mslxdff 0.1.233 → 0.1.235

package/src/chat-pipeline/index.js

@@ -1,156 +1,156 @@
-import { performance } from "node:perf_hooks";
-import { analyzePolicy } from "./policy.js";
-import { createEngine } from "./engine.js";
-import { runHook } from "../plugins.js";
-import { isFreeModel } from "../models.js";
-import { clientIp, summarizePrompt } from "../routes/helpers.js";
-import { formatTimeline } from "../timeline.js";
-import { summarizeRequest, shouldTraceModel } from "../model-trace.js";
-import { apiKindOf } from "../api-kind.js";
-
-/**
- * ChatPipeline 深模块门面 — 对外 execute(req) 单一 inlet
- * 内部组合 Policy→Engine：解析 header/model → 产 order → 委托 engine 执行
- * gateway 仅薄适配：readBody + request:received hook + 调 execute
- */
-
-export function createChatPipeline({ upstream, auto, logs, peers, groups, bus, token, plugins, maxHops } = {}) {
-  const engine = createEngine();
-
-  async function execute({ req, res } = {}) {
-    const startedAt = Date.now();
-    const reqId = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
-    // 入站协议门（chat|responses|messages|other）：全场只在这里判一次，之后随 handlerCtx 透传；
-    // 各日志写点不得再各自匹配路径（第二份判定迟早漂移）—— 见 src/api-kind.js
-    const api = apiKindOf(req);
-    const perf0 = performance.now();
-    const stages = [];
-    const mark = (name) => stages.push([name, Math.round(performance.now() - perf0)]);
-
-    const policy = analyzePolicy({ headers: req?.headers || {}, body: req?.body || {} });
-    const { requested, useAuto, autoProvider, lockModel, hops, shareKeys, workbuddyUid, aliasInfo } = policy;
-    mark("parsed");
-    if (aliasInfo) { try { res?.setHeader?.("x-mslxdff-alias", aliasInfo); } catch {} }
-    // mslxdff/ 前缀或 alias 命中时，把 body.model 改写为还原后的模型（与原 gateway 语义一致）
-    const timeline = { direct: [], peers: [], retries: 0, retryResult: null, result: null };
-    if (aliasInfo && req?.body && req.body.model !== requested) {
-      req.body = { ...req.body, model: requested };
-    }
-
-    // 事件/日志帮手先于 order 推导声明：evt 在 auto-scope 分支即被使用，
-    // 声明置后会让 useAuto && autoProvider 的请求在 TDZ 上崩（线上 -chat 回退路径）
-    const logCall = (model, status) => logs?.appendCall({ reqId, api, model, auto: useAuto, status, durationMs: Date.now() - startedAt, stream: Boolean(req?.body?.stream), stages });
-    const logError = (model, status, message) => logs?.appendError({ reqId, api, model, auto: useAuto, status, message, stages });
-    const evt = (type, data) => {
-      const entry = { ts: Date.now(), reqId, type, ...data, api, model: data.model ?? requested, auto: useAuto, durationMs: Date.now() - startedAt, stages: [...stages] };
-      const traceModel = entry.model || requested;
-      if (shouldTraceModel(type)) {
-        // Note: 模型日志只投影安全字段，不能把含 prompt 的 entry 原样下传 — 见 .agents/notes/implemented/feature/2026-09-25-model-trace-log.md
-        const safeTraceData = { ...entry };
-        if (safeTraceData.prompt !== undefined) delete safeTraceData.prompt;
-        logs?.appendModelTrace?.(traceModel, { type, reqId, model: traceModel, data: safeTraceData, request: type === "request" ? summarizeRequest(req?.body) : null, totalMs: entry.durationMs });
-      }
-      if (type === "peer-forward") timeline.peers.push({ peer: entry.peer, ok: entry.ok === true, status: entry.status, latencyMs: entry.latencyMs, message: entry.message || entry.error || "" });
-      if (type === "upstream-done" || type === "upstream-error") timeline.direct.push({ status: entry.status, reason: entry.message || entry.error || "" });
-      if (type === "peer-error") {
-        const known = timeline.peers.find((p) => p.peer === entry.peer);
-        if (known) { known.ok = false; known.status = entry.status ?? known.status; known.message = entry.message || entry.error || known.message; }
-        else timeline.peers.push({ peer: entry.peer, ok: false, status: entry.status, message: entry.message || entry.error || "" });
-      }
-      if (type === "empty-turn-retry") timeline.retries += 1;
-      // 空转重试必须交代结局：只记次数的话，"重试后救回来"和"重试到死"在日志里长得一模一样
-      if (type === "empty-turn-recovered") timeline.retryResult = "ok";
-      if (type === "empty-turn-exhausted") timeline.retryResult = timeline.retryResult || "lost";
-      if (type === "result" || (type === "client-response" && !timeline.result)) {
-        timeline.result = { status: entry.status, detail: entry.detail || null };
-        try { logs?.appendTimeline?.(formatTimeline({ reqId, model: entry.model || requested, ...timeline, totalMs: Date.now() - startedAt })); } catch {}
-      }
-      if (bus) bus.emit(entry);
-      logs?.appendEvent?.(entry);
-    };
-    const done = (info) => {
-      if (!plugins?.length) return;
-      runHook(plugins, "request:completed", { reqId, requested, useAuto, hops, stream: Boolean(req?.body?.stream), durationMs: Date.now() - startedAt, ...info }).catch(() => {});
-    };
-
-    // order 推导 + plugin model:select 可改
-    // 语义：指定模型 = 死锁单模型（本机→组员同款，挂了就报挂，不兜其他 picks）；只有 auto 才轮 picks
-    // 指定模型的额度耗尽时**不换模型**：横向只在同模型的组员/组长间接力（本机出口 IP 耗尽 → 换组员机器），
-    // 模型永不漂移。详见 serial-trial 的 order 单元素路径与 peer 接力。
-    // x-mslxdff-auto-provider 头可把 auto 候选限定到单供应商（opencode=裸 id 免费池），-chat 默认带
-    let order;
-    if (lockModel) order = [requested];
-    else if (useAuto) {
-      let cands = auto ? await auto.candidates() : [""];
-      if (autoProvider) {
-        const before = cands.length;
-        cands = cands.filter((m) => (autoProvider === "opencode"
-          ? !String(m).includes("/") && isFreeModel(m)
-          : String(m).startsWith(`${autoProvider}/`)));
-        evt("auto-scope", { reqId, provider: autoProvider, before, after: cands.length });
-      }
-      order = cands;
-    } else {
-      // 指定模型 = 死锁单模型：额度耗尽只换组员/组长（同模型换机器），**绝不换模型**。
-      // candidatesFor 的持久化副作用（把显式指定的模型加入勾选集，供日后 auto 用）必须保留——
-      // 见 auto.js:180「显式指定某模型 = 认可它，自动加入勾选集」，历史上删它会丢勾选记录。
-      // 但**不 await**（2026-10-22 日志定罪：loadList 拉全量模型目录烧 24s，写盘 persistPicks 仅 0ms）。
-      // 此路径 order 已定死 [requested]，candidatesFor 返回值根本不被消费，只为触发"加入勾选集"副作用——
-      // 为副作用让主请求干等 24s 是自伤。改后台 fire-and-forget：勾选照样持久化，主请求零阻塞。
-      if (auto && requested) {
-        const tCf = performance.now();
-        Promise.resolve()
-          .then(() => auto.candidatesFor(requested))
-          .catch(() => {})
-          .finally(() => {
-            const ms = Math.round(performance.now() - tCf);
-            if (ms > 5000) console.log(`[pipeline-bg] candidatesFor 后台耗时 model=${requested} ms=${ms}（未阻塞主请求）`);
-          });
-      }
-      order = [requested];
-    }
-    if (!order.length) order = [""];
-    const canFallback = order.length > 1;
-    // hi 探针（x-mslxdff-probe:1）只问「这台机器此刻能不能打通上游」，不代表真实业务：
-    // 它绝不能再触发本机的组员/宽带接力——否则探针会跟着走完整条接力链（最坏 45s 预算），
-    // 而调用方只看它几百毫秒内活不活。组员侧就地直连，成败如实回给调用方。
-    const isProbe = String(req?.headers?.["x-mslxdff-probe"] || "") === "1";
-    const canForwardPeers = !isProbe && Boolean(peers) && hops < (maxHops ?? 3);
-    mark("ordered");
-
-    const reqIp = clientIp(req); // 一次解析两处用：request 事件的 ip 字段 + 回路语料的 clientIp（routes/helpers.js 取 x-forwarded-for 首段）
-    evt("request", { reqId, hops, ip: reqIp, stream: Boolean(req?.body?.stream), prompt: summarizePrompt(req?.body), rawModel: policy.rawModel, requested, lockModel: lockModel || null });
-    if (aliasInfo) evt("alias", { reqId, alias: aliasInfo, rawModel: policy.rawModel, requested });
-    if (Object.keys(shareKeys).length) evt("share-keys", { reqId, providers: Object.keys(shareKeys) });
-    evt("ordered", { reqId, order, canFallback, canForwardPeers, useAuto, statuses: auto?.statuses?.() ?? null });
-
-    if (plugins?.length && !lockModel) {
-      const sel = await runHook(plugins, "model:select", { reqId, requested, useAuto, order: [...order], hops, stream: Boolean(req?.body?.stream) });
-      if (sel.changed && Array.isArray(sel.value) && sel.value.length) {
-        order = sel.value.filter(Boolean);
-        if (!order.length) order = [requested];
-        evt("plugin-hook", { reqId, hook: "model:select", applied: true, order: [...order] });
-      }
-      for (const e of sel.errors) evt("plugin-hook-error", { reqId, hook: "model:select", plugin: e.plugin, error: e.error });
-    }
-
-    // 客户端会话标识（opencode 插件 chat.headers 注入）→ 透传上游做粘性路由/缓存亲和；
-    // 无头时由 upstream.js 按对话首两条消息哈希兜底（不再每请求随机）
-    const clientSession = String(req?.headers?.["x-session-affinity"] || req?.headers?.["x-session-id"] || "").trim() || null;
-    // triedUrls 挂请求级并**按引用**共享：同一请求内"同一组员不重复试"的契约跨候选生效
-    // （peer 阶段各分支会 spread 出上下文副本，集合在这里建一次才不会各存一份）。
-    const handlerCtx = { reqId, api, model: null, body: req?.body, hops, peers, plugins, evt, logError, logCall, logs, workbuddyUid, sessionId: clientSession, clientIp: reqIp, triedUrls: new Set(), isProbe };
-    if (clientSession) evt("client-session", { reqId, sessionId: clientSession.slice(0, 24) });
-
-    await engine.run({
-      reqId, startedAt, req, res, body: req?.body, policy,
-      useAuto, lockModel, requested, hops,
-      canFallback, canForwardPeers,
-      perf0, stages, mark, evt, logCall, logError, done, handlerCtx,
-      auto, upstream, peers, groups, bus, token, plugins, logs,
-      order,
-    });
-  }
-
-  return { execute, _policy: analyzePolicy, _engine: engine };
+import { performance } from "node:perf_hooks";
+import { analyzePolicy } from "./policy.js";
+import { createEngine } from "./engine.js";
+import { runHook } from "../plugins.js";
+import { isFreeModel } from "../models.js";
+import { clientIp, summarizePrompt } from "../routes/helpers.js";
+import { formatTimeline } from "../timeline.js";
+import { summarizeRequest, shouldTraceModel } from "../model-trace.js";
+import { apiKindOf } from "../api-kind.js";
+
+/**
+ * ChatPipeline 深模块门面 — 对外 execute(req) 单一 inlet
+ * 内部组合 Policy→Engine：解析 header/model → 产 order → 委托 engine 执行
+ * gateway 仅薄适配：readBody + request:received hook + 调 execute
+ */
+
+export function createChatPipeline({ upstream, auto, logs, peers, groups, bus, token, plugins, maxHops } = {}) {
+  const engine = createEngine();
+
+  async function execute({ req, res } = {}) {
+    const startedAt = Date.now();
+    const reqId = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
+    // 入站协议门（chat|responses|messages|other）：全场只在这里判一次，之后随 handlerCtx 透传；
+    // 各日志写点不得再各自匹配路径（第二份判定迟早漂移）—— 见 src/api-kind.js
+    const api = apiKindOf(req);
+    const perf0 = performance.now();
+    const stages = [];
+    const mark = (name) => stages.push([name, Math.round(performance.now() - perf0)]);
+
+    const policy = analyzePolicy({ headers: req?.headers || {}, body: req?.body || {} });
+    const { requested, useAuto, autoProvider, lockModel, hops, shareKeys, workbuddyUid, aliasInfo } = policy;
+    mark("parsed");
+    if (aliasInfo) { try { res?.setHeader?.("x-mslxdff-alias", aliasInfo); } catch {} }
+    // mslxdff/ 前缀或 alias 命中时，把 body.model 改写为还原后的模型（与原 gateway 语义一致）
+    const timeline = { direct: [], peers: [], retries: 0, retryResult: null, result: null };
+    if (aliasInfo && req?.body && req.body.model !== requested) {
+      req.body = { ...req.body, model: requested };
+    }
+
+    // 事件/日志帮手先于 order 推导声明：evt 在 auto-scope 分支即被使用，
+    // 声明置后会让 useAuto && autoProvider 的请求在 TDZ 上崩（线上 -chat 回退路径）
+    const logCall = (model, status) => logs?.appendCall({ reqId, api, model, auto: useAuto, status, durationMs: Date.now() - startedAt, stream: Boolean(req?.body?.stream), stages });
+    const logError = (model, status, message) => logs?.appendError({ reqId, api, model, auto: useAuto, status, message, stages });
+    const evt = (type, data) => {
+      const entry = { ts: Date.now(), reqId, type, ...data, api, model: data.model ?? requested, auto: useAuto, durationMs: Date.now() - startedAt, stages: [...stages] };
+      const traceModel = entry.model || requested;
+      if (shouldTraceModel(type)) {
+        // Note: 模型日志只投影安全字段，不能把含 prompt 的 entry 原样下传 — 见 .agents/notes/implemented/feature/2026-09-25-model-trace-log.md
+        const safeTraceData = { ...entry };
+        if (safeTraceData.prompt !== undefined) delete safeTraceData.prompt;
+        logs?.appendModelTrace?.(traceModel, { type, reqId, model: traceModel, data: safeTraceData, request: type === "request" ? summarizeRequest(req?.body) : null, totalMs: entry.durationMs });
+      }
+      if (type === "peer-forward") timeline.peers.push({ peer: entry.peer, ok: entry.ok === true, status: entry.status, latencyMs: entry.latencyMs, message: entry.message || entry.error || "" });
+      if (type === "upstream-done" || type === "upstream-error") timeline.direct.push({ status: entry.status, reason: entry.message || entry.error || "" });
+      if (type === "peer-error") {
+        const known = timeline.peers.find((p) => p.peer === entry.peer);
+        if (known) { known.ok = false; known.status = entry.status ?? known.status; known.message = entry.message || entry.error || known.message; }
+        else timeline.peers.push({ peer: entry.peer, ok: false, status: entry.status, message: entry.message || entry.error || "" });
+      }
+      if (type === "empty-turn-retry") timeline.retries += 1;
+      // 空转重试必须交代结局：只记次数的话，"重试后救回来"和"重试到死"在日志里长得一模一样
+      if (type === "empty-turn-recovered") timeline.retryResult = "ok";
+      if (type === "empty-turn-exhausted") timeline.retryResult = timeline.retryResult || "lost";
+      if (type === "result" || (type === "client-response" && !timeline.result)) {
+        timeline.result = { status: entry.status, detail: entry.detail || null };
+        try { logs?.appendTimeline?.(formatTimeline({ reqId, model: entry.model || requested, ...timeline, totalMs: Date.now() - startedAt })); } catch {}
+      }
+      if (bus) bus.emit(entry);
+      logs?.appendEvent?.(entry);
+    };
+    const done = (info) => {
+      if (!plugins?.length) return;
+      runHook(plugins, "request:completed", { reqId, requested, useAuto, hops, stream: Boolean(req?.body?.stream), durationMs: Date.now() - startedAt, ...info }).catch(() => {});
+    };
+
+    // order 推导 + plugin model:select 可改
+    // 语义：指定模型 = 死锁单模型（本机→组员同款，挂了就报挂，不兜其他 picks）；只有 auto 才轮 picks
+    // 指定模型的额度耗尽时**不换模型**：横向只在同模型的组员/组长间接力（本机出口 IP 耗尽 → 换组员机器），
+    // 模型永不漂移。详见 serial-trial 的 order 单元素路径与 peer 接力。
+    // x-mslxdff-auto-provider 头可把 auto 候选限定到单供应商（opencode=裸 id 免费池），-chat 默认带
+    let order;
+    if (lockModel) order = [requested];
+    else if (useAuto) {
+      let cands = auto ? await auto.candidates() : [""];
+      if (autoProvider) {
+        const before = cands.length;
+        cands = cands.filter((m) => (autoProvider === "opencode"
+          ? !String(m).includes("/") && isFreeModel(m)
+          : String(m).startsWith(`${autoProvider}/`)));
+        evt("auto-scope", { reqId, provider: autoProvider, before, after: cands.length });
+      }
+      order = cands;
+    } else {
+      // 指定模型 = 死锁单模型：额度耗尽只换组员/组长（同模型换机器），**绝不换模型**。
+      // candidatesFor 的持久化副作用（把显式指定的模型加入勾选集，供日后 auto 用）必须保留——
+      // 见 auto.js:180「显式指定某模型 = 认可它，自动加入勾选集」，历史上删它会丢勾选记录。
+      // 但**不 await**（2026-10-22 日志定罪：loadList 拉全量模型目录烧 24s，写盘 persistPicks 仅 0ms）。
+      // 此路径 order 已定死 [requested]，candidatesFor 返回值根本不被消费，只为触发"加入勾选集"副作用——
+      // 为副作用让主请求干等 24s 是自伤。改后台 fire-and-forget：勾选照样持久化，主请求零阻塞。
+      if (auto && requested) {
+        const tCf = performance.now();
+        Promise.resolve()
+          .then(() => auto.candidatesFor(requested))
+          .catch(() => {})
+          .finally(() => {
+            const ms = Math.round(performance.now() - tCf);
+            if (ms > 5000) console.log(`[pipeline-bg] candidatesFor 后台耗时 model=${requested} ms=${ms}（未阻塞主请求）`);
+          });
+      }
+      order = [requested];
+    }
+    if (!order.length) order = [""];
+    const canFallback = order.length > 1;
+    // hi 探针（x-mslxdff-probe:1）只问「这台机器此刻能不能打通上游」，不代表真实业务：
+    // 它绝不能再触发本机的组员/宽带接力——否则探针会跟着走完整条接力链（最坏 45s 预算），
+    // 而调用方只看它几百毫秒内活不活。组员侧就地直连，成败如实回给调用方。
+    const isProbe = String(req?.headers?.["x-mslxdff-probe"] || "") === "1";
+    const canForwardPeers = !isProbe && Boolean(peers) && hops < (maxHops ?? 3);
+    mark("ordered");
+
+    const reqIp = clientIp(req); // 一次解析两处用：request 事件的 ip 字段 + 回路语料的 clientIp（routes/helpers.js 取 x-forwarded-for 首段）
+    evt("request", { reqId, hops, ip: reqIp, stream: Boolean(req?.body?.stream), prompt: summarizePrompt(req?.body), rawModel: policy.rawModel, requested, lockModel: lockModel || null });
+    if (aliasInfo) evt("alias", { reqId, alias: aliasInfo, rawModel: policy.rawModel, requested });
+    if (Object.keys(shareKeys).length) evt("share-keys", { reqId, providers: Object.keys(shareKeys) });
+    evt("ordered", { reqId, order, canFallback, canForwardPeers, useAuto, statuses: auto?.statuses?.() ?? null });
+
+    if (plugins?.length && !lockModel) {
+      const sel = await runHook(plugins, "model:select", { reqId, requested, useAuto, order: [...order], hops, stream: Boolean(req?.body?.stream) });
+      if (sel.changed && Array.isArray(sel.value) && sel.value.length) {
+        order = sel.value.filter(Boolean);
+        if (!order.length) order = [requested];
+        evt("plugin-hook", { reqId, hook: "model:select", applied: true, order: [...order] });
+      }
+      for (const e of sel.errors) evt("plugin-hook-error", { reqId, hook: "model:select", plugin: e.plugin, error: e.error });
+    }
+
+    // 客户端会话标识（opencode 插件 chat.headers 注入）→ 透传上游做粘性路由/缓存亲和；
+    // 无头时由 upstream.js 按对话首两条消息哈希兜底（不再每请求随机）
+    const clientSession = String(req?.headers?.["x-session-affinity"] || req?.headers?.["x-session-id"] || "").trim() || null;
+    // triedUrls 挂请求级并**按引用**共享：同一请求内"同一组员不重复试"的契约跨候选生效
+    // （peer 阶段各分支会 spread 出上下文副本，集合在这里建一次才不会各存一份）。
+    const handlerCtx = { reqId, api, model: null, body: req?.body, hops, peers, plugins, evt, logError, logCall, logs, workbuddyUid, sessionId: clientSession, clientIp: reqIp, triedUrls: new Set(), isProbe };
+    if (clientSession) evt("client-session", { reqId, sessionId: clientSession.slice(0, 24) });
+
+    await engine.run({
+      reqId, startedAt, req, res, body: req?.body, policy,
+      useAuto, lockModel, requested, hops,
+      canFallback, canForwardPeers,
+      perf0, stages, mark, evt, logCall, logError, done, handlerCtx,
+      auto, upstream, peers, groups, bus, token, plugins, logs,
+      order,
+    });
+  }
+
+  return { execute, _policy: analyzePolicy, _engine: engine };
 }

package/src/chat-pipeline/policy.js

@@ -1,84 +1,84 @@
-import { normalizeModel } from "../reasoning.js";
-import { isAutoModel } from "../auto.js";
-import { parseHops } from "../routes/helpers.js";
-import { parseShareKeysHeader, SHARE_KEYS_HEADER } from "../providers/share-keys.js";
-import { normalizeFullId, getModelAlias } from "../providers/model-id.js";
-
-/**
- * PolicyStage 纯函数 — 解析 model 别名 / 白名单前置 / header 透传
- * 零网络副作用，输入 headers+body，输出 PolicyResult
- */
-export function analyzePolicy({ headers = {}, body = {} } = {}) {
-  const hops = parseHops(headers["x-mslxdff-hops"] || headers["X-Mslxdff-Hops"] || "");
-  const shareKeys = parseShareKeysHeader(headers[SHARE_KEYS_HEADER] || headers["x-mslxdff-share-keys"] || "");
-  const workbuddyUid = (headers["x-mslxdff-workbuddy-uid"] || headers["x-workbuddy-uid"] || "").toString().trim();
-  const lockModel = (headers["x-mslxdff-model-lock"] || headers["X-Mslxdff-Model-Lock"] || "").toString();
-  // auto 范围限定：x-mslxdff-auto-provider: opencode → auto 候选只留该供应商（opencode=裸 id 免费池）
-  const autoProvider = (headers["x-mslxdff-auto-provider"] || headers["X-Mslxdff-Auto-Provider"] || "").toString().trim().toLowerCase() || null;
-  const rawModel = body.model || "";
-
-  let normalizedRequested = normalizeModel(lockModel || rawModel || "");
-  // [1m] 后缀回退（Claude Desktop 1M 条目 / Claude Code 1M 记法，ADR-0056）：alias 直查未命中时
-  // 剥去尾部 [1m] 再查一次。仅用于本次查找——不回写、不注册 alias，未命中路径逐字不变（design D2）。
-  // 两个 alias 查找点（首轮 + mslxdff/ 前缀二段）共用同一回退，否则 `mslxdff/<槽位>[1m]` 不等价（评审 1 P1）。
-  const resolveAlias = (id) => {
-    const hit = getModelAlias(id);
-    if (hit) return hit;
-    return /\[1m\]$/i.test(id) ? getModelAlias(id.replace(/\[1m\]$/i, "")) : null;
-  };
-  let aliasResolved = resolveAlias(normalizedRequested);
-  if (aliasResolved) {
-    normalizedRequested = aliasResolved;
-  }
-  let requested = normalizedRequested;
-  let aliasInfo = null;
-
-  if (requested.startsWith("mslxdff/")) {
-    const rawPart = requested.slice("mslxdff/".length);
-    aliasInfo = `${requested} -> ${rawPart} (mslxdff provider stripped)`;
-    requested = rawPart;
-    const alias2 = resolveAlias(requested);
-    if (alias2) {
-      aliasInfo = `${rawModel} -> ${alias2} (mslxdff + alias)`;
-      requested = alias2;
-    }
-  } else if (aliasResolved) {
-    // 非 mslxdff 的 dash 形态已在首轮 aliasResolved 处理
-    aliasInfo = aliasResolved !== (lockModel || rawModel) ? `${rawModel} -> ${aliasResolved} (alias)` : null;
-    if (!aliasInfo) aliasInfo = null;
-  }
-
-  // workbuddy <uid>:model 形式的 uid 钉死在 normalizeFullId 侧处理，这里透传原始 requested
-  // 若 requested 含 workbuddy/ 前缀且含 :，则尝试提取 uid
-  let extractedUid = workbuddyUid;
-  if (!extractedUid && requested.startsWith("workbuddy/") && requested.includes(":")) {
-    const after = requested.slice("workbuddy/".length);
-    const uidPart = after.split(":")[0];
-    if (uidPart) extractedUid = uidPart;
-  }
-
-  const useAuto = isAutoModel(requested);
-
-  // 对 workbuddy 前缀的 model，做 normalizeFullId 归一（剥 uid 供上游）
-  // 但保留 requested 为完整带前缀形态，供 serial-trial 做 ViaRoute 判定与组员路由
-  let normalizedForUpstream = requested;
-  try {
-    const norm = normalizeFullId(requested);
-    if (norm && norm.raw) normalizedForUpstream = norm.raw ? `${norm.provider ? norm.provider + "/" : ""}${norm.raw}` : requested;
-  } catch {}
-
-  return {
-    rawModel,
-    requested,
-    normalizedRequested,
-    normalizedForUpstream,
-    aliasInfo,
-    useAuto,
-    autoProvider,
-    shareKeys,
-    workbuddyUid: extractedUid,
-    lockModel,
-    hops,
-    bodyModel: body.model || null,
-  };
-}
+import { normalizeModel } from "../reasoning.js";
+import { isAutoModel } from "../auto.js";
+import { parseHops } from "../routes/helpers.js";
+import { parseShareKeysHeader, SHARE_KEYS_HEADER } from "../providers/share-keys.js";
+import { normalizeFullId, getModelAlias } from "../providers/model-id.js";
+
+/**
+ * PolicyStage 纯函数 — 解析 model 别名 / 白名单前置 / header 透传
+ * 零网络副作用，输入 headers+body，输出 PolicyResult
+ */
+export function analyzePolicy({ headers = {}, body = {} } = {}) {
+  const hops = parseHops(headers["x-mslxdff-hops"] || headers["X-Mslxdff-Hops"] || "");
+  const shareKeys = parseShareKeysHeader(headers[SHARE_KEYS_HEADER] || headers["x-mslxdff-share-keys"] || "");
+  const workbuddyUid = (headers["x-mslxdff-workbuddy-uid"] || headers["x-workbuddy-uid"] || "").toString().trim();
+  const lockModel = (headers["x-mslxdff-model-lock"] || headers["X-Mslxdff-Model-Lock"] || "").toString();
+  // auto 范围限定：x-mslxdff-auto-provider: opencode → auto 候选只留该供应商（opencode=裸 id 免费池）
+  const autoProvider = (headers["x-mslxdff-auto-provider"] || headers["X-Mslxdff-Auto-Provider"] || "").toString().trim().toLowerCase() || null;
+  const rawModel = body.model || "";
+
+  let normalizedRequested = normalizeModel(lockModel || rawModel || "");
+  // [1m] 后缀回退（Claude Desktop 1M 条目 / Claude Code 1M 记法，ADR-0056）：alias 直查未命中时
+  // 剥去尾部 [1m] 再查一次。仅用于本次查找——不回写、不注册 alias，未命中路径逐字不变（design D2）。
+  // 两个 alias 查找点（首轮 + mslxdff/ 前缀二段）共用同一回退，否则 `mslxdff/<槽位>[1m]` 不等价（评审 1 P1）。
+  const resolveAlias = (id) => {
+    const hit = getModelAlias(id);
+    if (hit) return hit;
+    return /\[1m\]$/i.test(id) ? getModelAlias(id.replace(/\[1m\]$/i, "")) : null;
+  };
+  let aliasResolved = resolveAlias(normalizedRequested);
+  if (aliasResolved) {
+    normalizedRequested = aliasResolved;
+  }
+  let requested = normalizedRequested;
+  let aliasInfo = null;
+
+  if (requested.startsWith("mslxdff/")) {
+    const rawPart = requested.slice("mslxdff/".length);
+    aliasInfo = `${requested} -> ${rawPart} (mslxdff provider stripped)`;
+    requested = rawPart;
+    const alias2 = resolveAlias(requested);
+    if (alias2) {
+      aliasInfo = `${rawModel} -> ${alias2} (mslxdff + alias)`;
+      requested = alias2;
+    }
+  } else if (aliasResolved) {
+    // 非 mslxdff 的 dash 形态已在首轮 aliasResolved 处理
+    aliasInfo = aliasResolved !== (lockModel || rawModel) ? `${rawModel} -> ${aliasResolved} (alias)` : null;
+    if (!aliasInfo) aliasInfo = null;
+  }
+
+  // workbuddy <uid>:model 形式的 uid 钉死在 normalizeFullId 侧处理，这里透传原始 requested
+  // 若 requested 含 workbuddy/ 前缀且含 :，则尝试提取 uid
+  let extractedUid = workbuddyUid;
+  if (!extractedUid && requested.startsWith("workbuddy/") && requested.includes(":")) {
+    const after = requested.slice("workbuddy/".length);
+    const uidPart = after.split(":")[0];
+    if (uidPart) extractedUid = uidPart;
+  }
+
+  const useAuto = isAutoModel(requested);
+
+  // 对 workbuddy 前缀的 model，做 normalizeFullId 归一（剥 uid 供上游）
+  // 但保留 requested 为完整带前缀形态，供 serial-trial 做 ViaRoute 判定与组员路由
+  let normalizedForUpstream = requested;
+  try {
+    const norm = normalizeFullId(requested);
+    if (norm && norm.raw) normalizedForUpstream = norm.raw ? `${norm.provider ? norm.provider + "/" : ""}${norm.raw}` : requested;
+  } catch {}
+
+  return {
+    rawModel,
+    requested,
+    normalizedRequested,
+    normalizedForUpstream,
+    aliasInfo,
+    useAuto,
+    autoProvider,
+    shareKeys,
+    workbuddyUid: extractedUid,
+    lockModel,
+    hops,
+    bodyModel: body.model || null,
+  };
+}

package/src/chat-pipeline/serial-trial.js

@@ -15,6 +15,7 @@ import { isEmptyTurnError } from "../routes/chat/relay-pipeline.js";
 import { emptyRetryCfg, emptyRaiseCap, withRaisedMaxTokens, withOutputFloor, emptyNudgeCfg, withEmptyNudge, computeNextDelay, emptyTurnBudgetMs, emptyTurnMinRaiseTo } from "./empty-turn.js";
 import { classifyTerminalUpstream, readVerdictText, terminalShortcircuitOff } from "./terminal-verdict.js";
 import { forwardOrGuard } from "./context-forward.js";
+import { chatWith5xxRetry, http5xxRetryCfg } from "./upstream-5xx-retry.js";
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
@@ -111,7 +112,14 @@ export async function runSerialTrial(ctx, deps = {}) {
       const tUp = performance.now();
       evt("upstream-try", { reqId, model, attempt: idx + 1, emptyRetry: emptyRetried, payload: summarizeRequest(forwarded) });
       try {
-        upRes = await upstream.chat(forwarded, chatOptsArg);
+        // 指定模型：5xx 先原地等 5s 重试（默认 3 次），仍 5xx 才交给上层换 1 个节点；auto 原样直发。
+        // 见 upstream-5xx-retry.js（用户口径 2026-10-23）。
+        upRes = await chatWith5xxRetry({
+          call: () => upstream.chat(forwarded, chatOptsArg),
+          singleModel: !useAuto,
+          evt, reqId, model,
+          isClosed: () => Boolean(res?.destroyed || res?.writableEnded),
+        });
         evt("upstream-done", { reqId, model, ok: !(upRes instanceof Error) && upRes.status < 400, status: upRes instanceof Error ? null : upRes.status, timing: upRes._t ?? null, error: null, ...upstreamEcho(upRes) });
       } catch (err) {
         if (auto) await auto.recordError(model, { message: errMsg(err) });
@@ -258,16 +266,21 @@ export async function runSerialTrial(ctx, deps = {}) {
     }
     // 转发闸门（详见 context-forward.js）：被拦即收场，不许换路重试——同一份大上下文换个目标照样撑爆。
     const gc = { res, body, order, handlerCtx, evt, logCall, logError, mark, perf0, stages, done, requested, useAuto, model, exhaustedLocal };
+    // 指定模型 5xx 重试耗尽后：只换 1 个节点（同模型换机器），该节点仍失败就直接收场，不再走宽带。
+    // 429 不在此列——额度按出口 IP 计，等待无意义，仍按原逻辑逐个问节点。
+    // retries=0 是整套功能的逃生阀：连「只换一个节点」一起关，回到旧的 5xx 全节点路径。
+    const pinned5xx = !useAuto && http5xxRetryCfg().retries > 0 && Number(lastErr?.status) >= 500;
+    const peerCtx = pinned5xx ? { ...handlerCtx, singlePeer: true } : handlerCtx;
     if (canForwardPeers) {
       if (!shouldUseGroupForModel(model)) {
         evt("group-skip", { reqId, model, reason: `${groupSkipReason(model)} (peer)` });
       } else {
-        const fr = await forwardOrGuard(() => peerRelay({ model, body, lastErr, requested, useAuto, lockModel, auto, peers, handlerCtx, evt, logCall, mark, perf0, attemptStartMs: performance.now(), stages, startedAt, plugins, res }), gc);
+        const fr = await forwardOrGuard(() => peerRelay({ model, body, lastErr, requested, useAuto, lockModel, auto, peers, handlerCtx: peerCtx, evt, logCall, mark, perf0, attemptStartMs: performance.now(), stages, startedAt, plugins, res }), gc);
         if (fr.done) return fr;
         lastErr = fr.lastErr ?? lastErr;
       }
     }
-    if (groups) {
+    if (groups && !pinned5xx) {
       if (!shouldUseGroupForModel(model)) {
         evt("group-skip", { reqId, model, reason: `${groupSkipReason(model)} (broadband)` });
       } else {

package/src/chat-pipeline/upstream-5xx-retry.js

@@ -0,0 +1,72 @@
+// 指定模型撞 5xx 的原地重试（用户口径，2026-10-23）：
+//   5xx → 等 5s → 同模型重拉，连续重试 3 次；仍 5xx 才交给上层换 1 个节点。
+// 为什么不在 auto 里用：auto 的候选是不同模型池，换模型比等待更划算；指定模型的模型不能换，
+// 只能先等上游缓过来，避免「一失败就换节点」把一次故障放大成整组节点同时打上游。
+// 只处理 HTTP 5xx；429（按出口 IP 的额度）与 4xx 一律不等待，交回上层走原有路径。
+const DEFAULTS = Object.freeze({ retries: 3, delayMs: 5000 });
+
+function envIntOrZero(env, name, fallback) {
+  const raw = String(env[name] ?? "").trim();
+  if (raw === "") return fallback;
+  const n = Number(raw);
+  return Number.isInteger(n) && n >= 0 ? n : fallback;
+}
+
+/** 读配置：次数与间隔都允许 0（0 次 = 关闭；0ms = 不等待）。空串/非法值回落默认。 */
+export function http5xxRetryCfg(env = process.env) {
+  return {
+    retries: envIntOrZero(env, "MSLXDFF_5XX_RETRIES", DEFAULTS.retries),
+    delayMs: envIntOrZero(env, "MSLXDFF_5XX_RETRY_DELAY_MS", DEFAULTS.delayMs),
+  };
+}
+
+export function isHttp5xx(status) {
+  return Number.isInteger(Number(status)) && Number(status) >= 500 && Number(status) <= 599;
+}
+
+function sleep(ms) {
+  return ms > 0 ? new Promise((r) => setTimeout(r, ms)) : Promise.resolve();
+}
+
+// 上一发失败的 5xx 响应体没有被业务消费（判据只读 clone），重试前主动取消，防连接空占。
+function cancelBody(res) {
+  try {
+    const p = res?.body?.cancel?.();
+    if (p && typeof p.catch === "function") p.catch(() => {});
+  } catch { /* 取消失败不影响重试 */ }
+}
+
+/**
+ * 包一层 upstream.chat：指定模型 + 5xx 时原地退避重试。
+ * @param {object} p
+ * @param {() => Promise<any>} p.call 真正发上游（每次调用都重新发）
+ * @param {boolean} p.singleModel 是否指定模型（false=auto，原样返回）
+ * @param {object} [p.cfg] http5xxRetryCfg()
+ * @param {(name:string, data:object)=>void} [p.evt]
+ * @param {string} [p.reqId]
+ * @param {string} [p.model]
+ * @param {() => boolean} [p.isClosed] 客户端是否已断开；断开即停止重试
+ * @returns {Promise<any>} 最后一发响应（可能是 5xx，也可能是成功）
+ */
+export async function chatWith5xxRetry({
+  call,
+  singleModel = false,
+  cfg = http5xxRetryCfg(),
+  evt,
+  reqId,
+  model,
+  isClosed,
+} = {}) {
+  let res = await call();
+  if (!singleModel || !cfg.retries) return res;
+  let retried = 0;
+  while (isHttp5xx(res?.status) && retried < cfg.retries) {
+    if (typeof isClosed === "function" && isClosed()) break;
+    retried += 1;
+    cancelBody(res);
+    try { evt?.("upstream-5xx-retry", { reqId, model, retry: retried, max: cfg.retries, delayMs: cfg.delayMs, status: res.status }); } catch {}
+    await sleep(cfg.delayMs);
+    res = await call();
+  }
+  return res;
+}