dsh-connect-workbuddy 4.8.1 → 4.9.0

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as isEncryptedFieldWrapper, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as deriveAtRestKey, K as WORKBUDDY_APP_EXECUTABLE_ENV, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as fetchAtRestKeyPayload, Y as deriveAtRestKeyId, Z as findWorkbuddyAppExecutable, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as workbuddyAppExecutableCandidates, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as withFileLock, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as isWorkbuddyBundle, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as readAtRestKey, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as writeFileAtomic, m as deriveCatalog, n as clearHostHeartbeat, nt as macosNestedAppBundles, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as clearAtRestKeyCache, r as isHeartbeatProcessAlive, rt as openEncryptedField, s as writeHostHeartbeat, st as resolveDshHome, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosBundleExecutable, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-BfAvb1_d.js";
+import { $ as isEncryptedFieldWrapper, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as deriveAtRestKey, K as WORKBUDDY_APP_EXECUTABLE_ENV, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as fetchAtRestKeyPayload, Y as deriveAtRestKeyId, Z as findWorkbuddyAppExecutable, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as workbuddyAppExecutableCandidates, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as withFileLock, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as isWorkbuddyBundle, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as readAtRestKey, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as writeFileAtomic, m as deriveCatalog, n as clearHostHeartbeat, nt as macosNestedAppBundles, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as clearAtRestKeyCache, r as isHeartbeatProcessAlive, rt as openEncryptedField, s as writeHostHeartbeat, st as resolveDshHome, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosBundleExecutable, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-CS6PxirW.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -106,6 +106,38 @@ const WORKBUDDY_PROVIDERS = {
 	cn: WORKBUDDY_PROVIDER,
 	global: WORKBUDDY_GLOBAL_PROVIDER
 };
+/**
+* Model identity BOTH regions stamp on their models — the fix for issue #59.
+*
+* pi-ai keeps a historical thinking block as `thinking` only when the message
+* that carried it names the SAME provider, api and model id as the request in
+* flight (`transform-messages.js:68`); every other block is downgraded to plain
+* `text` (`:88–96`) — downgraded, not dropped, which is why no byte count ever
+* explained the 1.94× regional jump. The two gateways are two provider STRINGS
+* for ONE model, so a transcript recorded in one region was replayed as text in
+* the other, and issue #59's reporter measured exactly that: 708K → 1.374M on
+* byte-identical history, and a compression request that could then never fit
+* the window it was computed for.
+*
+* `provider` is also the KEY pi-ai dispatches on (`models.js:410–416`
+* `requireProvider`), so the identity cannot simply be the shared string: the
+* registry has to keep resolving per region. Both halves of that are already
+* satisfied by pi-ai's own lookup shape — `getModel(provider, id)` is
+* `getModels(provider).find(...)` (`models.js:116–118`), i.e. the KEY is the
+* route id while the STAMPED field is whatever the provider put there — so the
+* route stays `workbuddy`/`workbuddy-global` (each with its own shim, catalog
+* and credential store) while every model it serves advertises THIS id. This
+* plugin's provider registers no `fetchModels`, so nothing downstream derives
+* anything from the stamped field; the openai-completions api uses
+* `model.provider` only for provider-specific quirks (none of which match
+* these ids) and as an error-message label.
+*
+* Deliberately NOT the same string as either route: a message is only
+* same-model when provider, api AND model id all match, so the shared id must
+* not be reachable as a route a user could pick — it names one model, not one
+* gateway.
+*/
+const WORKBUDDY_MODEL_IDENTITY = "workbuddy";
 /** Region a provider route id belongs to. */
 function regionOfProvider(provider) {
 	for (const [region, id] of Object.entries(WORKBUDDY_PROVIDERS)) if (id === provider) return region;
@@ -213,14 +245,20 @@ function workBuddyThinkingLevelMap(info) {
 	else map.off = null;
 	return map;
 }
-/** Build one pi-ai model descriptor pointing at the loopback shim. */
-function toPiModel(info, baseUrl, providerId) {
+/**
+* Build one pi-ai model descriptor pointing at the loopback shim.
+*
+* `identity` — not the route id — is what `provider` carries; see
+* {@link WORKBUDDY_MODEL_IDENTITY} for why the two must differ. The route the
+* model is REACHED by is the registry key the adapter serves, not this field.
+*/
+function toPiModel(info, baseUrl, identity = WORKBUDDY_MODEL_IDENTITY) {
 	const thinkingLevelMap = workBuddyThinkingLevelMap(info);
 	return {
 		id: info.id,
 		name: workBuddyDisplayName(info),
 		api: "openai-completions",
-		provider: providerId,
+		provider: identity,
 		baseUrl,
 		input: workBuddyModelInput(info),
 		cost: NO_COST,
@@ -526,10 +564,11 @@ function createWorkBuddyAdapter(options) {
 	const { shim, store, catalog, resolveAttachments } = options;
 	const providerId = options.provider ?? "workbuddy";
 	const providerName = options.displayName ?? "WorkBuddy";
+	const modelIdentity = options.modelIdentity ?? "workbuddy";
 	const generation = options.piAiGeneration ?? piAiRuntimeInfo().generation;
 	const buildModels = () => {
 		const baseUrl = `${shim.baseUrl()}/v1`;
-		return catalog.current().map((info) => toPiModel(info, baseUrl, providerId));
+		return catalog.current().map((info) => toPiModel(info, baseUrl, modelIdentity));
 	};
 	const provider = {
 		...createProvider({
@@ -688,28 +727,57 @@ async function foldOnce(deps, agent, measurement, window, target) {
 * what produced it. A paired capture in one session (4.6.7) measured
 * `bodyBytes` 3,628,068 vs 3,626,374, a ratio of 0.9995: both requests carried
 * the same bytes. What differed was the BUCKET each byte was counted in — CN
-* text 741,952 vs GL 184,821, CN reasoning 72,270 vs GL 627,994, with a
+* text 741,687 vs GL 184,821, CN reasoning 72,270 vs GL 627,994, with a
 * complementary residual of 0.3%. The gateways did not miscount; the same
 * history was labelled differently on the two sides.
 *
-* The labelling is pi-ai's replay, not this plugin's. `openai-completions.js`
-* records the reasoning field name the upstream stream actually used into
-* `thinkingSignature` (`:428`), and on the way back out writes
-* `assistantMsg[<that name>] = <the thinking text>` (`:1006`), so a
-* transcript produced against a gateway that says `reasoning` is replayed as
-* `reasoning` and one that says `reasoning_content` as `reasoning_content`.
-* This plugin sets only `compat.supportsReasoningEffort` (`src/adapter.ts:200`),
-* so the `else` branch is taken and the field goes out raw rather than folded
-* into text.
-*
-* An earlier revision of this comment claimed the opposite — that historical
-* `reasoning` never reaches the wire, because `requiresThinkingAsText` is unset
-* and the `reasoning_details` route needs a signature the parser never writes.
-* Both halves are wrong under pi-ai 0.85.1: the unset flag is precisely what
-* routes thinking out as a raw field, and the parser does write the
-* `reasoning_details` signature (`:188–193`). The correction matters because it
-* turns `reasoning` into a bucket that can be non-zero — and diffing it across
-* regions is the direct measurement of the drift.
+* The labelling is pi-ai's replay — which assistant messages it lets survive as
+* thinking at all. `transform-messages.js:68` (1.1.0, the version the host
+* bundles) computes
+*
+*     isSameModel = assistantMsg.provider === model.provider
+*                && assistantMsg.api      === model.api
+*                && assistantMsg.model    === model.id;
+*
+* and for a message that fails it, `:88–96` returns the surviving thinking as
+* `{ type: "text", text: block.thinking }` — downgraded, not dropped — while
+* `:76` drops redacted thinking and `:103` strips tool-call `thoughtSignature`.
+* `buildParams` runs that transform at `openai-completions.js:896`, before
+* anything is assembled, so a thinking block only stays a thinking block when
+* its message was recorded under the same provider AND the same model id as the
+* request now in flight. Survivors leave as the raw field: `:1002–1008` writes
+* `assistantMsg[signature] = <thinking>`, `signature` being the field name the
+* stream used, recorded per block at `:399–416` (`reasoning_content` for this
+* vendor, uniformly — 790 replay records in one real session held that value
+* and no other). Non-survivors are text by the time `:964–971` collects
+* `assistantText`, so they land in `assistantMsg.content` instead. This plugin
+* sets only `compat.supportsReasoningEffort` (`src/adapter.ts:200`), which
+* leaves `requiresThinkingAsText` at its `false` default (`:1270`), so the raw
+* field route is the live one rather than the fold-into-content route at `:983`.
+*
+* Two provider ids for one model is therefore two identities for one model, and
+* a region switch flips the sign for the entire other side at once: everything
+* that side ever thought is replayed as content instead of as a reasoning field,
+* and the gateways count content. That is the 1.94× above; the same formula read
+* in the other direction is the 0.696× the reverse switch produces (text
+* 642,800 vs 447,306 across the same bytes). The model-id leg of `isSameModel`
+* matters for the same reason — switching models inside ONE region has the same
+* effect — which is why the symptom belongs in `README`'s 已知限制, where users
+* meet it, and not only here.
+*
+* The retraction trail, because this header has misled twice. The first version
+* claimed historical `reasoning` never reaches the wire, because
+* `requiresThinkingAsText` is unset and the `reasoning_details` route needs a
+* signature the parser never writes. Both halves are wrong: the unset flag is
+* precisely what routes thinking out as a raw field. The second version — the
+* one this paragraph replaces — claimed the difference was the field NAME,
+* signature-driven, citing 0.85.1's `:428`/`:1006` and concluding that a gateway
+* saying `reasoning` replays as `reasoning`. That cannot be right either: both
+* gateways say `reasoning_content`, so a name-keyed story predicts NO difference
+* between them, and the host ships 1.1.0, not 0.85.1. What differs is survival,
+* not naming. The file keeps both dead ends on purpose — each one shaped what
+* this report measures, and the third version only settled the question because
+* the report could show bytes equal while buckets were not.
 *
 * This module exists to settle exactly that, and it can do it WITHOUT either
 * region having credit: the body is assembled locally, before the upstream ever
@@ -1478,8 +1546,9 @@ function nestedOrText(value) {
 * This is where gates 2 and 4 live. Returning nothing is the COMMON case for
 * mistaken input and is not an error: callers must show the block verbatim.
 */
-function parseBlock(block, gate) {
+function parseBlock(block, gate, seen) {
 	const calls = [];
+	let withheld = false;
 	const spans = ignoredSpans(block);
 	let index = 0;
 	while (index < block.length) {
@@ -1490,21 +1559,34 @@ function parseBlock(block, gate) {
 			if (close === void 0) break;
 			const call = parseInvoke(tag, close, block, gate);
 			if (call !== void 0) calls.push(call);
+			else if (tag.attributes.trim() === "" && gate.onWithheld !== void 0) {
+				seen.reason ??= "unnamed-invoke";
+				withheld = true;
+			}
 			index = close.end + 1;
 			continue;
 		}
 		index = tag.end + 1;
 	}
-	return calls;
+	return {
+		calls,
+		withheld
+	};
 }
 /** One `<invoke>` element → a call, or nothing when a gate refuses it. */
 function parseInvoke(open, close, block, gate) {
-	const name = parseAttributes(open.attributes)["name"];
-	if (name === void 0 || name === "") return void 0;
-	if (!gate.declaredNames.has(name)) return void 0;
+	const declared = parseAttributes(open.attributes)["name"];
+	const parameters = parseParameters(block.slice(open.end + 1, close.start));
+	let name;
+	if (declared !== void 0 && declared !== "") {
+		if (!gate.declaredNames.has(declared)) return void 0;
+		name = declared;
+	} else if (open.attributes.trim() === "") {
+		name = inferNameFromSchema(parameters, gate);
+		if (name === void 0) return void 0;
+	} else return;
 	const pinned = gate.pinnedToolName;
 	if (pinned !== void 0 && pinned !== "auto" && pinned !== "required" && pinned !== "none" && pinned !== name) return;
-	const parameters = parseParameters(block.slice(open.end + 1, close.start));
 	const required = gate.requiredParameters?.get(name);
 	if (required !== void 0 && required.some((parameter) => parameters[parameter] === void 0)) return void 0;
 	return {
@@ -1514,6 +1596,35 @@ function parseInvoke(open, close, block, gate) {
 	};
 }
 /**
+* Name a call from its ARGUMENTS when the opener names no tool — or refuse.
+*
+* The evidence is the model's own parameter tags; the constraint is the
+* request's schemas. A tool qualifies only when every tag the block carries is
+* accepted by its schema AND every required parameter is already present, and
+* exactly ONE declared tool qualifies. Everything less certain refuses:
+*
+*   - a block with no parameter tags at all (no evidence to read);
+*   - a tool whose schema is unknown here (it cannot be cleared — silence must
+*     not let an unverified tool win or lose);
+*   - a parameter no accepted set lists;
+*   - two tools that both fit ("the only tool on offer" was the whole point).
+*/
+function inferNameFromSchema(parameters, gate) {
+	const tags = Object.keys(parameters);
+	if (tags.length === 0) return void 0;
+	let fit;
+	for (const tool of gate.declaredNames) {
+		const accepted = gate.acceptedParameters?.get(tool);
+		if (accepted === void 0) return void 0;
+		if (tags.some((tag) => !accepted.has(tag))) continue;
+		const required = gate.requiredParameters?.get(tool);
+		if (required !== void 0 && required.some((parameter) => parameters[parameter] === void 0)) continue;
+		if (fit !== void 0) return void 0;
+		fit = tool;
+	}
+	return fit;
+}
+/**
 * `text` with every markup block removed — the check behind {@link hasProse}.
 *
 * ANY marker-bearing tag counts as markup, whatever it is called. Keying on the
@@ -1556,6 +1667,74 @@ function stripMarkup(text) {
 	return result;
 }
 /**
+* Drop stray marker-bearing tags from otherwise-ordinary prose, and say so.
+*
+* This is the OTHER half of "the user must never see protocol debris": a block
+* is handled by {@link parseBlock} (recovered, withheld, or shown verbatim by
+* gate 4), but lone tags outside every block — `</｜DSML｜｜ calls>` closing a
+* wrapper whose opener belonged to a withheld call, `<｜DSML｜ validate>` —
+* arrive as plain text and used to be forwarded raw. They are markup, not the
+* answer: {@link stripMarkup} already knows exactly which bytes those are
+* (marker-bearing tags only, quoted ones inside fences and code spans kept),
+* so this runs it and records the removal. The record makes it reportable —
+* silence about removing content is the failure mode this whole module exists
+* to avoid.
+*
+* Gate 4's "show it verbatim" applies to BLOCKS (which may be content); a lone
+* marker tag has no content of its own to lose, only the name it wears.
+*/
+function stripStray(text, seen) {
+	const cleaned = stripMarkup(text);
+	if (cleaned !== text) seen.reason ??= "stray-markup";
+	return cleaned;
+}
+/**
+* Drop a marker-bearing tag fragment that the stream held and can never finish.
+*
+* {@link holdFrom} keeps back a tail that could still become a block opener, so
+* at end of stream that held tail is by construction an unterminated `<…`. Two
+* outcomes, and the difference is the marker:
+*
+*   - it carries the marker (`<｜DSM`, `</｜DSML｜ invo`): the marker is what
+*     makes it protocol debris rather than prose. Its close is never coming, so
+*     forwarding it hands the user half a tag — the `</｜DSML｜ invo` that
+*     trailed a killed stream. It goes, and says so.
+*   - it does not (`<`, `</`, `<tool`): a bare `<` is doubt, not evidence, and
+*     is kept. A person may have meant the character, and half a word is a
+*     worse lie than a stray bracket.
+*
+* Only the LAST `<` is examined. Everything before it was already cleared by
+* `holdFrom`, and an earlier `<` inside ordinary prose must not be dragged out
+* along with the fragment that happens to follow it.
+*/
+function dropUnfinishedMarkerTail(text, seen) {
+	const lastLt = text.lastIndexOf("<");
+	if (lastLt === -1) return text;
+	if (!isLateMarkerFragment(text.slice(lastLt))) return text;
+	seen.reason ??= "stray-markup";
+	return text.slice(0, lastLt);
+}
+/**
+* Is this unterminated tag fragment a marker-bearing one?
+*
+* Deliberately narrow, for the same reason {@link looksLikeTagStart} is: it must
+* still be open (`>` never arrived, which is what "held at end of stream" means)
+* and, once the `<` and an optional `/` are stripped, the rest must BE a partial
+* marker or be a complete marker followed by a partial name. `<tool` fails the
+* second test and survives; so does `<`, which is not evidence of anything.
+*/
+function isLateMarkerFragment(tail) {
+	if (!tail.startsWith("<")) return false;
+	if (tail.includes(">")) return false;
+	let body = tail.slice(1);
+	if (body.startsWith("/")) body = body.slice(1);
+	if (body === "") return false;
+	if (isPartialMarker(body)) return true;
+	const prefixLength = prefixLengthAt(body, 0);
+	if (prefixLength === 0) return false;
+	return /^[A-Za-z_-]*$/.test(body.slice(prefixLength).trim());
+}
+/**
 * Does `text` carry content outside markup blocks?
 *
 * This is what makes "the turn produced nothing usable" a checkable fact rather
@@ -1610,6 +1789,7 @@ function looksLikeTagStart(tail) {
 	if (body.startsWith("/")) body = body.slice(1);
 	if (body === "" || isPartialMarker(body)) return true;
 	const prefixLength = prefixLengthAt(body, 0);
+	if (prefixLength > 0) return true;
 	body = body.slice(prefixLength).trim().toLowerCase();
 	if (body === "" || isPartialMarker(body)) return true;
 	return [
@@ -1665,6 +1845,22 @@ function normalizeFullwidth(text) {
 var DsmlStreamBuffer = class {
 	pending = "";
 	gate;
+	/** The first withholding reason observed in this stream, reported once. */
+	withHeld = {};
+	/**
+	* Set once anything has been withheld from this response.
+	*
+	* It gates the debris sweep, and that is the whole point: gate 4 promises a
+	* REFUSED block is shown verbatim, so marker text must survive the stream
+	* untouched in every response that withheld nothing. Only after a block has
+	* been removed can the tags left around it be known to belong to markup the
+	* reader is no longer seeing — the wrapper's own `calls` closer, the opener
+	* the withheld call never got. Before that, a marker tag in the text may be
+	* the answer itself.
+	*/
+	withheldOnce = false;
+	/** Whether the one notice allowed per response has gone out. See `takeWithheld`. */
+	noticeSent = false;
 	constructor(gate) {
 		this.gate = gate;
 	}
@@ -1678,46 +1874,106 @@ var DsmlStreamBuffer = class {
 			this.pending = "";
 			return {
 				text,
-				prose: hasProse(text)
+				prose: hasProse(text),
+				withheld: false
 			};
 		}
 		for (;;) {
 			const found = findFirstOpener(this.pending, ignoredSpans(this.pending));
 			if (found === void 0) break;
-			const head = this.pending.slice(0, found.open.start);
+			const head = this.stripDebris(this.pending.slice(0, found.open.start));
 			if (head !== "") parts.push(head);
 			if (found.close === void 0) {
 				this.pending = this.pending.slice(found.open.start);
-				return finish(parts, calls);
+				return finish(parts, calls, this.takeWithheld());
 			}
 			const body = this.pending.slice(found.open.start, found.close.end + 1);
-			const recovered = parseBlock(body, this.gate);
-			if (recovered.length > 0) calls.push(...recovered);
-			else parts.push(body);
+			const parsed = parseBlock(body, this.gate, this.withHeld);
+			if (parsed.calls.length > 0) calls.push(...parsed.calls);
+			else if (!parsed.withheld) parts.push(body);
 			this.pending = this.pending.slice(found.close.end + 1);
 		}
 		const hold = holdFrom(this.pending, ignoredSpans(this.pending));
-		if (hold > 0) parts.push(this.pending.slice(0, hold));
+		if (hold > 0) {
+			const tail = this.stripDebris(this.pending.slice(0, hold));
+			if (tail !== "") parts.push(tail);
+		}
 		this.pending = this.pending.slice(hold);
-		return finish(parts, calls);
+		return finish(parts, calls, this.takeWithheld());
 	}
-	/** End of stream: hand back everything still held, verbatim. */
+	/** End of stream: hand back everything still held — minus the debris. */
 	flush() {
-		const text = this.pending;
+		let text = this.pending;
 		this.pending = "";
-		return {
+		if (isUnnamedInvoke(text) && this.gate.onWithheld !== void 0) {
+			this.withHeld.reason ??= "unnamed-invoke";
+			text = "";
+		}
+		if (this.debris()) {
+			text = dropUnfinishedMarkerTail(text, this.withHeld);
+			text = stripStray(text, this.withHeld);
+		}
+		const state = this.takeWithheld();
+		const outcome = {
 			text,
-			prose: hasProse(text)
+			prose: hasProse(text),
+			withheld: state.withheld
+		};
+		if (state.withheldReason !== void 0) outcome.withheldReason = state.withheldReason;
+		return outcome;
+	}
+	/**
+	* Apply the debris sweep, but only to a response that has withheld something.
+	*
+	* See {@link withheldOnce}: before the first withhold, marker text in the
+	* prose is the caller's to show, not this layer's to delete.
+	*/
+	stripDebris(text) {
+		return this.debris() ? stripStray(text, this.withHeld) : text;
+	}
+	/** Has anything been withheld from this response, yet or already? */
+	debris() {
+		return this.withheldOnce || this.withHeld.reason !== void 0;
+	}
+	/**
+	* Hand the accumulated reason to exactly one outcome.
+	*
+	* Exactly one, because the notice it drives is emitted once per response. A
+	* reason reported on two outcomes would print the same sentence twice.
+	*/
+	takeWithheld() {
+		const reason = this.withHeld.reason;
+		if (reason === void 0) return { withheld: false };
+		this.withHeld = {};
+		this.withheldOnce = true;
+		if (this.noticeSent) return { withheld: true };
+		this.noticeSent = true;
+		this.gate.onWithheld?.(reason);
+		return {
+			withheld: true,
+			withheldReason: reason
 		};
 	}
 };
+/**
+* Is this block an invocation the model wrote without naming a tool?
+*
+* Deliberately narrow: no attribute at all on the opener. `<invoke name="">`
+* is a REFUSED call with a name the gates can judge, and gate 4 shows it.
+*/
+function isUnnamedInvoke(body) {
+	const open = scanTag(body, 0);
+	return open !== void 0 && !open.closing && open.name === "invoke" && open.attributes.trim() === "";
+}
 /** Assemble one `add()` outcome without ever emitting a `calls: undefined` key. */
-function finish(parts, calls) {
+function finish(parts, calls, state) {
 	const text = parts.join("");
 	const outcome = {
 		text,
-		prose: hasProse(text)
+		prose: hasProse(text),
+		withheld: state.withheld
 	};
+	if (state.withheldReason !== void 0) outcome.withheldReason = state.withheldReason;
 	if (calls.length > 0) outcome.calls = [...calls];
 	return outcome;
 }
@@ -2832,6 +3088,8 @@ function createWorkBuddyShim(options) {
 		const gate = declared === void 0 ? void 0 : {
 			declaredNames: declared.names,
 			requiredParameters: declared.requiredParameters,
+			acceptedParameters: declared.acceptedParameters,
+			inferFromSchema: true,
 			...declared.pinnedToolName === void 0 ? {} : { pinnedToolName: declared.pinnedToolName }
 		};
 		const notice = switchedFrom === void 0 || switchedBecause === void 0 ? void 0 : failoverNoticeText(switchedFrom, switchedBecause);
@@ -3559,12 +3817,24 @@ function retryDue(probe, nowMs, fallbackMs = POOL_UNKNOWN_COOLDOWN_MS) {
 * 2. **Expiring credits first, soonest first.** Points about to expire are
 *    worth exactly zero after they do, so spending them before they lapse is
 *    strictly better than saving them.
-* 3. **Largest expiring amount.** Between two accounts that both have expiring
+* 3. **User's manual order.** When the user has hand-ordered the pool (see
+*    `orderAccountIds`), that order breaks ties among accounts that are equal
+*    on the keys above AND below. It is the one place the user's own preference
+*    influences "who serves next": the manual picker on the card drags these
+*    ids into place, and the ranking honors the result.
+*    WHY EXPIRY STILL OUTRANKS THE MANUAL ORDER: this rule sits strictly BELOW
+*    the at-risk flag (rule #2), so an account with ANY expiring credits always
+*    beats the manual order even when the user dragged it to the bottom. That
+*    is deliberate (issue #70): a manual order that is unsaved, stale, or
+*    sloppily edited must never cause credits to lapse unspent — expiring
+*    credits are real money about to vanish, while the manual order is just a
+*    preference that might be wrong. This is not a bug, and a test pins it.
+* 4. **Largest expiring amount.** Between two accounts that both have expiring
 *    points, the one with more at risk goes first.
-* 4. **Credits, highest first.** Among accounts with nothing expiring, spend the
+* 5. **Credits, highest first.** Among accounts with nothing expiring, spend the
 *    one with the most, so a nearly-drained account is conserved.
-* 5. **Freshest credential.** Tie-break so a stale token never wins a draw.
-* 6. **Account id.** Final tie-break, making the order TOTAL: two accounts
+* 6. **Freshest credential.** Tie-break so a stale token never wins a draw.
+* 7. **Account id.** Final tie-break, making the order TOTAL: two accounts
 *    equal on every ranking key would otherwise keep the caller's array order,
 *    so the same pool could rotate differently between two runs.
 *
@@ -3594,7 +3864,9 @@ function retryDue(probe, nowMs, fallbackMs = POOL_UNKNOWN_COOLDOWN_MS) {
 * throws on missing data (an account with no credits is ranked as 0, not
 * crashed on).
 */
-function rankPool(members, nowMs) {
+function rankPool(members, nowMs, orderAccountIds) {
+	const order = /* @__PURE__ */ new Map();
+	for (const [index, id] of (orderAccountIds ?? []).entries()) if (!order.has(id)) order.set(id, index);
 	const rows = members.map((member) => {
 		const excludedBy = exclusionOf(member.probe, nowMs);
 		return {
@@ -3602,6 +3874,7 @@ function rankPool(members, nowMs) {
 			score: scoreOf(member),
 			...excludedBy === void 0 ? {} : { excludedBy },
 			_usable: excludedBy === void 0,
+			_order: order.get(member.account.id) ?? Number.POSITIVE_INFINITY,
 			_atRisk: (member.credits?.expiringSoon ?? 0) > 0,
 			_expiringAmount: member.credits?.expiringSoon ?? 0,
 			_expiring: member.credits?.nearestExpiryMs ?? Number.POSITIVE_INFINITY,
@@ -3611,6 +3884,7 @@ function rankPool(members, nowMs) {
 	rows.sort((left, right) => {
 		if (left._usable !== right._usable) return left._usable ? -1 : 1;
 		if (left._atRisk !== right._atRisk) return left._atRisk ? -1 : 1;
+		if (left._order !== right._order) return left._order - right._order;
 		if (left._atRisk && right._atRisk && left._expiring !== right._expiring) return left._expiring - right._expiring;
 		if (left._expiringAmount !== right._expiringAmount) return right._expiringAmount - left._expiringAmount;
 		if (left.score !== right.score) return right.score - left.score;
@@ -4950,7 +5224,7 @@ async function workBuddyWebPool(deps, region) {
 	if (pool === void 0) return void 0;
 	const preferences = pool.preferences(region);
 	const members = await pool.members(region);
-	const ranked = rankPool(members, Date.now());
+	const ranked = rankPool(members, Date.now(), preferences.orderAccountIds);
 	const catalog = pool.catalog?.(region) ?? [];
 	const target = resolveTargetModel(catalog, preferences.targetModelId);
 	const currentAccountId = await pool.currentAccountId?.(region);
@@ -5015,6 +5289,11 @@ async function workBuddyWebPool(deps, region) {
 		...target.staleModelId === void 0 ? {} : { staleTargetModelId: target.staleModelId },
 		targetModelSource: target.source,
 		memberAccountIds: preferences.memberAccountIds,
+		...(() => {
+			const listed = new Set(accounts.map((account) => account.accountId));
+			const orderedIds = (preferences.orderAccountIds ?? []).filter((id) => listed.has(id));
+			return orderedIds.length === 0 ? {} : { orderAccountIds: orderedIds };
+		})(),
 		...preferences.probeInputTokens === void 0 ? {} : { probeInputTokens: preferences.probeInputTokens },
 		effectiveMemberAccountIds: effectiveMembersOf(accounts.map((account) => account.accountId), new Set(preferences.memberAccountIds)),
 		...memberNames === void 0 ? {} : { memberNames },
@@ -5638,7 +5917,8 @@ const poolConfig = z.object({
 	* an older build — and one hand-edited to something odd — behaves identically.
 	*/
 	probeInputTokens: z.number().step(1).default(0).description("Input tokens each test probe sends: 10000 / 20000 / 30000 / 50000 / 100000. Bigger probes catch a rate limit real conversations would hit, but cost more credit per test and may mark an account unusable for large requests only. 0 uses the measured default (25000)"),
-	memberAccountIds: z.array(z.string()).default([]).description("Account ids checked into this pool (opt-in; empty means the pool covers nothing)")
+	memberAccountIds: z.array(z.string()).default([]).description("Account ids checked into this pool (opt-in; empty means the pool covers nothing)"),
+	orderAccountIds: z.array(z.string()).default([]).description("The user's hand-ordered pool order, as account ids. Independent of membership: an id need not be checked in (it only takes effect once the account is a member), and ids not listed sort last. Separate from memberAccountIds so reordering never conflicts with, or is destroyed by, a membership edit.")
 });
 const regionStateConfig = z.object({
 	enabled: z.boolean().default(true).description("Whether this region's provider is offered to DSH (opt-out; false withdraws it entirely)"),
@@ -6413,7 +6693,8 @@ function apply(ctx, config) {
 	const failoverAccountFor = async (region, triedAccountIds) => {
 		if (!poolPreferencesOf(current(), region).enabled) return void 0;
 		const tried = new Set(triedAccountIds);
-		for (const row of rankPool(await localPoolMembers(region), Date.now())) {
+		const order = poolPreferencesOf(current(), region).orderAccountIds;
+		for (const row of rankPool(await localPoolMembers(region), Date.now(), order)) {
 			if (row.excludedBy !== void 0) continue;
 			if (tried.has(row.account.id)) continue;
 			const credential = await stacks[region].store.credentialFor(row.account.id);
@@ -6601,7 +6882,7 @@ function apply(ctx, config) {
 			store.setRotatedAccount(void 0);
 			return;
 		}
-		const winner = rankPool(await localPoolMembers(region), Date.now()).find((row) => row.excludedBy === void 0);
+		const winner = rankPool(await localPoolMembers(region), Date.now(), poolPreferencesOf(current(), region).orderAccountIds).find((row) => row.excludedBy === void 0);
 		store.setRotatedAccount(winner?.account.id);
 	};
 	/**
@@ -6620,7 +6901,7 @@ function apply(ctx, config) {
 		const credential = await stacks[region].store.current().catch(() => void 0);
 		if (credential === void 0) return false;
 		const servingId = workbuddyAccountId(credential);
-		const row = rankPool(await localPoolMembers(region), Date.now()).find((candidate) => candidate.account.id === servingId);
+		const row = rankPool(await localPoolMembers(region), Date.now(), poolPreferencesOf(current(), region).orderAccountIds).find((candidate) => candidate.account.id === servingId);
 		return row !== void 0 && row.excludedBy !== void 0;
 	};
 	/**
@@ -6686,7 +6967,8 @@ function apply(ctx, config) {
 			enabled: pool?.enabled === true,
 			targetModelId: pool?.targetModelId ?? "",
 			...probeInputTokens === void 0 ? {} : { probeInputTokens },
-			memberAccountIds: pool?.memberAccountIds ?? []
+			memberAccountIds: pool?.memberAccountIds ?? [],
+			orderAccountIds: pool?.orderAccountIds ?? []
 		};
 	};
 	/**

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "4.8.1",
+  "version": "4.9.0",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",