dsh-connect-workbuddy 4.14.1 → 4.15.1

package/CHANGELOG.md

@@ -1,5 +1,113 @@
 # Changelog
 
+## 4.15.1 (2026-10-21)
+
+> 版本号是 **patch**：没有接口与配置变更。发往上游的请求在**没有被网关拒绝时仍然逐字节不变**；改动的只有「被渠道校验拒绝之后」那一段——多一级重试。路由、模型、凭据、计费与换号规则未变。
+
+### Fixes
+
+- **4.15.0 上线后仍有 11128：网关还会按「提示词里的一段长文本」匹配，不只看开头**
+  - **真实报文**（2026-10-21 19:1x，国内区、插件 4.15.0、requestId `06e7950a…`）：回显「system：You are an AI agent powered by DeepSeek Harness.」（插件已加中性头）——**每条被扫消息的开头都已经在中性头之后**，网关仍然 400。这直接证伪了「只匹配开头」这个 4.13.0 时代的结论。
+  - **实测**（同账号 / 同模型 / 同请求头，只改 body；把宿主的真实失败请求逐段二分）：
+    - 触发点是 system 提示词里 **221 个字符**的一段（DSH 的 Web GUI 段落前两句：「You are interacting with the user through the DeepSeek Harness Web GUI … they mean this GUI.」）；
+    - 这一段**单独**发就 400；**任何一处**变化就 200（改写一个词、替换引号里的某个词、甚至插入一个零宽空格都行）；
+    - 在这段外面加前缀或后缀**不影响**结果 ⇒ 精确子串匹配，不是开头规则；
+    - 段落里的**单句**各自发都是 200 —— 所以按「开头」设计的归一化永远看不到它。
+  - **为什么之前的两级都救不了**：前缀归一化与强制中性头都只动「开头」，而这次命中的是提示词**中间**的一段。
+  - **改法**：新增 `perturbChannelFingerprints()` —— 在被扫消息（`system` / `assistant`，含每个 text part）的**句读处**插入 U+200B 零宽空格。对读者不可见、对模型无意义（词一个都没改），但任何跨句的指纹都会被截断。**只在网关已经拒绝之后**使用，正常请求逐字节不变。
+  - **重试阶梯**（同一个账号，`channel_reject` 仍不换号）：首次失败 → ① `forceNeutralHead`（无处可改就跳过）→ 仍失败 → ② `perturbChannelFingerprints`（无处可改就跳过）。回复里会写明用了哪几级（「并已用强制中性头与一次不可见扰动重试过」）。
+  - **代价**：被拒的那一轮最多多两个请求；账号池不记这两次失败（拒的是请求，不是账号）。
+
+- **`perturbChannelFingerprints()` 的最终形态**：在被扫消息（`system` / `assistant`，含每个 text part）的**句末标点后**与**分句逗号/分号后**插入 U+200B；对已含 U+200B 的内容幂等跳过；`undefined` 表示「改了也没用」，调用方据此不发请求。`prepareChatBody` 与它的关系是「前者管已知开头，后者管未知的中段」，两者互不覆盖。
+
+- **回复会写明用了几级重试**：「并已用强制中性头重试过」「并已用一次不可见扰动重试过」「并已用强制中性头与一次不可见扰动重试过」。这一行只在这两级真的跑过时出现。
+
+### Tests
+
+- `tests/issue98-channel-gate.spec.ts` 新增 5 条 `perturbChannelFingerprints` 用例：句读处插入、`system`/`assistant` 两种角色都插而 `user`/`tool` 不动、parts 数组与中日文标点、幂等且无改动时返回 `undefined`、畸形 body 不抛错。
+- `tests/issue98-shim.spec.ts` 新增 2 条：开头级无救时**仍会**走扰动级（第二份 body 只多了不可见字符）；扰动级把被拒请求救成 200。
+- 既有断言按新阶梯更新：重试全失败时的文案改为同时写出两级。
+
+### 真实上游核验
+
+- 用**宿主的真实失败请求**（`/tmp/failing-body.json`：10,956 字符 system + 5 条 user + 44 个 tools）在真实国内网关跑完整阶梯：`prepareChatBody` → **400**；`forceNeutralHead` → `undefined`（开头已在中性头之后，证实 4.15.0 那一级在这里是空操作）；`perturbChannelFingerprints` → **200**。
+- 同一份 body 上把开头换成 `You are CodeBuddy…` / `You are WorkBuddy…` 仍然 **400**——这是「换成腾讯身份」不能作为解法的直接证据。
+
+## 4.15.0 (2026-10-21)
+
+> 版本号是 **minor**：有两处用户可见的行为变更 ——（1）`assistant` 历史消息也会被归一化（此前只处理 `system`），（2）渠道校验失败后插件会用「强制中性头」在**同一个账号**上重试一次。**没有被网关拒绝的请求逐字节不变**；被拒的那一次多花一个请求。路由 id、模型 id、凭据、计费与换号规则一律未变。
+
+### Fixes
+
+- **issue #98：网关的渠道校验也扫 `assistant` 历史消息，而插件只归一到 `system` —— 一个被污染过的会话从此每一步都失败**
+  - **实测**（2026-10-21，国内网关 `copilot.tencent.com`，同账号 / 模型 `deepseek-v4.1-flash` / 请求头，**只改 body**；`max_tokens: 8`）：
+
+    | body 里唯一的变化 | 结果 |
+    | --- | --- |
+    | `system` 开头 = `You are an AI agent powered by DeepSeek Harness.` | 400 / 11128 |
+    | **`assistant` 历史消息开头** = 同一句 | **400 / 11128** |
+    | 同一句放在 `assistant` 消息内容**中间** | 200 |
+    | 给那条 `assistant` 消息开头补一行 `You are a helpful assistant.` | 200 |
+    | `user` 消息开头 = 同一句 | 200（不扫 user） |
+    | `tool` 结果开头 = 同一句 | 200（不扫 tool） |
+    | `system` 的 content 是 parts 数组、命中在**第 2 个** text part | 400 |
+    | 同上，但每个 text part 都补了中性头 | 200 |
+    | `system` 开头是当前宿主的 `You are a coding agent powered by …` | 200（不在名单里） |
+
+  - **它解释了 issue #98 的每一条症状**：只要会话里有一条 `assistant` 消息**开头**是被拦的身份（模型把系统提示词原样复述出来、会话恢复/重放、折叠摘要留下的痕迹），**这个会话之后的每一轮**都会被拒——「单轮跑到 7 分钟多才第一次报错」「继续仍报同一个错」「同一账号另一个会话正常」「重启后 1 分 22 秒失败」都是这一条的形状。换账号、换区域、重装官方客户端都不能改变它，因为被拒的是**请求里的那一行历史**。
+  - **改了什么**：`neutralizeChannelFingerprints()` 现在对 `system` 与 `assistant` **两种角色**做同一件事（字符串 content 或 parts 数组里的**每个** text part，命中已知指纹就在最前面补一行中性头）。此前只处理 `system`，所以 `assistant` 里那一行**原样发出**。
+  - **为什么可以改历史消息**：这是唯一能救活会话的做法——那一行在**宿主的历史里**，插件只能改它发出去的那一份。改动只有一行前缀，`user` / `tool` / `tool_calls` 结构与工具配对一律不动；宿主自己的会话记录也不改（插件只重写请求体）。
+
+- **`system` 的 content 是 parts 数组时，4.13.0 的归一化一个字节都没生效**
+  - 归一化只认 `typeof content === 'string'`，于是数组形态的 system 消息（多段文本、图文混排）整个跳过。实测：命中放在**第 2 个** text part 照样 400；每个 part 都补中性头才 200。
+  - 现在逐个 text part 判断并前置；非 text part（图片等）与未命中的 part **逐字节不动**，畸形 part 只跳过、不抛错。
+
+- **渠道校验失败后，用「强制中性头」在同一个账号上重试一次（结构性兜底）**
+  - **不能靠「把名单列全」**：那份名单是网关自己的数据，插件只持有**实测快照**（`UNAPPROVED_CHANNEL_OPENINGS`）。网关加一条，插件就漏一条，而漏掉的那条会让**整个会话**死掉。猜下一条的名字不是修法。
+  - **所以改成不看名单**：首次被渠道校验拒绝后，`forceNeutralHead()` 给**每一条** `system` 与 `assistant` 消息（含每个 text part）的最前面补中性头，再发一次。实测：任何被拦的开头，只要被挪到内容开头之外就 200——网关读的是**开头**，不是内容。
+  - **同一个账号**：闸读的是请求，不是账号，所以 `channel_reject` 本来就不换号；这一次重试也不换（换号只会烧真实额度，再拿同一个 11128）。
+  - **只在需要时**：如果每条开头都已经是中性头（`forceNeutralHead` 返回 `undefined`），不重试——那只会把同样的字节再发一遍。
+  - **不记假账**：第一次失败是提示词的问题，不是账号的问题，所以它不进账号池的失败统计；重试若也失败，按最后一次的结果记账。
+
+- **回复不再谎报「命中的 system 提示开头」（issue #98 的核心误导）**
+  - **旧行为**：从**归一化之后**的 body 里取第一条 `system` 的第一行，而插件补的中性头正好在第一条 ⇒ 回复永远说「命中的 system 提示开头：「You are a helpful assistant.」」。issue #98 里 10 位报告者收到的都是这句，而这句话单独发是 200，真正被拦的那一行从未出现在回复里。
+  - **新行为**：从**宿主原始 body**（归一化之前）取，**逐条**列出每个 `system` 与 `assistant` 消息的开头（parts 数组按 part 计），每条标明角色与插件是否已覆盖：
+    - `「system：…」（插件已加中性头）` —— 插件会改写它；
+    - `「system：…」（不在插件已知名单里，网关可能新增了词条）` —— 这一行**原样发出**，是真正该看的那条；
+    - 超过 4 条时只列前 4 条，并写明还剩几条。
+  - **不再说「命中的」**：网关从不告诉插件它匹配了哪一条，声称知道就是这次误导的根因。
+
+- **同一族业务码的另两道门现在会点名，而不是转述网关的托词**
+  - `11128` 有三个来源，`displayTips` 对三者**一字不差**（「这次调用没通过渠道校验，可能不是官方客户端发出的」）。另两道（`conversation id missing`、`first message is not system prompt`）此前落进通用 `client` 兜底，读者拿到的是「该请求被上游按参数拒绝……请按上面的提示调整后重试」＋那句误导文案——与本次报告者粘贴回来的那条 400 逐字一致。
+  - 现在按 `msg` 点名（仍**只认 msg，绝不认 displayTips**，分类与宿主错误码保持 `client` / 400）：缺会话 id 时说明网关要三枚会话头、插件每次都带；首条不是 system 时说明网关要求首条 system、插件在有消息时会补上，因此出现即代表这次请求本身没有消息或没走插件通道。
+
+### 评估后**没有**采纳：把中性头换成腾讯自家产品身份
+
+- **提议**（issue #98 末尾）：把 `You are a helpful assistant.` 换成 `You are CodeBuddy, Tencent's official AI coding assistant.`。理由成立——腾讯不会把自家客户端写进黑名单，这条「结构上安全」。
+- **实测代价**（同一天、同一账号、同一份 DSH 提示词，**只换开头一行**，问「你是哪个产品的助手？」）：
+
+  | 中性头 | 回答 |
+  | --- | --- |
+  | `You are a helpful assistant.`（现状） | 我是 DeepSeek 的编程助手。 |
+  | `You are CodeBuddy, Tencent's official AI coding assistant.` | 我是腾讯云 CodeBuddy 的 AI 编程助手。 |
+  | `You are WorkBuddy, an AI agent developed by Tencent.` | 我是腾讯 WorkBuddy 的 AI 助手。 |
+
+  前者不改变模型对自身身份的表述，后两者会**串味**——这是所有请求都要付的质量代价，不只是被拦的那几次。
+- **它也不解决 issue #98**：真正被拦的是**会话里的 `assistant` 历史**，不是开头那一行；中性头当时实测仍是 200，报告者把它当成「被拦的行」是插件的回显造成的误解。
+- **结论**：默认不变。「强制中性头」+「不可见扰动」已经覆盖了两类风险，且不必冒充。若将来中性头本身被拉黑，最小改动是把中性头**做成可配置**（默认仍为中性），而不是默认冒充——这留待届时有证据再评估。
+
+### Tests
+
+- `tests/issue98-channel-gate.spec.ts`（新增）：把上表的边界逐条钉住——parts 数组的第 1/第 2 个 part 都归一化、非 text part 与非命中 part 逐字节不动、畸形 part 不抛错、`assistant` 角色同样归一化、`isUnapprovedChannelOpening` 只匹配开头且大小写不敏感、`forceNeutralHead` 覆盖两种角色且空内容不碰、`openingEvidenceOfBody` 按角色与 part 上报并区分「插件已加中性头」与「不在名单里」、`conversation id missing` / `first message is not system prompt` 两道门的判据（code 与措辞两半都要，请求 id 里恰好含数字不算）。
+- `tests/issue98-shim.spec.ts`（新增）：挂载**真实的 shim**，只替换上游应答——重试一次即成功（且发出去的第二份 body 在 `system` 与 `assistant` 两种消息前都补了中性头）、重试不换号且第一次失败不记账号账、无法改变时不重试、重试也失败时回复点名的是**宿主的**开头（含 `assistant：`）而不是插件自己的占位行、回复里不再出现「命中的 system 提示开头」与旧兜底句、两道旁门各自点名且不转述误导文案、宿主错误码仍是 `client` / 400。
+- `tests/issue90-channel-reject.spec.ts` 改写：旧的三条按「从归一化后的 body 回显」写的用例方向相反（那正是本次修掉的误导），改为按新契约断言；分类与「不浪费换号」等护栏原样保留。
+
+### 真实上游核验
+
+- 2026-10-21 共 **200 余次只读对照**（每次 `max_tokens: 8`，未改动任何账号设置）：国内网关覆盖开头/中间/parts/角色/多 system/缺头/内容指纹定位（逐段二分 + 前缀增长 + 单点改写的双向验证）等 180 余组，国际网关 20 余组（国际不拦 DSH 身份，只拦 Claude Code；`user` 首条仍是 `first message is not system prompt`）。
+- **内容指纹那一组的判定是「同一份 body 只改一处」**：原样 400、任意一处改动 200、外面加前后缀仍 400，三种同时成立才敢下「精确子串」的结论。
+- 关键结论都经过**双向**确认：既能复现 400，也能用同一份 body 只改开头一行拿到 200（否则无法排除账号、区域或时间窗的影响）。
+
 ## 4.14.1 (2026-10-21)
 
 > 版本号是 **patch**：没有接口、配置项或请求结构的变更，发往上游的请求体**一个字节都没变**。本版只改「哪些上游条目算作模型」这一处判断，以及它带出的一个目录退化路径。

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, _t as hostPeersInfo, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, lt as findWorkbuddyAppExecutableWithSource, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, rt as WORKBUDDY_APP_EXECUTABLE_ENV, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-D1WnqQY2.js";
+import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, pt as findWorkbuddyAppExecutableWithSource, r as isHeartbeatProcessAlive, st as WORKBUDDY_APP_EXECUTABLE_ENV, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, xt as hostPeersInfo, y as WorkBuddyCredentialStore } from "./host-heartbeat-DtQIBMYm.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/{host-heartbeat-D1WnqQY2.js → host-heartbeat-DtQIBMYm.js}

@@ -1598,8 +1598,15 @@ const CHANNEL_REJECT_MARKERS = ["unapproved channel", "illegal api invocation"];
 * be read as the prompt rule: a confidently wrong diagnosis is worse here than
 * the generic `client` reply, because it sends the user to rewrite a system
 * prompt that is not at fault.
+*
+* Each is also exported as its own predicate ({@link isConversationIdGateBody},
+* {@link isFirstMessageGateBody}) so the reply can NAME the gate instead of
+* relaying the upstream's `displayTips` — which is the SAME misleading
+* sentence for all three members of the `11128` family.
 */
-const OTHER_CHANNEL_CODE_GATES = ["conversation id missing", "first message is not system prompt"];
+const CONVERSATION_ID_GATE_MARKER = "conversation id missing";
+const FIRST_MESSAGE_GATE_MARKER = "first message is not system prompt";
+const OTHER_CHANNEL_CODE_GATES = [CONVERSATION_ID_GATE_MARKER, FIRST_MESSAGE_GATE_MARKER];
 /**
 * Whether a failure body is the MODEL-scoped throttle rather than an account
 * limit.
@@ -1637,52 +1644,57 @@ function isChannelRejectBody(body) {
 	return CHANNEL_REJECT_MARKERS.some((marker) => lower.includes(marker));
 }
 /**
-* The OPENINGS of the `system` messages in a prepared request body.
+* Whether a failure body is the CONVERSATION-ID gate (`11128`).
 *
-* This is the evidence the channel gate actually reacts to, and echoing it is
-* what turns "the upstream refused" into "the upstream refused because of this
-* line" — the reader can then fix the prompt or report the new opening, instead
-* of cycling accounts that cannot change a byte of it.
+* One of the two gates that share the channel gate's business code, and one
+* of the two this plugin's diagnosis EXCLUDES: the prompt is not at fault
+* here, the request headers are — which is why it must never be reported as
+* "the gateway refused your system prompt".
 *
-* Each entry is the first non-empty line, clipped: a fingerprint lives at the
-* START of the content, so the rest of a 10 KB system prompt is noise that
-* would bury the one sentence worth reading. At most three entries are kept —
-* the gate scans every `system` message, but a body with more than three of them
-* is already worth showing compactly.
+* It is exported anyway, so a reply can NAME it. The upstream's `displayTips`
+* for all three `11128` gates is the identical sentence ("这次调用没通过渠道
+* 校验，可能不是官方客户端发出的"), so the tips cannot tell them apart — only
+* `msg` can. Hence the wording is the criterion and the code is the
+* corroboration, never the other way round.
 *
-* Never throws: a malformed body is the upstream's to reject, and losing the
-* failure measurement is not an acceptable price for reading an excerpt.
+* BOTH halves are required, and the code is matched in its quoted-key form
+* (`"code":11128`): a request id is hexadecimal and can contain the digits
+* `11128` by coincidence, and a bare substring search over an arbitrary
+* failure body is how a red herring gets promoted into a diagnosis.
 */
-function systemOpeningsOfBody(bodyJson) {
-	let parsed;
-	try {
-		parsed = JSON.parse(bodyJson);
-	} catch {
-		return [];
-	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return [];
-	const messages = parsed["messages"];
-	if (!Array.isArray(messages)) return [];
-	const openings = [];
-	for (const value of messages) {
-		if (openings.length >= 3) break;
-		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
-		const message = value;
-		const role = message["role"];
-		if (typeof role !== "string" || role.trim().toLowerCase() !== "system") continue;
-		const content = message["content"];
-		if (typeof content !== "string") continue;
-		const opening = firstLineOf(content).replace(/\s+/gu, " ").trim();
-		if (opening !== "") openings.push(clip(opening, SYSTEM_OPENING_LIMIT));
-	}
-	return openings;
+function isConversationIdGateBody(body) {
+	const lower = body.toLowerCase();
+	return lower.includes(CHANNEL_REJECT_CODE) && lower.includes(CONVERSATION_ID_GATE_MARKER);
+}
+/**
+* Whether a failure body is the FIRST-MESSAGE gate (`11128`).
+*
+* The global gateway's own rule: a chat request must OPEN with a system
+* message, and a user-first body is refused with `11128` / "first message is
+* not system prompt". The plugin's `ensureSystemHead()` satisfies it, so a
+* body carrying this wording says the request never had a system head — not
+* that a system prompt was fingerprinted.
+*
+* Excluded from the prompt diagnosis for the same reason as
+* {@link isConversationIdGateBody}, and named by the same rule: the CODE plus
+* the WORDING, case-insensitively, code in its quoted-key form.
+*/
+function isFirstMessageGateBody(body) {
+	const lower = body.toLowerCase();
+	return lower.includes(CHANNEL_REJECT_CODE) && lower.includes(FIRST_MESSAGE_GATE_MARKER);
 }
+/**
+* The OPENINGS of the `system` messages in a prepared request body.
+*
+* REMOVED in favour of {@link systemOpeningEvidenceOfBody}, which answers the
+* same question ("what did the gate actually see?") for BOTH string and
+* array-shaped content and can also say whether an opening is the plugin's own
+* neutral head. Two functions that both claim to describe what the gate read
+* are two truths that drift — and the array-shaped case is exactly where the
+* old one was blind.
+*/
 /** Longest system-prompt opening echoed back to the user, in characters. */
 const SYSTEM_OPENING_LIMIT = 120;
-function firstLineOf(content) {
-	const newline = content.indexOf("\n");
-	return newline === -1 ? content : content.slice(0, newline);
-}
 function clip(text, limit) {
 	return text.length <= limit ? text : `${text.slice(0, limit - 1)}…`;
 }
@@ -1980,31 +1992,389 @@ const WORKBUDDY_FALLBACK_SYSTEM_PROMPT = "You are a helpful assistant.";
 * snapshot, not a theory of what the gate "means"; a gateway adding a new
 * opening is not caught until a body carries one, and the prepend only wins
 * while the gate keeps matching at offset 0.
+*
+* THE LIST CANNOT BE COMPLETE, AND THAT IS WHY {@link forceNeutralHead}
+* EXISTS. This is a snapshot of the upstream's own list, taken by measuring
+* openings one at a time; the upstream can extend it at any time and the
+* plugin cannot see it. So the plugin's own prepend is a best-effort filter,
+* not a guarantee — and the self-healing retry is what covers the openings
+* nobody has measured yet.
 */
 const UNAPPROVED_CHANNEL_OPENINGS = ["you are an ai agent powered by deepseek harness", "you are claude code, anthropic's official cli for claude"];
 /**
-* Move every `system` message off the content fingerprint above by prepending
-* the placeholder head.
+* Whether this text OPENS with an opening the gateways refuse.
+*
+* The gate is a PREFIX match on the START of a `system` message, so this is
+* the one predicate that decides it — used by the request path (which prepends
+* the neutral head on a hit) and by the failure path (which names the
+* offending line).
+*
+* THREE MEASURED RULES are folded in here, all from the live CN gateway on
+* 2026-10-21 (account `ba217455…`, `deepseek-v4.1-flash`, every other request
+* field held fixed):
+*
+*   1. Only the START counts — the same sentence mid-content answers 200.
+*   2. LEADING WHITESPACE is trimmed before the comparison — " <banned>" and
+*      "\n<banned>" both answer 200 today.
+*   3. The comparison is CASE-INSENSITIVE — the lower-cased sentence fails too.
+*
+* (2) is a gift that can be withdrawn, so the comparison is made the way a
+* trimming gate would make it even while the gateway is lenient: a rule that
+* only holds while the gateway forgets to trim is a rule waiting to break.
+*
+* The list itself stays the measured snapshot. It is deliberately NOT
+* extended by guesswork: an opening nobody measured is an opening nobody knows
+* the gateway refuses, and inventing entries would neutralise prompts that
+* answer 200 today.
+*/
+function isUnapprovedChannelOpening(text) {
+	const opening = text.replace(/^\s+/u, "").toLowerCase();
+	return UNAPPROVED_CHANNEL_OPENINGS.some((prefix) => opening.startsWith(prefix));
+}
+/**
+* Whether this text already begins with the plugin's own neutral head.
+*
+* The question the failure path has to answer per system message: "is the
+* line the gateway refused OURS, or the HOST's?" — the plugin's head is the
+* one line it has ever added to a prompt, so it is the only opening that
+* cannot be a third-party-agent fingerprint.
+*/
+function startsWithNeutralHead(text) {
+	return text.replace(/^\s+/u, "").toLowerCase().startsWith(WORKBUDDY_FALLBACK_SYSTEM_PROMPT.toLowerCase());
+}
+/**
+* The roles whose message OPENINGS the gateway scans.
+*
+* MEASURED on the live CN gateway (2026-10-21, every other request field held
+* fixed): `system` and `assistant` are scanned; `user` and `tool` are not (a
+* body whose `user` or `tool` content opens with the banned identity answers
+* 200). That second role is the one the plugin missed until 4.15.0, and it is
+* why issue #98's sessions stayed broken: an `assistant` history message that
+* opens with the fingerprint poisons EVERY later turn of that session, on
+* every account and in every region.
 *
-* A no-op for a body with no system message and for every system message whose
-* content starts with anything else, so a request that the gateways already
-* answer keeps its prompt byte-for-byte — only the messages the gate would
-* refuse grow, by one short line.
+* `developer` is not listed because `prepareChatBody` rewrites it to `system`
+* before this module looks at the body — and because both gateways refuse
+* `developer` outright, so neutralising its content would not save the request.
+*/
+function scansOpening(role) {
+	if (typeof role !== "string") return false;
+	const name = role.trim().toLowerCase();
+	return name === "system" || name === "assistant";
+}
+/**
+* Move every scanned message (`system` and `assistant`) off the content
+* fingerprint above by prepending the placeholder head.
+*
+* A no-op for a body whose messages start with anything else, so a request the
+* gateways already answer keeps its prompt byte-for-byte — only the messages
+* the gate would refuse grow, by one short line.
+*
+* BOTH ROLES, because the gate reads both. Until 4.15.0 this only handled
+* `system`, and the failure that left behind is issue #98: a conversation
+* whose HISTORY contains an assistant message opening with the banned identity
+* (the model echoing its own prompt, a restored session, a compaction
+* artefact) was refused on every single turn, and no account or region could
+* change a byte of it.
+*
+* ARRAY CONTENT IS HANDLED PART BY PART, and that is not a nicety. Measured on
+* the live CN gateway (2026-10-21): when a scanned message's `content` is an
+* array of parts, the gate reads EVERY TEXT PART of it — a banned opening in
+* the FIRST part is refused, and a banned opening in the SECOND part is
+* refused just the same. Prepending to the first part only would therefore
+* fix the first half of the failure and leave the second half to the users who
+* report it again.
 */
 function neutralizeChannelFingerprints(obj) {
 	const messages = obj["messages"];
 	if (!Array.isArray(messages)) return;
 	for (const value of messages) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+		const message = value;
+		if (!scansOpening(message["role"])) continue;
+		const content = message["content"];
+		if (typeof content === "string") {
+			if (!isUnapprovedChannelOpening(content)) continue;
+			message["content"] = `${WORKBUDDY_FALLBACK_SYSTEM_PROMPT}\n\n${content}`;
+			continue;
+		}
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
+			const record = part;
+			const type = record["type"];
+			if (typeof type !== "string" || type.trim().toLowerCase() !== "text") continue;
+			const text = record["text"];
+			if (typeof text !== "string" || !isUnapprovedChannelOpening(text)) continue;
+			record["text"] = `${WORKBUDDY_FALLBACK_SYSTEM_PROMPT}\n\n${text}`;
+		}
+	}
+}
+/**
+* A body in which EVERY scanned opening (`system` and `assistant`) is moved
+* behind the neutral head.
+*
+* THE ONE-SHOT SELF-HEALING RETRY'S BODY BUILDER. The gateway's fingerprint
+* list is a SNAPSHOT the upstream can extend at any time, and the plugin
+* cannot see it: the two entries in {@link UNAPPROVED_CHANNEL_OPENINGS} are
+* what was MEASURED on 2026-10-21, not a contract. So the day the gateway
+* adds an entry, this plugin's own prepend stops matching and the banned
+* opening goes out on the wire unchanged — exactly the dead end issue #98
+* describes, and exactly what a longer guess-list cannot prevent (nobody can
+* measure the next entry before it bites).
+*
+* The remedy is a second attempt that does not depend on knowing the
+* fingerprint at all: this builds a body in which EVERY scanned message,
+* whatever it opens with, gets the neutral head in front. The gateway matches
+* the START of a scanned message, so a neutral first line moves the whole
+* opening out of the matched region — whether the banned text is a known
+* entry, a new one, or a fingerprint this plugin has never heard of.
+*
+* `assistant` messages are included for the measured reason
+* {@link neutralizeChannelFingerprints} documents: a history message that opens
+* with a refused identity is what keeps a whole session failing, so a retry
+* that only moved the system prompt would spend a request to be refused for the
+* same reason.
+*
+* WHEN IT IS USED: only AFTER the gateway refused the first attempt with the
+* channel gate. A request the gateway already answers keeps its bytes
+* unchanged, because this function is never called for it — the normal path
+* is {@link prepareChatBody}, which only touches the openings it has MEASURED
+* as fingerprinted.
+*
+* `undefined` means "this body cannot change": every scanned opening already
+* starts with the neutral head, so a retry would send the same bytes and
+* spend a request for the same refusal. The caller uses that to avoid
+* spending the round trip.
+*
+* Empty contents are skipped: an empty string cannot open with anything, so it
+* cannot be the culprit, and an assistant message that carries `tool_calls`
+* with `content: ""` is a replay shape this function has no reason to touch.
+*
+* Never throws. A body it cannot read is the upstream's to reject, and a
+* parse error must not turn a retry into a crash.
+*/
+function forceNeutralHead(bodyJson) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyJson);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const obj = parsed;
+	const messages = obj["messages"];
+	if (!Array.isArray(messages)) return void 0;
+	let changed = false;
+	for (const value of messages) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+		const message = value;
+		if (!scansOpening(message["role"])) continue;
+		const content = message["content"];
+		if (typeof content === "string") {
+			if (content.trim() === "" || startsWithNeutralHead(content)) continue;
+			message["content"] = `${WORKBUDDY_FALLBACK_SYSTEM_PROMPT}\n\n${content}`;
+			changed = true;
+			continue;
+		}
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
+			const record = part;
+			const type = record["type"];
+			if (typeof type !== "string" || type.trim().toLowerCase() !== "text") continue;
+			const text = record["text"];
+			if (typeof text !== "string" || text.trim() === "" || startsWithNeutralHead(text)) continue;
+			record["text"] = `${WORKBUDDY_FALLBACK_SYSTEM_PROMPT}\n\n${text}`;
+			changed = true;
+		}
+	}
+	if (!changed) return void 0;
+	return JSON.stringify(obj);
+}
+/**
+* The invisible character used to break a content fingerprint.
+*
+* U+200B ZERO WIDTH SPACE: it renders as nothing, it is not whitespace for the
+* gateway's own matching, and a model reads straight through it. Measured on
+* the live CN gateway: putting one inside the refused span turns 400 into 200,
+* while the text the model reads is unchanged.
+*/
+const ZERO_WIDTH_SPACE = "​";
+/**
+* A body whose scanned message TEXT is perturbed just enough to break an exact
+* content fingerprint.
+*
+* THE SECOND HALF OF ISSUE #98, found on 2026-10-21 after 4.15.0 shipped. The
+* gateway does not only match the OPENING of a scanned message; it also matches
+* one long substring INSIDE the system prompt. Measured byte-exactly on a real
+* failed request (CN gateway, `deepseek-v4.1-flash`, the host's own body):
+*
+*   - the refusal is reproducible, and it is not the opening: the plugin had
+*     already prepended the neutral head, and the request still answered 400;
+*   - bisecting the host's 10,956-character system prompt by lines and then by
+*     sentences found a 221-character span: the DSH Web-GUI paragraph's first
+*     two sentences ("You are interacting with the user through the DeepSeek
+*     Harness Web GUI … they mean this GUI.");
+*   - that span ALONE reproduces the 400, and the SAME span with ANY change
+*     inside it answers 200 — one character rewritten, one quoted word
+*     replaced, even a zero-width space inserted. An outer prefix or suffix
+*     does not help, so the match is an exact substring, not an opening rule;
+*   - the paragraph's individual sentences each answer 200, which is why the
+*     plugin's opening-based normalisation never saw this.
+*
+* SO THE RESCUE CANNOT BE "prepend a line" (that is {@link forceNeutralHead},
+* and it is a no-op here). Nor can it be a list of refused spans: the list is
+* the upstream's own data, it already grew once without notice, and it will
+* grow again. What DOES generalise is the observation that an exact-substring
+* match dies on any perturbation inside it — so this inserts a zero-width space
+* at every sentence and clause boundary of the scanned messages, which is
+* invisible to the reader, meaningless to the model, and inside the refused
+* span with near-certainty for any prose fingerprint.
+*
+* WHEN IT IS USED: only as the last retry, after the gateway already refused
+* the request AND the neutral head could not change anything. Requests the
+* gateway answers keep their bytes untouched.
+*
+* Idempotent: a body that already carries U+200B in a scanned message is left
+* alone, so a retry never stacks perturbations. Returns `undefined` when
+* nothing would change, which is the caller's signal not to spend a request.
+*
+* Never throws: a malformed body is the upstream's to reject, and a parse error
+* must not turn a rescue into a crash.
+*/
+function perturbChannelFingerprints(bodyJson) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyJson);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const obj = parsed;
+	const messages = obj["messages"];
+	if (!Array.isArray(messages)) return void 0;
+	let changed = false;
+	const perturb = (text) => {
+		if (text.includes(ZERO_WIDTH_SPACE)) return void 0;
+		const next = text.replace(/([.!?])(\s+)/gu, `$1${ZERO_WIDTH_SPACE}$2`).replace(/([。！？])/gu, `$1${ZERO_WIDTH_SPACE}`).replace(/([,;])(\s+)/gu, `$1${ZERO_WIDTH_SPACE}$2`);
+		return next === text ? void 0 : next;
+	};
+	for (const value of messages) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+		const message = value;
+		if (!scansOpening(message["role"])) continue;
+		const content = message["content"];
+		if (typeof content === "string") {
+			const next = perturb(content);
+			if (next !== void 0) {
+				message["content"] = next;
+				changed = true;
+			}
+			continue;
+		}
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
+			const record = part;
+			const type = record["type"];
+			if (typeof type !== "string" || type.trim().toLowerCase() !== "text") continue;
+			const text = record["text"];
+			if (typeof text !== "string") continue;
+			const next = perturb(text);
+			if (next !== void 0) {
+				record["text"] = next;
+				changed = true;
+			}
+		}
+	}
+	if (!changed) return void 0;
+	return JSON.stringify(obj);
+}
+/**
+* The openings of every scanned message in a body, one entry per TEXT PART.
+*
+* `system` AND `assistant`, because both are read by the gate (measured; see
+* {@link scansOpening}). `developer` counts as a system message because the
+* plugin rewrites `developer` → `system` on the wire.
+*
+* Array content contributes ONE ENTRY PER PART, for the same reason the request
+* path neutralises every part: the gate reads every text part, so "which line
+* tripped it" can be any of them.
+*
+* Capped at {@link SYSTEM_EVIDENCE_LIMIT} entries, and never throws — losing
+* the failure measurement is not an acceptable price for reading an excerpt.
+*/
+function openingEvidenceOfBody(bodyJson) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyJson);
+	} catch {
+		return [];
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return [];
+	const messages = parsed["messages"];
+	if (!Array.isArray(messages)) return [];
+	const evidence = [];
+	for (let index = 0; index < messages.length; index++) {
+		if (evidence.length >= SYSTEM_EVIDENCE_LIMIT) break;
+		const value = messages[index];
 		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
 		const message = value;
 		const role = message["role"];
-		if (typeof role !== "string" || role.trim().toLowerCase() !== "system") continue;
+		if (typeof role !== "string") continue;
+		const roleName = role.trim().toLowerCase();
+		if (roleName !== "system" && roleName !== "assistant" && roleName !== "developer") continue;
+		const roleOfEvidence = roleName === "assistant" ? "assistant" : "system";
 		const content = message["content"];
-		if (typeof content !== "string") continue;
-		const opening = content.replace(/^\s+/, "").toLowerCase();
-		if (!UNAPPROVED_CHANNEL_OPENINGS.some((prefix) => opening.startsWith(prefix))) continue;
-		message["content"] = `${WORKBUDDY_FALLBACK_SYSTEM_PROMPT}\n\n${content}`;
+		const texts = [];
+		if (typeof content === "string") texts.push(content);
+		else if (Array.isArray(content)) for (const part of content) {
+			if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
+			const record = part;
+			const type = record["type"];
+			if (typeof type !== "string" || type.trim().toLowerCase() !== "text") continue;
+			const text = record["text"];
+			if (typeof text === "string") texts.push(text);
+		}
+		for (const text of texts) {
+			if (evidence.length >= SYSTEM_EVIDENCE_LIMIT) break;
+			const opening = firstNonEmptyLineOf(text).replace(/\s+/gu, " ").trim();
+			if (opening === "") continue;
+			evidence.push({
+				opening: clip(opening, SYSTEM_OPENING_LIMIT),
+				role: roleOfEvidence,
+				neutralized: startsWithNeutralHead(opening) || isUnapprovedChannelOpening(opening),
+				messageIndex: index
+			});
+		}
 	}
+	return evidence;
+}
+/**
+* How many openings the failure path reports.
+*
+* Eight is generous: the gate scans every system message and every text part
+* of it, so a body with more than a handful of openings is not a prompt the
+* reader can act on anyway — the reply names the first ones and the failure
+* body carries the rest.
+*
+* The cap is HERE and not in the reply: this function reports everything it
+* found (up to eight) and the reply renders as many of them as fit, saying
+* how many were left out. Truncating the evidence before the reply sees it
+* would make "N more" unanswerable.
+*/
+const SYSTEM_EVIDENCE_LIMIT = 8;
+/**
+* The first line of a text that carries something.
+*
+* Blank lines are SKIPPED: the neutral head is followed by an empty line, so
+* the head itself is the line worth reporting, and a content that opens with
+* blank lines still has an opening.
+*/
+function firstNonEmptyLineOf(content) {
+	for (const line of content.split("\n")) if (line.trim() !== "") return line;
+	return "";
 }
 /**
 * Make the conversation open with a system message, prepending the fallback
@@ -4863,7 +5233,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.14.1";
+const WORKBUDDY_CONNECT_VERSION = "4.15.1";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -5021,4 +5391,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { withEffectiveOff as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, defaultOffModelIds as J, systemOpeningsOfBody as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, recordRefusal as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, offDefaultFor as X, lastRefusalFor as Y, offRefused as Z, WORKBUDDY_AUTH_FILENAME as _, hostPeersInfo as _t, readHostHeartbeat as a, deriveAtRestKey as at, WorkBuddyEncryptedCredentialError as b, writeFileAtomic as bt, WORKBUDDY_CONNECT_VERSION as c, findWorkbuddyAppExecutable as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, isWorkbuddyBundle as dt, NATIVE_MODALITY_BY_MODEL_ID as et, WorkBuddyCatalog as f, macosBundleExecutable as ft, ENCRYPTED_CREDENTIAL_CODE as g, workbuddyAppExecutableCandidates as gt, fallbackModelsFor as h, readAtRestKey as ht, processStartTimeMs as i, clearAtRestKeyCache as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, findWorkbuddyAppExecutableWithSource as lt, deriveCatalog as m, openEncryptedField as mt, clearHostHeartbeat as n, nativeModalityOf as nt, workbuddyHostHeartbeatPath as o, deriveAtRestKeyId as ot, applyContextBudgets as p, macosNestedAppBundles as pt, REFUSES_OFF_MODEL_IDS as q, isHeartbeatProcessAlive as r, WORKBUDDY_APP_EXECUTABLE_ENV as rt, writeHostHeartbeat as s, fetchAtRestKeyPayload as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, imageDefaultFor as tt, FALLBACK_WORKBUDDY_MODELS as u, isEncryptedFieldWrapper as ut, WORKBUDDY_AUTH_FILE_ENV as v, resolveDshHome as vt, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, withFileLock as yt, knownRegionOf as z };
+export { lastRefusalFor as $, workbuddyAccountId as A, isCredentialRejectedError as B, defaultDesktopAuthDirs as C, withFileLock as Ct, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, parseCreditMultiplier as G, knownRegionOf as H, classifyUpstreamError as I, perturbChannelFingerprints as J, parseReasoning as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, defaultOffModelIds as Q, forceNeutralHead as R, defaultDesktopAuthCandidates as S, resolveDshHome as St, hasEncryptedCredentialFields as T, modelIdOfBody as U, isFirstMessageGateBody as V, openingEvidenceOfBody as W, regionOf as X, prepareChatBody as Y, REFUSES_OFF_MODEL_IDS as Z, WORKBUDDY_AUTH_FILENAME as _, macosNestedAppBundles as _t, readHostHeartbeat as a, imageDefaultFor as at, WorkBuddyEncryptedCredentialError as b, workbuddyAppExecutableCandidates as bt, WORKBUDDY_CONNECT_VERSION as c, clearAtRestKeyCache as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, fetchAtRestKeyPayload as dt, offDefaultFor as et, WorkBuddyCatalog as f, findWorkbuddyAppExecutable as ft, ENCRYPTED_CREDENTIAL_CODE as g, macosBundleExecutable as gt, fallbackModelsFor as h, isWorkbuddyBundle as ht, processStartTimeMs as i, NATIVE_MODALITY_BY_MODEL_ID as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, deriveAtRestKey as lt, deriveCatalog as m, isEncryptedFieldWrapper as mt, clearHostHeartbeat as n, recordRefusal as nt, workbuddyHostHeartbeatPath as o, nativeModalityOf as ot, applyContextBudgets as p, findWorkbuddyAppExecutableWithSource as pt, parseUpstreamModel as q, isHeartbeatProcessAlive as r, withEffectiveOff as rt, writeHostHeartbeat as s, WORKBUDDY_APP_EXECUTABLE_ENV as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, offRefused as tt, FALLBACK_WORKBUDDY_MODELS as u, deriveAtRestKeyId as ut, WORKBUDDY_AUTH_FILE_ENV as v, openEncryptedField as vt, defaultDesktopAuthPath as w, writeFileAtomic as wt, authFileName as x, hostPeersInfo as xt, WorkBuddyCredentialStore as y, readAtRestKey as yt, isConversationIdGateBody as z };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as withEffectiveOff, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as defaultOffModelIds, K as systemOpeningsOfBody, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as recordRefusal, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as offDefaultFor, Y as lastRefusalFor, Z as offRefused, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as deriveAtRestKey, b as WorkBuddyEncryptedCredentialError, bt as writeFileAtomic, c as WORKBUDDY_CONNECT_VERSION, ct as findWorkbuddyAppExecutable, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as isWorkbuddyBundle, et as NATIVE_MODALITY_BY_MODEL_ID, f as WorkBuddyCatalog, ft as macosBundleExecutable, g as ENCRYPTED_CREDENTIAL_CODE, gt as workbuddyAppExecutableCandidates, h as fallbackModelsFor, ht as readAtRestKey, i as processStartTimeMs, it as clearAtRestKeyCache, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, m as deriveCatalog, mt as openEncryptedField, n as clearHostHeartbeat, nt as nativeModalityOf, o as workbuddyHostHeartbeatPath, ot as deriveAtRestKeyId, p as applyContextBudgets, pt as macosNestedAppBundles, q as REFUSES_OFF_MODEL_IDS, r as isHeartbeatProcessAlive, rt as WORKBUDDY_APP_EXECUTABLE_ENV, s as writeHostHeartbeat, st as fetchAtRestKeyPayload, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as imageDefaultFor, u as FALLBACK_WORKBUDDY_MODELS, ut as isEncryptedFieldWrapper, v as WORKBUDDY_AUTH_FILE_ENV, vt as resolveDshHome, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, yt as withFileLock, z as knownRegionOf } from "./host-heartbeat-D1WnqQY2.js";
+import { $ as lastRefusalFor, A as workbuddyAccountId, B as isCredentialRejectedError, C as defaultDesktopAuthDirs, Ct as withFileLock, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as parseCreditMultiplier, H as knownRegionOf, I as classifyUpstreamError, J as perturbChannelFingerprints, K as parseReasoning, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as defaultOffModelIds, R as forceNeutralHead, S as defaultDesktopAuthCandidates, St as resolveDshHome, T as hasEncryptedCredentialFields, U as modelIdOfBody, V as isFirstMessageGateBody, W as openingEvidenceOfBody, X as regionOf, Y as prepareChatBody, Z as REFUSES_OFF_MODEL_IDS, _ as WORKBUDDY_AUTH_FILENAME, _t as macosNestedAppBundles, a as readHostHeartbeat, at as imageDefaultFor, b as WorkBuddyEncryptedCredentialError, bt as workbuddyAppExecutableCandidates, c as WORKBUDDY_CONNECT_VERSION, ct as clearAtRestKeyCache, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as fetchAtRestKeyPayload, et as offDefaultFor, f as WorkBuddyCatalog, ft as findWorkbuddyAppExecutable, g as ENCRYPTED_CREDENTIAL_CODE, gt as macosBundleExecutable, h as fallbackModelsFor, ht as isWorkbuddyBundle, i as processStartTimeMs, it as NATIVE_MODALITY_BY_MODEL_ID, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as deriveAtRestKey, m as deriveCatalog, mt as isEncryptedFieldWrapper, n as clearHostHeartbeat, nt as recordRefusal, o as workbuddyHostHeartbeatPath, ot as nativeModalityOf, p as applyContextBudgets, q as parseUpstreamModel, r as isHeartbeatProcessAlive, rt as withEffectiveOff, s as writeHostHeartbeat, st as WORKBUDDY_APP_EXECUTABLE_ENV, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as offRefused, u as FALLBACK_WORKBUDDY_MODELS, ut as deriveAtRestKeyId, v as WORKBUDDY_AUTH_FILE_ENV, vt as openEncryptedField, w as defaultDesktopAuthPath, wt as writeFileAtomic, x as authFileName, y as WorkBuddyCredentialStore, yt as readAtRestKey, z as isConversationIdGateBody } from "./host-heartbeat-DtQIBMYm.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -2960,6 +2960,43 @@ function clippedUpstreamText(text, limit) {
 	return `${cut.trimEnd()}…`;
 }
 /**
+* The channel-gate reply's evidence sentence: what the gateway actually read.
+*
+* Read from the HOST's body, not from the prepared one, because the prepared
+* body has the plugin's neutral head in front of every opening it recognises —
+* so the first line it could report is the plugin's own placeholder, which is
+* exactly the false lead issue #98's reporters were given. They were told the
+* gateway had refused `You are a helpful assistant.`, a line that returns 200
+* when sent alone.
+*
+* Each entry is labelled with its ROLE (`system` / `assistant`) because both are
+* scanned and the difference is what tells the reader where to look: an
+* `assistant` entry is a history message, i.e. the session is poisoned and every
+* later turn will fail the same way until that line is changed.
+*
+* Each entry also says whether the plugin's own neutralisation already covers
+* it. An entry marked "not in the plugin's list" is the actionable one: that
+* opening goes on the wire verbatim, so either the host wrote it or the
+* gateway's list grew.
+*
+* Capped at {@link CHANNEL_EVIDENCE_LIMIT} entries: a session can carry dozens
+* of system/assistant messages, and a wall of them would bury the one that
+* matters. The remainder is counted instead of listed.
+*/
+function channelEvidenceText(bodyJson) {
+	const entries = openingEvidenceOfBody(bodyJson);
+	if (entries.length === 0) return "（请求里没有可读的 system 或 assistant 消息开头。）";
+	const shown = entries.slice(0, CHANNEL_EVIDENCE_LIMIT);
+	const rendered = shown.map((entry) => {
+		const label = entry.neutralized ? "（插件已加中性头）" : "（不在插件已知名单里，网关可能新增了词条）";
+		return `「${entry.role}：${entry.opening}」${label}`;
+	}).join("、");
+	const hidden = entries.length - shown.length;
+	return `请求里被网关扫描的消息开头：${rendered}${hidden > 0 ? `……另有 ${hidden} 条未列出。` : "。"}`;
+}
+/** How many message openings the channel-gate reply lists. */
+const CHANNEL_EVIDENCE_LIMIT = 4;
+/**
 * The line prepended to an answer that came from a failover account.
 *
 * Block-quoted and bracketed so it reads as machinery rather than as the model's
@@ -3284,6 +3321,56 @@ function createWorkBuddyShim(options) {
 		const controller = new AbortController();
 		res.on("close", () => controller.abort());
 		let result = await client.chatStream(credential, prepared, controller.signal);
+		/**
+		* The retry ladder that does not depend on knowing the fingerprint
+		* (issue #98, both halves).
+		*
+		* The gateway refuses the request for data the plugin cannot see: a list of
+		* refused `system`/`assistant` OPENINGS (the plugin holds a measured
+		* SNAPSHOT, `UNAPPROVED_CHANNEL_OPENINGS`) and, since 2026-10-21, at least
+		* one long substring INSIDE the prompt. Every account and every region
+		* sends the same bytes, so without a rescue the only outcome is a dead end
+		* the reader cannot get out of.
+		*
+		* Two rungs, both on the SAME credential (the gate reads the request, not
+		* the account, which is why `channel_reject` is not failover-worthy):
+		*
+		*   1. `forceNeutralHead` — move every scanned opening behind the neutral
+		*      head. Measured: whatever the banned opening is, moving it off the
+		*      start of the content answers 200.
+		*   2. `perturbChannelFingerprints` — insert zero-width spaces at the
+		*      sentence boundaries of the scanned messages, which breaks an
+		*      exact-substring fingerprint without changing a word the model reads.
+		*      This is the rung that rescues the inside-the-prompt fingerprints,
+		*      where rung 1 is a no-op.
+		*
+		* Both return `undefined` when they would change nothing; that is the
+		* signal not to spend a request on a body that would be refused identically.
+		*
+		* Nothing has been written to the client at this point (`!ok` means the
+		* upstream answered non-2xx before any stream started), so a retry cannot
+		* splice two responses together. The first attempt's failure is NOT booked
+		* as an account failure: it was the request that was refused, not the
+		* credential.
+		*/
+		let retriedWithForcedHead = false;
+		let retriedWithPerturbation = false;
+		if (!result.ok && result.kind === "channel_reject" && !controller.signal.aborted) {
+			const forced = forceNeutralHead(prepared);
+			if (forced !== void 0) {
+				logger?.warn("dsh-connect-workbuddy: the channel gate refused the body; retrying once with the neutral head forced in front of every opening");
+				result = await client.chatStream(credential, forced, controller.signal);
+				retriedWithForcedHead = true;
+			}
+			if (!result.ok && result.kind === "channel_reject" && !controller.signal.aborted) {
+				const rescued = perturbChannelFingerprints(forced ?? prepared);
+				if (rescued !== void 0) {
+					logger?.warn("dsh-connect-workbuddy: the channel gate refused the body again; retrying once with an invisible perturbation of the scanned text");
+					result = await client.chatStream(credential, rescued, controller.signal);
+					retriedWithPerturbation = true;
+				}
+			}
+		}
 		const triedAccountIds = [];
 		/**
 		* The account the request STARTED on, and the reason it was abandoned.
@@ -3390,9 +3477,12 @@ function createWorkBuddyShim(options) {
 				if (detail?.upstreamCode !== void 0) meta.push(`code ${detail.upstreamCode}`);
 				if (detail?.requestId !== void 0) meta.push(`requestId ${detail.requestId}`);
 				const stamp = meta.length === 0 ? "" : `（${meta.join("，")}）`;
-				const openings = systemOpeningsOfBody(prepared);
-				const evidence = openings.length === 0 ? "" : `命中的 system 提示开头：${openings.map((opening) => `「${opening}」`).join("、")}。`;
-				const message = `workbuddy 上游失败：${failoverReasonText(result)}（http ${result.status}）${note}${stamp}。${evidence}该请求被 WorkBuddy 网关的渠道校验拦截，上游把它描述成「不是官方客户端发出的」，但那是误导性文案：网关匹配的是 system 提示的开头，与账号、积分、额度、网络都无关，换账号或换区域也不会改变结果。若这段开头来自宿主或其他插件，请修改该提示；插件已对已知的第三方 agent 指纹做归一化，新的指纹可反馈到 issue 里`;
+				const evidence = channelEvidenceText(raw);
+				const retries = [];
+				if (retriedWithForcedHead) retries.push("强制中性头");
+				if (retriedWithPerturbation) retries.push("一次不可见扰动");
+				const retryNote = retries.length === 0 ? "" : `，并已用${retries.join("与")}重试过`;
+				const message = `workbuddy 上游失败：${failoverReasonText(result)}（http ${result.status}）${note}${stamp}。${evidence}该请求被 WorkBuddy 网关的渠道校验拦截，上游把它描述成「不是官方客户端发出的」，但那是误导性文案：网关匹配的是每一条 system 与 assistant 消息的开头，与账号、积分、额度、网络都无关，换账号或换区域也不会改变结果。插件已对已知的第三方 agent 指纹做归一化` + retryNote + "；若上面标着「不在插件已知名单里」的开头来自宿主或其他插件，请修改该提示；新的指纹可反馈到 issue 里";
 				writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, message, hostErrorCode(result.kind));
 				return;
 			}
@@ -3401,10 +3491,11 @@ function createWorkBuddyShim(options) {
 			if (detail?.upstreamCode !== void 0) meta.push(`code ${detail.upstreamCode}`);
 			if (detail?.requestId !== void 0) meta.push(`requestId ${detail.requestId}`);
 			const stamp = meta.length === 0 ? "" : `（${meta.join("，")}）`;
+			const siblingGate = isConversationIdGateBody(result.message) ? "该请求被上游以「conversation id missing」拒绝：网关要求每个请求带上会话 id 头（X-Conversation-ID、X-Conversation-Request-ID、X-Conversation-Message-ID），插件每次都会带上这三个头；仍出现说明这次请求没有走插件的聊天通道，请升级插件或反馈 issue" : isFirstMessageGateBody(result.message) ? "该请求被上游以「first message is not system prompt」拒绝：网关要求首条消息是 system 消息；插件在请求带消息时会保证这一点，所以出现这条说明这次请求本身没有消息，或没有走插件的聊天通道，请升级插件或反馈 issue" : void 0;
 			const refusedTier = reasoningTierRefusal(result);
 			const receipt = refusedTier ?? detail?.tips ?? detail?.displayMsg ?? clippedUpstreamText(result.message, 400);
 			const advice = refusedTier !== void 0 ? "这不是账号或网络问题：该模型实测拒绝「off」推理档位，请到模型卡片里取消该行的「可关闭思考」勾选后重试" : result.kind === "client" ? "该请求被上游按参数拒绝：与网络、账号、额度都无关，换账号也不会改变结果，请按上面的提示调整后重试" : shortfall === void 0 ? "" : "建议换一个模型继续，或稍后等待该账号的额度恢复";
-			const body = advice === "" ? receipt : `${receipt.replace(/[。.]$/u, "")}。${advice}`;
+			const body = siblingGate !== void 0 ? siblingGate : advice === "" ? receipt : `${receipt.replace(/[。.]$/u, "")}。${advice}`;
 			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy 上游失败：${failoverReasonText(result)}（http ${result.status}）${note}${why}${stamp}。${body}`, hostErrorCode(result.kind));
 			return;
 		}

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型（国内版与国际版）接入 DeepSeek Harness：每次刷新按上游目录自动读取每个模型的积分倍率，支持逐模型图片输入开关、多账号切换与账号池自动换号，并提供每日签到、卡片与输入框里的胶囊积分读数等只读积分概览。",
-  "version": "4.14.1",
+  "version": "4.15.1",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",