签 code 10001 视为成功）
   mslxdff -providers list          list all configured upstream providers (opencode, openrouter, generic, workbuddy)
   mslxdff -creategroup <name>      create a group on this node (the group name is the password)
-  mslxdff -addtogroup <leader-host> <name> [--broadband]  join a group via its leader host (default port 8989) — broadband: 宽带动态IP成员（经Leader中继，无需公网入站，默认127.0.0.1）
+  mslxdff -addtogroup [<host> [<name>]] [--broadband]  join a group via its leader host (default port 8989) — broadband: 宽带动态IP成员（经Leader中继，无需公网入站）；省略参数＝手机宽带向导（问地址+组名，自动起服务，报出口 IP）
   mslxdff -group sync              pull the freshest member list for all joined groups
   mslxdff -group leave <name>      leave a group (removes its members from this node)
   mslxdff -group list              list groups on this node (numbered members)
@@ -46,6 +46,8 @@ Usage:
   mslxdff -use-group [on|off]     本机失败时是否走组员网络（默认 on；off 则所有供应商仅本机，MSLXDFF_USE_GROUP 环境变量可覆盖）
   mslxdff -help                    show this help
 
+手机接入（Android/Termux）: pkg install nodejs-lts → npm i -g mslxdff → mslxdff -addtogroup → termux-wake-lock（详见 docs/MOBILE.md）
+
 Environment:
   MSLXDFF_PORT          listen port (default 8989; use mslxdff -port N to persist)
   MSLXDFF_STATE_FILE      token/port state file

package/src/cli/join-core.js

@@ -0,0 +1,99 @@
+import { createGroupsService } from "../groups.js";
+import { createPeersService } from "../peers.js";
+import { loadToken } from "../state.js";
+import { markJoined, syncAllJoinedGroups } from "./group-helpers.js";
+import { compatFetch, timeoutSignal } from "../compat.js";
+import { errMsg } from "./util.js";
+
+const DEFAULT_PORT = 8989;
+const JOIN_TIMEOUT_MS = 8000;
+
+/** 组长地址归一化 + 人话校验（ADR-0006 术语 leader-host）：`1.2.3.4` → `http://1.2.3.4:8989`。 */
+export function normalizeLeaderUrl(raw, { defaultPort = DEFAULT_PORT } = {}) {
+  const s = String(raw ?? "").trim();
+  if (!s) return { ok: false, reason: "请填写组长地址（如 1.2.3.4:8989）" };
+  if (/\s/.test(s)) return { ok: false, reason: "地址不能包含空格" };
+  const schemeMatch = /^([a-z][a-z0-9+.-]*):\/\//i.exec(s);
+  if (schemeMatch && !/^https?$/i.test(schemeMatch[1])) {
+    return { ok: false, reason: "只支持 http:// 或 https:// 开头的地址" };
+  }
+  const withScheme = Boolean(schemeMatch);
+  let body = withScheme ? s.slice(schemeMatch[0].length) : s;
+  if (body.endsWith("/")) body = body.replace(/\/+$/, "");
+  if (body.includes("/")) return { ok: false, reason: "暂不支持带路径的地址（只填 ip:端口）" };
+  if (!body) return { ok: false, reason: "地址缺少主机名" };
+  let host = body;
+  let port = null;
+  const v6End = body.lastIndexOf("]");
+  const ci = body.lastIndexOf(":");
+  if (!(v6End >= 0 && v6End === body.length - 1 && ci < v6End)) {
+    if (ci >= 0) {
+      host = body.slice(0, ci);
+      const p = body.slice(ci + 1);
+      if (!/^\d{1,5}$/.test(p)) return { ok: false, reason: "端口必须是数字（1-65535）" };
+      port = Number(p);
+      if (port < 1 || port > 65535) return { ok: false, reason: "端口超出范围（1-65535）" };
+    }
+  }
+  if (!host) return { ok: false, reason: "地址缺少主机名" };
+  const isV6 = /^\[[0-9a-fA-F:.]+\]$/.test(host);
+  if (!isV6 && !/^[\w.-]+$/.test(host)) return { ok: false, reason: "主机名含非法字符（支持 ip、域名或 [ipv6]）" };
+  const url = withScheme
+    ? `${schemeMatch[1].toLowerCase()}://${host}${port ? `:${port}` : ""}`
+    : `http://${host}:${port ?? defaultPort}`;
+  return { ok: true, url };
+}
+
+/**
+ * 加入远端组（宽带/静态共用核心）：归一化 → POST /v1/groups/join → markJoined → 同步 peers。
+ * 只返回结果对象，不打印、不 exit——由 CLI 命令与交互式向导各自决定展示与退出码。
+ */
+export async function joinGroupCore({ leaderHost, name, isBroadband = false, args = [] }) {
+  const norm = normalizeLeaderUrl(leaderHost);
+  if (!norm.ok) return { ok: false, error: norm.reason, reason: norm.reason };
+  const leaderUrl = norm.url;
+  const groupName = String(name ?? "").trim();
+  if (!groupName) return { ok: false, leaderUrl, error: "组名不能为空" };
+  const groups = createGroupsService({});
+  const peers = createPeersService({});
+  const myToken = (await loadToken()).token;
+  const kind = isBroadband ? "broadband" : "static";
+  let joinBody;
+  if (isBroadband) {
+    const relayId = `relay://${myToken.slice(0, 8)}`;
+    joinBody = { name: groupName, key: groupName, leaderUrl, url: relayId, token: myToken, kind };
+  } else {
+    const { effectivePort } = await import("./policy.js");
+    joinBody = { name: groupName, key: groupName, leaderUrl, myPort: effectivePort(args), token: myToken, kind };
+  }
+  try {
+    const res = await compatFetch(`${leaderUrl}/v1/groups/join`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(joinBody),
+      signal: timeoutSignal(JOIN_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      return { ok: false, leaderUrl, error: `HTTP ${res.status} ${text.slice(0, 200)}` };
+    }
+    const data = await res.json().catch(() => ({}));
+    const myUrl = data.you?.url || joinBody.url || "";
+    markJoined({ name: groupName, leaderUrl, myUrl, memberName: myUrl, kind });
+    const synced = await syncAllJoinedGroups({ peers, groups });
+    const s = synced.find((x) => x.name === groupName);
+    return {
+      ok: true,
+      leaderUrl,
+      name: groupName,
+      myUrl,
+      memberName: myUrl,
+      kind,
+      added: s?.added ?? 0,
+      syncError: s?.error || null,
+      token: myToken,
+    };
+  } catch (err) {
+    return { ok: false, leaderUrl, error: errMsg(err) };
+  }
+}

package/src/cli/join-wizard.js

@@ -0,0 +1,171 @@
+import { createInterface } from "../readline-compat.js";
+import { normalizeLeaderUrl, joinGroupCore } from "./join-core.js";
+import { compatFetch, timeoutSignal } from "../compat.js";
+import { errMsg } from "./util.js";
+
+const PROBE_TIMEOUT_MS = 6000;
+const SERVICE_HEALTH_TIMEOUT_MS = 6000;
+const MAX_ATTEMPTS = 3;
+
+export function isTermux(env = process.env) {
+  return Boolean(env?.TERMUX_VERSION) || String(env?.PREFIX || "").includes("com.termux");
+}
+
+export function createAskSession() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: Boolean(process.stdin.isTTY) });
+  // 逐行异步迭代而非 rl.question：question 回调在管道/多行同 chunk 时会丢行（绑定前的行被 emit 掉），
+  // 且 stdin 结束（管道 EOF / Ctrl+D）时 pending 的 question 永不 resolve，会让顶层 await 悬挂退出（exit 13）。
+  const it = rl[Symbol.asyncIterator]();
+  return {
+    ask: async (q) => {
+      process.stdout.write(q);
+      const { value, done } = await it.next();
+      return done ? null : value;
+    },
+    close: () => {
+      try { rl.close(); } catch {}
+    },
+  };
+}
+
+/** 出口 IP：组长侧 clientIp() 视角（ADR-0006：不靠 ifconfig.me）。 */
+export async function probeExitIp({ leaderUrl, token, group }) {
+  try {
+    const res = await compatFetch(`${leaderUrl}/v1/groups/relay/heartbeat`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+      body: JSON.stringify({ name: group, group }),
+      signal: timeoutSignal(PROBE_TIMEOUT_MS),
+    });
+    if (!res.ok) return null;
+    const j = await res.json().catch(() => null);
+    return j?.ip || null;
+  } catch {
+    return null;
+  }
+}
+
+/** 确保后台服务在跑：已在跑则复用；否则启动并等 health（daemon 的 10s ensure 会自动接上长连）。 */
+export async function ensureServiceRunning() {
+  const { readPid, isPidAlive, startDaemon } = await import("../daemon.js");
+  const { waitForHealth, effectivePort } = await import("./policy.js");
+  const pid = readPid();
+  if (pid && isPidAlive(pid)) return { pid, started: false };
+  const newPid = startDaemon([]);
+  await waitForHealth(effectivePort([]), SERVICE_HEALTH_TIMEOUT_MS);
+  return { pid: newPid, started: true };
+}
+
+/**
+ * 手机宽带接入向导：问组长地址 → 问组名 → 宽带入组 → 报出口 IP → 确保服务运行 → 保活指引。
+ * 依赖全可注入（session/join/probeIp/ensureService/out/env），便于单测与复用。
+ * // Note: 为什么默认 broadband、为何用 iterator 而非 rl.question — 见 .agents/notes/implemented/feature/2026-09-16-mobile-broadband-join-wizard.md
+ */
+export async function runJoinWizard(opts = {}) {
+  const out = opts.out || ((line) => console.log(line));
+  const env = opts.env || process.env;
+  const session = opts.session || createAskSession();
+  const ask = opts.ask || ((q) => session.ask(q));
+  const join = opts.join || joinGroupCore;
+  const ensureService = opts.ensureService || ensureServiceRunning;
+  const probeIp = opts.probeIp || probeExitIp;
+  const maxAttempts = opts.maxAttempts ?? MAX_ATTEMPTS;
+
+  out("");
+  out("  手机宽带接入 — 让这台设备成为组内出口（不占端口，只出站）");
+  out("");
+
+  let leaderUrl = null;
+  let name = String(opts.groupName ?? "").trim();
+
+  try {
+    if (opts.leaderInput) {
+      const norm = normalizeLeaderUrl(opts.leaderInput);
+      if (!norm.ok) {
+        out(`✗ 组长地址无效：${norm.reason}`);
+        out("  重试：mslxdff -addtogroup");
+        return { ok: false, error: norm.reason };
+      }
+      leaderUrl = norm.url;
+    } else {
+      for (let i = 0; i < maxAttempts; i++) {
+        const raw = await ask("1/2 组长地址（ip:端口，如 149.13.91.10:8989）: ");
+        if (raw === null) {
+          out("· 已取消（输入结束）");
+          return { ok: false, error: "cancelled" };
+        }
+        const norm = normalizeLeaderUrl(raw);
+        if (norm.ok) {
+          leaderUrl = norm.url;
+          break;
+        }
+        out(`  ✗ ${norm.reason}`);
+      }
+      if (!leaderUrl) {
+        out("✗ 组长地址始终无效，已退出。重试：mslxdff -addtogroup");
+        return { ok: false, error: "invalid leader input" };
+      }
+    }
+
+    if (!name) {
+      for (let i = 0; i < maxAttempts; i++) {
+        const raw = await ask("2/2 组名: ");
+        if (raw === null) {
+          out("· 已取消（输入结束）");
+          return { ok: false, error: "cancelled" };
+        }
+        const v = String(raw).trim();
+        if (v) {
+          name = v;
+          break;
+        }
+        out("  ✗ 组名不能为空");
+      }
+      if (!name) {
+        out("✗ 未填写组名，已退出。重试：mslxdff -addtogroup");
+        return { ok: false, error: "empty group name" };
+      }
+    }
+  } finally {
+    session.close();
+  }
+
+  out(`→ 正在连接组长 ${leaderUrl} ...`);
+  const r = await join({ leaderHost: leaderUrl, name, isBroadband: true });
+  if (!r?.ok) {
+    out(`✗ 加入失败：${r?.error || "未知错误"}`);
+    out("  检查：① 地址与端口是否正确 ② 组长服务是否在跑 ③ 手机网络是否可达");
+    out("  重试：mslxdff -addtogroup");
+    return { ok: false, leaderUrl, error: r?.error || "join failed" };
+  }
+  out(`✓ 已加入组「${name}」（宽带成员 ${r.myUrl}）`);
+  if (r.syncError) out(`  ⚠ 组员列表同步失败（不影响出口贡献）：${r.syncError}`);
+
+  out("→ 正在确认出口 IP ...");
+  const exitIp = await probeIp({ leaderUrl: r.leaderUrl || leaderUrl, token: r.token, group: name }).catch(() => null);
+  if (exitIp) out(`✓ 出口 IP: ${exitIp}（组长视角，上游分流按这个 IP）`);
+  else out("· 出口 IP 待确认（组长暂时不可达，恢复后自动重试）");
+
+  out("→ 正在启动后台服务 ...");
+  const service = await ensureService().catch((err) => ({ error: errMsg(err) }));
+  if (service?.error) {
+    out(`✗ 后台服务启动失败：${service.error}`);
+    out("  手动启动：mslxdff -d      查看日志：mslxdff -log 50");
+  } else if (service?.started) {
+    out(`✓ 后台服务已启动（pid ${service.pid}）`);
+  } else {
+    out(`✓ 后台服务已在运行（pid ${service.pid}），已自动接入`);
+  }
+
+  out("");
+  out("保持在线：");
+  if (isTermux(env)) {
+    out("  • termux-wake-lock    防止系统休眠杀进程（强烈建议）");
+  } else {
+    out("  • 关机/断网后需重跑本命令");
+  }
+  out("  • mslxdff -status     查看组与出口状态");
+  out("  • mslxdff -stop       停止贡献");
+  out("");
+  return { ok: true, leaderUrl, name, myUrl: r.myUrl, exitIp, service };
+}

package/src/daemon.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, openSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
 import { join, dirname } from "node:path";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
@@ -16,11 +16,17 @@ export function logFile() {
   return join(daemonDir(), "daemon.log");
 }
 
-export function startDaemon(args = []) {
+// 当前代码所在的 CLI 入口（bin/mslxdff.js 绝对路径）：startDaemon 与
+// auto-update 的 -restart 委托共用（后者从 daemon 进程 spawn 时必须指向同一份代码）。
+export function daemonEntry() {
   const here = fileURLToPath(import.meta.url);
-  const entry = here.endsWith("bin/mslxdff.js")
+  return here.endsWith("bin/mslxdff.js")
     ? here
     : join(dirname(here), "..", "bin", "mslxdff.js");
+}
+
+export function startDaemon(args = []) {
+  const entry = daemonEntry();
   const dir = daemonDir();
   mkdirSync(dir, { recursive: true });
   const logFd = openSync(logFile(), "a", 0o600);
@@ -70,6 +76,12 @@ export function isPidAlive(pid) {
 export function stopDaemon() {
   const pid = readPid();
   if (!pid) return { stopped: false, reason: "no pid file" };
+  // 杀者留痕（写 daemon.log）：Windows 的 SIGTERM 是 TerminateProcess 强杀，被杀的 daemon
+  // 在 JS 层收不到任何事件（无法自记），故由"杀者"记录调用方 pid——
+  // 没有这行 = 非我方所杀（外部 taskkill/任务管理器/崩溃），配合最后一条 heartbeat 定位死亡时刻。
+  try {
+    appendFileSync(logFile(), `[lifecycle] stopDaemon called by pid=${process.pid} — killing daemon pid=${pid}\n`);
+  } catch {}
   try {
     process.kill(pid, "SIGTERM");
   } catch (err) {

package/src/routes/peers.js

@@ -8,6 +8,12 @@ import { compatFetch, timeoutSignal, getUndici } from "../compat.js";
 const PEER_TIMEOUT_MS = 30_000;
 const PEER_STATUS_TIMEOUT_MS = 2_000;
 const DEFAULT_PEER_CONNECT_TIMEOUT_MS = 3_000;
+// SSE 响应体数据间隔超时（undici bodyTimeout）。慢模型首块后可静默思考远超 30s，
+// 沿用 30s 会把组内转发的中继活流掐成 "terminated"（实测首块后 ~31s 必断，本地直连
+// 无此限制——组内因此比直连"不流畅"）。与应用层 MAX_STREAM_MS(120s) 对齐：
+// undici 层只做最后兜底，掐流交给应用层的首块/总时长策略。
+const PEER_BODY_TIMEOUT_MS = 120_000;
+export { PEER_BODY_TIMEOUT_MS };
 
 function peerConnectTimeoutMs() {
   const n = Number(process.env.MSLXDFF_PEER_CONNECT_TIMEOUT_MS);
@@ -25,7 +31,7 @@ function getPeerDispatcher() {
     peerDispatcher = new Agent({
       connect: { timeout: peerConnectTimeoutMs() },
       headersTimeout: PEER_TIMEOUT_MS,
-      bodyTimeout: PEER_TIMEOUT_MS,
+      bodyTimeout: PEER_BODY_TIMEOUT_MS,
       keepAliveTimeout: 30_000,
       keepAliveMaxTimeout: 60_000,
     });
@@ -104,8 +110,9 @@ export async function peerHealthyModels(peer, { timeoutMs = PEER_STATUS_TIMEOUT_
   return p;
 }
 
-async function forwardToPeer(peer, body, model, hops) {
-  const controller = new AbortController();
+// controller 由调用方持有：赛跑 winner 确定后可主动 abort 其余 in-flight，
+// 避免迟到流挂满 bodyTimeout（并给对方省下无用负载）。30s timer 仅覆盖"等响应头"。
+async function forwardToPeer(peer, body, model, hops, controller = new AbortController()) {
   const timer = setTimeout(() => controller.abort(), PEER_TIMEOUT_MS);
   try {
     const headers = {
@@ -178,23 +185,39 @@ export async function racePeerCandidates(candidates, ctx) {
     const completed = await new Promise((resolve) => {
       const order = [];
       const total = prepared.length;
+      const ctrls = new Map(); // url -> controller（winner 后统一取消其余）
       let settled = false;
       const finish = (winner) => {
         if (settled) return;
         settled = true;
+        if (winner) {
+          for (const c of ctrls.values()) {
+            if (c === winner.ctrl) continue;
+            c.killedByUs = true;
+            c.abort();
+          }
+        }
         resolve({ list: order, winner });
       };
       for (const { peer, target } of prepared) {
         tried.add(peer.url);
+        const ctrl = new AbortController();
+        ctrls.set(peer.url, ctrl);
         ctx.evt("peer-request", { peer: peer.url, model: target, hops: ctx.hops + 1 });
         // 插件 hook：peer:beforeForward — 转发给组员前观察
         if (ctx.plugins?.length) {
           runHook(ctx.plugins, "peer:beforeForward", { reqId: ctx.reqId, peer: peer.url, model: target, hops: ctx.hops + 1 }).catch(() => {});
         }
         const t0 = performance.now();
-        forwardToPeer(peer, ctx.body, target, ctx.hops).then((res) => {
+        forwardToPeer(peer, ctx.body, target, ctx.hops, ctrl).then((res) => {
           const latencyMs = Math.round(performance.now() - t0);
           const failed = res instanceof Error || res.status >= 400;
+          // winner 已定后被我们主动取消：静默，不记账不报错（否则污染健康统计与错误日志）
+          if (res instanceof Error && ctrl.killedByUs) {
+            order.push({ ok: false, peer, target, res, status: 0, killed: true });
+            if (order.length === total) finish(null);
+            return;
+          }
           ctx.evt("peer-forward", { peer: peer.url, model: target, hops: ctx.hops + 1, latencyMs, ok: !failed });
           // 插件 hook：peer:result — 组员响应后观察
           if (ctx.plugins?.length) {
@@ -211,7 +234,7 @@ export async function racePeerCandidates(candidates, ctx) {
             recordLater(() => ctx.peers.recordResult(peer.url, { ok: false }));
             if (order.length === total) finish(null);
           } else {
-            const entry = { ok: true, peer, target, res, latencyMs };
+            const entry = { ok: true, peer, target, res, latencyMs, ctrl };
             order.push(entry);
             if (!settled) {
               // 第一个成功立即返回：不等慢/黑洞候选（迟到者的记账由各分支自理）

package/src/runtime/auto-update.js

@@ -1,6 +1,24 @@
+import { closeSync, openSync } from "node:fs";
 import { autoUpdateIntervalMs } from "../cli/policy.js";
 import { errMsg, npmCmd, run } from "../cli/util.js";
-import { resolvePort } from "../server.js";
+
+// 升级后的重启委托：在 daemon 进程内直调 stopDaemon() 是自杀式 SIGTERM，
+// 会打断紧随其后的 startDaemon()/waitForHealth()（2026-09-15 实测：0.1.124→0.1.125
+// 自动升级后 daemon 反复抢占/静默消失 7 分钟）。改为 spawn 一个 CLI 子进程执行
+// `-restart`（成熟路径：杀旧 + 起新 + health 二次确认），daemon 自己不再掌舵重启。
+// env 必须剔除 MSLXDFF_DAEMON，否则子进程的 handleRestart 守卫会把 -restart 当 no-op。
+export function spawnRestartViaCli({ spawnFn, nodePath, entry, logFd, env }) {
+  const clean = { ...env };
+  delete clean.MSLXDFF_DAEMON;
+  delete clean.MSLXDFF_DEBUG;
+  const child = spawnFn(nodePath, [entry, "-restart"], {
+    detached: true,
+    stdio: ["ignore", logFd, logFd],
+    env: clean,
+  });
+  child.unref();
+  return child.pid;
+}
 
 export function setupAutoUpdate({ VERSION, bus, logs }) {
   const autoUpdateMs = autoUpdateIntervalMs();
@@ -78,12 +96,18 @@ export function setupAutoUpdate({ VERSION, bus, logs }) {
     emitAutoUpdate("auto-update-installed", { current: VERSION, latest, stdout: String(up.stdout || "").slice(0, 500) });
     console.log(`auto-update: installed v${latest}, restarting daemon...`);
     emitAutoUpdate("auto-update-restarting", { current: VERSION, latest });
-    const { stopDaemon, startDaemon } = await import("../daemon.js");
-    try { stopDaemon(); } catch (e) { emitAutoUpdate("auto-update-stop-failed", { error: errMsg(e) }); }
-    const { waitForHealth } = await import("../cli/policy.js");
-    const newPid = startDaemon([]);
-    await waitForHealth(resolvePort(), 8000);
-    console.log(`auto-update: restarted as v${latest} (pid ${newPid})`);
-    emitAutoUpdate("auto-update-restarted", { current: VERSION, latest, newPid });
+    const { daemonEntry, logFile } = await import("../daemon.js");
+    const { spawn } = await import("node:child_process");
+    const logFd = openSync(logFile(), "a", 0o600);
+    let restarterPid = null;
+    try {
+      restarterPid = spawnRestartViaCli({ spawnFn: spawn, nodePath: process.execPath, entry: daemonEntry(), logFd, env: process.env });
+    } finally {
+      try { closeSync(logFd); } catch {}
+    }
+    // 不再自己 stopDaemon()/startDaemon()/waitForHealth()：-restart 会杀旧（我们）并起新版本；
+    // 若它失败，本进程保持服务（下轮 60m 检查重试），绝不让重启半途变成"两个都死"。
+    console.log(`auto-update: restart handed to CLI -restart (pid ${restarterPid})`);
+    emitAutoUpdate("auto-update-restart-spawned", { current: VERSION, latest, pid: restarterPid });
   }
 }

package/src/runtime/bootstrap.js

@@ -11,6 +11,8 @@ const logs = { appendCall, appendError, appendEvent };
  * 重活下沉 providers-setup / server-lifecycle / group-sync / broadband(-stream)。
  */
 export async function startDaemonMain(VERSION) {
+  const { installLifecycleLog } = await import("./lifecycle-log.js");
+  installLifecycleLog({ version: VERSION, logs });
   const ctx = await setupProviders();
   const { srv, bus } = await startServerLifecycle({ VERSION, ...ctx, logs });
   void srv;

package/src/runtime/broadband-stream.js

@@ -25,6 +25,7 @@ export function startBroadbandStream({ token, upstream, execAndPost, broadbandGr
         if (!res.ok) throw new Error(`stream ${res.status}`);
         if (!res.body) throw new Error("no body");
         attempts = 0;
+        console.log(`broadband relay: connected ${g.name} via ${g.leaderUrl} (SSE)`);
         let buf = "";
         const decodeChunk = (c) => {
           if (typeof c === "string") return c;
@@ -73,5 +74,6 @@ export function startBroadbandStream({ token, upstream, execAndPost, broadbandGr
     for (const g of broadbandGroups()) if (!streamManagers.has(g.name)) startStreamForGroup(g);
   }, 10_000);
   ensureTimer.unref();
-  console.log(`broadband relay: stream (SSE) + ping 25s for ${broadbandGroups().length} group(s)`);
+  const n = broadbandGroups().length;
+  console.log(n ? `broadband relay: stream (SSE) + ping 25s for ${n} group(s)` : "broadband relay: idle (0 group) — waiting for a group join, checked every 10s");
 }

package/src/runtime/broadband.js

@@ -6,10 +6,11 @@ import { compatFetch, timeoutSignal } from "../compat.js";
 /**
  * 宽带中继 — poll 模式（heartbeat + poll）与 stream 模式分发。
  * stream 长连下沉 broadband-stream.js，本文件保留任务执行与降级分支。
+ * 空组不再早退：加组后由 ensure（stream 10s / poll 每次读组）自动接上，无需重启 daemon。
+ * // Note: 空组不早退与向导默认 broadband 的取舍 — 见 .agents/notes/implemented/feature/2026-09-16-mobile-broadband-join-wizard.md
  */
 export function startBroadband({ token, upstream }) {
   const broadbandGroups = () => loadGroupsJoined().filter((g) => g.kind === "broadband" && g.leaderUrl);
-  if (!broadbandGroups().length) return;
   const streamEnabled = (() => {
     const v = process.env.MSLXDFF_BROADBAND_STREAM;
     if (v === "0" || v === "false" || v === "off") return false;
@@ -91,7 +92,8 @@ export function startBroadband({ token, upstream }) {
     hbTimer.unref();
     const pollTimer = setInterval(doPoll, 1000);
     pollTimer.unref();
-    console.log(`broadband relay: heartbeat 30s + poll 1s for ${broadbandGroups().length} group(s) [poll mode]`);
+    const n = broadbandGroups().length;
+    console.log(n ? `broadband relay: heartbeat 30s + poll 1s for ${n} group(s) [poll mode]` : "broadband relay: idle (0 group) — waiting for a group join [poll mode]");
     return;
   }
   startBroadbandStream({ token, upstream, execAndPost, broadbandGroups });

package/src/runtime/lifecycle-log.js

@@ -0,0 +1,64 @@
+// daemon 生命周期留痕：启动 / 信号 / 顶层异常 / 退出 / 心跳。
+// 目的：daemon "神秘消失"时，daemon.log 能直接区分四种死法——
+//   被信号杀（有 `SIGTERM received` 行）、崩溃（有 uncaughtException 行）、
+//   被 SIGKILL/任务管理器杀（只有未送达的 exit 行 → 看最后一条 heartbeat 定位死亡时刻）、
+//   OOM 积累（heartbeat 的 rss 曲线）。
+// 顶层异常只记录不退出（代理服务无持久状态，活着比干净退出更有价值；异常多为请求级漏网）。
+import { appendEvent } from "../logs.js";
+
+const HEARTBEAT_MS = Math.max(60_000, Number(process.env.MSLXDFF_HEARTBEAT_MS) || 30 * 60 * 1000);
+
+function log(line) {
+  try { console.log(line); } catch {}
+}
+
+// 纯函数：启动行（可测）
+export function lifecycleStartLine({ version, pid, ppid, node, platform, cwd }) {
+  return `[lifecycle] start pid=${pid} ppid=${ppid} version=${version} node=${node} platform=${platform} cwd=${cwd}`;
+}
+
+export function lifecycleHeartbeatLine({ pid, uptimeMin, rssMb }) {
+  return `[lifecycle] heartbeat pid=${pid} uptime=${uptimeMin}m rss=${rssMb}mb`;
+}
+
+export function installLifecycleLog({ version, bus, logs } = {}) {
+  const t0 = Date.now();
+  const rssMb = () => Math.round((process.memoryUsage?.().rss ?? 0) / 1048576);
+  const emit = (type, data) => {
+    try { bus?.emit({ ts: Date.now(), type, ...data }); } catch {}
+    try { logs?.appendEvent?.({ ts: Date.now(), type, ...data }); } catch {}
+  };
+
+  log(lifecycleStartLine({
+    version,
+    pid: process.pid,
+    ppid: process.ppid,
+    node: process.version,
+    platform: process.platform,
+    cwd: process.cwd(),
+  }));
+  emit("lifecycle-start", { pid: process.pid, ppid: process.ppid, version, node: process.version });
+
+  process.on("uncaughtException", (e) => {
+    const detail = String(e?.stack || e?.message || e).slice(0, 2000);
+    log(`[lifecycle] uncaughtException (kept running): ${detail}`);
+    emit("lifecycle-uncaught", { detail: detail.slice(0, 500) });
+  });
+  process.on("unhandledRejection", (r) => {
+    const detail = String(r?.stack || r?.message || r).slice(0, 2000);
+    log(`[lifecycle] unhandledRejection (kept running): ${detail}`);
+    emit("lifecycle-unhandled-rejection", { detail: detail.slice(0, 500) });
+  });
+  process.on("exit", (code) => {
+    const uptimeSec = Math.round((Date.now() - t0) / 1000);
+    log(`[lifecycle] exit code=${code} uptime=${uptimeSec}s rss=${rssMb()}mb`);
+  });
+  process.on("SIGHUP", () => log(`[lifecycle] SIGHUP received (ignored, pid ${process.pid})`));
+
+  const hb = setInterval(() => {
+    // 心跳只落 daemon.log（不写 events.log：48 条/天，避免污染结构化事件流）
+    log(lifecycleHeartbeatLine({ pid: process.pid, uptimeMin: Math.round((Date.now() - t0) / 60000), rssMb: rssMb() }));
+  }, HEARTBEAT_MS);
+  hb.unref?.();
+  return { heartbeatMs: HEARTBEAT_MS };
+}

package/src/runtime/server-lifecycle.js

@@ -66,7 +66,7 @@ export async function startServerLifecycle({ VERSION, token, created, upstream,
     const msg = String(err?.message || err);
     const code = err?.code || "";
     if (code === "EADDRINUSE" || msg.includes("EADDRINUSE")) {
-      console.log(`port ${resolvePort()} in use — freeing stale holder and retrying...`);
+      console.log(`[lifecycle] EADDRINUSE on port ${resolvePort()} — freeing stale holder and retrying...`);
       try {
         const { execFile } = await import("node:child_process");
         const execAsync2 = (f, a) => new Promise((res) => execFile(f, a, { windowsHide: true, timeout: 4000 }, (e, so, se) => res({ e, so: String(so||""), se: String(se||"") })));
@@ -86,6 +86,8 @@ export async function startServerLifecycle({ VERSION, token, created, upstream,
             while ((m2 = re2.exec(line))) pids.add(Number(m2[1]));
           }
         }
+        if (pids.size) console.log(`[lifecycle] killing stale holder(s): ${[...pids].join(",")} (self=${process.pid})`);
+        else console.log(`[lifecycle] no holder pid discoverable (ss/fuser unavailable on this platform?) — retry may fail`);
         for (const p of pids) { if (p !== process.pid) try { process.kill(p, "SIGTERM"); } catch {} }
         if (pids.size) await new Promise((r2) => setTimeout(r2, 600));
         for (const p of pids) try { const { isPidAlive } = await import("../daemon.js"); if (isPidAlive(p)) process.kill(p, "SIGKILL"); } catch {}
@@ -147,7 +149,7 @@ export async function startServerLifecycle({ VERSION, token, created, upstream,
   }
   const addr = srv.server.address();
   const host = addr.address === "0.0.0.0" || addr.address === "::" ? "localhost" : addr.address;
-  console.log(`mslxdff v${VERSION} listening on http://${host}:${addr.port}`);
+  console.log(`mslxdff v${VERSION} listening on http://${host}:${addr.port} (pid ${process.pid})`);
   if (created) {
     console.log(`auth token: ${token}`);
   }

package/src/server.js

@@ -30,8 +30,15 @@ export function startServer({ router, signals = true, host, onBeforeClose }, por
   };
 
   if (signals) {
-    process.on("SIGINT", close);
-    process.on("SIGTERM", close);
+    // 关停留痕（Linux 有效：可捕获 SIGTERM/SIGINT 并记录）。Windows 注意：process.kill 的
+    // SIGTERM 实为 TerminateProcess 强杀，被杀的 JS 进程收不到该事件，此处不会触发——
+    // Windows 的"谁杀了我"靠 src/daemon.js stopDaemon() 的杀者留痕 + 最后一条 heartbeat。
+    const onSignal = (sig) => {
+      try { console.log(`[lifecycle] ${sig} received — shutting down (pid ${process.pid}, uptime ${Math.round(process.uptime())}s)`); } catch {}
+      close();
+    };
+    process.on("SIGINT", () => onSignal("SIGINT"));
+    process.on("SIGTERM", () => onSignal("SIGTERM"));
   }
 
   return { server, ready, close };

package/src/upstream-engine/sdk/convert.js

@@ -39,7 +39,7 @@ function parseToolArgs(raw) {
   try { return JSON.parse(String(raw)); } catch { return {}; }
 }
 
-export function toModelPrompt(messages) {
+export function toModelPrompt(messages, { dropEncrypted = false } = {}) {
   const out = [];
   for (const m of Array.isArray(messages) ? messages : []) {
     if (!m || typeof m !== "object") continue;
@@ -55,11 +55,17 @@ export function toModelPrompt(messages) {
       // 无加密态时才退回纯文本 reasoning（chat 通道的 reasoning_content）。
       // 空串是 payload 回填的有意标记（requiresReasoningContentOnAssistantMessages）：所有 assistant
       // 必须带该字段——AI SDK 以 length>0 判定是否输出，故用 " " 占位而非 ""。
+      // dropEncrypted：上游拒收跨 caller 的加密态时的降级重试——只留可读摘要（无摘要则整条跳过，
+      // 留给下面的明文 reasoning_content 兜底），不置 pushedEncrypted。
       const items = Array.isArray(m.reasoning_items) ? m.reasoning_items : [];
       let pushedEncrypted = false;
       for (const r of items) {
         if (!r || typeof r !== "object") continue;
         const summaryText = Array.isArray(r.summary) ? r.summary.map((s) => s?.text || "").join("\n") : "";
+        if (dropEncrypted) {
+          if (summaryText) parts.push({ type: "reasoning", text: summaryText });
+          continue;
+        }
         parts.push({
           type: "reasoning",
           text: summaryText || " ",

package/src/upstream-engine/sdk/responses.js

@@ -8,6 +8,15 @@ import { ENGINE_MARKER } from "./chat.js";
 
 export const RESPONSES_CHAT_PATH = "/zen/v1/responses";
 
+// 降级阈值：加密思考块（encrypted_content）由上游按 caller（出口）签发，客户端跨出口回传
+// （经组员/换代理/直连切换）会被拒 400 "reasoning `encrypted_content` was not issued to this caller"。
+// 命中即剥掉加密态重试一次；仍失败原样返回，交上层转组员接力（保底不变差）。
+const ENC_CALLER_400_RE = /encrypted_content[^"]*was not issued to this caller/i;
+
+export function isEncryptedCallerError(text) {
+  return typeof text === "string" && ENC_CALLER_400_RE.test(text);
+}
+
 // 上游 encrypted reasoning 只在 output_item.done 里给，而 AI SDK 仅在有 summary 文本时才透出到 parts
 // （muse-spark 这类无 summary 的思考模型会被吞掉）。这里在 fetch 层 tee 一份原始 SSE 自行解析，
 // 侧信道把加密思考交给序列化器，收尾帧补发。
@@ -104,20 +113,38 @@ export async function attemptOnceResponsesSdk({
     },
   };
   let res;
+  let encRetry = false;
+  const streamOnce = (prompt) => model.doStream({
+    prompt,
+    ...params,
+    providerOptions,
+    tools: toModelTools(body?.tools),
+    toolChoice: toModelToolChoice(body?.tool_choice),
+  });
   try {
-    res = await model.doStream({
-      prompt: toModelPrompt(body?.messages),
-      ...params,
-      providerOptions,
-      tools: toModelTools(body?.tools),
-      toolChoice: toModelToolChoice(body?.tool_choice),
-    });
+    res = await streamOnce(toModelPrompt(body?.messages));
   } catch (e) {
-    const mapped = errorResponseFromSdkError(e, { marker });
+    let mapped = errorResponseFromSdkError(e, { marker });
+    if (mapped && mapped.status === 400) {
+      let txt = "";
+      try { txt = await mapped.clone().text(); } catch {}
+      if (isEncryptedCallerError(txt)) {
+        try {
+          res = await streamOnce(toModelPrompt(body?.messages, { dropEncrypted: true }));
+          mapped = null;
+          encRetry = true;
+        } catch (e2) {
+          const mapped2 = errorResponseFromSdkError(e2, { marker });
+          if (mapped2) return mapped2;
+          throw e2;
+        }
+      }
+    }
     if (mapped) return mapped;
-    throw e;
   }
-  return streamResponseFromParts(res.stream, { marker, clock, t0, captured });
+  const out = streamResponseFromParts(res.stream, { marker, clock, t0, captured });
+  if (encRetry) { try { out._t.encRetry = true; } catch {} }
+  return out;
 }
 
 export function createSdkResponses({