fix(#59,#63,#66): audit-driven hardening — parser order, rate-limit, /v1/responses + /v1/messages spec gaps

7 fixes from a project-wide gpt-5.5 audit:

#59 sub-bug 3 — tool-boundary text split (P1 真因 = parser bug)
- ToolCallStreamParser.feed() 之前 `{text, toolCalls}` 两个数组返回，丢失 text/tool 相对顺序
- 改成同时返回 `items: [{type:'text',text}|{type:'tool_call',toolCall}]` 保留顺序
- chat.js 流式消费方按 items 顺序 emit，不再先发全部 tool 再发文本
- 老 `text/toolCalls` 字段保留向后兼容

#66 — 300秒限速误报
- rateLimitCooldownMs 解析具体的 retry-after N seconds/minutes/hours，不再一刀切 5min
- markRateLimited 改成 max-extend 而不是覆盖，并发 429 不会把 cooldown 不断后推
- preflight checkMessageRateLimit 没拿到 retryAfterMs 时不再本地标 cooldown，本次 skip 即可
- windsurf-api.js 透传上游 retryAfterMs

#63 follow-up + P1 #2 — /v1/responses 规范缺口
- 非 function tools (web_search_preview 等) 静默 drop → 改成 400 直接拒
- function-call-only 响应不再带空 message item 在 output

P1 #1 — /v1/messages 丢失 thinking + tool_choice
- anthropicToOpenAI 透传 body.thinking
- Anthropic tool_choice (auto/any/tool/none) 映射到 OpenAI 形状

P1 #3 — 全账号 RPM 满返回 429 不是 503
- isAllTemporarilyUnavailable 聚合 rate_limit / model_rate_limit / rpm_full / strict_reuse_busy
- 非流式路径在 queue 超时后返回 429 + Retry-After，503 只在真没账号时返
- 流式 SSE 头已发，body error type 至少标对 rate_limit_exceeded

P1 #4 — preflight skip 还在吃本地 RPM headroom
- account 加 _lastReservationAt + getApiKey 返回 reservationTimestamp
- refundReservation(apiKey, ts) 把最近一条 _rpmHistory 退回去
- preflight !hasCapacity 路径自动调用，避免被跳过的账号占住本地配额

P2 cache-hit chunk 不一致
- cache HIT 流式分支拆成 finish_reason chunk + 单独 usage chunk，跟 live-stream 路径同 shape

测试：
- 12 个新单测 + 修了既有的 4 个，全套 158 个测试通过
- 新文件: test/rate-limit.test.js, test/messages.test.js, test/chat-cache-hit.test.js
- 改动: test/tool-emulation.test.js (items 顺序), test/responses.test.js (unsupported tool 400 + empty msg)

来源审计报告: tmp/audit-report-2026-04-26.md (gpt-5.5 high reasoning 出的 296 行 P0/P1/P2 全列)

Author: dwgx

src/auth.js

@@ -398,12 +398,14 @@ export function getApiKey(excludeKeys = [], modelKey = null) {
 
   const { account } = candidates[0];
   account._rpmHistory.push(now);
+  account._lastReservationAt = now;
   account.lastUsed = now;
   account._inflight = (account._inflight || 0) + 1;
   return {
     id: account.id, email: account.email, apiKey: account.apiKey,
     apiServerUrl: account.apiServerUrl || '',
     proxy: getEffectiveProxy(account.id) || null,
+    reservationTimestamp: now,
   };
 }
 
@@ -439,12 +441,14 @@ export function acquireAccountByKey(apiKey, modelKey = null) {
   if (used >= limit) return null;
   if (modelKey && !isModelAllowedForAccount(a, modelKey)) return null;
   a._rpmHistory.push(now);
+  a._lastReservationAt = now;
   a.lastUsed = now;
   a._inflight = (a._inflight || 0) + 1;
   return {
     id: a.id, email: a.email, apiKey: a.apiKey,
     apiServerUrl: a.apiServerUrl || '',
     proxy: getEffectiveProxy(a.id) || null,
+    reservationTimestamp: now,
   };
 }
 
@@ -530,17 +534,30 @@ export async function ensureLsForAccount(accountId) {
 export function markRateLimited(apiKey, durationMs = 5 * 60 * 1000, modelKey = null) {
   const account = accounts.find(a => a.apiKey === apiKey);
   if (!account) return;
-  const until = Date.now() + durationMs;
+  const safeMs = Math.max(1000, Number(durationMs) || 0);
+  const until = Date.now() + safeMs;
   if (modelKey) {
     if (!account._modelRateLimits) account._modelRateLimits = {};
-    account._modelRateLimits[modelKey] = until;
-    log.warn(`Account ${account.id} (${account.email}) rate-limited on ${modelKey} for ${Math.round(durationMs / 60000)} min`);
+    account._modelRateLimits[modelKey] = Math.max(account._modelRateLimits[modelKey] || 0, until);
+    log.warn(`Account ${account.id} (${account.email}) rate-limited on ${modelKey} for ${Math.round(safeMs / 60000)} min`);
   } else {
-    account.rateLimitedUntil = until;
-    log.warn(`Account ${account.id} (${account.email}) rate-limited (all models) for ${Math.round(durationMs / 60000)} min`);
+    account.rateLimitedUntil = Math.max(account.rateLimitedUntil || 0, until);
+    log.warn(`Account ${account.id} (${account.email}) rate-limited (all models) for ${Math.round(safeMs / 60000)} min`);
   }
 }
 
+export function refundReservation(apiKey, timestamp) {
+  const account = accounts.find(a => a.apiKey === apiKey);
+  if (!account) return false;
+  if (!Number.isFinite(timestamp)) return false;
+  if ((account._inflight || 0) <= 0) return false;
+  pruneRpmHistory(account, Date.now());
+  const idx = account._rpmHistory?.lastIndexOf(timestamp) ?? -1;
+  if (idx === -1) return false;
+  account._rpmHistory.splice(idx, 1);
+  return true;
+}
+
 /**
  * Check if an account is rate-limited for a specific model.
  */
@@ -628,6 +645,50 @@ export function isAllRateLimited(modelKey) {
   return { allLimited: true, retryAfterMs };
 }
 
+export function isAllTemporarilyUnavailable(modelKey) {
+  const now = Date.now();
+  let anyEligible = false;
+  let soonestExpiry = Infinity;
+
+  for (const a of accounts) {
+    if (a.status !== 'active') continue;
+    const limit = rpmLimitFor(a);
+    if (limit <= 0) continue;
+    if (modelKey && !isModelAllowedForAccount(a, modelKey)) continue;
+    anyEligible = true;
+
+    if (a.rateLimitedUntil && a.rateLimitedUntil > now) {
+      soonestExpiry = Math.min(soonestExpiry, a.rateLimitedUntil);
+      continue;
+    }
+
+    if (modelKey && a._modelRateLimits) {
+      const until = a._modelRateLimits[modelKey];
+      if (until && until > now) {
+        soonestExpiry = Math.min(soonestExpiry, until);
+        continue;
+      }
+      if (until && until <= now) delete a._modelRateLimits[modelKey];
+    }
+
+    const used = pruneRpmHistory(a, now);
+    if (used >= limit) {
+      const oldest = a._rpmHistory?.[0];
+      soonestExpiry = Math.min(
+        soonestExpiry,
+        oldest ? Math.max(now + 30_000, oldest + RPM_WINDOW_MS) : now + 30_000
+      );
+      continue;
+    }
+
+    return { allUnavailable: false, retryAfterMs: null };
+  }
+
+  if (!anyEligible) return { allUnavailable: false, retryAfterMs: null };
+  const retryAfterMs = soonestExpiry === Infinity ? 30_000 : Math.max(1000, soonestExpiry - now);
+  return { allUnavailable: true, retryAfterMs };
+}
+
 export function isAuthenticated() {
   return accounts.some(a => a.status === 'active');
 }

src/handlers/chat.js

@@ -5,7 +5,7 @@
 
 import { createHash, randomUUID } from 'crypto';
 import { WindsurfClient, isCascadeTransportError } from '../client.js';
-import { getApiKey, acquireAccountByKey, releaseAccount, getAccountAvailability, reportError, reportSuccess, markRateLimited, reportInternalError, updateCapability, getAccountList, isAllRateLimited } from '../auth.js';
+import { getApiKey, acquireAccountByKey, releaseAccount, getAccountAvailability, reportError, reportSuccess, markRateLimited, reportInternalError, updateCapability, getAccountList, isAllRateLimited, isAllTemporarilyUnavailable, refundReservation } from '../auth.js';
 import { resolveModel, getModelInfo } from '../models.js';
 import { getLsFor, ensureLs } from '../langserver.js';
 import { config, log } from '../config.js';
@@ -186,9 +186,17 @@ function strictReuseMessage(model, retryMs, reason = 'temporarily unavailable')
   return `${model} 上下文复用绑定账号暂不可用（${reason}）。为避免切换账号导致上下文丢失，请 ${Math.ceil(retryMs / 1000)} 秒后重试`;
 }
 
-function rateLimitCooldownMs(message = '') {
+export function rateLimitCooldownMs(message = '') {
+  const m = String(message || '').match(/(?:retry (?:after|in)|after)\s+(\d+)\s*(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h)/i);
+  if (m) {
+    const n = Number(m[1]);
+    const unit = m[2].toLowerCase();
+    if (unit.startsWith('h')) return n * 60 * 60 * 1000;
+    if (unit.startsWith('m')) return n * 60 * 1000;
+    return n * 1000;
+  }
   if (/about an hour|in an hour|try again in.*hour/i.test(message)) return 60 * 60 * 1000;
-  return 5 * 60 * 1000;
+  return 60 * 1000;
 }
 
 function genId() {
@@ -436,6 +444,8 @@ export async function handleChatCompletions(body, context = {}) {
   } = body;
   let messages = body.messages;
   const callerKey = context.callerKey || body.__callerKey || '';
+  const checkMessageRateLimitFn = context.checkMessageRateLimit || checkMessageRateLimit;
+  const waitForAccountFn = context.waitForAccount || waitForAccount;
 
   // Probe diagnostics: dump compact request shape for every call, plus a
   // tail of the last user turn. Keeps us able to see how third-party
@@ -664,7 +674,10 @@ export async function handleChatCompletions(body, context = {}) {
   const ckey = cacheKey(body);
 
   if (stream) {
-    return streamResponse(chatId, created, displayModel, modelKey, messages, cascadeMessages, modelEnum, modelUid, useCascade, ckey, emulateTools, toolPreamble, reqId, wantJson, callerKey);
+    return streamResponse(chatId, created, displayModel, modelKey, messages, cascadeMessages, modelEnum, modelUid, useCascade, ckey, emulateTools, toolPreamble, reqId, wantJson, callerKey, {
+      checkMessageRateLimit: checkMessageRateLimitFn,
+      waitForAccount: waitForAccountFn,
+    });
   }
 
   // ── Local response cache (exact body match) ─────────────
@@ -750,7 +763,7 @@ export async function handleChatCompletions(body, context = {}) {
       }
     }
     if (!acct) {
-      acct = await waitForAccount(tried, null, QUEUE_MAX_WAIT_MS, modelKey);
+      acct = await waitForAccountFn(tried, null, QUEUE_MAX_WAIT_MS, modelKey);
       if (!acct) break;
     }
     tried.push(acct.apiKey);
@@ -761,10 +774,13 @@ export async function handleChatCompletions(body, context = {}) {
     if (isExperimentalEnabled('preflightRateLimit')) {
       try {
         const px = getEffectiveProxy(acct.id) || null;
-        const rl = await checkMessageRateLimit(acct.apiKey, px);
+        const rl = await checkMessageRateLimitFn(acct.apiKey, px);
         if (!rl.hasCapacity) {
           log.warn(`Preflight: ${acct.email} has no capacity (remaining=${rl.messagesRemaining}), skipping`);
-          markRateLimited(acct.apiKey, 5 * 60 * 1000, modelKey);
+          refundReservation(acct.apiKey, acct.reservationTimestamp);
+          if (Number.isFinite(rl.retryAfterMs) && rl.retryAfterMs > 0) {
+            markRateLimited(acct.apiKey, rl.retryAfterMs, modelKey);
+          }
           if (strictReuse && checkedOutReuseEntry && fpBefore && checkedOutReuseEntry.apiKey === acct.apiKey) {
             const availability = getAccountAvailability(acct.apiKey, modelKey);
             const retryAfterMs = strictReuseRetryMs(availability);
@@ -872,6 +888,25 @@ export async function handleChatCompletions(body, context = {}) {
     };
   }
   // If all accounts exhausted, check if it's because they're all rate-limited
+  const temporaryUnavailable = isAllTemporarilyUnavailable(modelKey);
+  if (temporaryUnavailable.allUnavailable) {
+    if (checkedOutReuseEntry && fpBefore) {
+      poolCheckin(fpBefore, checkedOutReuseEntry, callerKey);
+      log.info(`Chat[${reqId}]: restored checked-out cascade after temporary unavailability`);
+    }
+    const retryAfterSec = Math.ceil(temporaryUnavailable.retryAfterMs / 1000);
+    return {
+      status: 429,
+      headers: { 'Retry-After': String(retryAfterSec) },
+      body: {
+        error: {
+          message: `${displayModel} 所有账号暂时不可用，请 ${retryAfterSec} 秒后重试`,
+          type: 'rate_limit_exceeded',
+          retry_after_ms: temporaryUnavailable.retryAfterMs,
+        },
+      },
+    };
+  }
   if (!lastErr || lastErr.status === 429) {
     const rl = isAllRateLimited(modelKey);
     if (rl.allLimited) {
@@ -1060,7 +1095,9 @@ async function nonStreamResponse(client, id, created, model, modelKey, messages,
   }
 }
 
-function streamResponse(id, created, model, modelKey, messages, cascadeMessages, modelEnum, modelUid, useCascade, ckey, emulateTools, toolPreamble, reqId, wantJson = false, callerKey = '') {
+function streamResponse(id, created, model, modelKey, messages, cascadeMessages, modelEnum, modelUid, useCascade, ckey, emulateTools, toolPreamble, reqId, wantJson = false, callerKey = '', deps = {}) {
+  const checkMessageRateLimitFn = deps.checkMessageRateLimit || checkMessageRateLimit;
+  const waitForAccountFn = deps.waitForAccount || waitForAccount;
   return {
     status: 200,
     stream: true,
@@ -1120,8 +1157,9 @@ function streamResponse(id, created, model, modelKey, messages, cascadeMessages,
               choices: [{ index: 0, delta: { content: cached.text }, finish_reason: null }] });
           }
           send({ id, object: 'chat.completion.chunk', created, model,
-            choices: [{ index: 0, delta: {}, finish_reason: 'stop' }],
-            usage: cachedUsage(messages, cached.text) });
+            choices: [{ index: 0, delta: {}, finish_reason: 'stop' }] });
+          send({ id, object: 'chat.completion.chunk', created, model,
+            choices: [], usage: cachedUsage(messages, cached.text) });
           if (!res.writableEnded) { res.write('data: [DONE]\n\n'); res.end(); }
         } finally {
           unregisterSse();
@@ -1228,18 +1266,32 @@ function streamResponse(id, created, model, modelKey, messages, cascadeMessages,
           //              →  client
           let safeText = chunk.text;
           if (toolParser) {
-            const { text: safe, toolCalls: done } = toolParser.feed(chunk.text);
-            safeText = safe;
-            // Only emit tool_call deltas when emulating — otherwise the
-            // parsed calls came from Cascade's built-in tools and are
-            // silently discarded. Sanitize server-internal paths out of
-            // the emulated call's input too (issue #38) — otherwise Claude
-            // Code tries to Read the sandbox path and fails.
-            for (const rawTc of done) {
-              const tc = sanitizeToolCall(rawTc);
-              const idx = collectedToolCalls.length;
-              collectedToolCalls.push(tc);
-              emitToolCallDelta(tc, idx);
+            const parsed = toolParser.feed(chunk.text);
+            safeText = parsed.text;
+            if (Array.isArray(parsed.items) && parsed.items.length) {
+              for (const item of parsed.items) {
+                if (item.type === 'text') {
+                  emitContent(pathStreamText.feed(item.text));
+                  continue;
+                }
+                const tc = sanitizeToolCall(item.toolCall);
+                const idx = collectedToolCalls.length;
+                collectedToolCalls.push(tc);
+                emitToolCallDelta(tc, idx);
+              }
+              safeText = '';
+            } else {
+              // Only emit tool_call deltas when emulating — otherwise the
+              // parsed calls came from Cascade's built-in tools and are
+              // silently discarded. Sanitize server-internal paths out of
+              // the emulated call's input too (issue #38) — otherwise Claude
+              // Code tries to Read the sandbox path and fails.
+              for (const rawTc of parsed.toolCalls) {
+                const tc = sanitizeToolCall(rawTc);
+                const idx = collectedToolCalls.length;
+                collectedToolCalls.push(tc);
+                emitToolCallDelta(tc, idx);
+              }
             }
           }
           if (safeText) emitContent(pathStreamText.feed(safeText));
@@ -1283,7 +1335,7 @@ function streamResponse(id, created, model, modelKey, messages, cascadeMessages,
             }
           }
           if (!acct) {
-            acct = await waitForAccount(tried, abortController.signal, QUEUE_MAX_WAIT_MS, modelKey);
+            acct = await waitForAccountFn(tried, abortController.signal, QUEUE_MAX_WAIT_MS, modelKey);
             if (!acct) break;
           }
           tried.push(acct.apiKey);
@@ -1294,10 +1346,13 @@ function streamResponse(id, created, model, modelKey, messages, cascadeMessages,
           if (isExperimentalEnabled('preflightRateLimit')) {
             try {
               const px = getEffectiveProxy(acct.id) || null;
-              const rl = await checkMessageRateLimit(acct.apiKey, px);
+              const rl = await checkMessageRateLimitFn(acct.apiKey, px);
               if (!rl.hasCapacity) {
                 log.warn(`Preflight: ${acct.email} has no capacity (remaining=${rl.messagesRemaining}), skipping`);
-                markRateLimited(acct.apiKey, 5 * 60 * 1000, modelKey);
+                refundReservation(acct.apiKey, acct.reservationTimestamp);
+                if (Number.isFinite(rl.retryAfterMs) && rl.retryAfterMs > 0) {
+                  markRateLimited(acct.apiKey, rl.retryAfterMs, modelKey);
+                }
                 if (strictReuse && checkedOutReuseEntry && fpBefore && checkedOutReuseEntry.apiKey === acct.apiKey) {
                   const availability = getAccountAvailability(acct.apiKey, modelKey);
                   const retryAfterMs = strictReuseRetryMs(availability);
@@ -1449,12 +1504,15 @@ function streamResponse(id, created, model, modelKey, messages, cascadeMessages,
         log.error('Stream error after retries:', lastErr?.message);
         recordRequest(model, false, Date.now() - startTime, currentApiKey);
         try {
+          const temporaryUnavailable = isAllTemporarilyUnavailable(modelKey);
           const rl = isAllRateLimited(modelKey);
           const allInternal = streamInternalCount > 0 && tried.length > 0 && streamInternalCount >= tried.length;
           // 优先暴露 upstream_transient，避免把 Cascade transport 抖动误报成账号限流。
           const lastIsTransport = isCascadeTransportError(lastErr);
           const errMsg = allInternal
             ? upstreamTransientErrorMessage(model, tried.length, lastIsTransport ? 'cascade_transport' : 'internal_error')
+            : temporaryUnavailable.allUnavailable
+            ? `${model} 所有账号暂时不可用，请 ${Math.ceil(temporaryUnavailable.retryAfterMs / 1000)} 秒后重试`
             : rl.allLimited
             ? `${model} 所有账号均已达速率限制，请 ${Math.ceil(rl.retryAfterMs / 1000)} 秒后重试`
             : sanitizeText(lastErr?.message || 'no accounts');
@@ -1473,10 +1531,10 @@ function streamResponse(id, created, model, modelKey, messages, cascadeMessages,
             // output). Close cleanly with a plain stop — the caller saw
             // whatever partial content we produced. Error details only
             // go to the server log.
-            send(chatStreamError(errMsg, allInternal ? 'upstream_transient_error' : 'upstream_error'));
+            send(chatStreamError(errMsg, allInternal ? 'upstream_transient_error' : temporaryUnavailable.allUnavailable ? 'rate_limit_exceeded' : 'upstream_error'));
             log.warn(`Stream: partial response delivered then failed (${errMsg})`);
           } else {
-            send(chatStreamError(errMsg, allInternal ? 'upstream_transient_error' : 'upstream_error'));
+            send(chatStreamError(errMsg, allInternal ? 'upstream_transient_error' : temporaryUnavailable.allUnavailable ? 'rate_limit_exceeded' : 'upstream_error'));
           }
           res.write('data: [DONE]\n\n');
         } catch {}

src/handlers/messages.js

@@ -22,6 +22,16 @@ function genMsgId() {
 // ─── Anthropic → OpenAI request translation ──────────────────
 
 function anthropicToOpenAI(body) {
+  const mapAnthropicToolChoice = (toolChoice) => {
+    if (!toolChoice || typeof toolChoice !== 'object') return toolChoice;
+    if (toolChoice.type === 'auto') return 'auto';
+    if (toolChoice.type === 'any') return 'required';
+    if (toolChoice.type === 'none') return 'none';
+    if (toolChoice.type === 'tool' && toolChoice.name) {
+      return { type: 'function', function: { name: toolChoice.name } };
+    }
+    return toolChoice;
+  };
   const messages = [];
   if (body.system) {
     const sysText = typeof body.system === 'string'
@@ -95,6 +105,8 @@ function anthropicToOpenAI(body) {
     ...(body.temperature != null ? { temperature: body.temperature } : {}),
     ...(body.top_p != null ? { top_p: body.top_p } : {}),
     ...(body.stop_sequences ? { stop: body.stop_sequences } : {}),
+    ...(body.tool_choice ? { tool_choice: mapAnthropicToolChoice(body.tool_choice) } : {}),
+    ...(body.thinking ? { thinking: body.thinking } : {}),
   };
 }