refactor(claude-code): 移除 TLS 指纹模拟配置，简化上下文构建逻辑

移除 enable_tls_fingerprint 配置项、TLS_PROFILE_CLAUDE_CODE 常量及
resolve_claude_code_tls_profile 函数，TLS profile 改为仅由 fingerprint
的 impersonate 字段决定，简化 build_and_set_claude_code_request_context
返回值为单一 context 对象。

src/models/admin_requests.py

@@ -308,9 +308,6 @@ class ClaudeCodeAdvancedConfig(BaseModel):
     session_idle_timeout_minutes: int | None = Field(
         None, ge=1, le=1440, description="会话空闲超时（分钟）"
     )
-    enable_tls_fingerprint: bool = Field(
-        False, description="是否启用 TLS 指纹模拟（模拟 Node.js/Claude Code 客户端）"
-    )
     session_id_masking_enabled: bool = Field(
         False, description="是否启用会话 ID 伪装（固定 metadata.user_id 中 session 片段）"
     )

src/services/provider/adapters/claude_code/constants.py

@@ -7,8 +7,6 @@ DEFAULT_ANTHROPIC_VERSION = "2023-06-01"
 DEFAULT_ACCEPT = "application/json"
 STREAM_HELPER_METHOD = "stream"
 SESSION_ID_MASKING_TTL_SECONDS = 15 * 60
-# 仅代表“启用 Claude Code TLS 配置”的客户端 profile 标识（best-effort）。
-TLS_PROFILE_CLAUDE_CODE = "claude_code_nodejs"
 
 # Claude Code OAuth required betas.
 BETA_CLAUDE_CODE = "claude-code-20250219"
@@ -48,5 +46,4 @@ __all__ = [
     "DEFAULT_ANTHROPIC_VERSION",
     "SESSION_ID_MASKING_TTL_SECONDS",
     "STREAM_HELPER_METHOD",
-    "TLS_PROFILE_CLAUDE_CODE",
 ]

src/services/provider/adapters/claude_code/context.py

@@ -8,7 +8,6 @@ from typing import TYPE_CHECKING, Any
 
 from src.core.logger import logger
 from src.models.admin_requests import ClaudeCodeAdvancedConfig
-from src.services.provider.adapters.claude_code.constants import TLS_PROFILE_CLAUDE_CODE
 
 if TYPE_CHECKING:
     from src.services.provider.pool.config import PoolConfig
@@ -22,7 +21,6 @@ class ClaudeCodeRequestContext:
     key_id: str | None = None
     max_sessions: int | None = None
     session_idle_timeout_minutes: int = 5
-    enable_tls_fingerprint: bool = False
     session_id_masking_enabled: bool = False
     cache_ttl_override_enabled: bool = False
     cache_ttl_override_target: str = "ephemeral"
@@ -85,9 +83,6 @@ def build_claude_code_request_context(
         if advanced_config and advanced_config.session_idle_timeout_minutes is not None
         else 5
     )
-    enable_tls_fingerprint = (
-        bool(advanced_config.enable_tls_fingerprint) if advanced_config else False
-    )
     session_id_masking_enabled = (
         bool(advanced_config.session_id_masking_enabled) if advanced_config else False
     )
@@ -110,7 +105,6 @@ def build_claude_code_request_context(
         key_id=normalized_key_id,
         max_sessions=max_sessions,
         session_idle_timeout_minutes=idle_timeout_minutes,
-        enable_tls_fingerprint=enable_tls_fingerprint,
         session_id_masking_enabled=session_id_masking_enabled,
         cache_ttl_override_enabled=cache_ttl_override_enabled,
         cache_ttl_override_target=cache_ttl_override_target,
@@ -120,22 +114,14 @@ def build_claude_code_request_context(
     )
 
 
-def resolve_claude_code_tls_profile(
-    ctx: ClaudeCodeRequestContext | None,
-) -> str | None:
-    if ctx and ctx.enable_tls_fingerprint:
-        return TLS_PROFILE_CLAUDE_CODE
-    return None
-
-
 def build_and_set_claude_code_request_context(
     *,
     provider_config: Any,
     key_id: str | None,
     is_stream: bool,
     provider_id: str | None = None,
-) -> tuple[ClaudeCodeRequestContext, str | None]:
-    """构建并写入 Claude Code 上下文，同时返回对应 TLS profile。"""
+) -> ClaudeCodeRequestContext:
+    """构建并写入 Claude Code 上下文。"""
     ctx = build_claude_code_request_context(
         provider_config=provider_config,
         key_id=key_id,
@@ -143,7 +129,7 @@ def build_and_set_claude_code_request_context(
         provider_id=provider_id,
     )
     set_claude_code_request_context(ctx)
-    return ctx, resolve_claude_code_tls_profile(ctx)
+    return ctx
 
 
 __all__ = [
@@ -151,6 +137,5 @@ __all__ = [
     "build_claude_code_request_context",
     "ClaudeCodeRequestContext",
     "get_claude_code_request_context",
-    "resolve_claude_code_tls_profile",
     "set_claude_code_request_context",
 ]

src/services/provider/adapters/claude_code/envelope.py

@@ -644,16 +644,16 @@ class ClaudeCodeEnvelope:
 
             set_current_fingerprint(ensure_key_fingerprint(key, persist_if_missing=True))
 
-        _ctx, tls_profile = build_and_set_claude_code_request_context(
+        build_and_set_claude_code_request_context(
             provider_config=provider_config,
             key_id=key_id,
             is_stream=is_stream,
             provider_id=provider_id,
         )
         fp = get_current_fingerprint()
-        if _ctx.enable_tls_fingerprint and fp:
+        if fp:
             return fp.impersonate
-        return tls_profile
+        return None
 
     async def post_wrap_request(self, request_body: dict[str, Any]) -> None:
         await enforce_distributed_session_controls(

tests/services/test_claude_code_envelope.py

@@ -93,7 +93,7 @@ def test_claude_code_prepare_context_prefers_fingerprint_tls_profile() -> None:
     set_current_fingerprint(fp)
 
     tls_profile = claude_code_envelope.prepare_context(
-        provider_config={"claude_code_advanced": {"enable_tls_fingerprint": True}},
+        provider_config={},
         key_id="key-fingerprint-2",
         is_stream=False,
         provider_id="provider-1",

tests/services/test_claude_code_runtime_controls.py

@@ -5,13 +5,11 @@ import uuid
 import pytest
 
 from src.core.exceptions import ConcurrencyLimitError
-from src.services.provider.adapters.claude_code.constants import TLS_PROFILE_CLAUDE_CODE
 from src.services.provider.adapters.claude_code.context import (
     ClaudeCodeRequestContext,
     build_and_set_claude_code_request_context,
     build_claude_code_request_context,
     get_claude_code_request_context,
-    resolve_claude_code_tls_profile,
     set_claude_code_request_context,
 )
 from src.services.provider.adapters.claude_code.envelope import claude_code_envelope
@@ -35,7 +33,6 @@ def test_build_context_reads_claude_code_advanced_from_provider_config() -> None
             "claude_code_advanced": {
                 "max_sessions": 3,
                 "session_idle_timeout_minutes": 7,
-                "enable_tls_fingerprint": True,
                 "session_id_masking_enabled": True,
             }
         },
@@ -47,26 +44,23 @@ def test_build_context_reads_claude_code_advanced_from_provider_config() -> None
     assert ctx.key_id == "key-123"
     assert ctx.max_sessions == 3
     assert ctx.session_idle_timeout_minutes == 7
-    assert ctx.enable_tls_fingerprint is True
     assert ctx.session_id_masking_enabled is True
 
 
-def test_build_and_set_context_returns_tls_profile_when_enabled() -> None:
-    ctx, tls_profile = build_and_set_claude_code_request_context(
-        provider_config={"claude_code_advanced": {"enable_tls_fingerprint": True}},
+def test_build_and_set_context_stores_context_in_contextvar() -> None:
+    ctx = build_and_set_claude_code_request_context(
+        provider_config={},
         key_id="key-tls",
         is_stream=True,
     )
 
     assert ctx.key_id == "key-tls"
     assert get_claude_code_request_context() == ctx
-    assert tls_profile == TLS_PROFILE_CLAUDE_CODE
-    assert resolve_claude_code_tls_profile(ctx) == TLS_PROFILE_CLAUDE_CODE
 
 
 def test_get_ssl_context_for_claude_code_profile_is_cached() -> None:
-    first = get_ssl_context_for_profile(TLS_PROFILE_CLAUDE_CODE)
-    second = get_ssl_context_for_profile(TLS_PROFILE_CLAUDE_CODE)
+    first = get_ssl_context_for_profile("claude_code_nodejs")
+    second = get_ssl_context_for_profile("claude_code_nodejs")
 
     assert first is second