@goodandready/dsh-dsml-artifact-guard 0.2.13 → 0.2.14

package/lib/index.js

@@ -1,9 +1,14 @@
 import Schema from '@deepseek-ai/schemastery';
 import { registerPluginUpdater } from './updater.js';
+import { registerPluginTelemetry, recordArtifact } from './telemetry.js';
 
 const TAIL = /(?:<\/｜DSML｜parameter>\s*)?(?:<\/｜DSML｜invoke>\s*)?<\/｜DSML｜tool_calls>\s*$/u;
+const INCOMPLETE_TAIL = /(?:<\/｜DSML｜(?:parameter|invoke|tool_calls)>\s*)*(?:<\/｜DSML(?:｜(?:tool_calls|invoke|parameter)?)?>?)\s*$/u;
 const OPEN_TAG = /<｜DSML｜(?:tool_calls|invoke|parameter)[^>]*>/gu;
 const CLOSE_TAG = /<\/｜DSML｜(?:tool_calls|invoke|parameter)>/gu;
+const OPEN_THINK = /<think(?:>|\s[^>]*>)/gi;
+const CLOSE_THINK = /<\/think>/gi;
+const TRAILING_THINK_MARKERS = /(?:<\/think>|<｜end of sentence｜>|<｜thought｜>|<\/｜thought｜>)\s*$/u;
 const KEEP = 96;
 
 export const name = '@goodandready/dsh-dsml-artifact-guard';
@@ -16,6 +21,7 @@ export const Config = Schema.object({
   mode: Schema.string().default('sanitize').volatile().description('How to handle detected artifact markup'),
   modelPattern: Schema.string().default('deepseek').volatile().description('Model name substring this plugin guards'),
   providers: Schema.array(Schema.string()).default([]).volatile().description('Restrict guarding to these providers; empty means all'),
+  cleanThinkArtifacts: Schema.boolean().default(false).volatile().description('Clean leaked reasoning closing tags (</think>) and trailing incomplete tokens'),
   providerId: Schema.string().volatile().description('Legacy exact provider id match'),
   modelId: Schema.string().volatile().description('Legacy exact model id match'),
 });
@@ -62,12 +68,20 @@ export function matchesScope(o, c) {
   }
 }
 
-export async function* sanitizeDsmlArtifacts(s, { mode = 'sanitize', onArtifact } = {}) {
+export async function* sanitizeDsmlArtifacts(s, {
+  mode = 'sanitize',
+  cleanThinkArtifacts = false,
+  onArtifact,
+  provider = '',
+  model = '',
+} = {}) {
   let p = '';
   let i;
   let scanBuffer = '';
   let totalOpen = 0;
   let totalClose = 0;
+  let totalOpenThink = 0;
+  let totalCloseThink = 0;
 
   const countTags = (str) => {
     if (!str) return;
@@ -75,6 +89,12 @@ export async function* sanitizeDsmlArtifacts(s, { mode = 'sanitize', onArtifact
     if (opens) totalOpen += opens.length;
     const closes = str.match(CLOSE_TAG);
     if (closes) totalClose += closes.length;
+    if (cleanThinkArtifacts) {
+      const thinkOpens = str.match(OPEN_THINK);
+      if (thinkOpens) totalOpenThink += thinkOpens.length;
+      const thinkCloses = str.match(CLOSE_THINK);
+      if (thinkCloses) totalCloseThink += thinkCloses.length;
+    }
   };
 
   const flush = async function* (end) {
@@ -85,15 +105,86 @@ export async function* sanitizeDsmlArtifacts(s, { mode = 'sanitize', onArtifact
         countTags(scanBuffer);
         scanBuffer = '';
       }
+
+      // 1. Complete DSML closing tags tail
       if (TAIL.test(text)) {
         const tailMatch = text.match(TAIL);
         const tailCloseCount = tailMatch ? (tailMatch[0].match(CLOSE_TAG) || []).length : 0;
         const closedBeforeTail = totalClose - tailCloseCount;
         const unclosedBeforeTail = totalOpen - closedBeforeTail;
         if (unclosedBeforeTail <= 0) {
-          onArtifact?.({ mode, removed: 1 });
+          const removedSample = tailMatch ? tailMatch[0] : '';
+          onArtifact?.({
+            mode,
+            removed: tailCloseCount || 1,
+            sample: removedSample,
+            provider,
+            model,
+            type: 'dsml',
+          });
           if (mode === 'sanitize') text = text.replace(TAIL, '');
         }
+      } else if (INCOMPLETE_TAIL.test(text)) {
+        // 2. Trailing incomplete DSML closing tags at finish
+        const incompMatch = text.match(INCOMPLETE_TAIL);
+        const incompCloses = incompMatch ? (incompMatch[0].match(CLOSE_TAG) || []).length : 0;
+        const closedBefore = totalClose - incompCloses;
+        const unclosedBefore = totalOpen - closedBefore;
+        if (unclosedBefore <= 0) {
+          const removedSample = incompMatch ? incompMatch[0] : '';
+          onArtifact?.({
+            mode,
+            removed: Math.max(incompCloses, 1),
+            sample: removedSample,
+            provider,
+            model,
+            type: 'incomplete-dsml',
+          });
+          if (mode === 'sanitize') text = text.replace(INCOMPLETE_TAIL, '');
+        }
+      }
+
+      // 3. Reasoning think artifacts (when cleanThinkArtifacts is enabled)
+      if (cleanThinkArtifacts) {
+        // A. Trailing think markers at end of stream
+        if (TRAILING_THINK_MARKERS.test(text)) {
+          const markerMatch = text.match(TRAILING_THINK_MARKERS);
+          const sample = markerMatch ? markerMatch[0] : '';
+          onArtifact?.({
+            mode,
+            removed: 1,
+            sample,
+            provider,
+            model,
+            type: 'think-marker',
+          });
+          if (mode === 'sanitize') text = text.replace(TRAILING_THINK_MARKERS, '');
+        }
+        // B. Orphan </think> when no <think> was opened in the stream
+        if (totalOpenThink === 0 && CLOSE_THINK.test(text)) {
+          const thinkMatches = text.match(CLOSE_THINK) || [];
+          onArtifact?.({
+            mode,
+            removed: thinkMatches.length,
+            sample: '</think>',
+            provider,
+            model,
+            type: 'think-orphan',
+          });
+          if (mode === 'sanitize') text = text.replace(/<\/think>\s*/gi, '');
+        }
+        // C. Unclosed <think> block at stream end: auto-close to heal Markdown
+        if (totalOpenThink > totalCloseThink) {
+          onArtifact?.({
+            mode,
+            removed: 0,
+            sample: 'auto-closed unclosed <think>',
+            provider,
+            model,
+            type: 'think-repair',
+          });
+          if (mode === 'sanitize') text += '\n</think>\n';
+        }
       }
     }
     if (text) yield { type: 'text-delta', index: i, text };
@@ -191,6 +282,7 @@ export function apply(ctx, initialConfig = {}) {
   if (ctx.settings && typeof ctx.settings.configure === 'function') {
     ctx.effect(() => ctx.settings.configure({ auto: false }, ctx.fiber), 'dsh-dsml-artifact-guard: settings policy');
   }
+
   // Register one-click updater endpoint
   if (ctx.webServer && typeof ctx.webServer.register === 'function') {
     const mountUpdater = () => registerPluginUpdater(ctx, {
@@ -203,18 +295,36 @@ export function apply(ctx, initialConfig = {}) {
     } else {
       mountUpdater();
     }
+
+    const mountTelemetry = () => registerPluginTelemetry(ctx, {
+      endpoint: '/api/dsh-dsml-artifact-guard/stats',
+    });
+    if (typeof ctx.effect === 'function') {
+      ctx.effect(mountTelemetry, 'dsh-dsml-artifact-guard: plugin telemetry');
+    } else {
+      mountTelemetry();
+    }
   }
 
   // Hook into llm/stream with ctx.effect lifecycle cleanup
   ctx.effect(() => ctx.on('llm/stream', (o, next) => {
     const current = getConfig();
     const s = next(o);
-    return current.mode === 'disabled' || !matchesScope(o, current)
-      ? s
-      : sanitizeDsmlArtifacts(s, {
-        mode: current.mode,
-        onArtifact: (x) => ctx.logger?.info?.('DSML closing-tag artifact detected', x),
-      });
+    if (current.mode === 'disabled' || !matchesScope(o, current)) {
+      return s;
+    }
+    const provider = String(o?.providerId ?? o?.provider?.id ?? o?.provider ?? '').trim();
+    const model = String(o?.modelId ?? o?.model?.id ?? o?.model?.name ?? o?.model ?? '').trim();
+    return sanitizeDsmlArtifacts(s, {
+      mode: current.mode,
+      cleanThinkArtifacts: Boolean(current.cleanThinkArtifacts),
+      provider,
+      model,
+      onArtifact: (x) => {
+        recordArtifact(x);
+        ctx.logger?.info?.('DSML closing-tag artifact detected', x);
+      },
+    });
   }));
 }
 

package/lib/telemetry.js

@@ -0,0 +1,128 @@
+import { checkRequestMethod } from './index.js';
+import { isLoopback } from './updater.js';
+
+const STATS_HEADER = 'x-dsh-plugin-stats';
+const MAX_RECENT_EVENTS = 20;
+
+let stats = {
+  totalCleaned: 0,
+  sessionsGuarded: 0,
+  lastCleanedAt: null,
+  lastModel: null,
+  lastProvider: null,
+  recent: [],
+};
+
+export function recordArtifact({ mode = 'sanitize', removed = 1, sample = '', provider = '', model = '', type = 'dsml' } = {}) {
+  const count = Number(removed) > 0 ? Number(removed) : 1;
+  stats.totalCleaned += count;
+  stats.sessionsGuarded += 1;
+  stats.lastCleanedAt = new Date().toISOString();
+  if (model) stats.lastModel = String(model);
+  if (provider) stats.lastProvider = String(provider);
+
+  const event = {
+    id: Date.now().toString(36) + Math.random().toString(36).slice(2, 6),
+    timestamp: stats.lastCleanedAt,
+    mode: String(mode),
+    removed: count,
+    type: String(type),
+    sample: typeof sample === 'string' ? sample.slice(0, 160) : '',
+    provider: String(provider || ''),
+    model: String(model || ''),
+  };
+
+  stats.recent.unshift(event);
+  if (stats.recent.length > MAX_RECENT_EVENTS) {
+    stats.recent.length = MAX_RECENT_EVENTS;
+  }
+}
+
+export function getTelemetryStats() {
+  return {
+    totalCleaned: stats.totalCleaned,
+    sessionsGuarded: stats.sessionsGuarded,
+    lastCleanedAt: stats.lastCleanedAt,
+    lastModel: stats.lastModel,
+    lastProvider: stats.lastProvider,
+    recent: [...stats.recent],
+  };
+}
+
+export function resetTelemetryStats() {
+  stats = {
+    totalCleaned: 0,
+    sessionsGuarded: 0,
+    lastCleanedAt: null,
+    lastModel: null,
+    lastProvider: null,
+    recent: [],
+  };
+  return getTelemetryStats();
+}
+
+function header(request, name) {
+  const value = request?.headers?.[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+
+export function isTrustedStatsRequest(request) {
+  if (header(request, STATS_HEADER) !== '1') return false;
+  const site = header(request, 'sec-fetch-site');
+  if (site !== undefined && site !== 'same-origin') return false;
+  const origin = header(request, 'origin');
+  const host = header(request, 'host');
+  if (origin === undefined || host === undefined) return false;
+  try {
+    const url = new URL(origin);
+    if (url.protocol === 'dsh-app:' && url.hostname === 'app') {
+      return isLoopback(request.socket?.remoteAddress);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
+    if (url.host.toLowerCase() !== host.toLowerCase()) return false;
+    if (isLoopback(url.hostname)) {
+      return isLoopback(request.socket?.remoteAddress);
+    }
+    return site === 'same-origin';
+  } catch {
+    return false;
+  }
+}
+
+export function registerPluginTelemetry(ctx, options = {}) {
+  const endpoint = options.endpoint || '/api/dsh-dsml-artifact-guard/stats';
+  return ctx.webServer.register({
+    kind: 'exact',
+    path: endpoint,
+    handler: async (req, res) => {
+      try {
+        if (req.method === 'GET' || req.method === 'HEAD') {
+          const payload = getTelemetryStats();
+          res.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          });
+          res.end(req.method === 'HEAD' ? undefined : JSON.stringify(payload));
+          return;
+        }
+        if (!checkRequestMethod(req, 'POST')) {
+          res.writeHead(405, { allow: 'GET, HEAD, POST' });
+          res.end();
+          return;
+        }
+        if (!isTrustedStatsRequest(req)) {
+          res.writeHead(403, { 'content-type': 'application/json; charset=utf-8' });
+          res.end(JSON.stringify({ ok: false, error: 'Untrusted or cross-origin request rejected.' }));
+          return;
+        }
+        const updatedStats = resetTelemetryStats();
+        res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' });
+        res.end(JSON.stringify({ ok: true, stats: updatedStats }));
+      } catch (error) {
+        ctx.logger?.warn?.(`[dsh-dsml-artifact-guard] telemetry error: ${String(error)}`);
+        res.writeHead(500, { 'content-type': 'application/json; charset=utf-8' });
+        res.end(JSON.stringify({ ok: false, error: 'Internal telemetry error' }));
+      }
+    },
+  });
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@goodandready/dsh-dsml-artifact-guard",
-  "version": "0.2.13",
-  "description": "Sanitizes leaked DeepSeek DSML closing tags from model text streams",
+  "version": "0.2.14",
+  "description": "Sanitizes leaked DeepSeek DSML closing tags and reasoning artifacts from model text streams",
   "type": "module",
   "main": "lib/index.js",
   "license": "MIT",