mslxdff 0.1.224 → 0.1.225

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mslxdff",
-  "version": "0.1.224",
+  "version": "0.1.225",
   "description": "测试项目，请勿使用。",
   "type": "module",
   "bin": {

package/src/chat-pipeline/context-forward.js

@@ -0,0 +1,55 @@
+// 转发阶段的上下文闸门编排（从 serial-trial.js 拆出，控单文件 ≤20KB 硬门）。
+//
+// 分工：context-guard.js 做纯判决（估算 token、比上限），本文件做**编排**——把「组员/宽带转发」
+// 整段包起来，闸门一触发就收场，不再落到后面的换路逻辑。
+//
+// 为什么必须在这里停：闸门拦下**不是**上游失败。同一份大上下文换个目标（组员→宽带成员）照样撑爆，
+// 只会白烧另一台机器的额度。故直接以标准 `context_length_exceeded` 收场，让客户端压缩后重试。
+import { json } from "../routes/helpers.js";
+
+/** 闸门产出的失败（finishContextGuard 与各 handler 共用同一个标记）。 */
+export function isContextGuardErr(e) {
+  return Boolean(e && typeof e === "object" && e.contextGuard);
+}
+
+/**
+ * 收场：未 flush 时回标准错误体（客户端据 code 触发压缩）；已 flush（流式已开始）交给既有出口写 in-band 帧。
+ */
+export async function finishContextGuard({
+  res, body, lastErr, order, handlerCtx, evt, logCall, logError, mark, perf0, stages, done,
+  requested, useAuto, model, exhaustedLocal,
+}) {
+  const g = lastErr?.contextGuard || {};
+  evt("context-guard", {
+    reqId: handlerCtx.reqId, model, estimated: g.estimated, limit: g.limit, over: g.over,
+    action: "stop-forwarding",
+  });
+  try { logError(model, 400, lastErr.message); } catch {}
+  if (!res?.headersSent) {
+    return json(res, 400, {
+      error: { type: "invalid_request_error", code: "context_length_exceeded", message: lastErr.message },
+    });
+  }
+  await exhaustedLocal({
+    res, body, lastErr, order,
+    handlerCtx: { ...handlerCtx, model, reqId: handlerCtx.reqId },
+    evt, logCall, mark, perf0, stages, done, requested, useAuto,
+  });
+  return { done: true };
+}
+
+/**
+ * 跑一段转发并在闸门触发时立即收场。
+ * @param {Function} run 真正发起转发的函数（应返回 {handled, lastErr}）
+ * @param {object} ctx 收场所需的上下文（res/body/order/handlerCtx/evt/...）
+ * @returns {Promise<{done:boolean, lastErr?:object}>}
+ */
+export async function forwardOrGuard(run, ctx) {
+  const r = await run();
+  if (r?.handled) return { done: true };
+  if (isContextGuardErr(r?.lastErr)) {
+    await finishContextGuard({ ...ctx, lastErr: r.lastErr });
+    return { done: true };
+  }
+  return { done: false, lastErr: r?.lastErr };
+}

package/src/chat-pipeline/context-guard.js

@@ -0,0 +1,101 @@
+// 转发前上下文预检：本地额度用完要转给组员时，先把「上下文会不会撑爆对方」判掉。
+//
+// 为什么需要（用户定的口径）：各家 free 模型的上下文窗口各不相同、大多在 200k 以下，而网关**没有**
+// 一个可靠的上游窗口数据源 —— 靠模型自报会拿到 1M 这类不实的值（见 context-lookup 的 L4 兜底）。
+// 于是本地出口还有额度时一切正常（本地模型窗口往往更大），一旦额度用完转给组员，同一份大上下文
+// 在对方那里直接 `400 context_length_exceeded`。现网实证：errors.log 里 376 条超限，其中 274 条
+// 来自 broadband（组员执行）、93 条来自 messages、仅 9 条 chat；模型集中在 deepseek-v4.1-flash-free(323)。
+//
+// 设计取舍：**不猜每个模型的确切窗口**，只设一个保守的统一上限（默认 200k）。超了就**不转发**，
+// 让客户端按标准 `context_length_exceeded` 触发自己的压缩流程 —— 这正是「在转发之前触发压缩」。
+// 宁可让客户端多压一次，也不要把一个大上下文白转给组员、烧掉对方额度再撞墙。
+//
+// 与 count-tokens 的关系：估算公式**同源**（../text-tokens.js），不另造第二个读数来源（ADR-0055）。
+// 但计量对象不同：那边是 Anthropic 请求体（system/messages blocks），这边是**已翻译好的 chat body**
+// （messages 数组 + tools），是真正要发给上游的那份，所以单独走一遍计数。
+
+import { createTokenCounter } from "../text-tokens.js";
+
+// 统一保守窗口。取值依据：现网 free 层主流 200k，且错误集中在 -free 模型。
+// 未自报窗口的模型按这个值对外宣称（见 context-lookup 的 L4）；转发前也按它判。
+export const DEFAULT_FORWARD_MAX_CONTEXT_TOKENS = 200_000;
+
+/** 读取转发前上限；`0`/负数 = 关闭预检（退回旧行为：无脑转发）。非法值按默认。 */
+export function forwardMaxContextTokens(env = process.env) {
+  const raw = String(env.MSLXDFF_FORWARD_MAX_CONTEXT_TOKENS ?? "").trim();
+  if (raw === "") return DEFAULT_FORWARD_MAX_CONTEXT_TOKENS;
+  const n = Number(raw);
+  if (!Number.isFinite(n)) return DEFAULT_FORWARD_MAX_CONTEXT_TOKENS;
+  if (n <= 0) return 0;
+  const f = Math.floor(n);
+  // (0,1) 会被 floor 成 0 —— 那等于悄悄关掉闸门，按非法值回默认（同 context-lookup 的取舍）
+  return f > 0 ? f : DEFAULT_FORWARD_MAX_CONTEXT_TOKENS;
+}
+
+// 单条消息的文本面（role 名与 tool_call 参数也算：它们同样占上游上下文）
+function addMessage(counter, m) {
+  if (!m || typeof m !== "object") return;
+  const c = m.content;
+  if (typeof c === "string") counter.add(c);
+  else if (Array.isArray(c)) {
+    for (const p of c) {
+      if (!p || typeof p !== "object") continue;
+      if (typeof p.text === "string") counter.add(p.text);
+      else if (p.type === "image") counter.add("x".repeat(4000)); // 图片按固定面值近似（不吃字符但占真实上下文）
+    }
+  } else if (c != null) counter.add(String(c));
+  if (Array.isArray(m.tool_calls)) {
+    for (const tc of m.tool_calls) {
+      counter.add(String(tc?.function?.name || ""));
+      counter.add(String(tc?.function?.arguments || ""));
+    }
+  }
+}
+
+/**
+ * 估算**已翻译的 chat body** 的输入 token 数。
+ * 逐段喂进同一个计数器再一次性套公式（与 text-tokens 的累计口径一致：逐段各套会乘上「非空至少 1」下限）。
+ */
+export function estimateChatBodyTokens(body = {}) {
+  const counter = createTokenCounter();
+  const messages = Array.isArray(body?.messages) ? body.messages : [];
+  for (const m of messages) addMessage(counter, m);
+  if (Array.isArray(body?.tools) && body.tools.length) {
+    try { counter.add(JSON.stringify(body.tools)); } catch { /* 循环引用等异常：不计工具面 */ }
+  }
+  // tools 的 JSON 里已含 name/description/schema；system 已在 messages 首条里
+  return counter.tokens();
+}
+
+// 同一次请求的 body 对象会在多个出站口被反复判（via-route → peer → broadband），
+// 而大上下文扫描是 O(字符数)。按对象身份缓存，保证「每请求只算一次」（同 ADR-0055 决策 4 的口径）。
+const estimateCache = new WeakMap();
+
+function estimateOnce(body) {
+  if (!body || typeof body !== "object") return estimateChatBodyTokens(body);
+  const hit = estimateCache.get(body);
+  if (hit !== undefined) return hit;
+  const n = estimateChatBodyTokens(body);
+  estimateCache.set(body, n);
+  return n;
+}
+
+/**
+ * 转发前判决。返回 null = 放行；否则给出超限信息（调用方据此短路，**不转发**）。
+ * @param {object} body 已翻译的 chat body
+ * @param {{limit?:number}} opts limit 缺省读 env
+ * @returns {{estimated:number, limit:number, over:number}|null}
+ */
+export function overForwardLimit(body, opts = {}) {
+  const limit = opts.limit === undefined ? forwardMaxContextTokens() : Number(opts.limit) || 0;
+  if (!limit || limit <= 0) return null;
+  const estimated = estimateOnce(body);
+  if (estimated <= limit) return null;
+  return { estimated, limit, over: estimated - limit };
+}
+
+/** 给客户端看的文案：必须含 `context_length_exceeded` 语义，客户端据此触发压缩。 */
+export function contextGuardMessage({ estimated, limit } = {}) {
+  return `context_length_exceeded: 请求约 ${estimated ?? "?"} tokens，超过网关注入的转发上限 ${limit ?? "?"}；`
+    + "本地节点额度已用尽，为避免把同一份上下文转发给组员后再次超限，请先运行 /compact 压缩上下文再重试。";
+}

package/src/chat-pipeline/serial-trial.js

@@ -14,6 +14,7 @@ import { summarizeRequest, upstreamEcho } from "../model-trace.js";
 import { isEmptyTurnError } from "../routes/chat/relay-pipeline.js";
 import { emptyRetryCfg, emptyRaiseCap, withRaisedMaxTokens, withOutputFloor, emptyNudgeCfg, withEmptyNudge, computeNextDelay, emptyTurnBudgetMs, emptyTurnMinRaiseTo } from "./empty-turn.js";
 import { classifyTerminalUpstream, readVerdictText, terminalShortcircuitOff } from "./terminal-verdict.js";
+import { forwardOrGuard } from "./context-forward.js";
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
@@ -253,21 +254,24 @@ export async function runSerialTrial(ctx, deps = {}) {
       }
       break;
     }
+    // 转发闸门（详见 context-forward.js）：被拦即收场，不许换路重试——同一份大上下文换个目标照样撑爆。
+    const gc = { res, body, order, handlerCtx, evt, logCall, logError, mark, perf0, stages, done, requested, useAuto, model, exhaustedLocal };
     if (canForwardPeers) {
       if (!shouldUseGroupForModel(model)) {
         evt("group-skip", { reqId, model, reason: `${groupSkipReason(model)} (peer)` });
       } else {
-        const pr = await peerRelay({ model, body, lastErr, requested, useAuto, lockModel, auto, peers, handlerCtx, evt, logCall, mark, perf0, attemptStartMs: performance.now(), stages, startedAt, plugins, res });
-        if (pr.handled) return { done: true };
-        if (pr.lastErr) lastErr = pr.lastErr;
+        const fr = await forwardOrGuard(() => peerRelay({ model, body, lastErr, requested, useAuto, lockModel, auto, peers, handlerCtx, evt, logCall, mark, perf0, attemptStartMs: performance.now(), stages, startedAt, plugins, res }), gc);
+        if (fr.done) return fr;
+        lastErr = fr.lastErr ?? lastErr;
       }
     }
     if (groups) {
       if (!shouldUseGroupForModel(model)) {
         evt("group-skip", { reqId, model, reason: `${groupSkipReason(model)} (broadband)` });
       } else {
-        const br = await broadbandRelay({ model, body, hops, lastErr, requested, useAuto, lockModel, auto, groups, token, bus, logs, handlerCtx, evt, mark, perf0, attemptStartMs: performance.now(), stages, res, startedAt, plugins });
-        if (br.handled) return { done: true };
+        const fr = await forwardOrGuard(() => broadbandRelay({ model, body, hops, lastErr, requested, useAuto, lockModel, auto, groups, token, bus, logs, handlerCtx, evt, mark, perf0, attemptStartMs: performance.now(), stages, res, startedAt, plugins }), gc);
+        if (fr.done) return fr;
+        lastErr = fr.lastErr ?? lastErr;
       }
     }
     if (canFailover()) { evt("fallback", { reqId, from: model, to: order[idx + 1] ?? null, reason: lastErr?.message || `upstream ${lastErr?.status ?? 502}` }); continue; }

package/src/routes/chat/broadband-handler.js

@@ -1,72 +1,80 @@
-import { relay, SLOW_TOTAL_MS, STREAM_TIMEOUT_MS, STALL_TIMEOUT_MS, SCORE_STALL_MS } from "../stream.js";
-import { buildFallbackInfo } from "../fallback.js";
-import { createRelayPipeline } from "./relay-pipeline.js";
-import { tryBroadbandRelay } from "../relay-queue.js";
-
-/** 薄适配：broadband 两种形态合一经由 pipeline */
-export async function handleBroadbandRelay({
-  model,
-  body,
-  hops,
-  lastErr,
-  requested,
-  useAuto,
-  lockModel,
-  auto,
-  groups,
-  token,
-  bus,
-  logs,
-  handlerCtx,
-  evt,
-  mark,
-  perf0,
-  attemptStartMs,
-  stages,
-  res,
-  startedAt,
-  plugins,
-  deps = {},
-}) {
-  const { createPipeline = createRelayPipeline, tryBroadbandRelay: tryRelay = tryBroadbandRelay } = deps;
-  const bb = await tryRelay({ groups, token, model, body, hops, bus, logs, reqId: handlerCtx.reqId, evt, res, mark, perf0, stages });
-  if (!bb) {
-    evt("relay-miss", { reqId: handlerCtx.reqId, model });
-    return { handled: false };
-  }
-  const pipeline = createPipeline({
-    relay,
-    buildFallbackInfo,
-    auto,
-    plugins,
-    evt,
-    mark,
-    logCall: () => {},
-    logError: () => {},
-    constants: { STREAM_TIMEOUT_MS, SLOW_TOTAL_MS, STALL_TIMEOUT_MS, SCORE_STALL_MS },
-    startedAt,
-    stages,
-  });
-  const isResponse = bb.result && typeof bb.result.status === "number" && typeof bb.result.headers?.get === "function";
-  if (isResponse) {
-    const r = await pipeline.execute({ res, upRes: bb.result, body, requested, actual: model, lastErr, via: "broadband", lockModel, useAuto, handlerCtx, mark, perf0, attemptStartMs, stages, startedAt });
-    if (!r.handled) return { handled: false, upRes: null, lastErr: r.lastErr };
-    return { handled: true };
-  }
-  if (bb.result && typeof bb.result.status === "number") {
-    const b = bb.result.body || "";
-    const str = typeof b === "string" ? b : JSON.stringify(b);
-    const isSSE = bb.result.headers?.["Content-Type"]?.includes("text/event-stream");
-    const fakeRes = {
-      status: bb.result.status,
-      headers: { get: (k) => bb.result.headers?.[k] || bb.result.headers?.[k.toLowerCase()] || null },
-      text: async () => str,
-      body: isSSE ? (async function* () { yield Buffer.from(str); })() : null,
-    };
-    const r = await pipeline.execute({ res, upRes: fakeRes, body, requested, actual: model, lastErr, via: "broadband-local", lockModel, useAuto, handlerCtx, mark, perf0, attemptStartMs, stages, startedAt });
-    if (!r.handled) return { handled: false, upRes: null, lastErr: r.lastErr };
-    return { handled: true };
-  }
-  evt("relay-miss", { reqId: handlerCtx.reqId, model });
-  return { handled: false };
-}
+import { relay, SLOW_TOTAL_MS, STREAM_TIMEOUT_MS, STALL_TIMEOUT_MS, SCORE_STALL_MS } from "../stream.js";
+import { buildFallbackInfo } from "../fallback.js";
+import { createRelayPipeline } from "./relay-pipeline.js";
+import { tryBroadbandRelay } from "../relay-queue.js";
+import { overForwardLimit, contextGuardMessage } from "../../chat-pipeline/context-guard.js";
+
+/** 薄适配：broadband 两种形态合一经由 pipeline */
+export async function handleBroadbandRelay({
+  model,
+  body,
+  hops,
+  lastErr,
+  requested,
+  useAuto,
+  lockModel,
+  auto,
+  groups,
+  token,
+  bus,
+  logs,
+  handlerCtx,
+  evt,
+  mark,
+  perf0,
+  attemptStartMs,
+  stages,
+  res,
+  startedAt,
+  plugins,
+  deps = {},
+}) {
+  const { createPipeline = createRelayPipeline, tryBroadbandRelay: tryRelay = tryBroadbandRelay } = deps;
+  // 转发前上下文预检：宽带成员是完全不同的另一台机器，上下文撑爆的代价（白烧它的额度）最实在。
+  const guard = overForwardLimit(body);
+  if (guard) {
+    const msg = contextGuardMessage(guard);
+    evt("context-guard", { reqId: handlerCtx.reqId, model, via: "broadband", estimated: guard.estimated, limit: guard.limit, over: guard.over });
+    return { handled: false, lastErr: { model, upstream: null, status: 400, message: msg, contextGuard: true } };
+  }
+  const bb = await tryRelay({ groups, token, model, body, hops, bus, logs, reqId: handlerCtx.reqId, evt, res, mark, perf0, stages });
+  if (!bb) {
+    evt("relay-miss", { reqId: handlerCtx.reqId, model });
+    return { handled: false };
+  }
+  const pipeline = createPipeline({
+    relay,
+    buildFallbackInfo,
+    auto,
+    plugins,
+    evt,
+    mark,
+    logCall: () => {},
+    logError: () => {},
+    constants: { STREAM_TIMEOUT_MS, SLOW_TOTAL_MS, STALL_TIMEOUT_MS, SCORE_STALL_MS },
+    startedAt,
+    stages,
+  });
+  const isResponse = bb.result && typeof bb.result.status === "number" && typeof bb.result.headers?.get === "function";
+  if (isResponse) {
+    const r = await pipeline.execute({ res, upRes: bb.result, body, requested, actual: model, lastErr, via: "broadband", lockModel, useAuto, handlerCtx, mark, perf0, attemptStartMs, stages, startedAt });
+    if (!r.handled) return { handled: false, upRes: null, lastErr: r.lastErr };
+    return { handled: true };
+  }
+  if (bb.result && typeof bb.result.status === "number") {
+    const b = bb.result.body || "";
+    const str = typeof b === "string" ? b : JSON.stringify(b);
+    const isSSE = bb.result.headers?.["Content-Type"]?.includes("text/event-stream");
+    const fakeRes = {
+      status: bb.result.status,
+      headers: { get: (k) => bb.result.headers?.[k] || bb.result.headers?.[k.toLowerCase()] || null },
+      text: async () => str,
+      body: isSSE ? (async function* () { yield Buffer.from(str); })() : null,
+    };
+    const r = await pipeline.execute({ res, upRes: fakeRes, body, requested, actual: model, lastErr, via: "broadband-local", lockModel, useAuto, handlerCtx, mark, perf0, attemptStartMs, stages, startedAt });
+    if (!r.handled) return { handled: false, upRes: null, lastErr: r.lastErr };
+    return { handled: true };
+  }
+  evt("relay-miss", { reqId: handlerCtx.reqId, model });
+  return { handled: false };
+}

package/src/routes/chat/via-route-handler.js

@@ -5,6 +5,7 @@ import { getViaRoute } from "../../bench/via-routes.js";
 import { buildShareKeysHeader, SHARE_KEYS_HEADER } from "../../providers/share-keys.js";
 import { errMsg } from "../helpers.js";
 import { compatFetch } from "../../compat.js";
+import { overForwardLimit, contextGuardMessage } from "../../chat-pipeline/context-guard.js";
 
 function shortLabel(p) {
   const raw = String(p?.name || p?.id || p?.url || "").trim();
@@ -59,6 +60,15 @@ export async function handleViaRoute({
     return { handled: false };
   }
   evt("via-route-hit", { reqId: handlerCtx.reqId, model, peer: peer.url, peerLabel, routeBest: route.best, at: route.at });
+  // 转发前上下文预检：via-route 是**第一条**出站口（比 peer/broadband 更早），大上下文在这里就该拦下，
+  // 否则白烧组员额度再撞上游 `400 context_length_exceeded`。放行由调用方继续走 peer/broadband 的同一闸门。
+  const guard = overForwardLimit(body);
+  if (guard) {
+    const msg = contextGuardMessage(guard);
+    evt("context-guard", { reqId: handlerCtx.reqId, model, via: "via-route", peer: peer.url, estimated: guard.estimated, limit: guard.limit, over: guard.over });
+    try { logError?.(model, 400, msg); } catch {}
+    return { handled: false, lastErr: { model, upstream: null, status: 400, message: msg, contextGuard: true } };
+  }
   // 单路径转发，不并发：直接打 best peer
   const hops = handlerCtx.hops || 0;
   // ADR-0019：借道 = 用 A 的 key —— 转发时自动附带（组内互信，无开关），与 peers.js 共用同一组装点。

package/src/routes/peers.js

@@ -5,6 +5,7 @@ import { runHook } from "../plugins.js";
 import { buildShareKeysHeader, SHARE_KEYS_HEADER } from "../providers/share-keys.js";
 import { compatFetch, timeoutSignal, getUndici } from "../compat.js";
 import { serialTryPeers, PEER_SERIAL } from "./peer-serial.js";
+import { overForwardLimit, contextGuardMessage } from "../chat-pipeline/context-guard.js";
 
 // peer 阶段总预算：三批候选（ordered / orderedByLastError / coolingByLastError）共享同一个
 // 截止时间，而不是每批各吃满一次等头超时。实测最坏路径是三批串行各 30s（≈90s），
@@ -143,8 +144,15 @@ export { clearPeerHealthCache, peerHealthyModels };
 const DEFAULT_PEER_HEADERS_TIMEOUT_MS = 120_000;
 
 async function forwardToPeer(peer, body, model, hops, controller = new AbortController(), waitMs = DEFAULT_PEER_HEADERS_TIMEOUT_MS) {
-  const timer = setTimeout(() => controller.abort(), Math.max(1, Math.round(waitMs)));
-  try {
+  // 转发前上下文预检（真正的出站闸门）：所有经组员的转发都从这里出去，大上下文必须在这里拦下。
+  // 现网实证：errors.log 里 376 条 `context_length_exceeded`，274 条正是组员执行撞的 —— 白烧对方额度。
+  const guard = overForwardLimit(body);
+  if (guard) {
+    const err = new Error(contextGuardMessage(guard));
+    err.contextGuard = guard;
+    return err;
+  }
+  const timer = setTimeout(() => controller.abort(), Math.max(1, Math.round(waitMs)));  try {
     const headers = {
       "Content-Type": "application/json",
       "Authorization": `Bearer ${peer.token}`,
@@ -214,6 +222,9 @@ function peerName(peer) {
 // 组员试法：**串行**（用户 2026-10-19 决定：不竞速）。实现在 ./peer-serial.js，
 // 本文件只保留调度与并发版（PEER_SERIAL=false 时的旧路径）。
 export { PEER_SERIAL };
+// 测试接缝：转发闸门是「上下文超限不许出站」的唯一落点，必须有直接单测钉住
+// （经 race/serial 间接测会被网络的真实失败盖掉，判不出是闸门还是对端挂了）。
+export { forwardToPeer };
 
 export async function racePeerCandidates(candidates, ctx) {
   const tried = (ctx.triedUrls ??= new Set());