@klarkxy/dsh-current-title 0.3.1 → 0.3.3

package/lib/index.js

@@ -1,11 +1,888 @@
-import { DEFAULT_TIMEOUT_MS, PLUGIN_NAME, PROVIDER_ID, RPC_CHANNEL, SETTINGS_KEY, defaultGenerateConfig, defaultModelRoute, isTitleLocaleMode, normalizeCadence, normalizeModelRoute, normalizePrompt } from "./contracts.js";
-import { registerHostRpc } from "@klarkxy/dsh-plugin-kit/host-rpc";
-import { isSubagentSession, modelSettingsChangesIdentity } from "@klarkxy/dsh-plugin-kit/contracts";
-import { createModelSettingsChanges } from "@klarkxy/dsh-plugin-kit/model-settings-changes";
-import { notifyModelSettingsChanged, registerModelSettings } from "@klarkxy/dsh-plugin-kit/model-settings";
-import { callLlmText, resolveFeatureModel } from "@klarkxy/dsh-plugin-kit";
+import { C as normalizeCadence, D as normalizeModelRoute, E as modelRouteOverride, S as isTitleLocaleMode, T as defaultModelRoute, _ as SETTINGS_KEY, b as defaultGenerateConfig, c as DEFAULT_TIMEOUT_MS, d as PLUGIN_NAME, h as RPC_CHANNEL, p as PROVIDER_ID, v as TITLE_CALL_FEATURE, w as normalizePrompt } from "./contracts2.js";
+import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
+import { BlockAssembler, ReasoningEffortId, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { defineDomain, domainTable } from "@deepseek-ai/dsh-storage-domain";
 import { z } from "zod";
+//#region ../dsh-plugin-kit/src/contracts.ts
+function producerMessageSource(plugin) {
+	return {
+		kind: `plugin:${plugin}`,
+		plugin
+	};
+}
+/**
+* True when `session` is a delegated child thread rather than a human-driven top-level
+* conversation.
+*
+* A message's `source.kind === 'user'` cannot answer this: a lead agent's dispatch prompt
+* is delivered as the child's own user message, so delegated work is indistinguishable
+* from a person typing once you only look at the message. Plugins use this to keep
+* automatic writes and derived model calls on top-level sessions.
+*/
+function isSubagentSession(session) {
+	const header = session?.header;
+	if (!header || typeof header !== "object") return false;
+	if (header.origin === "subagent" || Number(header.delegationDepth ?? 0) > 0) return true;
+	const humanFork = header.isSeeded === true && (header.delegationDepth === void 0 || header.delegationDepth === 0) && header.origin === void 0 && (header.classification === void 0 || header.classification === "ordinary" || header.classification === "free");
+	return Boolean(header.parentSession) && !humanFork;
+}
+/** `@klarkxy/dsh-git-commit` becomes `KlarkxyDshGitCommitModelSettingsChanges`. */
+function modelSettingsChangesIdentity(packageName) {
+	const scoped = /^@([^/]+)\/(.+)$/.exec(packageName);
+	const parts = (scoped ? `${scoped[1]}/${scoped[2]}` : packageName).split(/[^A-Za-z0-9]+/).filter(Boolean);
+	if (!parts.length) throw new Error("Model settings package name has no RPC segment");
+	const segment = `${parts.map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("")}ModelSettingsChanges`;
+	if (!/^[A-Z][A-Za-z0-9]*$/.test(segment)) throw new Error(`Model settings sync name is not an RPC segment: ${segment}`);
+	return {
+		service: segment,
+		namespace: segment
+	};
+}
+/** Root context service key holding the shared auxiliary-model state. */
+const AUXILIARY_MODEL_SERVICE = "dshAuxiliaryModel";
+/** Authenticated host-RPC channel for get/set of the shared default. */
+const AUXILIARY_MODEL_CHANNEL = "/dsh-auxiliary-model";
+/** Model-settings namespace under which the shared default is published. */
+const AUXILIARY_MODEL_NS = "@klarkxy/dsh-plugin-kit/auxiliary-model";
+/**
+* Typert identity of the shared change stream. Mounted on the root context
+* with ownerNs filtering, so frames only carry {@link AUXILIARY_MODEL_NS}.
+*/
+const AUXILIARY_MODEL_CHANGES_IDENTITY = modelSettingsChangesIdentity("@klarkxy/dsh-plugin-kit");
+function sharedAuxiliaryModel(host) {
+	const root = host?.root;
+	try {
+		const shared = root?.get?.(AUXILIARY_MODEL_SERVICE, false);
+		return shared && typeof shared.snapshot === "function" ? shared : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Synchronously read the shared auxiliary default; `undefined` only when no
+* participant retains the singleton or the default is legitimately unset.
+* An initialization or snapshot failure propagates: silently falling back to
+* a different model after a storage error would spend the wrong budget.
+*/
+function getAuxiliaryModel(host) {
+	const shared = sharedAuxiliaryModel(host);
+	if (!shared) return void 0;
+	return modelRouteOverride(shared.snapshot().model ?? void 0);
+}
+//#endregion
+//#region ../dsh-plugin-kit/src/host-rpc.ts
+/** The shared authenticated HTTP boundary. Each plugin still owns its RPC envelope semantics. */
+function registerHostRpcTransport(ctx, channel, dispatch, options = {}) {
+	const bodyLimit = options.maxBodyBytes ?? 65536;
+	if (!Number.isSafeInteger(bodyLimit) || bodyLimit <= 0) throw new Error("Invalid RPC body limit");
+	const isEndpoint = options.isEndpoint ?? ((endpoint) => /^[a-z.]+$/.test(endpoint));
+	return ctx.webServer.register({
+		kind: "prefix",
+		path: channel,
+		handler: async (req, res) => {
+			const reject = (status, error, override) => {
+				if (res.destroyed) return;
+				if (status === 413) res.writeHead(status, { connection: "close" });
+				else res.writeHead(status);
+				res.end(override ?? options.errorBody?.(status, error) ?? (status === 500 ? "rpc request failed" : ""));
+			};
+			try {
+				if (typeof ctx.connection.requestRejection !== "function") {
+					reject(503);
+					return;
+				}
+				const rejection = ctx.connection.requestRejection(req);
+				if (rejection !== void 0) {
+					reject(rejection);
+					return;
+				}
+				const pathname = new URL(req.url ?? "/", "http://dsh.internal").pathname;
+				const endpoint = pathname.startsWith(`${channel}/`) ? pathname.slice(channel.length + 1) : "";
+				if (req.method !== "POST" || !isEndpoint(endpoint)) {
+					reject(404);
+					return;
+				}
+				const contentType = String(req.headers["content-type"] ?? "").split(";", 1)[0]?.trim();
+				if ((options.caseInsensitiveContentType ? contentType.toLowerCase() : contentType) !== "application/json") {
+					reject(415);
+					return;
+				}
+				const guarded = options.beforeBody?.(req, endpoint);
+				if (guarded) {
+					reject(guarded.status, void 0, guarded.body);
+					return;
+				}
+				const controller = new AbortController();
+				res.on("close", () => {
+					if (!res.writableEnded) controller.abort();
+				});
+				const chunks = [];
+				let size = 0;
+				for await (const chunk of req) {
+					const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+					size += buffer.length;
+					if (size > bodyLimit) {
+						reject(413);
+						req.destroy();
+						return;
+					}
+					chunks.push(buffer);
+				}
+				let body;
+				try {
+					body = JSON.parse(Buffer.concat(chunks).toString("utf8") || (options.emptyBodyAsNull ? "null" : ""));
+				} catch {
+					reject(400);
+					return;
+				}
+				await dispatch(endpoint, body, controller.signal, res);
+			} catch (error) {
+				reject(500, error);
+			}
+		}
+	});
+}
+/** Write the native Connection response envelope after a plugin has handled a request. */
+function sendHostRpcResponse(response, rpcId, result, noStore = true) {
+	if (response.destroyed) return;
+	response.writeHead(200, {
+		"content-type": "application/json",
+		...noStore ? { "cache-control": "no-store" } : {}
+	});
+	response.end(JSON.stringify({
+		type: "server-response",
+		rpcId,
+		result
+	}));
+}
+/** Safe host RPC registration. Missing requestRejection fails closed. */
+function registerHostRpc(ctx, channel, call, options = {}) {
+	return registerHostRpcTransport(ctx, channel, async (endpoint, body, signal, res) => {
+		if (!body || typeof body !== "object" || Array.isArray(body)) {
+			res.writeHead(400);
+			res.end();
+			return;
+		}
+		const request = body;
+		if (request.type !== "client-request" || request.method !== endpoint || typeof request.rpcId !== "string" || options.requirePayload && !Object.hasOwn(request, "payload")) {
+			res.writeHead(400);
+			res.end();
+			return;
+		}
+		const raw = await call(endpoint, request.payload, signal);
+		const result = raw.ok ? raw : {
+			...raw,
+			error: {
+				details: {},
+				...raw.error
+			}
+		};
+		sendHostRpcResponse(res, request.rpcId, result);
+	}, options);
+}
+//#endregion
+//#region ../dsh-plugin-kit/src/model-settings.ts
+const MODEL_SETTINGS_EVENT = "model-settings/collect";
+const MODEL_SETTINGS_CHANGED_EVENT = "model-settings/changed";
+/** Publish only after the owner's save commits. A failed observer must never
+* turn an already committed write into an apparent save failure. */
+function notifyModelSettingsChanged(ctx, ns, revision) {
+	try {
+		ctx.parallel(MODEL_SETTINGS_CHANGED_EVENT, {
+			ns,
+			revision
+		}).catch(() => {});
+	} catch {}
+}
+/** Cordis disposes the listener with its fiber. In-flight references also fail closed. */
+function registerModelSettings(ctx, provider) {
+	let active = true;
+	const requireActive = (signal) => {
+		signal.throwIfAborted();
+		if (!active) throw new Error("Model settings owner unloaded; refresh and retry");
+	};
+	const guarded = {
+		ns: provider.ns,
+		title: provider.title,
+		instanceId: globalThis.crypto.randomUUID(),
+		async read(signal) {
+			requireActive(signal);
+			const value = await provider.read(signal);
+			requireActive(signal);
+			return value;
+		},
+		async write(path, route, revision, signal) {
+			requireActive(signal);
+			return provider.write(path, route, revision, signal);
+		}
+	};
+	const off = ctx.on(MODEL_SETTINGS_EVENT, (collect) => {
+		if (active) collect(guarded);
+	});
+	return () => {
+		active = false;
+		off();
+	};
+}
+//#endregion
+//#region ../dsh-plugin-kit/src/model-settings-client.ts
+/** This stream carries invalidations only; ready is never a settings snapshot. */
+function parseModelSettingsChangeFrame(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid model settings change frame");
+	const frame = value;
+	if (frame.kind === "ready" && Object.keys(frame).length === 1) return { kind: "ready" };
+	if (frame.kind === "changed" && Object.keys(frame).length === 3 && typeof frame.ns === "string" && frame.ns.length > 0 && typeof frame.revision === "number" && Number.isSafeInteger(frame.revision) && frame.revision >= 0) return {
+		kind: "changed",
+		ns: frame.ns,
+		revision: frame.revision
+	};
+	throw new Error("Invalid model settings change frame");
+}
+//#endregion
+//#region ../dsh-plugin-kit/src/model-settings-changes.ts
+var __runInitializers = function(thisArg, initializers, value) {
+	var useValue = arguments.length > 2;
+	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+	return useValue ? value : void 0;
+};
+var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+	function accept(f) {
+		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
+		return f;
+	}
+	var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+	var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+	var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+	var _, done = false;
+	for (var i = decorators.length - 1; i >= 0; i--) {
+		var context = {};
+		for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+		for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+		context.addInitializer = function(f) {
+			if (done) throw new TypeError("Cannot add initializers after decoration has completed");
+			extraInitializers.push(accept(f || null));
+		};
+		var result = (0, decorators[i])(kind === "accessor" ? {
+			get: descriptor.get,
+			set: descriptor.set
+		} : descriptor[key], context);
+		if (kind === "accessor") {
+			if (result === void 0) continue;
+			if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+			if (_ = accept(result.get)) descriptor.get = _;
+			if (_ = accept(result.set)) descriptor.set = _;
+			if (_ = accept(result.init)) initializers.unshift(_);
+		} else if (_ = accept(result)) {
+			if (kind === "field") initializers.unshift(_);
+			else descriptor[key] = _;
+		}
+	}
+	if (target) Object.defineProperty(target, contextIn.name, descriptor);
+	done = true;
+};
+/** Attach first, then yield ready: commits during a consumer's baseline read
+* remain queued. Coalescing revisions never invents a settings snapshot.
+* `ownerNs` keeps one plugin's stream to its own settings; omit it to forward every namespace. */
+async function* watchModelSettingsChanges(events, signal, ownerNs) {
+	signal.throwIfAborted();
+	const pending = /* @__PURE__ */ new Map();
+	let full = false;
+	let wake;
+	const changed = (ns, revision) => {
+		if (ownerNs !== void 0 && ns !== ownerNs) return;
+		let frame;
+		try {
+			frame = parseModelSettingsChangeFrame({
+				kind: "changed",
+				ns,
+				revision
+			});
+		} catch {
+			return;
+		}
+		if (!full) {
+			if (!pending.has(ns) && pending.size >= 256) {
+				pending.clear();
+				full = true;
+			} else pending.set(ns, frame);
+		}
+		wake?.();
+	};
+	const disposers = [];
+	const cleanup = () => {
+		for (const off of disposers.splice(0).reverse()) off();
+		pending.clear();
+	};
+	const aborted = () => {
+		cleanup();
+		wake?.();
+	};
+	signal.addEventListener("abort", aborted, { once: true });
+	try {
+		disposers.push(events.on(MODEL_SETTINGS_CHANGED_EVENT, ({ ns, revision }) => changed(ns, revision)));
+		disposers.push(events.on("settings/document-updated", changed));
+		signal.throwIfAborted();
+		yield { kind: "ready" };
+		while (true) {
+			signal.throwIfAborted();
+			if (full) {
+				full = false;
+				yield { kind: "ready" };
+				continue;
+			}
+			if (pending.size) {
+				const [ns, frame] = pending.entries().next().value;
+				pending.delete(ns);
+				yield frame;
+				continue;
+			}
+			await new Promise((resolve) => {
+				wake = resolve;
+				if (signal.aborted || full || pending.size) resolve();
+			});
+			wake = void 0;
+		}
+	} finally {
+		signal.removeEventListener("abort", aborted);
+		cleanup();
+	}
+}
+/** One owner's invalidation stream, registered on the calling plugin fiber.
+* Nothing here is stored in a module-level singleton. */
+let ModelSettingsChangesController = (() => {
+	let _classSuper = TypertRemoteService;
+	let _instanceExtraInitializers = [];
+	let _watch_decorators;
+	return class ModelSettingsChangesController extends _classSuper {
+		static {
+			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+			_watch_decorators = [Remote({ mode: "stream" })];
+			__esDecorate(this, null, _watch_decorators, {
+				kind: "method",
+				name: "watch",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "watch" in obj,
+					get: (obj) => obj.watch
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			if (_metadata) Object.defineProperty(this, Symbol.metadata, {
+				enumerable: true,
+				configurable: true,
+				writable: true,
+				value: _metadata
+			});
+		}
+		lifetime = (__runInitializers(this, _instanceExtraInitializers), new AbortController());
+		ownerNs;
+		constructor(ctx, identity, ownerNs) {
+			super(ctx, identity.service, { namespace: identity.namespace });
+			this.ownerNs = ownerNs;
+			ctx.effect(() => () => {
+				this.lifetime.abort(/* @__PURE__ */ new Error("Model settings sync owner unloaded"));
+			});
+		}
+		watch(signal) {
+			return watchModelSettingsChanges(this.ctx, AbortSignal.any([this.lifetime.signal, signal]), this.ownerNs);
+		}
+	};
+})();
+/** Register this owner's controller. `ownerNs` limits the stream to that settings namespace. */
+function createModelSettingsChanges(ctx, identity, ownerNs) {
+	return new ModelSettingsChangesController(ctx, identity, ownerNs);
+}
+//#endregion
+//#region ../dsh-plugin-kit/src/auxiliary-model.ts
+const DOMAIN_NAME = "dsh_auxiliary";
+const DOMAIN_VERSION = 1;
+const TABLE = "settings";
+const KEY = "defaults";
+const INJECT = [
+	"storageDomain",
+	"webServer",
+	"connection"
+];
+/** Marker on the benign "released while the domain was still opening" error. */
+const RECOVERABLE = Symbol.for("klarkxy.dsh.auxiliary-model.recoverable");
+function recoverable(error) {
+	error[RECOVERABLE] = true;
+	return error;
+}
+async function openSharedDomain(scope) {
+	const [{ defineDomain, domainTable }, { z }] = await Promise.all([import("@deepseek-ai/dsh-storage-domain"), import("zod")]);
+	const identifier = z.string().min(1).max(250).refine((value) => value === value.trim() && !/[\x00-\x1f\x7f]/.test(value), "model route identifiers must be non-blank, trimmed and control-free");
+	const model = z.union([z.object({
+		provider: identifier,
+		model: identifier,
+		reasoningEffort: identifier.max(80).optional()
+	}).strict(), z.null()]);
+	return scope.storageDomain.open(defineDomain({
+		name: DOMAIN_NAME,
+		version: DOMAIN_VERSION,
+		tables: { [TABLE]: domainTable(z.object({
+			revision: z.number().int().nonnegative(),
+			model
+		}).strict()) }
+	}));
+}
+/** Marks an optimistic-lock conflict so the RPC envelope can carry 'conflict'. */
+function conflictError(message) {
+	return Object.assign(new Error(message), { conflict: true });
+}
+/** RPC-visible error classification; storage failures stay sanitized. */
+function rpcFailure(error) {
+	if (error && typeof error === "object" && "conflict" in error) return {
+		ok: false,
+		error: {
+			code: "auxiliary-model/conflict",
+			message: error instanceof Error ? error.message : "Revision conflict"
+		}
+	};
+	if (error instanceof Error && /Invalid model route|valid expected revision|Unknown auxiliary model setting/.test(error.message)) return {
+		ok: false,
+		error: {
+			code: "auxiliary-model/rejected",
+			message: error.message
+		}
+	};
+	return {
+		ok: false,
+		error: {
+			code: "auxiliary-model/store",
+			message: "Auxiliary model store request failed"
+		}
+	};
+}
+/**
+* Serialized optimistic-lock write; resolves after the durable put commits.
+* Revision verification happens inside the queue: two writers carrying the
+* same expectedRevision race for one slot and only the first commits.
+* Notification fires only after commit, so a failed observer can never turn
+* an already committed write into an apparent save failure.
+*/
+function setSharedModel(state, ctx, input, expectedRevision) {
+	if (!Number.isSafeInteger(expectedRevision)) return Promise.reject(conflictError("A valid expected revision is required; reload and retry"));
+	const row = input && typeof input === "object" && !Array.isArray(input) ? input : void 0;
+	const validField = (value) => typeof value === "string" && value === value.trim() && !/[\x00-\x1f\x7f]/.test(value);
+	if (!row || [
+		"provider",
+		"model",
+		"reasoningEffort"
+	].some((key) => row[key] !== void 0 && !validField(row[key]))) return Promise.reject(/* @__PURE__ */ new Error("Invalid model route"));
+	const normalized = normalizeModelRoute(row);
+	if ((Boolean(row.provider) || Boolean(row.model)) && !modelRouteOverride(normalized)) return Promise.reject(/* @__PURE__ */ new Error("Invalid model route"));
+	const commit = state.tail.then(async () => {
+		if (state.closed || !state.domain) throw new Error("Auxiliary model settings are unloading; retry in a moment");
+		if (expectedRevision !== state.data.revision) throw conflictError("Auxiliary model settings changed; reload and retry");
+		const next = {
+			revision: state.data.revision + 1,
+			model: modelRouteOverride(normalized) ?? null
+		};
+		await state.domain.table(TABLE).put(KEY, {
+			revision: next.revision,
+			model: next.model
+		});
+		state.data = next;
+		notifyModelSettingsChanged(ctx.root, AUXILIARY_MODEL_NS, next.revision);
+		return next;
+	});
+	state.tail = commit.then(() => {}, () => {});
+	return commit;
+}
+function initScope(state, ctx, scope) {
+	const generation = ++state.generation;
+	let disposed = false;
+	scope.effect(() => () => {
+		disposed = true;
+	});
+	const stale = () => state.closed || disposed || state.generation !== generation;
+	const run = (async () => {
+		state.available = false;
+		const domain = await openSharedDomain(scope);
+		if (stale()) {
+			await domain.close();
+			throw recoverable(/* @__PURE__ */ new Error("Auxiliary model store released during open"));
+		}
+		state.domain = domain;
+		try {
+			scope.effect(() => () => domain.close());
+		} catch (error) {
+			await domain.close();
+			throw error;
+		}
+		const stored = domain.table(TABLE).get(KEY);
+		if (stale()) {
+			await domain.close();
+			throw recoverable(/* @__PURE__ */ new Error("Auxiliary model store superseded during open"));
+		}
+		state.data = {
+			revision: stored?.revision ?? 0,
+			model: stored?.model ?? null
+		};
+		state.error = void 0;
+		state.available = true;
+		scope.effect(() => registerModelSettings(scope, {
+			ns: AUXILIARY_MODEL_NS,
+			title: {
+				zh: "辅助模型",
+				en: "Auxiliary model"
+			},
+			read(signal) {
+				signal.throwIfAborted();
+				const { revision, model } = state.data;
+				return {
+					revision,
+					fields: [{
+						path: ["model"],
+						label: {
+							zh: "全局辅助模型",
+							en: "Global auxiliary model"
+						},
+						current: model ?? void 0,
+						allowFollow: true,
+						followLabel: {
+							zh: "当前会话模型",
+							en: "Current conversation model"
+						}
+					}]
+				};
+			},
+			async write(path, route, expectedRevision, signal) {
+				signal.throwIfAborted();
+				if (path.length !== 1 || path[0] !== "model") throw new Error("Unknown auxiliary model setting");
+				return setSharedModel(state, ctx, route, expectedRevision);
+			}
+		}));
+		scope.effect(() => registerHostRpc(scope, AUXILIARY_MODEL_CHANNEL, async (endpoint, payload, signal) => {
+			signal.throwIfAborted();
+			if (state.closed) return {
+				ok: false,
+				error: {
+					code: "auxiliary-model/unloading",
+					message: "Auxiliary model settings are unloading; retry in a moment"
+				}
+			};
+			if (!state.available) return state.error ? {
+				ok: false,
+				error: {
+					code: "auxiliary-model/store",
+					message: "Auxiliary model store request failed"
+				}
+			} : {
+				ok: false,
+				error: {
+					code: "auxiliary-model/unavailable",
+					message: "Auxiliary model settings are unavailable; retry in a moment"
+				}
+			};
+			if (endpoint === "defaults.get") {
+				const { revision, model } = state.data;
+				return {
+					ok: true,
+					value: {
+						revision,
+						model
+					}
+				};
+			}
+			if (endpoint === "defaults.set") try {
+				const body = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+				const value = await setSharedModel(state, ctx, body.model, body.expectedRevision);
+				signal.throwIfAborted();
+				return {
+					ok: true,
+					value
+				};
+			} catch (error) {
+				if (signal.aborted) throw error;
+				return rpcFailure(error);
+			}
+			return {
+				ok: false,
+				error: {
+					code: "auxiliary-model/unknown-endpoint",
+					message: `Unknown endpoint: ${endpoint}`
+				}
+			};
+		}, { isEndpoint: (endpoint) => /^[a-z.]+$/.test(endpoint) }));
+		createModelSettingsChanges(scope, AUXILIARY_MODEL_CHANGES_IDENTITY, AUXILIARY_MODEL_NS);
+		scope.effect(() => () => {
+			if (state.generation === generation) {
+				state.available = false;
+				state.domain = void 0;
+			}
+		});
+	})().catch((error) => {
+		if (error && typeof error === "object") error.auxGeneration = generation;
+		if (state.generation === generation) {
+			state.available = false;
+			state.error = error;
+		}
+		throw error;
+	});
+	run.catch(() => {});
+	const armed = run.then(() => {});
+	armed.catch(() => {});
+	state.ready = armed;
+	return run;
+}
+function teardown(state, ctx) {
+	if (!state.closing) {
+		state.closed = true;
+		const root = ctx.root;
+		state.closing = (async () => {
+			await state.scopeInit?.catch(() => {});
+			await state.tail.catch(() => {});
+			try {
+				await state.fiber?.dispose();
+			} catch (error) {
+				try {
+					ctx.logger?.warn("auxiliary-model: fiber dispose failed", error);
+				} catch {}
+			}
+			try {
+				if (root.get("dshAuxiliaryModel", false) === state) state.stopUnprovide?.();
+			} catch {}
+			state.stopUnprovide = void 0;
+		})();
+	}
+	return state.closing;
+}
+function createSharedState(ctx) {
+	const root = ctx.root;
+	const state = {
+		users: 0,
+		closed: false,
+		available: false,
+		generation: 0,
+		tail: Promise.resolve(),
+		data: {
+			revision: 0,
+			model: null
+		},
+		snapshot() {
+			if (this.error) throw this.error;
+			if (!this.available) throw new Error("Auxiliary model store is unavailable; retry in a moment");
+			return this.data;
+		},
+		ready: Promise.resolve(),
+		teardown() {
+			return teardown(this, ctx);
+		}
+	};
+	const inactive = INJECT.filter((service) => {
+		try {
+			return root.get(service, true) === void 0;
+		} catch {
+			return true;
+		}
+	});
+	if (inactive.length) throw new Error(`retainAuxiliaryModel requires active ${inactive.join(", ")}; declare them in inject`);
+	state.fiber = root.inject(INJECT, (scope) => {
+		state.scopeInit = initScope(state, ctx, scope);
+	});
+	state.ready = Promise.resolve(state.fiber).then(() => {
+		if (!state.scopeInit) throw recoverable(/* @__PURE__ */ new Error("Auxiliary model owner fiber settled without initializing its scope"));
+		return state.scopeInit;
+	});
+	state.ready.catch((error) => {
+		const tag = error.auxGeneration;
+		if (tag !== void 0 && tag !== state.generation) return;
+		state.error = state.error ?? error;
+		state.closed = true;
+		state.teardown();
+	});
+	state.stopUnprovide = root.provide(AUXILIARY_MODEL_SERVICE, state);
+	return state;
+}
+async function obtainShared(ctx) {
+	const root = ctx.root;
+	for (;;) {
+		const existing = root.get(AUXILIARY_MODEL_SERVICE, false);
+		if (existing) {
+			if (!existing.closed) return existing;
+			await existing.closing;
+			continue;
+		}
+		return createSharedState(ctx);
+	}
+}
+/**
+* Retain the shared auxiliary-model store for the calling plugin.
+*
+* Resolves once storage is open and the read/write surfaces are live, with a
+* release function; register it as `ctx.effect(() => release)` so the store
+* unloads with the plugin. The first participant opens the shared owner
+* fiber; `await release()` drains pending writes and fully tears the owner
+* down when the last participant leaves. Requires `storageDomain`,
+* `webServer` and `connection` to exist on the host.
+*
+* Concurrent retainers share one owner; a retain arriving during teardown
+* waits for the closing owner and then reinstalls — it never inherits a
+* half-torn-down state.
+*/
+async function retainAuxiliaryModel(ctx) {
+	for (;;) {
+		const state = await obtainShared(ctx);
+		await state.ready;
+		if (state.closed) continue;
+		state.users += 1;
+		let released = false;
+		return async () => {
+			if (released) return;
+			released = true;
+			state.users -= 1;
+			if (state.users <= 0) await state.teardown();
+			else await state.tail.catch(() => {});
+		};
+	}
+}
+new TextEncoder();
+function normalizeSegments(context) {
+	if (context === void 0) return [];
+	return (typeof context === "string" ? [context] : context).filter((segment) => typeof segment === "string" && segment.length > 0);
+}
+/** Only word characters, dots, colons and dashes are kept inside the feature attribute. */
+function featureAttribute(feature) {
+	return feature.replaceAll(/[^\w.:-]/g, "_");
+}
+/**
+* Assemble the single user message for an auxiliary model call: stable
+* material in one labelled block first, the live request last. With no
+* context the result is byte-identical to `text`, so callers without
+* material keep exactly the previous wire shape.
+*/
+function buildAuxiliaryUserText(request) {
+	const context = normalizeSegments(request.context);
+	if (!context.length) return request.text;
+	return `<auxiliary-context${request.feature ? ` feature="${featureAttribute(request.feature)}"` : ""}>\n${context.join("\n")}\n</auxiliary-context>\n<request>\n${request.text}\n</request>`;
+}
+//#endregion
+//#region ../dsh-plugin-kit/src/llm-call.ts
+function routeOf(value) {
+	if (typeof value?.provider !== "string" || !value.provider.trim()) return void 0;
+	if (typeof value.model !== "string" || !value.model.trim()) return void 0;
+	const effort = typeof value.reasoningEffort === "string" ? value.reasoningEffort.trim() : "";
+	return effort ? {
+		provider: value.provider.trim(),
+		model: value.model.trim(),
+		reasoningEffort: effort
+	} : {
+		provider: value.provider.trim(),
+		model: value.model.trim()
+	};
+}
+/**
+* Plugin selection first; then the shared auxiliary default (when any
+* participant retains it); otherwise the live session model, then the host
+* default. Cordis callers must declare agents, sessionProjections and
+* agentDefaultModel in their inject list so the fallback reads use the
+* caller's live services.
+*/
+function resolveFeatureModel(host, saved, sessionId) {
+	const explicit = routeOf(saved);
+	if (explicit) return explicit;
+	const auxiliary = getAuxiliaryModel(host);
+	if (auxiliary) return auxiliary;
+	const face = host;
+	if (sessionId && face?.agents && face.sessionProjections) {
+		const session = face.agents.get(sessionId)?.session;
+		if (session) {
+			try {
+				const pending = face.sessionProjections.stateOf(session, "modelSelection")?.pending;
+				const selected = routeOf(pending ?? void 0);
+				if (selected) return selected;
+			} catch {}
+			const header = session.requestHeader?.();
+			const recorded = header?.config;
+			if (recorded) {
+				const route = routeOf(header?.adapterDefaults?.reasoningEffort === true ? {
+					provider: recorded.provider,
+					model: recorded.model
+				} : recorded);
+				if (route) return route;
+			}
+		}
+	}
+	return routeOf(face?.agentDefaultModel?.currentSelection());
+}
+function joinText(assembler) {
+	return assembler.blocks().filter((block) => block.type === "text").map((block) => block.text).join("");
+}
+async function readStream(stream, signal, live) {
+	const assembler = new BlockAssembler();
+	const iterator = stream[Symbol.asyncIterator]();
+	try {
+		while (live()) {
+			if (signal.aborted) break;
+			const item = await iterator.next();
+			if (item.done) break;
+			assembler.push(item.value);
+		}
+	} finally {
+		await iterator.return?.();
+	}
+	return assembler;
+}
+/** One native model call. No retry, timeout policy, or provider queue. */
+async function callLlmText(llm, request) {
+	request.signal.throwIfAborted();
+	const live = () => request.isCurrent?.() !== false && !request.signal.aborted;
+	if (!live()) throw Object.assign(/* @__PURE__ */ new Error("调用已取消。"), { name: "AbortError" });
+	const effort = request.route.reasoningEffort?.trim();
+	const prepared = await llm.prepareCall({
+		provider: request.route.provider,
+		model: request.route.model,
+		...effort ? { reasoningEffort: ReasoningEffortId(effort) } : {},
+		maxTokens: request.maxTokens
+	}, request.signal, request.configure);
+	if (!live()) throw Object.assign(/* @__PURE__ */ new Error("调用已取消。"), { name: "AbortError" });
+	const options = {
+		provider: prepared.config.provider,
+		model: prepared.config.model,
+		...prepared.config.reasoningEffort ? { reasoningEffort: prepared.config.reasoningEffort } : {},
+		...prepared.config.maxTokens !== void 0 ? { maxTokens: Math.min(request.maxTokens, prepared.config.maxTokens) } : { maxTokens: request.maxTokens },
+		...prepared.config.temperature !== void 0 ? { temperature: prepared.config.temperature } : {},
+		...prepared.config.stop ? { stop: [...prepared.config.stop] } : {},
+		system: request.system,
+		messages: [createUserMessage({
+			source: producerMessageSource(request.plugin),
+			content: [{
+				type: "text",
+				text: buildAuxiliaryUserText(request)
+			}]
+		})],
+		signal: request.signal,
+		...request.purpose ? { purpose: request.purpose } : {},
+		...request.sessionId ? { sessionId: request.sessionId } : {}
+	};
+	const assembler = await readStream(prepared.stream(options), request.signal, live);
+	if (request.signal.aborted || assembler.finish.kind === "aborted") throw Object.assign(/* @__PURE__ */ new Error("调用已取消。"), { name: "AbortError" });
+	if (!live()) throw Object.assign(/* @__PURE__ */ new Error("调用已取消。"), { name: "AbortError" });
+	if (assembler.finish.kind === "error") {
+		const code = assembler.finish.failure.code;
+		throw Object.assign(new Error(assembler.finish.failure.message || "模型调用失败。"), { code });
+	}
+	if (assembler.blocks().some((block) => block.type === "tool-call") || assembler.finish.kind === "tool-calls") throw new Error("这次调用不使用工具。");
+	if (assembler.finish.kind !== "stop") throw new Error("模型调用未完成。");
+	const usage = assembler.usage;
+	return {
+		text: joinText(assembler),
+		provider: prepared.config.provider,
+		model: prepared.config.model,
+		...usage ? {
+			inputTokens: usage.inputTokens,
+			outputTokens: usage.outputTokens,
+			...usage.totalTokens !== void 0 ? { totalTokens: usage.totalTokens } : {},
+			...usage.cacheReadTokens !== void 0 ? { cacheReadTokens: usage.cacheReadTokens } : {},
+			...usage.cacheWriteTokens !== void 0 ? { cacheWriteTokens: usage.cacheWriteTokens } : {},
+			...usage.reasoningTokens !== void 0 ? { reasoningTokens: usage.reasoningTokens } : {}
+		} : {}
+	};
+}
+//#endregion
 //#region src/input.ts
 const FRAME_PREFIX = "Choose the current task from these recent human messages, ordered oldest to newest:\n";
 function frameMessages(messages) {
@@ -205,6 +1082,18 @@ function sourceVersionOf(sessionId, messages) {
 }
 //#endregion
 //#region src/generate.ts
+/**
+* Fixed bytes the auxiliary-context envelope adds around the selected
+* messages, so maxInputBytes keeps bounding the wire text. The stable block
+* carries the framing rule and the request block the JSON message list —
+* selectRecentMessages measures that same pair through frameMessages, so
+* only the constant envelope overhead is new.
+*/
+const ENVELOPE_OVERHEAD_BYTES = utf8Bytes(buildAuxiliaryUserText({
+	feature: TITLE_CALL_FEATURE,
+	context: FRAME_PREFIX,
+	text: "[]"
+})) - utf8Bytes(frameMessages([]));
 function systemPrompt(config, customPrompt = "") {
 	return [
 		customPrompt.trim() || "Name the current task in an AI coding-assistant session.",
@@ -236,15 +1125,15 @@ function titleModelRoute(route) {
 async function generateCurrentTitle(options) {
 	options.signal.throwIfAborted();
 	if (!options.isCurrent()) throw Object.assign(/* @__PURE__ */ new Error("dsh-current-title: generation is no longer current"), { code: "superseded" });
-	const selected = selectRecentMessages(options.messages, options.config.maxRecentMessages, options.config.maxInputBytes);
+	const selected = selectRecentMessages(options.messages, options.config.maxRecentMessages, options.config.maxInputBytes - ENVELOPE_OVERHEAD_BYTES);
 	if (selected.length === 0) throw new Error("dsh-current-title: at least one source message is required");
 	const route = resolveFeatureModel(options.host, titleModelRoute(options.model), options.sessionId);
-	if (!route) throw new Error("dsh-current-title: 请在插件页选择模型，或设置宿主默认对话模型。");
+	if (!route) throw new Error("dsh-current-title: 请在设置页选择模型，或设置默认辅助模型 / 宿主默认对话模型。");
 	const callRoute = {
 		provider: route.provider,
 		model: route.model
 	};
-	const framedInput = frameMessages(selected);
+	const framedInput = JSON.stringify(selected);
 	const locale = resolveTitleLocale(options.localeMode ?? options.config.locale, selected.map((message) => message.text), options.localePreference);
 	const sourceVersion = sourceVersionOf(options.sessionId, selected);
 	const deadline = new AbortController();
@@ -257,6 +1146,8 @@ async function generateCurrentTitle(options) {
 			plugin: PLUGIN_NAME,
 			route: callRoute,
 			system: systemPrompt(options.config, options.prompt),
+			feature: TITLE_CALL_FEATURE,
+			context: FRAME_PREFIX,
 			text: framedInput,
 			maxTokens: options.config.maxOutputTokens,
 			purpose: "session-title",
@@ -811,6 +1702,8 @@ const inject = [
 ];
 async function apply(ctx, config = {}) {
 	createModelSettingsChanges(ctx, modelSettingsChangesIdentity(PLUGIN_NAME), PLUGIN_NAME);
+	const release = await retainAuxiliaryModel(ctx);
+	ctx.effect(() => release, "current-title.auxiliary-model");
 	const host = ctx;
 	const domain = await host.storageDomain.open(titleDomain);
 	const table = domain.table("settings");
@@ -856,8 +1749,8 @@ async function apply(ctx, config = {}) {
 					},
 					current: settings.model,
 					followLabel: {
-						zh: "当前会话 / 宿主默认模型",
-						en: "Current conversation / host default"
+						zh: "默认辅助模型",
+						en: "Default auxiliary model"
 					},
 					allowFollow: true
 				}]