dsh-connect-workbuddy 4.7.0 → 4.8.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 4.8.0 (2026-10-18)
+
+> 版本号是 **minor**：这不是只改内部的 patch —— 它**会改动会话历史**。跨区/跨窗口切换后原本必然卡死的那一类会话，本版能把上下文折回去继续用。没有溢出时行为完全不变。
+
+### Fixes
+
+- **切到窗口更小的路由后，会话永久卡在 `400 code 11115 prompt is too long`（#59 后半）**
+  - **症状**：会话在一个 1M 窗口的模型上跑得很长，切成国际区（`workbuddy-global`，窗口 1,048,576）后，**每一条**请求都返回 `prompt is too long: 1374460 tokens > 1048576 maximum`。换回原区域能用，再切过去还是卡死；手动压缩同样 400。会话实质报废。
+  - **根因（宿主侧，两处叠加）**：
+    1. **压力阈值按「当前模型」窗口现算**，`compaction-basic/src/config.ts:188-192` 的 `thresholdTokens = min(contextWindow × thresholdRatio, messageBudgetTokens)`。1M 窗口下阈值是 800,000，而 707,801 未到 —— 会话在**切区那一刻就已经超了新模型的窗口**，可自动压缩的触发点还在旧模型的尺度上，永远等不到。
+    2. **溢出兜底把整段历史塞进一次摘要请求**，`compaction-basic/src/index.ts:299` 的 `selectCompactableRange(session, measurement, 0)` 保留量为 0 → `region.ts:150-154` 选出「除最后一条外的全部历史」；`summarizer.ts:141-151` 又把这份摘要发给**当前那条小窗口路由**。于是救援请求和它要救援的请求一样溢出 —— 死锁。
+    宿主侧已按 deepseek-ai/deepseek-harness#9814 提交，上面两处即该 issue 的 A、B 两点。
+  - **本版做的事**：适配器在溢出错误**仍然持有 session id** 的那一刻接手，用宿主**自己的**压缩事务（`ctx.compaction.compactRegion`）把历史折回去，而不是另发一次摘要请求。
+    - 分块上限 = 模型窗口的 **35%**，因此摘要请求本身**按构造**一定装得下（宿主默认那一次是 131%）。
+    - 折叠目标是窗口的 **60%**，逐块折叠直到低于目标；块边界来自宿主自己的 `tokenMeter`。
+    - **绝不折掉当前请求携带的那条消息**（`nodes.at(-1)` 永远保留）。
+    - 宿主拒绝某个区间（切断了 tool call 与 result 的配对、或正有压缩在跑）时，把尾边向内收一格重试；仍是拒绝就放弃，绝不空转。
+    - 折完仍降不下去（单条消息本身就超过窗口）时立刻停手 —— 这是结构性问题，重试只会烧掉重试预算。
+  - **实测（真实 GL 400 载荷）**：`isContextOverflow` 对 `prompt is too long: 1374460 tokens > 1048576 maximum` 与 `{"code":11115,...,"type":"CONTEXT_WINDOW_EXCEEDED"}` 均判定为真，对 `rate limit exceeded` 判定为假 —— 只在真溢出时动手。
+  - **降级路径**：宿主没装压缩包（`compaction` 服务不存在）、或请求没带 `sessionId`（非主循环调用）时，适配器原样返回，行为与本版之前**逐字节相同**。
+
+### 已知未修
+
+- **跨区 prompt token 计数漂移**（#59 前半）：同一份 3.6 MB 请求体，CN 计 642,800、GL 计 447,306。这不是网关数错 —— 历史里的 thinking 块按上游当初实际返回的字段名（`reasoning` / `reasoning_content`）原样回放（宿主 `pi-ai` 0.85.1 `openai-completions.js:428` → `:1006`），同一批字节因此落进不同计费桶。归属宿主，本插件没有改写历史的权限，详见 #59 与 `src/body-report.ts` 头部说明。
+
 ## 4.7.0 (2026-10-17)
 
 > 版本号是 **minor**：这不是只改内部的 patch —— 它**改变了发往上游的请求体**。DSH Desktop 0.2.1-rc.1 随包 pi-ai 1.1.0，本版修的是该组合下「请求静默丢掉 system prompt 与全部工具声明」。若你停留在更早的宿主，行为不变。

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, K as WORKBUDDY_APP_EXECUTABLE_ENV, O as legacyWorkbuddyOwnAuthPath, Q as findWorkbuddyAppExecutableWithSource, S as defaultDesktopAuthCandidates, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, ot as hostPeersInfo, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-Dd9fsFMR.js";
+import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, K as WORKBUDDY_APP_EXECUTABLE_ENV, O as legacyWorkbuddyOwnAuthPath, Q as findWorkbuddyAppExecutableWithSource, S as defaultDesktopAuthCandidates, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, ot as hostPeersInfo, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat--S6JVSci.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/{host-heartbeat-Dd9fsFMR.js → host-heartbeat--S6JVSci.js}

@@ -3957,7 +3957,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.7.0";
+const WORKBUDDY_CONNECT_VERSION = "4.8.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -1246,6 +1246,18 @@ declare function createWorkBuddyShim(options: WorkBuddyShimOptions): WorkBuddySh
 /** The resolved pi-ai generation, by context-shape capability. */
 type PiAiGeneration = 'modern' | 'legacy';
 //#endregion
+//#region src/context-rescue.d.ts
+interface ContextRescue {
+  /**
+   * Fold history until the next request fits the given window.
+   *
+   * @param sessionId - session whose history should be folded.
+   * @param window - context window of the route that just overflowed.
+   * @returns whether any history was folded.
+   */
+  rescue(sessionId: string, window: number): Promise<boolean>;
+}
+//#endregion
 //#region src/adapter.d.ts
 /** Provider route this bundle owns for the domestic (CN) gateway. */
 declare const WORKBUDDY_PROVIDER = "workbuddy";
@@ -1270,6 +1282,12 @@ interface WorkBuddyAdapterOptions {
   displayName?: string;
   /** Resolve the durable attachment service at request time, when present. */
   resolveAttachments?: () => AttachmentStore | undefined;
+  /**
+   * Resolve the host-side context-overflow rescue, when this host exposes one.
+   * Omitted (or resolving to `undefined`) leaves the adapter exactly as it was:
+   * a provider overflow is forwarded and the host's own recovery decides.
+   */
+  resolveContextRescue?: () => ContextRescue | undefined;
   /**
    * Override the pi-ai generation gate (see {@link piAiRuntimeInfo}); tests
    * inject both branches because this checkout only ever RESOLVES one of

package/lib/index.js

@@ -1,9 +1,9 @@
-import { $ as isEncryptedFieldWrapper, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as deriveAtRestKey, K as WORKBUDDY_APP_EXECUTABLE_ENV, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as fetchAtRestKeyPayload, Y as deriveAtRestKeyId, Z as findWorkbuddyAppExecutable, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as workbuddyAppExecutableCandidates, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as withFileLock, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as isWorkbuddyBundle, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as readAtRestKey, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as writeFileAtomic, m as deriveCatalog, n as clearHostHeartbeat, nt as macosNestedAppBundles, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as clearAtRestKeyCache, r as isHeartbeatProcessAlive, rt as openEncryptedField, s as writeHostHeartbeat, st as resolveDshHome, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosBundleExecutable, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-Dd9fsFMR.js";
+import { $ as isEncryptedFieldWrapper, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as deriveAtRestKey, K as WORKBUDDY_APP_EXECUTABLE_ENV, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as fetchAtRestKeyPayload, Y as deriveAtRestKeyId, Z as findWorkbuddyAppExecutable, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as workbuddyAppExecutableCandidates, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as withFileLock, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as isWorkbuddyBundle, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as readAtRestKey, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as writeFileAtomic, m as deriveCatalog, n as clearHostHeartbeat, nt as macosNestedAppBundles, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as clearAtRestKeyCache, r as isHeartbeatProcessAlive, rt as openEncryptedField, s as writeHostHeartbeat, st as resolveDshHome, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosBundleExecutable, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat--S6JVSci.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { join } from "node:path";
-import { createProvider } from "@earendil-works/pi-ai";
+import { createAssistantMessageEventStream, createProvider, isContextOverflow } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
@@ -473,6 +473,51 @@ function withLegacyContext(api, generation) {
 	};
 }
 /**
+* Layer the host-side context-overflow rescue onto a provider's streams.
+*
+* pi-ai reports a provider failure as an `error` event rather than a throw, so
+* the rescue runs while the failing assistant message is still in hand: history
+* is folded before the event continues on its way, and the host's retry then
+* rebuilds its request against a smaller surface. Nothing is swallowed — the
+* error event is forwarded unchanged, because deciding whether to retry is the
+* host's policy, not this transport's.
+*
+* Both gates are deliberate. Without `sessionId` there is no session to fold,
+* and without a declared `contextWindow` there is no budget to fold against;
+* either absence leaves the stream untouched.
+*/
+function withContextRescue(api, resolve) {
+	if (resolve === void 0) return api;
+	const wrap = (inner) => (model, context, options) => {
+		const source = inner(model, context, options);
+		const rescue = resolve();
+		const sessionId = options?.sessionId;
+		const window = model.contextWindow;
+		if (rescue === void 0 || sessionId === void 0 || window === void 0) return source;
+		const out = createAssistantMessageEventStream();
+		let final;
+		(async () => {
+			try {
+				for await (const event of source) {
+					if (event.type === "done") final = event.message;
+					if (event.type === "error") final = event.error;
+					if (event.type === "error" && isContextOverflow(event.error)) await rescue.rescue(sessionId, window);
+					out.push(event);
+				}
+				out.end(final);
+			} catch {
+				out.end(final);
+			}
+		})();
+		return out;
+	};
+	return {
+		...api,
+		stream: wrap(api.stream),
+		streamSimple: wrap(api.streamSimple)
+	};
+}
+/**
 * Assemble the adapter. The provider's `getModels` reads the live catalog,
 * and every model's `baseUrl` is re-resolved per read so the shim's
 * ephemeral port applies from the first snapshot after startup.
@@ -501,7 +546,7 @@ function createWorkBuddyAdapter(options) {
 				}
 			} },
 			models: buildModels(),
-			api: withLegacyContext(openAICompletionsApi(), generation)
+			api: withContextRescue(withLegacyContext(openAICompletionsApi(), generation), options.resolveContextRescue)
 		}),
 		getModels: () => buildModels()
 	};
@@ -529,6 +574,104 @@ function createWorkBuddyAdapter(options) {
 	};
 }
 //#endregion
+//#region src/context-rescue.ts
+/** Share of the window one fold chunk may consume, leaving room for the prompt. */
+const CHUNK_FRACTION = .35;
+/** Post-fold measurement target: comfortably below the window the route allows. */
+const TARGET_FRACTION = .6;
+/** A session is never folded more than this many times by one rescue. */
+const MAX_ROUNDS = 8;
+/** How many times one chunk may shrink its tail edge before giving up. */
+const MAX_SHRINK = 24;
+/** A single fold is abandoned after this long. */
+const FOLD_TIMEOUT_MS = 18e4;
+/**
+* Create the rescue bound to a live host.
+*
+* @param resolve - resolves host services at call time.
+* @returns the rescue handle the adapter calls on a provider overflow.
+*/
+function createContextRescue(resolve) {
+	const inflight = /* @__PURE__ */ new Set();
+	return { async rescue(sessionId, window) {
+		if (inflight.has(sessionId)) return false;
+		inflight.add(sessionId);
+		try {
+			return await foldUntilFits(resolve(), sessionId, window);
+		} catch (error) {
+			resolve().log?.("dsh-connect-workbuddy: context rescue failed", error);
+			return false;
+		} finally {
+			inflight.delete(sessionId);
+		}
+	} };
+}
+async function foldUntilFits(deps, sessionId, window) {
+	const { meter, compaction, agents } = deps;
+	if (meter === void 0 || compaction === void 0 || agents === void 0) return false;
+	const agent = agents.get(sessionId);
+	if (agent === void 0) return false;
+	const target = Math.max(1, Math.floor(window * TARGET_FRACTION));
+	let foldedAny = false;
+	let previous = Number.POSITIVE_INFINITY;
+	for (let round = 0; round < MAX_ROUNDS; round += 1) {
+		const measurement = meter.measure(agent.session);
+		if (measurement.totalTokens <= target) return foldedAny;
+		if (measurement.totalTokens >= previous) return foldedAny;
+		previous = measurement.totalTokens;
+		if (!await foldOnce(deps, agent, measurement, window, target)) return foldedAny;
+		foldedAny = true;
+	}
+	return foldedAny;
+}
+/**
+* Fold the oldest chunk that fits, shrinking its tail edge when the host
+* refuses the range.
+*
+* The host rejects a range whose edges split a tool call from its result, and
+* it rejects an active or missing range before appending anything — so a
+* refused attempt costs no durable state and the edge can simply move inward.
+*
+* @returns whether one chunk was folded.
+*/
+async function foldOnce(deps, agent, measurement, window, target) {
+	const nodes = measurement.nodes;
+	if (nodes.length < 2) return false;
+	const budget = Math.floor(window * CHUNK_FRACTION);
+	const excess = measurement.totalTokens - target;
+	const chunk = Math.max(1, Math.min(budget, excess));
+	const head = nodes[0];
+	const compaction = deps.compaction;
+	if (head === void 0 || compaction === void 0) return false;
+	let end = -1;
+	let accumulated = 0;
+	for (let index = 0; index < nodes.length - 1; index += 1) {
+		const node = nodes[index];
+		if (node === void 0) break;
+		accumulated += node.tokens;
+		end = index;
+		if (accumulated >= chunk) break;
+	}
+	if (end < 0) return false;
+	const signal = AbortSignal.timeout(FOLD_TIMEOUT_MS);
+	const floor = Math.max(0, end - MAX_SHRINK);
+	for (; end >= floor; end -= 1) {
+		const tail = nodes[end];
+		if (tail === void 0) break;
+		try {
+			await compaction.compactRegion(head.seq, tail.seq, agent, signal);
+			return true;
+		} catch (error) {
+			if (signal.aborted) {
+				deps.log?.("dsh-connect-workbuddy: context rescue timed out", error);
+				return false;
+			}
+		}
+	}
+	deps.log?.("dsh-connect-workbuddy: context rescue found no foldable range");
+	return false;
+}
+//#endregion
 //#region src/body-report.ts
 /**
 * Body-composition report: WHAT was sent upstream, in counts (issue #59).
@@ -541,16 +684,32 @@ function createWorkBuddyAdapter(options) {
 *   - the gateways count identical bytes differently (upstream's business); or
 *   - the two requests did not carry the same messages (ours to fix).
 *
-* The second world was left standing by two independent measurements. The
-* reporter ran this project's `--kind`/`--language` probe on BOTH regions and
-* got the same tokens-per-1000-chars on byte-identical prose, code and JSON
-* (ratios 0.98–1.06 across six cells), so identical bytes really do bill
-* identically. And a code trace showed historical `reasoning` never reaches the
-* wire at all: pi-ai only forwards `thinking` blocks as text when
-* `compat.requiresThinkingAsText` is set — this plugin never sets it — and the
-* `reasoning_details` route needs a signature the stream parser never writes.
-* With the counting difference excluded and reasoning excluded, the remaining
-* candidate is that the two bodies differ in the first place.
+* Neither world, it turned out — the answer was a third one, and this report is
+* what produced it. A paired capture in one session (4.6.7) measured
+* `bodyBytes` 3,628,068 vs 3,626,374, a ratio of 0.9995: both requests carried
+* the same bytes. What differed was the BUCKET each byte was counted in — CN
+* text 741,952 vs GL 184,821, CN reasoning 72,270 vs GL 627,994, with a
+* complementary residual of 0.3%. The gateways did not miscount; the same
+* history was labelled differently on the two sides.
+*
+* The labelling is pi-ai's replay, not this plugin's. `openai-completions.js`
+* records the reasoning field name the upstream stream actually used into
+* `thinkingSignature` (`:428`), and on the way back out writes
+* `assistantMsg[<that name>] = <the thinking text>` (`:1006`), so a
+* transcript produced against a gateway that says `reasoning` is replayed as
+* `reasoning` and one that says `reasoning_content` as `reasoning_content`.
+* This plugin sets only `compat.supportsReasoningEffort` (`src/adapter.ts:200`),
+* so the `else` branch is taken and the field goes out raw rather than folded
+* into text.
+*
+* An earlier revision of this comment claimed the opposite — that historical
+* `reasoning` never reaches the wire, because `requiresThinkingAsText` is unset
+* and the `reasoning_details` route needs a signature the parser never writes.
+* Both halves are wrong under pi-ai 0.85.1: the unset flag is precisely what
+* routes thinking out as a raw field, and the parser does write the
+* `reasoning_details` signature (`:188–193`). The correction matters because it
+* turns `reasoning` into a bucket that can be non-zero — and diffing it across
+* regions is the direct measurement of the drift.
 *
 * This module exists to settle exactly that, and it can do it WITHOUT either
 * region having credit: the body is assembled locally, before the upstream ever
@@ -6609,6 +6768,15 @@ function apply(ctx, config) {
 	Promise.all(REGION_KEYS.map((region) => stacks[region].shim.ready)).then(async () => {
 		if (stopped) return;
 		const adapters = {};
+		const hostService = (name) => ctx.get(name);
+		const contextRescue = createContextRescue(() => ({
+			meter: hostService("tokenMeter"),
+			compaction: hostService("compaction"),
+			agents: hostService("agents"),
+			log: (message, error) => {
+				ctx.logger.warn(message, error);
+			}
+		}));
 		try {
 			for (const region of REGION_KEYS) adapters[region] = createWorkBuddyAdapter({
 				shim: stacks[region].shim,
@@ -6616,7 +6784,8 @@ function apply(ctx, config) {
 				catalog: stacks[region].catalog,
 				provider: WORKBUDDY_PROVIDERS[region],
 				displayName: WORKBUDDY_PROVIDER_DISPLAY_NAMES[region],
-				resolveAttachments: () => ctx.get("attachments")
+				resolveAttachments: () => ctx.get("attachments"),
+				resolveContextRescue: () => contextRescue
 			});
 			invalidateCatalog = () => {
 				for (const region of REGION_KEYS) adapters[region].invalidate();

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "4.7.0",
+  "version": "4.8.0",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",