dsh-connect-workbuddy 4.14.1 → 5.0.0

package/lib/{host-heartbeat-D1WnqQY2.js → host-heartbeat-D313ENPV.js}

@@ -1026,6 +1026,269 @@ function imageDefaultFor(info) {
 	if (info.supportsImages === false) return false;
 	return NATIVE_MODALITY_BY_MODEL_ID[info.id] === "multimodal";
 }
+/** Everything the app treats as a queue condition (`isQueueError`). */
+const WORKBUDDY_QUEUE_CODES = [
+	6020,
+	6021,
+	6022
+];
+/** The app's default when the upstream sends no `retry_after` (`?? 5`). */
+const WORKBUDDY_QUEUE_DEFAULT_RETRY_SEC = 5;
+/** True when a business code is one of the app's three queue codes. */
+function isQueueCode(value) {
+	return typeof value === "number" && WORKBUDDY_QUEUE_CODES.includes(value);
+}
+/** Read one queue condition out of a `data`-shaped object, or `undefined`. */
+function reportFrom(code, data) {
+	if (!isQueueCode(code)) return void 0;
+	const body = typeof data === "object" && data !== null ? data : {};
+	const numberField = (key) => typeof body[key] === "number" && Number.isFinite(body[key]) ? body[key] : void 0;
+	const position = numberField("queue_position");
+	const size = numberField("queue_size");
+	const retryAfter = numberField("retry_after");
+	return {
+		code,
+		...position === void 0 ? {} : { position },
+		...size === void 0 ? {} : { size },
+		retryAfterSec: retryAfter !== void 0 && retryAfter > 0 ? retryAfter : WORKBUDDY_QUEUE_DEFAULT_RETRY_SEC
+	};
+}
+/**
+* Read a queue condition out of one upstream body.
+*
+* Three shapes are accepted, because the gateway wraps the same fact three ways
+* depending on which channel answered:
+*
+*   1. the chat endpoint's own error envelope — `{"code":6020,"data":{…}}`;
+*   2. the app's agent-protocol envelope, where the condition rides as a JSON
+*      STRING inside `_meta['codebuddy.ai/errorMessage']`
+*      (`{"code":6020,"data":{…},"message":"…"}` — see the app's
+*      `extractQueueInfoFromPromptResult`);
+*   3. a nested `data.code`, for a gateway that wraps one envelope in another.
+*
+* Anything else — a 14003 throttle, a quota refusal, a 500 — is NOT a queue and
+* returns `undefined`, so this can sit in the error path without changing it.
+*/
+function parseQueueAnswer(text) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return;
+	}
+	const direct = readEnvelope$1(parsed);
+	if (direct !== void 0) return direct;
+	if (typeof parsed === "object" && parsed !== null) {
+		const meta = parsed["_meta"];
+		if (typeof meta === "object" && meta !== null) {
+			const message = meta["codebuddy.ai/errorMessage"];
+			if (typeof message === "string") try {
+				return readEnvelope$1(JSON.parse(message));
+			} catch {
+				return;
+			}
+		}
+	}
+}
+/** `{code, data}` at the top level, or one `data` level down. */
+function readEnvelope$1(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const envelope = value;
+	const top = reportFrom(envelope["code"], envelope["data"]);
+	if (top !== void 0) return top;
+	const data = envelope["data"];
+	if (typeof data === "object" && data !== null) {
+		const inner = data;
+		return reportFrom(inner["code"], inner["data"] ?? inner);
+	}
+}
+/**
+* The sentence a queue condition is reported with — the app's own vocabulary
+* ("排队", "位"), and never the upstream's untranslated `message` key.
+*
+* `waiting` names both numbers because they answer different questions: the
+* POSITION is how long the wait is, the SIZE is whether it is moving at all.
+*/
+function queueNoticeText(report) {
+	if (report.code === 6020) return `模型排队中：你排在第 ${report.position === void 0 ? "未知" : `${report.position}`} 位${report.size === void 0 ? "" : `，队列共 ${report.size} 个请求`}；约 ${report.retryAfterSec} 秒后自动重试`;
+	if (report.code === 6021) return `模型队列已满${report.size === void 0 ? "" : `（共 ${report.size} 个请求排队）`}，现在无法排队；请稍后重试或换一个模型`;
+	return `你的排队任务已达上限${report.size === void 0 ? "" : `（共 ${report.size} 个请求排队）`}，请等待已排队请求完成后再试`;
+}
+//#endregion
+//#region src/image-gen.ts
+/**
+* WorkBuddy 生图的纯逻辑层：媒体模型筛选、请求体构造、响应解析、失败描述。
+*
+* 这一层刻意不做任何网络 I/O、不引用宿主的任何包。`src/upstream.ts` 会被
+* `src/bin.ts` 静态可达（见 tests/host-peers.spec.ts 对 lib/bin.js 可达图的断言：
+* 除 `node:` 外不得出现任何裸说明符），所以任何被它引用的模块都必须保持零外部依赖。
+*
+* 上游契约照抄官方 CLI `codebuddy-lite-wb.mjs` 的 ImageService（实测 2026-10-21，
+* 国内区 `copilot.tencent.com` 与 `www.workbuddy.cn` 两个入口逐字段同答）：
+*
+*   POST {endpoint}/v2/images/generations
+*   body = { model, prompt, size, ...按 model 前缀分支的字段 }
+*   resp = { code, msg, request_id?, data: { created, data: [{ url } | { b64_json }],
+*            usage: { credit } } }
+*
+* 前缀分支（`buildBaseRequestBody` 原文行为）：
+*   - `hunyuan-*`：额外只带 `n`（默认 1）/ `footnote` / `revise`
+*   - `gemini-*`  ：什么都不加
+*   - 其它        ：`response_format: 'b64_json'` + 可选 `n` / `quality` / `style` / `background`
+*
+* 国内区产品配置里带 `text-to-image` 标签的只有 `hunyuan-image-alpha`，
+* 带 `image-to-image` 的只有 `hunyuan-image-alpha-edit`，因此实际走的就是
+* hunyuan 分支、响应里是 COS 签名 URL（24h 有效），单张约 5.71 credits。
+*
+* @module dsh-connect-workbuddy/image-gen
+*/
+/** 产品配置里「文生图」模型的标签。 */
+const IMAGE_TAG_TEXT_TO_IMAGE = "text-to-image";
+/** 官方 CLI 的默认尺寸。 */
+const DEFAULT_IMAGE_SIZE = "1024x1024";
+/** 生图路由。 */
+const IMAGE_GENERATIONS_PATH = "/v2/images/generations";
+/** 生图链路的错误。带一个稳定的 `code`，避免调用方去匹配文案。 */
+var WorkBuddyImageError = class extends Error {
+	code;
+	constructor(message, code) {
+		super(message);
+		this.name = "WorkBuddyImageError";
+		this.code = code;
+	}
+};
+function asString(value) {
+	return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function stringList(value) {
+	if (!Array.isArray(value)) return [];
+	const out = [];
+	for (const item of value) {
+		const text = asString(item);
+		if (text !== void 0) out.push(text);
+	}
+	return out;
+}
+/**
+* 从产品配置的 `data.models` 里挑出带指定 tag 的媒体模型。
+*
+* 去重按 `id`：上游目录里同一个 id 只应出现一次，但目录是外部数据，
+* 重复条目不该让卡片或工具参数里出现两个同名选项。
+*/
+function selectMediaModels(rawModels, tag = IMAGE_TAG_TEXT_TO_IMAGE) {
+	if (!Array.isArray(rawModels)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of rawModels) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		const id = asString(record["id"]);
+		if (id === void 0 || seen.has(id)) continue;
+		const tags = stringList(record["tags"]);
+		if (!tags.includes(tag)) continue;
+		seen.add(id);
+		out.push({
+			id,
+			name: asString(record["name"]) ?? id,
+			tags
+		});
+	}
+	return out;
+}
+/**
+* 选出生图模型：优先用调用方点名的那个，否则用目录里的第一个。
+*
+* 点名的模型必须在目录里——不在目录里就直接报错，而不是把它发上去让上游
+* 回一个「route config not found」。这样报错信息能指出真正的问题（模型名写错
+* 或该区没有这个模型），而不是一句上游 404。
+*/
+function pickImageModel(models, requested) {
+	if (requested !== void 0 && requested !== "") {
+		const found = models.find((model) => model.id === requested);
+		if (found === void 0) {
+			const known = models.map((model) => model.id).join(", ");
+			throw new WorkBuddyImageError(`workbuddy image: 目录里没有生图模型「${requested}」。可用：${known === "" ? "（空）" : known}`, "NO_IMAGE_MODEL");
+		}
+		return found;
+	}
+	const first = models[0];
+	if (first === void 0) throw new WorkBuddyImageError("workbuddy image: 该区账号的产品配置里没有任何带 text-to-image 标签的模型。国内区应有 hunyuan-image-alpha；国际区当前没有生图模型。", "NO_IMAGE_MODEL");
+	return first;
+}
+/** 按官方 CLI 的 `buildBaseRequestBody` 分支规则拼请求体。 */
+function buildImageBody(request) {
+	const model = request.model;
+	const body = {
+		model,
+		prompt: request.prompt,
+		size: request.size ?? "1024x1024"
+	};
+	if (model.startsWith("hunyuan-")) {
+		body["n"] = request.n ?? 1;
+		return body;
+	}
+	if (model.startsWith("gemini-")) return body;
+	body["response_format"] = "b64_json";
+	if (request.n !== void 0) body["n"] = request.n;
+	return body;
+}
+/**
+* 解析生图响应。
+*
+* 信封是 `{code, msg, request_id, data}`；`code !== 0` 是业务失败（与 HTTP 状态
+* 无关，上游可能 HTTP 200 但 code 非 0）。`data.data` 是数组，元素要么带 `url`
+* 要么带 `b64_json`；`data.usage.credit` 是本次实际扣的积分。
+*/
+function parseImageResponse(payload) {
+	if (typeof payload !== "object" || payload === null) throw new WorkBuddyImageError("workbuddy image: 上游返回的不是 JSON 对象", "UPSTREAM");
+	const envelope = payload;
+	const code = typeof envelope["code"] === "number" ? envelope["code"] : void 0;
+	if (code !== void 0 && code !== 0) {
+		const message = asString(envelope["msg"]) ?? "unknown error";
+		const requestId = asString(envelope["request_id"]);
+		throw new WorkBuddyImageError(`workbuddy image: 上游拒绝（code ${code}）: ${message}` + (requestId === void 0 ? "" : `（request_id ${requestId}）`), "UPSTREAM");
+	}
+	const data = envelope["data"];
+	if (typeof data !== "object" || data === null) throw new WorkBuddyImageError("workbuddy image: 响应缺少 data 字段", "UPSTREAM");
+	const record = data;
+	const items = Array.isArray(record["data"]) ? record["data"] : [];
+	const first = items.length > 0 ? items[0] : void 0;
+	let url;
+	let b64;
+	if (typeof first === "object" && first !== null) {
+		const item = first;
+		url = asString(item["url"]);
+		b64 = asString(item["b64_json"]);
+	}
+	if (url === void 0 && b64 === void 0) throw new WorkBuddyImageError("workbuddy image: 上游返回成功但 data.data 里既没有 url 也没有 b64_json", "EMPTY_RESULT");
+	const usage = typeof record["usage"] === "object" && record["usage"] !== null ? record["usage"] : {};
+	const credit = typeof usage["credit"] === "number" && Number.isFinite(usage["credit"]) ? usage["credit"] : void 0;
+	const created = typeof record["created"] === "number" ? record["created"] : void 0;
+	return {
+		...url === void 0 ? {} : { url },
+		...b64 === void 0 ? {} : { b64 },
+		...created === void 0 ? {} : { created },
+		...credit === void 0 ? {} : { credit }
+	};
+}
+/** 把一次非 2xx 的响应翻成带 `code` 的错误，好让上层决定怎么提示。 */
+function describeImageFailure(status, bodyText) {
+	const text = bodyText.trim();
+	let detail = text.slice(0, 240);
+	if (text.startsWith("{")) try {
+		const parsed = JSON.parse(text);
+		if (typeof parsed === "object" && parsed !== null) {
+			const record = parsed;
+			const message = asString(record["msg"]);
+			const code = typeof record["code"] === "number" ? record["code"] : void 0;
+			if (message !== void 0) detail = code === void 0 ? message : `code ${code}: ${message}`;
+		}
+	} catch {}
+	if (status === 401 || status === 403) return new WorkBuddyImageError(`workbuddy image: 凭据被上游拒绝（HTTP ${status}），请在插件设置里重新登录 WorkBuddy。${detail === "" ? "" : ` ${detail}`}`, "AUTH");
+	if (status === 429) return new WorkBuddyImageError(`workbuddy image: 触发上游限流（HTTP 429），稍后再试。${detail === "" ? "" : ` ${detail}`}`, "RATE_LIMIT");
+	if (status === 404) return new WorkBuddyImageError(`workbuddy image: 上游没有这条生图路由（HTTP 404）。全球区没有生图模型，请用国内区账号。${detail === "" ? "" : ` ${detail}`}`, "NO_ROUTE");
+	return new WorkBuddyImageError(`workbuddy image: 上游失败（HTTP ${status}）${detail === "" ? "" : `: ${detail}`}`, "UPSTREAM");
+}
 //#endregion
 //#region src/off-thinking.ts
 /**
@@ -1353,6 +1616,126 @@ function attachPromos(models, promos) {
 	});
 }
 //#endregion
+//#region src/busy.ts
+/** The upstream's enum, in the order its own bundle declares it. */
+const WORKBUDDY_BUSY_LEVELS = [
+	"idle",
+	"normal",
+	"busy",
+	"congested",
+	"unavailable",
+	"unknown"
+];
+/** Coerce one `busy_level` value; everything the enum does not name is `unknown`. */
+function normalizeBusyLevel(value) {
+	return typeof value === "string" && WORKBUDDY_BUSY_LEVELS.includes(value) ? value : "unknown";
+}
+/**
+* Read one probe answer into a model-id → level map.
+*
+* Tolerant by design: an entry that is not an object, or that names no model, is
+* skipped; a level the enum does not know becomes `unknown` rather than being
+* dropped, because "the upstream answered about this model but said something
+* we do not understand" is still a fact about that model.
+*/
+function parseBusyLevels(entries) {
+	const levels = /* @__PURE__ */ new Map();
+	for (const entry of Array.isArray(entries) ? entries : []) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const raw = entry;
+		const id = typeof raw["model"] === "string" ? raw["model"] : "";
+		if (id === "") continue;
+		levels.set(id, normalizeBusyLevel(raw["busy_level"]));
+	}
+	return levels;
+}
+/**
+* Split ids into probe-sized batches, de-duplicated and order-preserving.
+*
+* De-duplication matters: the roster the plugin sends is the `cli` agent's
+* roster PLUS the user's kept ids, so the same id can legitimately appear twice,
+* and the upstream counts what it is asked for.
+*/
+function batchModelIds(ids, size = 50) {
+	const unique = [...new Set(ids.filter((id) => id !== ""))];
+	const batches = [];
+	for (let index = 0; index < unique.length; index += size) batches.push(unique.slice(index, index + size));
+	return batches;
+}
+/** The app's own Chinese wording, per level. `normal` and `unknown` have none. */
+const BUSY_LABELS_ZH = {
+	idle: "空闲",
+	busy: "轻微拥堵",
+	congested: "极度拥堵",
+	unavailable: "不可用"
+};
+/** The app's own English wording, per level. */
+const BUSY_LABELS_EN = {
+	idle: "Idle",
+	busy: "Slightly congested",
+	congested: "Extremely congested",
+	unavailable: "Unavailable"
+};
+/**
+* The word this level is drawn with, or `undefined` when it is not worth drawing.
+*
+* `normal` returns `undefined` on purpose: the app's selector shows a busy line
+* only for a level that differs from the healthy default, and a badge that reads
+* "正常" on fifteen rows out of twenty is noise, not information. `unknown`
+* returns `undefined` for the same reason plus one more — the plugin must not
+* invent a claim the upstream never made.
+*/
+function busyLabel(level, locale = "zh") {
+	return (locale === "en" ? BUSY_LABELS_EN : BUSY_LABELS_ZH)[level];
+}
+/**
+* Suffix appended to a model's DSH-facing display name, prefixed with a middle
+* dot, or `''` when the level is not worth drawing.
+*
+* This is the "badge to the RIGHT of the model name" the DSH model selector
+* already does for its own variants (`deepseek-v4.1-flash · 1017`): DSH renders
+* `name` verbatim and offers no separate badge slot to a provider, so the only
+* way to put load beside the name — instead of in a second line, or inside the
+* name — is to extend the name. The name stays display-only: every DSH-side join
+* keys on the model ID, and `workBuddyDisplayName` is the single place that
+* builds it.
+*
+* ONLY A LEVEL THAT ASKS FOR A DECISION IS DRAWN — `busy`, `congested`,
+* `unavailable`. `idle` deliberately gets no suffix here even though it has a
+* word: on the measured CN roster seven of twenty models are idle, and a picker
+* whose every row carries a badge reads as decoration rather than as a warning.
+* That is also how the app's own selector behaves in its compact mode, where only
+* `congested` is drawn at all. The card's detail panel is where the full scale
+* belongs.
+*/
+function busyDisplaySuffix(level, locale = "zh") {
+	if (level === void 0 || !DRAWN_IN_PICKER.has(level)) return "";
+	const label = busyLabel(level, locale);
+	return label === void 0 ? "" : ` · ${label}`;
+}
+/** The levels that change a model-picking decision; see {@link busyDisplaySuffix}. */
+const DRAWN_IN_PICKER = /* @__PURE__ */ new Set([
+	"busy",
+	"congested",
+	"unavailable"
+]);
+/**
+* Attach each model's level to its catalog entry.
+*
+* A model the probe did not answer for keeps whatever it had — which, for a
+* freshly discovered roster, is nothing. Models are copied, never mutated: the
+* catalog entry is shared with the settings card's saved snapshot.
+*/
+function attachBusyLevels(models, levels) {
+	return models.map((model) => {
+		const level = levels.get(model.id);
+		return level === void 0 || level === model.busyLevel ? model : {
+			...model,
+			busyLevel: level
+		};
+	});
+}
+//#endregion
 //#region src/upstream.ts
 /**
 * WorkBuddy (CodeBuddy / copilot.tencent.com) upstream client: chat streaming,
@@ -1429,6 +1812,22 @@ const MODELS_CATALOG_PATH = "/v2/enterprises/personal/models";
 */
 const GLOBAL_CONFIG_PATH = "/v3/config";
 /**
+* The app's model-load probe (see `src/busy.ts`), read-only and free.
+*
+* Not part of any catalog document: this endpoint answers ONE fact per model id
+* — how busy it is right now — and answers it for up to 50 ids at a time. It is
+* host- and identity-insensitive on the CN side (measured 2026-10-21 on all
+* three CN hosts, under both the CLI and the app user agent: byte-identical),
+* so it is asked as the chat channel's own identity.
+*/
+const MODEL_BUSY_PATH = "/v2/chat/busy";
+/**
+* The app's own ceiling for one probe (`timeout: 5e3` in its
+* `useModelBusyLevels`). Short on purpose: a slow load probe is worth less than
+* the refresh it is attached to, and the catalog must not wait on it.
+*/
+const MODEL_BUSY_TIMEOUT_MS = 5e3;
+/**
 * The chat channel's user agent — the identity the plugin's adapter speaks as.
 *
 * Chat is a different contract from configuration: the conversation-identity
@@ -1492,6 +1891,15 @@ const ERROR_BODY_LIMIT = 4096;
 */
 const PROBE_TIMEOUT_MS = 1e4;
 /**
+* 生图请求的超时。
+*
+* 实测一张 1024x1024 的图在官方网关要 17–39 秒（`hunyuan-image-alpha`，
+* 2026-10-21，两个国内入口各测一次），比任何 JSON 接口都慢一个数量级，
+* 因此不能复用 {@link JSON_TIMEOUT_MS}。三分钟足够覆盖一次正常的排队+推理，
+* 又不至于让一个卡死的连接占住工具槽位太久。
+*/
+const IMAGE_TIMEOUT_MS = 18e4;
+/**
 * Insufficient-credit markers.
 *
 * ENGLISH IS MATCHED CASE-INSENSITIVELY (see {@link classifyUpstreamError}) so
@@ -1598,8 +2006,15 @@ const CHANNEL_REJECT_MARKERS = ["unapproved channel", "illegal api invocation"];
 * be read as the prompt rule: a confidently wrong diagnosis is worse here than
 * the generic `client` reply, because it sends the user to rewrite a system
 * prompt that is not at fault.
+*
+* Each is also exported as its own predicate ({@link isConversationIdGateBody},
+* {@link isFirstMessageGateBody}) so the reply can NAME the gate instead of
+* relaying the upstream's `displayTips` — which is the SAME misleading
+* sentence for all three members of the `11128` family.
 */
-const OTHER_CHANNEL_CODE_GATES = ["conversation id missing", "first message is not system prompt"];
+const CONVERSATION_ID_GATE_MARKER = "conversation id missing";
+const FIRST_MESSAGE_GATE_MARKER = "first message is not system prompt";
+const OTHER_CHANNEL_CODE_GATES = [CONVERSATION_ID_GATE_MARKER, FIRST_MESSAGE_GATE_MARKER];
 /**
 * Whether a failure body is the MODEL-scoped throttle rather than an account
 * limit.
@@ -1637,52 +2052,57 @@ function isChannelRejectBody(body) {
 	return CHANNEL_REJECT_MARKERS.some((marker) => lower.includes(marker));
 }
 /**
-* The OPENINGS of the `system` messages in a prepared request body.
+* Whether a failure body is the CONVERSATION-ID gate (`11128`).
 *
-* This is the evidence the channel gate actually reacts to, and echoing it is
-* what turns "the upstream refused" into "the upstream refused because of this
-* line" — the reader can then fix the prompt or report the new opening, instead
-* of cycling accounts that cannot change a byte of it.
+* One of the two gates that share the channel gate's business code, and one
+* of the two this plugin's diagnosis EXCLUDES: the prompt is not at fault
+* here, the request headers are — which is why it must never be reported as
+* "the gateway refused your system prompt".
 *
-* Each entry is the first non-empty line, clipped: a fingerprint lives at the
-* START of the content, so the rest of a 10 KB system prompt is noise that
-* would bury the one sentence worth reading. At most three entries are kept —
-* the gate scans every `system` message, but a body with more than three of them
-* is already worth showing compactly.
+* It is exported anyway, so a reply can NAME it. The upstream's `displayTips`
+* for all three `11128` gates is the identical sentence ("这次调用没通过渠道
+* 校验，可能不是官方客户端发出的"), so the tips cannot tell them apart — only
+* `msg` can. Hence the wording is the criterion and the code is the
+* corroboration, never the other way round.
 *
-* Never throws: a malformed body is the upstream's to reject, and losing the
-* failure measurement is not an acceptable price for reading an excerpt.
+* BOTH halves are required, and the code is matched in its quoted-key form
+* (`"code":11128`): a request id is hexadecimal and can contain the digits
+* `11128` by coincidence, and a bare substring search over an arbitrary
+* failure body is how a red herring gets promoted into a diagnosis.
 */
-function systemOpeningsOfBody(bodyJson) {
-	let parsed;
-	try {
-		parsed = JSON.parse(bodyJson);
-	} catch {
-		return [];
-	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return [];
-	const messages = parsed["messages"];
-	if (!Array.isArray(messages)) return [];
-	const openings = [];
-	for (const value of messages) {
-		if (openings.length >= 3) break;
-		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
-		const message = value;
-		const role = message["role"];
-		if (typeof role !== "string" || role.trim().toLowerCase() !== "system") continue;
-		const content = message["content"];
-		if (typeof content !== "string") continue;
-		const opening = firstLineOf(content).replace(/\s+/gu, " ").trim();
-		if (opening !== "") openings.push(clip(opening, SYSTEM_OPENING_LIMIT));
-	}
-	return openings;
+function isConversationIdGateBody(body) {
+	const lower = body.toLowerCase();
+	return lower.includes(CHANNEL_REJECT_CODE) && lower.includes(CONVERSATION_ID_GATE_MARKER);
 }
+/**
+* Whether a failure body is the FIRST-MESSAGE gate (`11128`).
+*
+* The global gateway's own rule: a chat request must OPEN with a system
+* message, and a user-first body is refused with `11128` / "first message is
+* not system prompt". The plugin's `ensureSystemHead()` satisfies it, so a
+* body carrying this wording says the request never had a system head — not
+* that a system prompt was fingerprinted.
+*
+* Excluded from the prompt diagnosis for the same reason as
+* {@link isConversationIdGateBody}, and named by the same rule: the CODE plus
+* the WORDING, case-insensitively, code in its quoted-key form.
+*/
+function isFirstMessageGateBody(body) {
+	const lower = body.toLowerCase();
+	return lower.includes(CHANNEL_REJECT_CODE) && lower.includes(FIRST_MESSAGE_GATE_MARKER);
+}
+/**
+* The OPENINGS of the `system` messages in a prepared request body.
+*
+* REMOVED in favour of {@link systemOpeningEvidenceOfBody}, which answers the
+* same question ("what did the gate actually see?") for BOTH string and
+* array-shaped content and can also say whether an opening is the plugin's own
+* neutral head. Two functions that both claim to describe what the gate read
+* are two truths that drift — and the array-shaped case is exactly where the
+* old one was blind.
+*/
 /** Longest system-prompt opening echoed back to the user, in characters. */
 const SYSTEM_OPENING_LIMIT = 120;
-function firstLineOf(content) {
-	const newline = content.indexOf("\n");
-	return newline === -1 ? content : content.slice(0, newline);
-}
 function clip(text, limit) {
 	return text.length <= limit ? text : `${text.slice(0, limit - 1)}…`;
 }
@@ -1696,6 +2116,7 @@ function classifyUpstreamError(status, body) {
 	for (const marker of POLICY_REJECT_MARKERS) if (body.includes(marker)) return "policy_reject";
 	if (isChannelRejectBody(body)) return "channel_reject";
 	if (isModelBusyBody(body)) return "model_busy";
+	if (parseQueueAnswer(body) !== void 0) return "model_queue";
 	if (status === 429) return "soft_rate";
 	if (status === 404) return "not_found";
 	if (status >= 500) return "server";
@@ -1923,6 +2344,31 @@ function billingHeaders(credential) {
 	return headers;
 }
 /**
+* 生图请求头。
+*
+* 实测口径（2026-10-21，国内区）：`Authorization: Bearer` + `X-Product: SaaS` +
+* 用户/企业/域三连 + 会话身份三连 + `PRODUCT_UA`，在 `copilot.tencent.com` 与
+* `www.workbuddy.cn` 两个入口都返回 200。刻意**不带** `Origin` / `Referer`：
+* 探针当时没带，带了只是多一个可能被网关拒掉的变量，没有收益。
+*
+* 复用 {@link conversationHeaders}：官方 CLI 的 ImageService 也是每次现生成
+* 一组会话 UUID，且两个区走同一条代码路径（见该函数的注释）。
+*/
+function imageHeaders(credential) {
+	return {
+		"Authorization": `Bearer ${credential.accessToken}`,
+		"Accept": "application/json, text/plain, */*",
+		"Content-Type": "application/json",
+		"User-Agent": PRODUCT_UA,
+		"X-Product": "SaaS",
+		"X-Requested-With": "XMLHttpRequest",
+		...credential.uid === "" ? { "X-No-User-Id": "1" } : { "X-User-Id": credential.uid },
+		...credential.enterpriseId === void 0 || credential.enterpriseId === "" ? { "X-No-Enterprise-Id": "1" } : { "X-Enterprise-Id": credential.enterpriseId },
+		...credential.domain === "" ? { "X-No-Department-Info": "1" } : { "X-Domain": credential.domain },
+		...conversationHeaders()
+	};
+}
+/**
 * Stand-in system message for a request that reached the wire carrying none.
 *
 * Not a stylistic default: both WorkBuddy gateways want the conversation to
@@ -1980,31 +2426,389 @@ const WORKBUDDY_FALLBACK_SYSTEM_PROMPT = "You are a helpful assistant.";
 * snapshot, not a theory of what the gate "means"; a gateway adding a new
 * opening is not caught until a body carries one, and the prepend only wins
 * while the gate keeps matching at offset 0.
+*
+* THE LIST CANNOT BE COMPLETE, AND THAT IS WHY {@link forceNeutralHead}
+* EXISTS. This is a snapshot of the upstream's own list, taken by measuring
+* openings one at a time; the upstream can extend it at any time and the
+* plugin cannot see it. So the plugin's own prepend is a best-effort filter,
+* not a guarantee — and the self-healing retry is what covers the openings
+* nobody has measured yet.
 */
 const UNAPPROVED_CHANNEL_OPENINGS = ["you are an ai agent powered by deepseek harness", "you are claude code, anthropic's official cli for claude"];
 /**
-* Move every `system` message off the content fingerprint above by prepending
-* the placeholder head.
+* Whether this text OPENS with an opening the gateways refuse.
+*
+* The gate is a PREFIX match on the START of a `system` message, so this is
+* the one predicate that decides it — used by the request path (which prepends
+* the neutral head on a hit) and by the failure path (which names the
+* offending line).
+*
+* THREE MEASURED RULES are folded in here, all from the live CN gateway on
+* 2026-10-21 (account `ba217455…`, `deepseek-v4.1-flash`, every other request
+* field held fixed):
+*
+*   1. Only the START counts — the same sentence mid-content answers 200.
+*   2. LEADING WHITESPACE is trimmed before the comparison — " <banned>" and
+*      "\n<banned>" both answer 200 today.
+*   3. The comparison is CASE-INSENSITIVE — the lower-cased sentence fails too.
+*
+* (2) is a gift that can be withdrawn, so the comparison is made the way a
+* trimming gate would make it even while the gateway is lenient: a rule that
+* only holds while the gateway forgets to trim is a rule waiting to break.
+*
+* The list itself stays the measured snapshot. It is deliberately NOT
+* extended by guesswork: an opening nobody measured is an opening nobody knows
+* the gateway refuses, and inventing entries would neutralise prompts that
+* answer 200 today.
+*/
+function isUnapprovedChannelOpening(text) {
+	const opening = text.replace(/^\s+/u, "").toLowerCase();
+	return UNAPPROVED_CHANNEL_OPENINGS.some((prefix) => opening.startsWith(prefix));
+}
+/**
+* Whether this text already begins with the plugin's own neutral head.
 *
-* A no-op for a body with no system message and for every system message whose
-* content starts with anything else, so a request that the gateways already
-* answer keeps its prompt byte-for-byte — only the messages the gate would
-* refuse grow, by one short line.
+* The question the failure path has to answer per system message: "is the
+* line the gateway refused OURS, or the HOST's?" — the plugin's head is the
+* one line it has ever added to a prompt, so it is the only opening that
+* cannot be a third-party-agent fingerprint.
+*/
+function startsWithNeutralHead(text) {
+	return text.replace(/^\s+/u, "").toLowerCase().startsWith(WORKBUDDY_FALLBACK_SYSTEM_PROMPT.toLowerCase());
+}
+/**
+* The roles whose message OPENINGS the gateway scans.
+*
+* MEASURED on the live CN gateway (2026-10-21, every other request field held
+* fixed): `system` and `assistant` are scanned; `user` and `tool` are not (a
+* body whose `user` or `tool` content opens with the banned identity answers
+* 200). That second role is the one the plugin missed until 4.15.0, and it is
+* why issue #98's sessions stayed broken: an `assistant` history message that
+* opens with the fingerprint poisons EVERY later turn of that session, on
+* every account and in every region.
+*
+* `developer` is not listed because `prepareChatBody` rewrites it to `system`
+* before this module looks at the body — and because both gateways refuse
+* `developer` outright, so neutralising its content would not save the request.
+*/
+function scansOpening(role) {
+	if (typeof role !== "string") return false;
+	const name = role.trim().toLowerCase();
+	return name === "system" || name === "assistant";
+}
+/**
+* Move every scanned message (`system` and `assistant`) off the content
+* fingerprint above by prepending the placeholder head.
+*
+* A no-op for a body whose messages start with anything else, so a request the
+* gateways already answer keeps its prompt byte-for-byte — only the messages
+* the gate would refuse grow, by one short line.
+*
+* BOTH ROLES, because the gate reads both. Until 4.15.0 this only handled
+* `system`, and the failure that left behind is issue #98: a conversation
+* whose HISTORY contains an assistant message opening with the banned identity
+* (the model echoing its own prompt, a restored session, a compaction
+* artefact) was refused on every single turn, and no account or region could
+* change a byte of it.
+*
+* ARRAY CONTENT IS HANDLED PART BY PART, and that is not a nicety. Measured on
+* the live CN gateway (2026-10-21): when a scanned message's `content` is an
+* array of parts, the gate reads EVERY TEXT PART of it — a banned opening in
+* the FIRST part is refused, and a banned opening in the SECOND part is
+* refused just the same. Prepending to the first part only would therefore
+* fix the first half of the failure and leave the second half to the users who
+* report it again.
 */
 function neutralizeChannelFingerprints(obj) {
 	const messages = obj["messages"];
 	if (!Array.isArray(messages)) return;
 	for (const value of messages) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+		const message = value;
+		if (!scansOpening(message["role"])) continue;
+		const content = message["content"];
+		if (typeof content === "string") {
+			if (!isUnapprovedChannelOpening(content)) continue;
+			message["content"] = `${WORKBUDDY_FALLBACK_SYSTEM_PROMPT}\n\n${content}`;
+			continue;
+		}
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
+			const record = part;
+			const type = record["type"];
+			if (typeof type !== "string" || type.trim().toLowerCase() !== "text") continue;
+			const text = record["text"];
+			if (typeof text !== "string" || !isUnapprovedChannelOpening(text)) continue;
+			record["text"] = `${WORKBUDDY_FALLBACK_SYSTEM_PROMPT}\n\n${text}`;
+		}
+	}
+}
+/**
+* A body in which EVERY scanned opening (`system` and `assistant`) is moved
+* behind the neutral head.
+*
+* THE ONE-SHOT SELF-HEALING RETRY'S BODY BUILDER. The gateway's fingerprint
+* list is a SNAPSHOT the upstream can extend at any time, and the plugin
+* cannot see it: the two entries in {@link UNAPPROVED_CHANNEL_OPENINGS} are
+* what was MEASURED on 2026-10-21, not a contract. So the day the gateway
+* adds an entry, this plugin's own prepend stops matching and the banned
+* opening goes out on the wire unchanged — exactly the dead end issue #98
+* describes, and exactly what a longer guess-list cannot prevent (nobody can
+* measure the next entry before it bites).
+*
+* The remedy is a second attempt that does not depend on knowing the
+* fingerprint at all: this builds a body in which EVERY scanned message,
+* whatever it opens with, gets the neutral head in front. The gateway matches
+* the START of a scanned message, so a neutral first line moves the whole
+* opening out of the matched region — whether the banned text is a known
+* entry, a new one, or a fingerprint this plugin has never heard of.
+*
+* `assistant` messages are included for the measured reason
+* {@link neutralizeChannelFingerprints} documents: a history message that opens
+* with a refused identity is what keeps a whole session failing, so a retry
+* that only moved the system prompt would spend a request to be refused for the
+* same reason.
+*
+* WHEN IT IS USED: only AFTER the gateway refused the first attempt with the
+* channel gate. A request the gateway already answers keeps its bytes
+* unchanged, because this function is never called for it — the normal path
+* is {@link prepareChatBody}, which only touches the openings it has MEASURED
+* as fingerprinted.
+*
+* `undefined` means "this body cannot change": every scanned opening already
+* starts with the neutral head, so a retry would send the same bytes and
+* spend a request for the same refusal. The caller uses that to avoid
+* spending the round trip.
+*
+* Empty contents are skipped: an empty string cannot open with anything, so it
+* cannot be the culprit, and an assistant message that carries `tool_calls`
+* with `content: ""` is a replay shape this function has no reason to touch.
+*
+* Never throws. A body it cannot read is the upstream's to reject, and a
+* parse error must not turn a retry into a crash.
+*/
+function forceNeutralHead(bodyJson) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyJson);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const obj = parsed;
+	const messages = obj["messages"];
+	if (!Array.isArray(messages)) return void 0;
+	let changed = false;
+	for (const value of messages) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+		const message = value;
+		if (!scansOpening(message["role"])) continue;
+		const content = message["content"];
+		if (typeof content === "string") {
+			if (content.trim() === "" || startsWithNeutralHead(content)) continue;
+			message["content"] = `${WORKBUDDY_FALLBACK_SYSTEM_PROMPT}\n\n${content}`;
+			changed = true;
+			continue;
+		}
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
+			const record = part;
+			const type = record["type"];
+			if (typeof type !== "string" || type.trim().toLowerCase() !== "text") continue;
+			const text = record["text"];
+			if (typeof text !== "string" || text.trim() === "" || startsWithNeutralHead(text)) continue;
+			record["text"] = `${WORKBUDDY_FALLBACK_SYSTEM_PROMPT}\n\n${text}`;
+			changed = true;
+		}
+	}
+	if (!changed) return void 0;
+	return JSON.stringify(obj);
+}
+/**
+* The invisible character used to break a content fingerprint.
+*
+* U+200B ZERO WIDTH SPACE: it renders as nothing, it is not whitespace for the
+* gateway's own matching, and a model reads straight through it. Measured on
+* the live CN gateway: putting one inside the refused span turns 400 into 200,
+* while the text the model reads is unchanged.
+*/
+const ZERO_WIDTH_SPACE = "​";
+/**
+* A body whose scanned message TEXT is perturbed just enough to break an exact
+* content fingerprint.
+*
+* THE SECOND HALF OF ISSUE #98, found on 2026-10-21 after 4.15.0 shipped. The
+* gateway does not only match the OPENING of a scanned message; it also matches
+* one long substring INSIDE the system prompt. Measured byte-exactly on a real
+* failed request (CN gateway, `deepseek-v4.1-flash`, the host's own body):
+*
+*   - the refusal is reproducible, and it is not the opening: the plugin had
+*     already prepended the neutral head, and the request still answered 400;
+*   - bisecting the host's 10,956-character system prompt by lines and then by
+*     sentences found a 221-character span: the DSH Web-GUI paragraph's first
+*     two sentences ("You are interacting with the user through the DeepSeek
+*     Harness Web GUI … they mean this GUI.");
+*   - that span ALONE reproduces the 400, and the SAME span with ANY change
+*     inside it answers 200 — one character rewritten, one quoted word
+*     replaced, even a zero-width space inserted. An outer prefix or suffix
+*     does not help, so the match is an exact substring, not an opening rule;
+*   - the paragraph's individual sentences each answer 200, which is why the
+*     plugin's opening-based normalisation never saw this.
+*
+* SO THE RESCUE CANNOT BE "prepend a line" (that is {@link forceNeutralHead},
+* and it is a no-op here). Nor can it be a list of refused spans: the list is
+* the upstream's own data, it already grew once without notice, and it will
+* grow again. What DOES generalise is the observation that an exact-substring
+* match dies on any perturbation inside it — so this inserts a zero-width space
+* at every sentence and clause boundary of the scanned messages, which is
+* invisible to the reader, meaningless to the model, and inside the refused
+* span with near-certainty for any prose fingerprint.
+*
+* WHEN IT IS USED: only as the last retry, after the gateway already refused
+* the request AND the neutral head could not change anything. Requests the
+* gateway answers keep their bytes untouched.
+*
+* Idempotent: a body that already carries U+200B in a scanned message is left
+* alone, so a retry never stacks perturbations. Returns `undefined` when
+* nothing would change, which is the caller's signal not to spend a request.
+*
+* Never throws: a malformed body is the upstream's to reject, and a parse error
+* must not turn a rescue into a crash.
+*/
+function perturbChannelFingerprints(bodyJson) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyJson);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const obj = parsed;
+	const messages = obj["messages"];
+	if (!Array.isArray(messages)) return void 0;
+	let changed = false;
+	const perturb = (text) => {
+		if (text.includes(ZERO_WIDTH_SPACE)) return void 0;
+		const next = text.replace(/([.!?])(\s+)/gu, `$1${ZERO_WIDTH_SPACE}$2`).replace(/([。！？])/gu, `$1${ZERO_WIDTH_SPACE}`).replace(/([,;])(\s+)/gu, `$1${ZERO_WIDTH_SPACE}$2`);
+		return next === text ? void 0 : next;
+	};
+	for (const value of messages) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+		const message = value;
+		if (!scansOpening(message["role"])) continue;
+		const content = message["content"];
+		if (typeof content === "string") {
+			const next = perturb(content);
+			if (next !== void 0) {
+				message["content"] = next;
+				changed = true;
+			}
+			continue;
+		}
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
+			const record = part;
+			const type = record["type"];
+			if (typeof type !== "string" || type.trim().toLowerCase() !== "text") continue;
+			const text = record["text"];
+			if (typeof text !== "string") continue;
+			const next = perturb(text);
+			if (next !== void 0) {
+				record["text"] = next;
+				changed = true;
+			}
+		}
+	}
+	if (!changed) return void 0;
+	return JSON.stringify(obj);
+}
+/**
+* The openings of every scanned message in a body, one entry per TEXT PART.
+*
+* `system` AND `assistant`, because both are read by the gate (measured; see
+* {@link scansOpening}). `developer` counts as a system message because the
+* plugin rewrites `developer` → `system` on the wire.
+*
+* Array content contributes ONE ENTRY PER PART, for the same reason the request
+* path neutralises every part: the gate reads every text part, so "which line
+* tripped it" can be any of them.
+*
+* Capped at {@link SYSTEM_EVIDENCE_LIMIT} entries, and never throws — losing
+* the failure measurement is not an acceptable price for reading an excerpt.
+*/
+function openingEvidenceOfBody(bodyJson) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyJson);
+	} catch {
+		return [];
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return [];
+	const messages = parsed["messages"];
+	if (!Array.isArray(messages)) return [];
+	const evidence = [];
+	for (let index = 0; index < messages.length; index++) {
+		if (evidence.length >= SYSTEM_EVIDENCE_LIMIT) break;
+		const value = messages[index];
 		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
 		const message = value;
 		const role = message["role"];
-		if (typeof role !== "string" || role.trim().toLowerCase() !== "system") continue;
+		if (typeof role !== "string") continue;
+		const roleName = role.trim().toLowerCase();
+		if (roleName !== "system" && roleName !== "assistant" && roleName !== "developer") continue;
+		const roleOfEvidence = roleName === "assistant" ? "assistant" : "system";
 		const content = message["content"];
-		if (typeof content !== "string") continue;
-		const opening = content.replace(/^\s+/, "").toLowerCase();
-		if (!UNAPPROVED_CHANNEL_OPENINGS.some((prefix) => opening.startsWith(prefix))) continue;
-		message["content"] = `${WORKBUDDY_FALLBACK_SYSTEM_PROMPT}\n\n${content}`;
+		const texts = [];
+		if (typeof content === "string") texts.push(content);
+		else if (Array.isArray(content)) for (const part of content) {
+			if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
+			const record = part;
+			const type = record["type"];
+			if (typeof type !== "string" || type.trim().toLowerCase() !== "text") continue;
+			const text = record["text"];
+			if (typeof text === "string") texts.push(text);
+		}
+		for (const text of texts) {
+			if (evidence.length >= SYSTEM_EVIDENCE_LIMIT) break;
+			const opening = firstNonEmptyLineOf(text).replace(/\s+/gu, " ").trim();
+			if (opening === "") continue;
+			evidence.push({
+				opening: clip(opening, SYSTEM_OPENING_LIMIT),
+				role: roleOfEvidence,
+				neutralized: startsWithNeutralHead(opening) || isUnapprovedChannelOpening(opening),
+				messageIndex: index
+			});
+		}
 	}
+	return evidence;
+}
+/**
+* How many openings the failure path reports.
+*
+* Eight is generous: the gate scans every system message and every text part
+* of it, so a body with more than a handful of openings is not a prompt the
+* reader can act on anyway — the reply names the first ones and the failure
+* body carries the rest.
+*
+* The cap is HERE and not in the reply: this function reports everything it
+* found (up to eight) and the reply renders as many of them as fit, saying
+* how many were left out. Truncating the evidence before the reply sees it
+* would make "N more" unanswerable.
+*/
+const SYSTEM_EVIDENCE_LIMIT = 8;
+/**
+* The first line of a text that carries something.
+*
+* Blank lines are SKIPPED: the neutral head is followed by an empty line, so
+* the head itself is the line worth reporting, and a content that opens with
+* blank lines still has an opening.
+*/
+function firstNonEmptyLineOf(content) {
+	for (const line of content.split("\n")) if (line.trim() !== "") return line;
+	return "";
 }
 /**
 * Make the conversation open with a system message, prepending the fallback
@@ -2664,6 +3468,101 @@ var WorkBuddyUpstreamClient = class {
 			return await readCatalog(MODELS_CATALOG_PATH);
 		}
 	}
+	/**
+	* Read how busy each model is right now, from the upstream's own probe.
+	*
+	* Batched at the upstream's ceiling (`WORKBUDDY_BUSY_BATCH_SIZE`), because the
+	* probe takes a list of ids and answers only about the ids it was given.
+	*
+	* Throws on anything that is not a clean `code: 0`, like every other reader in
+	* this class — the CALLER decides that a failed load probe is survivable and
+	* catches it. Nothing here is persisted: the level belongs to the refresh that
+	* asked for it.
+	*/
+	async fetchModelBusy(credential, modelIds, signal) {
+		const levels = /* @__PURE__ */ new Map();
+		for (const batch of batchModelIds(modelIds)) {
+			const response = await fetch(`${chatBase(credential)}${MODEL_BUSY_PATH}`, {
+				method: "POST",
+				headers: {
+					...commonHeaders(credential),
+					"Authorization": `Bearer ${credential.accessToken}`,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify({ models: batch }),
+				signal: signal ?? AbortSignal.timeout(MODEL_BUSY_TIMEOUT_MS)
+			});
+			const envelope = await readEnvelope(response);
+			if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
+			for (const [id, level] of parseBusyLevels(envelope.data)) levels.set(id, level);
+		}
+		return levels;
+	}
+	/**
+	* 读该账号所属区的产品配置，挑出带 `text-to-image` 标签的媒体模型。
+	*
+	* 走的是和 {@link fetchModels} 同一条 `/v3/config`（国内区与国际区都答），
+	* 区别只在这里保留 `data.models` 的媒体条目、而不是投影成 CLI 聊天目录。
+	* 国内区实测 62 条模型里只有 `hunyuan-image-alpha` 带 `text-to-image`；
+	* 国际区一条都没有 —— 所以本方法对国际区返回空数组，而不是编一个模型出来。
+	*
+	* 这是一次 EXTRA 读取，不是「复用目录那一次」：`fetchModels` 的结果被投影成
+	* 聊天目录就丢掉了媒体标签，所以这里必须再读一遍同一份文档。它是只读 GET、
+	* 不花积分，且工具侧有 5 分钟缓存，但「零新增请求」的说法不成立，别那么写。
+	* 国内区与 {@link fetchModels} 一样走 `/v3` → `/v2` 降级：上游一旦不答
+	* `/v3`，聊天目录会降级而这里不能变成一个原始异常。
+	*/
+	async fetchMediaModels(credential, signal) {
+		const readMedia = async (path) => {
+			const response = await fetch(`${chatBase(credential)}${path}`, {
+				headers: {
+					"Authorization": `Bearer ${credential.accessToken}`,
+					"Accept": "application/json",
+					"Origin": originReferer(credential),
+					"Referer": `${originReferer(credential)}/`,
+					"User-Agent": PRODUCT_UA
+				},
+				signal: signal ?? AbortSignal.timeout(JSON_TIMEOUT_MS)
+			});
+			const envelope = await readEnvelope(response);
+			if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
+			return selectMediaModels((typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {})["models"], IMAGE_TAG_TEXT_TO_IMAGE);
+		};
+		try {
+			return await readMedia(GLOBAL_CONFIG_PATH);
+		} catch (error) {
+			if (regionOf(credential.domain) === "global") throw error;
+			this.onFallback?.(`CN media catalog ${GLOBAL_CONFIG_PATH} failed; falling back to ${MODELS_CATALOG_PATH}: ` + (error instanceof Error ? error.message : String(error)));
+			return await readMedia(MODELS_CATALOG_PATH);
+		}
+	}
+	/**
+	* 发一次文生图请求。
+	*
+	* 端点、请求体、响应解析全部照抄官方 CLI 的 ImageService（见 `image-gen.ts`
+	* 的模块注释）。实测单张 5.71 credits，产物是 24 小时有效的 COS 签名 URL。
+	*
+	* 失败分两层：HTTP 非 2xx 交给 {@link describeImageFailure} 翻成带 code 的
+	* 错误（401/403 提示重新登录、404 提示该区没有生图路由、429 提示限流）；
+	* HTTP 200 但信封 `code !== 0` 由 {@link parseImageResponse} 处理。
+	*/
+	async generateImage(credential, request, signal) {
+		const response = await fetch(`${chatBase(credential)}${IMAGE_GENERATIONS_PATH}`, {
+			method: "POST",
+			headers: imageHeaders(credential),
+			body: JSON.stringify(buildImageBody(request)),
+			signal: signal ?? AbortSignal.timeout(IMAGE_TIMEOUT_MS)
+		});
+		const text = await response.text();
+		if (!response.ok) throw describeImageFailure(response.status, text);
+		let payload;
+		try {
+			payload = JSON.parse(text);
+		} catch {
+			throw new WorkBuddyImageError(`workbuddy image: 上游返回的不是 JSON（HTTP ${response.status}）: ${text.slice(0, 200)}`, "UPSTREAM");
+		}
+		return parseImageResponse(payload);
+	}
 	/** Query today's check-in status without changing account state. */
 	async fetchCheckinStatus(credential) {
 		const response = await fetch(`${billingBase(credential)}/v2/billing/meter/checkin-activity-status`, {
@@ -4863,7 +5762,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.14.1";
+const WORKBUDDY_CONNECT_VERSION = "5.0.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -5021,4 +5920,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { withEffectiveOff as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, defaultOffModelIds as J, systemOpeningsOfBody as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, recordRefusal as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, offDefaultFor as X, lastRefusalFor as Y, offRefused as Z, WORKBUDDY_AUTH_FILENAME as _, hostPeersInfo as _t, readHostHeartbeat as a, deriveAtRestKey as at, WorkBuddyEncryptedCredentialError as b, writeFileAtomic as bt, WORKBUDDY_CONNECT_VERSION as c, findWorkbuddyAppExecutable as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, isWorkbuddyBundle as dt, NATIVE_MODALITY_BY_MODEL_ID as et, WorkBuddyCatalog as f, macosBundleExecutable as ft, ENCRYPTED_CREDENTIAL_CODE as g, workbuddyAppExecutableCandidates as gt, fallbackModelsFor as h, readAtRestKey as ht, processStartTimeMs as i, clearAtRestKeyCache as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, findWorkbuddyAppExecutableWithSource as lt, deriveCatalog as m, openEncryptedField as mt, clearHostHeartbeat as n, nativeModalityOf as nt, workbuddyHostHeartbeatPath as o, deriveAtRestKeyId as ot, applyContextBudgets as p, macosNestedAppBundles as pt, REFUSES_OFF_MODEL_IDS as q, isHeartbeatProcessAlive as r, WORKBUDDY_APP_EXECUTABLE_ENV as rt, writeHostHeartbeat as s, fetchAtRestKeyPayload as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, imageDefaultFor as tt, FALLBACK_WORKBUDDY_MODELS as u, isEncryptedFieldWrapper as ut, WORKBUDDY_AUTH_FILE_ENV as v, resolveDshHome as vt, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, withFileLock as yt, knownRegionOf as z };
+export { REFUSES_OFF_MODEL_IDS as $, workbuddyAccountId as A, withFileLock as At, isCredentialRejectedError as B, defaultDesktopAuthDirs as C, macosBundleExecutable as Ct, isVaultAccountId as D, workbuddyAppExecutableCandidates as Dt, isEncryptedCredentialError as E, readAtRestKey as Et, WorkBuddyUpstreamClient as F, parseCreditMultiplier as G, knownRegionOf as H, classifyUpstreamError as I, perturbChannelFingerprints as J, parseReasoning as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, hostPeersInfo as Ot, WorkBuddyCredentialRejectedError as P, busyDisplaySuffix as Q, forceNeutralHead as R, defaultDesktopAuthCandidates as S, isWorkbuddyBundle as St, hasEncryptedCredentialFields as T, openEncryptedField as Tt, modelIdOfBody as U, isFirstMessageGateBody as V, openingEvidenceOfBody as W, regionOf as X, prepareChatBody as Y, attachBusyLevels as Z, WORKBUDDY_AUTH_FILENAME as _, deriveAtRestKeyId as _t, readHostHeartbeat as a, withEffectiveOff as at, WorkBuddyEncryptedCredentialError as b, findWorkbuddyAppExecutableWithSource as bt, WORKBUDDY_CONNECT_VERSION as c, pickImageModel as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, NATIVE_MODALITY_BY_MODEL_ID as dt, defaultOffModelIds as et, WorkBuddyCatalog as f, imageDefaultFor as ft, ENCRYPTED_CREDENTIAL_CODE as g, deriveAtRestKey as gt, fallbackModelsFor as h, clearAtRestKeyCache as ht, processStartTimeMs as i, recordRefusal as it, workbuddyOwnAuthPath as j, writeFileAtomic as jt, parseWorkBuddyAuth as k, resolveDshHome as kt, piAiRuntimeInfo as l, parseQueueAnswer as lt, deriveCatalog as m, WORKBUDDY_APP_EXECUTABLE_ENV as mt, clearHostHeartbeat as n, offDefaultFor as nt, workbuddyHostHeartbeatPath as o, DEFAULT_IMAGE_SIZE as ot, applyContextBudgets as p, nativeModalityOf as pt, parseUpstreamModel as q, isHeartbeatProcessAlive as r, offRefused as rt, writeHostHeartbeat as s, WorkBuddyImageError as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, lastRefusalFor as tt, FALLBACK_WORKBUDDY_MODELS as u, queueNoticeText as ut, WORKBUDDY_AUTH_FILE_ENV as v, fetchAtRestKeyPayload as vt, defaultDesktopAuthPath as w, macosNestedAppBundles as wt, authFileName as x, isEncryptedFieldWrapper as xt, WorkBuddyCredentialStore as y, findWorkbuddyAppExecutable as yt, isConversationIdGateBody as z };