mslxdff 0.1.200 → 0.1.203

package/src/providers/qoder/request.js

@@ -1,27 +1,27 @@
-// qoder 上游请求装配（纯函数，无网络）：OpenAI body → COSY 签名请求（url/headers/bodyStr）。
-// 从 chat.js 拆出，使真流式/聚合两条管线共享同一装配口（单一来源，防两处签名漂移）。
-import { getEndpoints, normalizeRegion } from "./constants.js";
-import { buildCosyHeaders, pathSigFrom } from "./session.js";
-import { cosyEncode } from "./encode.js";
-import { buildQoderBody, mapModel } from "./payload.js";
-
-export function buildUpstreamRequest({ sess, region, model, messages, tools, maxTokens, isReasoning }) {
-  const upstreamModel = mapModel(model);
-  const { body, mcSource } = buildQoderBody({
-    template: undefined,
-    userType: sess?.identity?.userType,
-    model: upstreamModel,
-    messages,
-    tools,
-    maxTokens,
-    isReasoning,
-  });
-  const ep = getEndpoints(normalizeRegion(region));
-  const url = ep.chatStreamURL;
-  const bodyStr = cosyEncode(Buffer.from(JSON.stringify(body)));
-  const headers = buildCosyHeaders(sess, pathSigFrom(url), bodyStr, "text/event-stream");
-  headers["x-model-key"] = upstreamModel;
-  headers["x-model-source"] = mcSource;
-  headers["accept"] = "text/event-stream";
-  return { url, headers, bodyStr, upstreamModel, mcSource };
-}
+// qoder 上游请求装配（纯函数，无网络）：OpenAI body → COSY 签名请求（url/headers/bodyStr）。
+// 从 chat.js 拆出，使真流式/聚合两条管线共享同一装配口（单一来源，防两处签名漂移）。
+import { getEndpoints, normalizeRegion } from "./constants.js";
+import { buildCosyHeaders, pathSigFrom } from "./session.js";
+import { cosyEncode } from "./encode.js";
+import { buildQoderBody, mapModel } from "./payload.js";
+
+export function buildUpstreamRequest({ sess, region, model, messages, tools, maxTokens, isReasoning }) {
+  const upstreamModel = mapModel(model);
+  const { body, mcSource } = buildQoderBody({
+    template: undefined,
+    userType: sess?.identity?.userType,
+    model: upstreamModel,
+    messages,
+    tools,
+    maxTokens,
+    isReasoning,
+  });
+  const ep = getEndpoints(normalizeRegion(region));
+  const url = ep.chatStreamURL;
+  const bodyStr = cosyEncode(Buffer.from(JSON.stringify(body)));
+  const headers = buildCosyHeaders(sess, pathSigFrom(url), bodyStr, "text/event-stream");
+  headers["x-model-key"] = upstreamModel;
+  headers["x-model-source"] = mcSource;
+  headers["accept"] = "text/event-stream";
+  return { url, headers, bodyStr, upstreamModel, mcSource };
+}

package/src/providers/qoder/session.js

@@ -1,135 +1,135 @@
-// qoder COSY 签名与会话（转译 qoder2api internal/cosy/session.go + signature.go + auth.go）
-// 会话：RSA-OAEP 加密 tempKey + AES-CBC 加密身份 payload → cosyKey + info
-// 签名：md5(payloadB64 + "\n" + cosyKey + "\n" + date + "\n" + body + "\n" + pathSig)
-import { createHash, randomBytes, createCipheriv, publicEncrypt } from "node:crypto";
-import { cosyEncode } from "./encode.js";
-import { newUUID, unixSec } from "./fingerprint.js";
-
-export const APP_CODE = "cosy";
-export const VERSION = "1.0.10";
-// base64("war, war never changes")
-const SECRET_B64 = "d2FyLCB3YXIgbmV2ZXIgY2hhbmdlcw==";
-
-const SERVER_PUB_KEY = `-----BEGIN PUBLIC KEY-----
-MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
-4k6Pz1EaDicBMpdpxKduSZu5OANqUq8er4GM95omAGIOPOh+Nx0spthYA2BqGz+l
-6HRkPJ7S236FZz73In/KVuLnwI8JJ2CbuJap8kvheCCZpmAWpb/cPx/3Vr/J6I17
-XcW+ML9FoCI6AOvOzwIDAQAB
------END PUBLIC KEY-----`;
-
-export function signLegacy(date) {
-  const s = APP_CODE + "&" + SECRET_B64 + "&" + date;
-  return createHash("md5").update(s).digest("hex");
-}
-
-export function currentDate() {
-  return new Date().toUTCString();
-}
-
-export function buildPayloadB64(info) {
-  const m = JSON.stringify({
-    cosyVersion: VERSION,
-    ideVersion: "",
-    info,
-    requestId: newUUID(),
-    version: "v1",
-  });
-  return Buffer.from(m).toString("base64");
-}
-
-export function signRequest(payloadB64, cosyKey, cosyDate, body, pathWithoutAlgo) {
-  const s = payloadB64 + "\n" + cosyKey + "\n" + cosyDate + "\n" + body + "\n" + pathWithoutAlgo;
-  return createHash("md5").update(s).digest("hex");
-}
-
-export function composeBearer(payloadB64, sig) {
-  return "Bearer COSY." + payloadB64 + "." + sig;
-}
-
-export function psfRsaEncrypt(plaintext) {
-  return publicEncrypt(
-    { key: SERVER_PUB_KEY, padding: 1 }, // PKCS1v15
-    plaintext
-  );
-}
-
-function aesEncrypt(plain, key) {
-  const bs = 16;
-  const pad = bs - (plain.length % bs);
-  const padded = Buffer.alloc(plain.length + pad, pad);
-  plain.copy(padded);
-  const iv = key.slice(0, bs);
-  const cipher = createCipheriv("aes-128-cbc", key, iv);
-  return Buffer.concat([cipher.update(padded), cipher.final()]);
-}
-
-export function authPayloadJSON(id) {
-  return JSON.stringify({
-    name: id.name || "",
-    aid: id.aid || "",
-    uid: id.uid || "",
-    yx_uid: id.yxUid || "",
-    organization_id: id.organizationId || "",
-    organization_name: id.organizationName || "",
-    user_type: id.userType || "personal_standard",
-    security_oauth_token: id.securityOauthToken || "",
-    refresh_token: id.refreshToken || "",
-  });
-}
-
-export function newSession(id, machineId, machineToken, machineType) {
-  const raw = randomBytes(16);
-  const tempKey = Buffer.from(raw.toString("hex").slice(0, 16), "utf8").slice(0, 16);
-  // 确保正好 16 字节
-  const key16 = Buffer.alloc(16);
-  tempKey.copy(key16);
-
-  const cosyKeyBytes = psfRsaEncrypt(key16);
-  const cosyKey = cosyKeyBytes.toString("base64");
-
-  const payloadBytes = Buffer.from(authPayloadJSON(id), "utf8");
-  const encPayload = aesEncrypt(payloadBytes, key16);
-  const info = encPayload.toString("base64");
-
-  return { tempKey: key16, cosyKey, info, identity: id, machineId, machineToken, machineType };
-}
-
-// 去除 /algo 前缀的 PathSig
-export function pathSigFrom(url) {
-  try {
-    const u = new URL(url);
-    let p = u.pathname;
-    if (p.startsWith("/algo")) p = p.slice(5);
-    return p;
-  } catch {
-    return "";
-  }
-}
-
-// 构造请求头
-export function buildCosyHeaders(sess, pathSig, bodyStr, accept) {
-  const payloadB64 = buildPayloadB64(sess.info);
-  const date = String(unixSec());
-  const sig = signRequest(payloadB64, sess.cosyKey, date, bodyStr || "", pathSig);
-  const bearer = composeBearer(payloadB64, sig);
-  return {
-    "cosy-data-policy": "agree",
-    "content-type": "application/json",
-    "cosy-machinetype": sess.machineType,
-    "cosy-clienttype": "5",
-    "cosy-date": date,
-    "cosy-user": sess.identity.uid,
-    "cosy-key": sess.cosyKey,
-    "cache-control": "no-cache",
-    "accept": accept || "application/json",
-    "authorization": bearer,
-    "cosy-version": VERSION,
-    "cosy-machineid": sess.machineId,
-    "cosy-machinetoken": sess.machineToken,
-    "login-version": "v2",
-    "user-agent": "Go-http-client/2.0",
-    "cosy-scene": "assistant",
-    "cosy-business-product": "ide",
-    "cosy-business-type": "agent",
-  };
+// qoder COSY 签名与会话（转译 qoder2api internal/cosy/session.go + signature.go + auth.go）
+// 会话：RSA-OAEP 加密 tempKey + AES-CBC 加密身份 payload → cosyKey + info
+// 签名：md5(payloadB64 + "\n" + cosyKey + "\n" + date + "\n" + body + "\n" + pathSig)
+import { createHash, randomBytes, createCipheriv, publicEncrypt } from "node:crypto";
+import { cosyEncode } from "./encode.js";
+import { newUUID, unixSec } from "./fingerprint.js";
+
+export const APP_CODE = "cosy";
+export const VERSION = "1.0.10";
+// base64("war, war never changes")
+const SECRET_B64 = "d2FyLCB3YXIgbmV2ZXIgY2hhbmdlcw==";
+
+const SERVER_PUB_KEY = `-----BEGIN PUBLIC KEY-----
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
+4k6Pz1EaDicBMpdpxKduSZu5OANqUq8er4GM95omAGIOPOh+Nx0spthYA2BqGz+l
+6HRkPJ7S236FZz73In/KVuLnwI8JJ2CbuJap8kvheCCZpmAWpb/cPx/3Vr/J6I17
+XcW+ML9FoCI6AOvOzwIDAQAB
+-----END PUBLIC KEY-----`;
+
+export function signLegacy(date) {
+  const s = APP_CODE + "&" + SECRET_B64 + "&" + date;
+  return createHash("md5").update(s).digest("hex");
+}
+
+export function currentDate() {
+  return new Date().toUTCString();
+}
+
+export function buildPayloadB64(info) {
+  const m = JSON.stringify({
+    cosyVersion: VERSION,
+    ideVersion: "",
+    info,
+    requestId: newUUID(),
+    version: "v1",
+  });
+  return Buffer.from(m).toString("base64");
+}
+
+export function signRequest(payloadB64, cosyKey, cosyDate, body, pathWithoutAlgo) {
+  const s = payloadB64 + "\n" + cosyKey + "\n" + cosyDate + "\n" + body + "\n" + pathWithoutAlgo;
+  return createHash("md5").update(s).digest("hex");
+}
+
+export function composeBearer(payloadB64, sig) {
+  return "Bearer COSY." + payloadB64 + "." + sig;
+}
+
+export function psfRsaEncrypt(plaintext) {
+  return publicEncrypt(
+    { key: SERVER_PUB_KEY, padding: 1 }, // PKCS1v15
+    plaintext
+  );
+}
+
+function aesEncrypt(plain, key) {
+  const bs = 16;
+  const pad = bs - (plain.length % bs);
+  const padded = Buffer.alloc(plain.length + pad, pad);
+  plain.copy(padded);
+  const iv = key.slice(0, bs);
+  const cipher = createCipheriv("aes-128-cbc", key, iv);
+  return Buffer.concat([cipher.update(padded), cipher.final()]);
+}
+
+export function authPayloadJSON(id) {
+  return JSON.stringify({
+    name: id.name || "",
+    aid: id.aid || "",
+    uid: id.uid || "",
+    yx_uid: id.yxUid || "",
+    organization_id: id.organizationId || "",
+    organization_name: id.organizationName || "",
+    user_type: id.userType || "personal_standard",
+    security_oauth_token: id.securityOauthToken || "",
+    refresh_token: id.refreshToken || "",
+  });
+}
+
+export function newSession(id, machineId, machineToken, machineType) {
+  const raw = randomBytes(16);
+  const tempKey = Buffer.from(raw.toString("hex").slice(0, 16), "utf8").slice(0, 16);
+  // 确保正好 16 字节
+  const key16 = Buffer.alloc(16);
+  tempKey.copy(key16);
+
+  const cosyKeyBytes = psfRsaEncrypt(key16);
+  const cosyKey = cosyKeyBytes.toString("base64");
+
+  const payloadBytes = Buffer.from(authPayloadJSON(id), "utf8");
+  const encPayload = aesEncrypt(payloadBytes, key16);
+  const info = encPayload.toString("base64");
+
+  return { tempKey: key16, cosyKey, info, identity: id, machineId, machineToken, machineType };
+}
+
+// 去除 /algo 前缀的 PathSig
+export function pathSigFrom(url) {
+  try {
+    const u = new URL(url);
+    let p = u.pathname;
+    if (p.startsWith("/algo")) p = p.slice(5);
+    return p;
+  } catch {
+    return "";
+  }
+}
+
+// 构造请求头
+export function buildCosyHeaders(sess, pathSig, bodyStr, accept) {
+  const payloadB64 = buildPayloadB64(sess.info);
+  const date = String(unixSec());
+  const sig = signRequest(payloadB64, sess.cosyKey, date, bodyStr || "", pathSig);
+  const bearer = composeBearer(payloadB64, sig);
+  return {
+    "cosy-data-policy": "agree",
+    "content-type": "application/json",
+    "cosy-machinetype": sess.machineType,
+    "cosy-clienttype": "5",
+    "cosy-date": date,
+    "cosy-user": sess.identity.uid,
+    "cosy-key": sess.cosyKey,
+    "cache-control": "no-cache",
+    "accept": accept || "application/json",
+    "authorization": bearer,
+    "cosy-version": VERSION,
+    "cosy-machineid": sess.machineId,
+    "cosy-machinetoken": sess.machineToken,
+    "login-version": "v2",
+    "user-agent": "Go-http-client/2.0",
+    "cosy-scene": "assistant",
+    "cosy-business-product": "ide",
+    "cosy-business-type": "agent",
+  };
 }

package/src/providers/qoder/sticky.js

@@ -1,38 +1,38 @@
-// qoder 同请求粘号：一个客户端请求内的多次上游调用（空转重试/换路重试）复用同一个号，
-// 只有该号进入冷却（401/403/429/5xx → ring.onError）才切到下一个号。
-// 背景：keyring 每次 next() 都前进一格，而 qoder 两个号分属 cn/global 两区（region 决定 URL），
-// 于是「重试」会把同一个请求甩到另一个区——排障时表现为"URL 莫名在切"。粘号把"切号"收回到
-// 唯一正当理由：该号已被冷却。无 scope（拿不到请求标识）时退化为原 round-robin，与旧行为一致。
-// Note: 切号的唯一正当理由是冷却（401/403/429/5xx）——空转等其它失败不换号，故选择器要能问 keyring "上次这个号还在冷却吗" — 见 .agents/notes/implemented/feature/2026-09-27-qoder-per-request-sticky-account.md
-export function createStickyPicker({ pick, isCooling = () => false, now = Date.now, ttlMs = 600_000, maxEntries = 200 } = {}) {
-  const seen = new Map(); // scope → { key, at }
-
-  function evict() {
-    const t = now();
-    for (const [scope, hit] of seen) if (t - hit.at >= ttlMs) seen.delete(scope);
-    while (seen.size > maxEntries) seen.delete(seen.keys().next().value);
-  }
-
-  // onDecision（可选）：把"这次为什么选它"回报给调用方 —— 决定必须可观测。
-  // sticky=同请求复用 / new=新请求轮转选中 / switch=上次的号在冷却(或 TTL 过期)故换 / rr=无 scope 退回轮转
-  return function pickSticky(scope, onDecision) {
-    if (!scope) {
-      onDecision?.("rr");
-      return pick();
-    }
-    const hit = seen.get(scope);
-    // 粘住：同一请求内复用上次的号，除非它已被冷却（那时必须换）
-    if (hit && now() - hit.at < ttlMs && !isCooling(hit.key)) {
-      hit.at = now();
-      onDecision?.("sticky");
-      return hit.key;
-    }
-    const key = pick();
-    onDecision?.(hit ? "switch" : "new");
-    if (key) {
-      seen.set(scope, { key, at: now() });
-      if (seen.size > maxEntries) evict();
-    }
-    return key;
-  };
-}
+// qoder 同请求粘号：一个客户端请求内的多次上游调用（空转重试/换路重试）复用同一个号，
+// 只有该号进入冷却（401/403/429/5xx → ring.onError）才切到下一个号。
+// 背景：keyring 每次 next() 都前进一格，而 qoder 两个号分属 cn/global 两区（region 决定 URL），
+// 于是「重试」会把同一个请求甩到另一个区——排障时表现为"URL 莫名在切"。粘号把"切号"收回到
+// 唯一正当理由：该号已被冷却。无 scope（拿不到请求标识）时退化为原 round-robin，与旧行为一致。
+// Note: 切号的唯一正当理由是冷却（401/403/429/5xx）——空转等其它失败不换号，故选择器要能问 keyring "上次这个号还在冷却吗" — 见 .agents/notes/implemented/feature/2026-09-27-qoder-per-request-sticky-account.md
+export function createStickyPicker({ pick, isCooling = () => false, now = Date.now, ttlMs = 600_000, maxEntries = 200 } = {}) {
+  const seen = new Map(); // scope → { key, at }
+
+  function evict() {
+    const t = now();
+    for (const [scope, hit] of seen) if (t - hit.at >= ttlMs) seen.delete(scope);
+    while (seen.size > maxEntries) seen.delete(seen.keys().next().value);
+  }
+
+  // onDecision（可选）：把"这次为什么选它"回报给调用方 —— 决定必须可观测。
+  // sticky=同请求复用 / new=新请求轮转选中 / switch=上次的号在冷却(或 TTL 过期)故换 / rr=无 scope 退回轮转
+  return function pickSticky(scope, onDecision) {
+    if (!scope) {
+      onDecision?.("rr");
+      return pick();
+    }
+    const hit = seen.get(scope);
+    // 粘住：同一请求内复用上次的号，除非它已被冷却（那时必须换）
+    if (hit && now() - hit.at < ttlMs && !isCooling(hit.key)) {
+      hit.at = now();
+      onDecision?.("sticky");
+      return hit.key;
+    }
+    const key = pick();
+    onDecision?.(hit ? "switch" : "new");
+    if (key) {
+      seen.set(scope, { key, at: now() });
+      if (seen.size > maxEntries) evict();
+    }
+    return key;
+  };
+}

package/src/providers/qoder/stream.js

@@ -1,116 +1,116 @@
-// qoder 真流式转发：上游 Response.body → OpenAI SSE Response（边收边转，不攒数组）。
-// 对标 traework chat.js reshapeSoloStream（reader.read 循环 + sendChunk 即时写）。
-// usage 只在尾帧出现：收到即记，附在 finish chunk 上一次发出（与旧回放语义一致）。
-import { extractDelta } from "./sse.js";
-
-// SSE 缓冲上限：未完结行超 2MiB 立即中断（内存保护，对齐外部参照实现 defaultMaxSseBufferChars）
-const MAX_BUFFER_CHARS = 2 * 1024 * 1024;
-
-// 空轮排障用的临时日志开关：QODER_DEBUG_STREAM=1 才输出，默认静默（问题定位后可摘）
-const DBG_STREAM = () => process.env.QODER_DEBUG_STREAM === "1";
-const sdbg = (...a) => { if (DBG_STREAM()) console.log("[qoder-stream]", ...a); };
-function openaiChunk({ model, chatId, delta, finish, usage }) {
-  const c = {
-    id: chatId,
-    object: "chat.completion.chunk",
-    created: Math.floor(Date.now() / 1000),
-    model,
-    choices: [{ index: 0, delta, finish_reason: finish || null }],
-  };
-  if (usage && finish) c.usage = usage;
-  return `data: ${JSON.stringify(c)}\n\n`;
-}
-
-function errorEvent(e) {
-  return `event: error\ndata: ${JSON.stringify({ message: String(e?.detail || e?.message || e), type: e?.kind || "upstream_error" })}\n\n`;
-}
-
-export function reshapeQoderStream(upstreamRes, { model, chatId, prefetched = [] }) {
-  const src = upstreamRes.body;
-  const enc = new TextEncoder();
-  const dec = new TextDecoder();
-  // 预读帧（chat.js 为取流内判决而先读的字节）原样回灌：既不丢内容也不重复，
-  // 判决帧会在这里被正常解析并抛错，同时 chat.js 已用同一批帧定出状态码挂上门面。
-  let buf = prefetched.map((b) => dec.decode(b, { stream: true })).join("");
-  let usage = null;
-  // 收尾判定与 aggregate 同构：上游给过 finish_reason 一律优先，全程没给才兜底（tool_calls > stop）
-  let upstreamFinish = "";
-  let sawToolCalls = false;
-  let sawContent = false;
-  let finishSent = false;
-  const stream = new ReadableStream({
-    async start(ctrl) {
-      const reader = src.getReader();
-      const send = (t) => ctrl.enqueue(enc.encode(t));
-      let chunkIdx = 0;
-      let contentLen = 0;
-      let lineIdx = 0;
-      try {
-        sdbg(`[enter] model=${model} chatId=${chatId} ct=${upstreamRes.headers.get("content-type")} status=${upstreamRes.status}`);
-        // role: assistant will be attached on first real delta to avoid premature payload commit
-        for (;;) {
-          const { done, value } = await reader.read();
-          if (value) {
-            const text = dec.decode(value, { stream: !done });
-            buf += text;
-            sdbg(`[chunk#${chunkIdx++}] bytes=${value.byteLength} done=${done} decodedLen=${text.length} raw=${JSON.stringify(text.slice(0, 500))}`);
-          }
-          const lines = buf.split("\n");
-          buf = lines.pop();
-          sdbg(`[buf] lines=${lines.length} leftover=${JSON.stringify(buf.slice(0, 200))}`);
-          for (const raw of lines) {
-            const line = raw.replace(/\r$/, "");
-            lineIdx++;
-            if (!line.startsWith("data:")) { sdbg(`[line#${lineIdx}] non-data: ${JSON.stringify(line.slice(0, 200))}`); continue; }
-            const payload = line.slice(5).trim();
-            if (!payload || payload === "[DONE]") { sdbg(`[line#${lineIdx}] skip: ${JSON.stringify(payload)}`); continue; }
-            const d = extractDelta(payload);
-            sdbg(`[line#${lineIdx}] payload=${JSON.stringify(payload.slice(0, 800))}`);
-            sdbg(`[line#${lineIdx}] parsed keys=${Object.keys(d).join(",")} content=${JSON.stringify((d.content || "").slice(0, 200))} reasoning=${JSON.stringify((d.reasoning || "").slice(0, 200))} toolCalls=${(d.toolCalls || []).length} usageIn=${d.usageIn} usageOut=${d.usageOut} err=${!!d.err}`);
-            if (d.err) { sdbg(`[line#${lineIdx}] ERROR from extractDelta: ${JSON.stringify(d.err)}`); throw d.err; }
-            if (d.usageIn || d.usageOut) {
-              usage = { prompt_tokens: d.usageIn, completion_tokens: d.usageOut, total_tokens: d.usageIn + d.usageOut };
-              sdbg(`[usage] ${JSON.stringify(usage)}`);
-            }
-            if (d.finishReason) upstreamFinish = d.finishReason;
-            const delta = {};
-            if (!sawContent) delta.role = "assistant";
-            if (d.content) { delta.content = d.content; contentLen += d.content.length; sawContent = true; }
-            if (d.reasoning) { delta.reasoning_content = d.reasoning; sawContent = true; }
-            if (d.toolCalls) { delta.tool_calls = d.toolCalls; sawToolCalls = true; sawContent = true; }
-            if (Object.keys(delta).length) send(openaiChunk({ model, chatId, delta }));
-            sdbg(`[acc] line#=${lineIdx} sawContent=${sawContent} contentLen=${contentLen} upstreamFinish=${upstreamFinish} usage=${JSON.stringify(usage)}`);
-          }
-          // 完整行消费完毕后再判越限：leftover 超大不得把同 chunk 里的合法帧连坐丢弃（评审路1 P1#4）
-          if (buf.length > MAX_BUFFER_CHARS) {
-            sdbg(`[buffer-limit] leftover=${buf.length} chars → abort stream`);
-            throw { kind: "upstream", status: 502, detail: "qoder SSE buffer exceeded 2MiB limit" };
-          }
-          if (done) break;
-        }
-        sdbg(`[end] totalChunks=${chunkIdx} totalLines=${lineIdx} sawContent=${sawContent} contentLen=${contentLen} upstreamFinish=${upstreamFinish} usage=${JSON.stringify(usage)}`);
-        if (!sawContent && !usage) {
-          sdbg(`[empty-stream] sawContent=false usage=null → throw 502 empty upstream stream`);
-          throw { kind: "upstream", status: 502, detail: "empty upstream stream" };
-        }
-        const finish = upstreamFinish || (sawToolCalls ? "tool_calls" : "stop");
-        send(openaiChunk({ model, chatId, delta: {}, finish, usage }));
-        send("data: [DONE]\n\n");
-        finishSent = true;
-      } catch (e) {
-        sdbg(`[catch] finishSent=${finishSent} e=${JSON.stringify(e?.message || e)}`);
-        if (!finishSent) {
-          if (sawContent) { try { send(openaiChunk({ model, chatId, delta: {} })); } catch {} }
-          try { send(errorEvent(e)); } catch {}
-          try { send("data: [DONE]\n\n"); } catch {}
-          finishSent = true;
-        }
-      }
-      try { ctrl.close(); } catch {}
-    },
-  });
-  return new Response(stream, {
-    status: 200,
-    headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive" },
-  });
-}
+// qoder 真流式转发：上游 Response.body → OpenAI SSE Response（边收边转，不攒数组）。
+// 对标 traework chat.js reshapeSoloStream（reader.read 循环 + sendChunk 即时写）。
+// usage 只在尾帧出现：收到即记，附在 finish chunk 上一次发出（与旧回放语义一致）。
+import { extractDelta } from "./sse.js";
+
+// SSE 缓冲上限：未完结行超 2MiB 立即中断（内存保护，对齐外部参照实现 defaultMaxSseBufferChars）
+const MAX_BUFFER_CHARS = 2 * 1024 * 1024;
+
+// 空轮排障用的临时日志开关：QODER_DEBUG_STREAM=1 才输出，默认静默（问题定位后可摘）
+const DBG_STREAM = () => process.env.QODER_DEBUG_STREAM === "1";
+const sdbg = (...a) => { if (DBG_STREAM()) console.log("[qoder-stream]", ...a); };
+function openaiChunk({ model, chatId, delta, finish, usage }) {
+  const c = {
+    id: chatId,
+    object: "chat.completion.chunk",
+    created: Math.floor(Date.now() / 1000),
+    model,
+    choices: [{ index: 0, delta, finish_reason: finish || null }],
+  };
+  if (usage && finish) c.usage = usage;
+  return `data: ${JSON.stringify(c)}\n\n`;
+}
+
+function errorEvent(e) {
+  return `event: error\ndata: ${JSON.stringify({ message: String(e?.detail || e?.message || e), type: e?.kind || "upstream_error" })}\n\n`;
+}
+
+export function reshapeQoderStream(upstreamRes, { model, chatId, prefetched = [] }) {
+  const src = upstreamRes.body;
+  const enc = new TextEncoder();
+  const dec = new TextDecoder();
+  // 预读帧（chat.js 为取流内判决而先读的字节）原样回灌：既不丢内容也不重复，
+  // 判决帧会在这里被正常解析并抛错，同时 chat.js 已用同一批帧定出状态码挂上门面。
+  let buf = prefetched.map((b) => dec.decode(b, { stream: true })).join("");
+  let usage = null;
+  // 收尾判定与 aggregate 同构：上游给过 finish_reason 一律优先，全程没给才兜底（tool_calls > stop）
+  let upstreamFinish = "";
+  let sawToolCalls = false;
+  let sawContent = false;
+  let finishSent = false;
+  const stream = new ReadableStream({
+    async start(ctrl) {
+      const reader = src.getReader();
+      const send = (t) => ctrl.enqueue(enc.encode(t));
+      let chunkIdx = 0;
+      let contentLen = 0;
+      let lineIdx = 0;
+      try {
+        sdbg(`[enter] model=${model} chatId=${chatId} ct=${upstreamRes.headers.get("content-type")} status=${upstreamRes.status}`);
+        // role: assistant will be attached on first real delta to avoid premature payload commit
+        for (;;) {
+          const { done, value } = await reader.read();
+          if (value) {
+            const text = dec.decode(value, { stream: !done });
+            buf += text;
+            sdbg(`[chunk#${chunkIdx++}] bytes=${value.byteLength} done=${done} decodedLen=${text.length} raw=${JSON.stringify(text.slice(0, 500))}`);
+          }
+          const lines = buf.split("\n");
+          buf = lines.pop();
+          sdbg(`[buf] lines=${lines.length} leftover=${JSON.stringify(buf.slice(0, 200))}`);
+          for (const raw of lines) {
+            const line = raw.replace(/\r$/, "");
+            lineIdx++;
+            if (!line.startsWith("data:")) { sdbg(`[line#${lineIdx}] non-data: ${JSON.stringify(line.slice(0, 200))}`); continue; }
+            const payload = line.slice(5).trim();
+            if (!payload || payload === "[DONE]") { sdbg(`[line#${lineIdx}] skip: ${JSON.stringify(payload)}`); continue; }
+            const d = extractDelta(payload);
+            sdbg(`[line#${lineIdx}] payload=${JSON.stringify(payload.slice(0, 800))}`);
+            sdbg(`[line#${lineIdx}] parsed keys=${Object.keys(d).join(",")} content=${JSON.stringify((d.content || "").slice(0, 200))} reasoning=${JSON.stringify((d.reasoning || "").slice(0, 200))} toolCalls=${(d.toolCalls || []).length} usageIn=${d.usageIn} usageOut=${d.usageOut} err=${!!d.err}`);
+            if (d.err) { sdbg(`[line#${lineIdx}] ERROR from extractDelta: ${JSON.stringify(d.err)}`); throw d.err; }
+            if (d.usageIn || d.usageOut) {
+              usage = { prompt_tokens: d.usageIn, completion_tokens: d.usageOut, total_tokens: d.usageIn + d.usageOut };
+              sdbg(`[usage] ${JSON.stringify(usage)}`);
+            }
+            if (d.finishReason) upstreamFinish = d.finishReason;
+            const delta = {};
+            if (!sawContent) delta.role = "assistant";
+            if (d.content) { delta.content = d.content; contentLen += d.content.length; sawContent = true; }
+            if (d.reasoning) { delta.reasoning_content = d.reasoning; sawContent = true; }
+            if (d.toolCalls) { delta.tool_calls = d.toolCalls; sawToolCalls = true; sawContent = true; }
+            if (Object.keys(delta).length) send(openaiChunk({ model, chatId, delta }));
+            sdbg(`[acc] line#=${lineIdx} sawContent=${sawContent} contentLen=${contentLen} upstreamFinish=${upstreamFinish} usage=${JSON.stringify(usage)}`);
+          }
+          // 完整行消费完毕后再判越限：leftover 超大不得把同 chunk 里的合法帧连坐丢弃（评审路1 P1#4）
+          if (buf.length > MAX_BUFFER_CHARS) {
+            sdbg(`[buffer-limit] leftover=${buf.length} chars → abort stream`);
+            throw { kind: "upstream", status: 502, detail: "qoder SSE buffer exceeded 2MiB limit" };
+          }
+          if (done) break;
+        }
+        sdbg(`[end] totalChunks=${chunkIdx} totalLines=${lineIdx} sawContent=${sawContent} contentLen=${contentLen} upstreamFinish=${upstreamFinish} usage=${JSON.stringify(usage)}`);
+        if (!sawContent && !usage) {
+          sdbg(`[empty-stream] sawContent=false usage=null → throw 502 empty upstream stream`);
+          throw { kind: "upstream", status: 502, detail: "empty upstream stream" };
+        }
+        const finish = upstreamFinish || (sawToolCalls ? "tool_calls" : "stop");
+        send(openaiChunk({ model, chatId, delta: {}, finish, usage }));
+        send("data: [DONE]\n\n");
+        finishSent = true;
+      } catch (e) {
+        sdbg(`[catch] finishSent=${finishSent} e=${JSON.stringify(e?.message || e)}`);
+        if (!finishSent) {
+          if (sawContent) { try { send(openaiChunk({ model, chatId, delta: {} })); } catch {} }
+          try { send(errorEvent(e)); } catch {}
+          try { send("data: [DONE]\n\n"); } catch {}
+          finishSent = true;
+        }
+      }
+      try { ctrl.close(); } catch {}
+    },
+  });
+  return new Response(stream, {
+    status: 200,
+    headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive" },
+  });
+}

package/src/providers/qoder.js

@@ -1,2 +1,2 @@
-// Shim — 保持历史导入路径兼容，真实实现下沉至 ./qoder/ 深模块
+// Shim — 保持历史导入路径兼容，真实实现下沉至 ./qoder/ 深模块
 export * from "./qoder/index.js";