dsh-connect-workbuddy 5.8.1 → 5.8.3

package/lib/{host-heartbeat-CM-09T4U.js → host-heartbeat-DzfWuVsm.js}

@@ -2115,6 +2115,27 @@ function normalizeVerdictText(text) {
 	return text.normalize("NFKC").replace(/[\u200b-\u200d\ufeff]/gu, "").replace(/\s+/gu, " ").trim().toLowerCase();
 }
 /**
+* A `11140` body whose display fields decode to NOTHING at all.
+*
+* THE FAILURE MODE THIS CATCHES. `isAccountRestrictedBody` needs the business
+* code AND a phrase in `displayMsg` / `displayTips` / `msg` — deliberately, so a
+* shared sentence cannot bench an account. The mirror risk is a MISS: if the
+* upstream renames those fields, escapes them differently, or moves the
+* restriction wording somewhere new, every restriction degrades silently to
+* `policy_reject` and a benched-worthy account keeps taking traffic with no log
+* line anywhere. A genuine content refusal always carries the fields (its whole
+* point is a human-facing sentence), so a `11140` that decodes to no display
+* text at all is an anomalous envelope shape, not a normal refusal — exactly the
+* narrow condition worth a warning. Bodies WITH display text that merely lack
+* the restriction phrase are the everyday `policy_reject` and stay silent.
+*
+* Pure and side-effect-free: the caller (the transport layer, which holds the
+* injected logger) decides what to do with the answer.
+*/
+function isUndecodablePolicyBody(body) {
+	return isContentPolicyBody(body) && accountVerdictText(body) === "";
+}
+/**
 * Business code of the MODEL-scoped throttle (`14003`, "too many requests").
 *
 * The quoted-key form for the same reason as the policy markers: a request id is
@@ -3342,12 +3363,22 @@ function modelIdOfBody(bodyJson) {
 	}
 }
 /**
+* The optional run of `billion-context` markers every injected-prefix match
+* tolerates in front of the marker text, and the built-in marker alternatives.
+*/
+const INJECTED_ACP_MARKER_RUN = "(?:<acp\\b[^>]*>m\\d{1,8}<\\/acp>[ \\t]*\\r?\\n?)*";
+const INJECTED_BUILT_IN_PREFIXES = "Time sampled while preparing turn \\d+, step \\d+:|Current runtime context\\.|<system-reminder>|\\[Compressed conversation section\\]|This is an efficiency nudge";
+/**
 * Prefixes the DSH harness uses for the context it injects as `user` messages.
 *
 * MEASURED shapes, not guesses: the harness's time-context provider appends
 * `Time sampled while preparing turn N, step M: …`, its runtime-context
 * provider appends `Current runtime context. …`, and its reminders arrive as
-* `<system-reminder>` blocks. `billion-context` may additionally wrap each
+* `<system-reminder>` blocks. `billion-context` injects its compression record
+* and its efficiency note as `user` messages too (issue #133): the compressed
+* section opens with a bracketed `[Compressed conversation section]` heading
+* line, and the nudge opens with `This is an efficiency …`. `billion-context`
+* may additionally wrap each
 * message in an `<acp …>mNNNNN</acp>` marker, so the pattern TOLERATES that
 * marker in front of an injected block — the marker itself is never removed
 * from an injected message (see {@link ACP_LEADING_TAG} for where a marker IS
@@ -3357,7 +3388,24 @@ function modelIdOfBody(bodyJson) {
 * as it arrived — the alternative (moving "the last non-empty user message")
 * would reorder real conversations from other clients.
 */
-const INJECTED_USER_PREFIX = /^(?:<acp\b[^>]*>m\d{1,8}<\/acp>[ \t]*\r?\n?)*(?:Time sampled while preparing turn \d+, step \d+:|Current runtime context\.|<system-reminder>)/u;
+const INJECTED_USER_PREFIX = new RegExp(`^${INJECTED_ACP_MARKER_RUN}(?:${INJECTED_BUILT_IN_PREFIXES})`, "u");
+/**
+* Escape a user-supplied prefix so it can be embedded as a literal alternative.
+*/
+function escapeRegExp(text) {
+	return text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+/**
+* The prefix pattern for one request: the built-ins plus any configured
+* extras, each extra matched literally at the same position the built-ins
+* match (after optional leading whitespace and the `billion-context` marker).
+* Returns the shared built-in pattern when there are no usable extras.
+*/
+function injectedPrefixPattern(extras) {
+	const literals = (extras ?? []).filter((extra) => typeof extra === "string" && extra !== "");
+	if (literals.length === 0) return INJECTED_USER_PREFIX;
+	return new RegExp(`^${INJECTED_ACP_MARKER_RUN}(?:${INJECTED_BUILT_IN_PREFIXES}|${literals.map(escapeRegExp).join("|")})`, "u");
+}
 /**
 * The per-message marker `billion-context` puts in front of every message.
 *
@@ -3431,9 +3479,9 @@ function stripLeadingAcpTag(content) {
 	};
 }
 /** Whether this message is one of the harness's injected context blocks. */
-function isInjectedUserMessage(message) {
+function isInjectedUserMessage(message, pattern) {
 	if (message["role"] !== "user") return false;
-	return INJECTED_USER_PREFIX.test(textOfContent(message["content"]).replace(/^\s+/u, ""));
+	return pattern.test(textOfContent(message["content"]).replace(/^\s+/u, ""));
 }
 /**
 * Move the trailing injected `user` messages above the real prompt.
@@ -3441,22 +3489,22 @@ function isInjectedUserMessage(message) {
 * Returns `true` when the order changed, so the caller can serialize only once.
 * Never throws, and a body with nothing to move keeps its exact message order.
 */
-function keepPromptLast(messages) {
+function keepPromptLast(messages, pattern) {
 	let promptIndex = -1;
 	for (let index = messages.length - 1; index >= 0; index--) {
 		const value = messages[index];
 		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
 		const message = value;
 		if (message["role"] !== "user") continue;
-		if (isInjectedUserMessage(message)) continue;
+		if (isInjectedUserMessage(message, pattern)) continue;
 		if (textOfContent(message["content"]).trim() === "") continue;
 		promptIndex = index;
 		break;
 	}
 	if (promptIndex < 0) return false;
-	const trailing = messages.slice(promptIndex + 1).filter((value) => typeof value === "object" && value !== null && !Array.isArray(value) ? isInjectedUserMessage(value) : false);
+	const trailing = messages.slice(promptIndex + 1).filter((value) => typeof value === "object" && value !== null && !Array.isArray(value) ? isInjectedUserMessage(value, pattern) : false);
 	if (trailing.length === 0) return false;
-	const kept = messages.filter((value, index) => !(index > promptIndex && typeof value === "object" && value !== null && !Array.isArray(value) && isInjectedUserMessage(value)));
+	const kept = messages.filter((value, index) => !(index > promptIndex && typeof value === "object" && value !== null && !Array.isArray(value) && isInjectedUserMessage(value, pattern)));
 	kept.splice(promptIndex, 0, ...trailing);
 	const prompt = kept[promptIndex + trailing.length];
 	if (typeof prompt === "object" && prompt !== null && !Array.isArray(prompt)) {
@@ -3501,13 +3549,97 @@ function prepareChatBody(source, options) {
 		if (message["role"] === "developer") message["role"] = "system";
 	}
 	ensureSystemHead(obj);
-	if (options?.keepPromptLast === true && Array.isArray(obj["messages"])) keepPromptLast(obj["messages"]);
+	if (options?.keepPromptLast === true && Array.isArray(obj["messages"])) keepPromptLast(obj["messages"], injectedPrefixPattern(options.extraInjectedPrefixes));
 	neutralizeChannelFingerprints(obj);
 	normalizeToolChoice(obj);
 	dropRefusedReasoning(obj);
 	return JSON.stringify(obj);
 }
 /**
+* The host's session-title prompt template, verbatim up to the JSON payload.
+*
+* MEASURED in the installed DSH desktop 0.2.1-rc.2 `app.asar`, twice: the
+* request builder interpolates exactly this prefix before the JSON array of
+* `{seq, text}` records, and the host's own format validator asserts the
+* session-event carries the same text. Every title plugin the host bundles
+* (`dsh-session-title-llm`, `…-first-prompt-llm`, `…-all-prompts-llm`) shares
+* the template, so one prefix covers all variants. `purpose: 'session-title'`
+* exists on the host's `GenerateOptions` type but does not travel on the
+* OpenAI wire, so body shape is the only discriminator the shim has.
+*/
+const SESSION_TITLE_PROMPT_PREFIX = "Generate the session title from this JSON array of human messages:\n";
+const SESSION_TITLE_PROMPT_HEAD = "Generate the session title from this JSON array of human messages:";
+/**
+* The ASCII-only head of the template, up to (not including) its newline.
+*
+* The full prefix contains a raw newline, which a serialized body escapes to
+* `\n`, so `prepared.includes(SESSION_TITLE_PROMPT_PREFIX)` would MISS every
+* real title. This head is all plain ASCII, so it appears verbatim in the
+* serialized body whenever the host sends the template as a single text part
+* — which its own format validator asserts (`content.length === 1`). It
+* therefore makes a prefilter without false negatives for the real shape; a
+* body split mid-template across array parts would slip past it and simply
+* keep the pre-rewrite behaviour. False positives (a conversation quoting the
+* template) are fine: the full detection below rejects them — the prefilter
+* only skips work, never changes a verdict.
+*/
+/**
+* Rewrite a recognized session-title request onto the hidden lightweight model.
+*
+* WHY (issues #132/#133). The host asks its title plugins' prompt through the
+* same provider the conversation uses, so the title of every new session is
+* billed at the main paid model's rate. The reporter measured the upstream's
+* hidden `wb-lite` at 0 credits for exactly these requests (real upstream
+* calls, counted toward request volume, only fired once per new session), so
+* the rewrite moves the title to that model.
+*
+* DETECTION is fail-closed: the body is rewritten only when it has NO
+* assistant or tool messages and EXACTLY ONE `user` message, and that message
+* opens with the host's title template above. A real conversation can hardly
+* collide with the template (the host's own validator asserts it), and the
+* failure direction if the host ever rewords it is safe: the rewrite simply
+* stops, and the title is billed as before. `keepPromptLast` is unaffected —
+* the template prefix is not an injected-context marker, so a title body is
+* never reordered.
+*
+* WHAT is rewritten: the model id and the reasoning fields the lightweight
+* model does not accept. Everything else — `stream`, `max_tokens`, the
+* identity headers, every message byte — is untouched, so the other switches
+* keep behaving exactly as they do for conversation requests.
+*
+* Returns the original string unchanged when not enabled or not a title
+* request, so the caller does not need a separate shape check.
+*/
+function rewriteSessionTitleModel(prepared, options) {
+	if (options?.enabled !== true) return prepared;
+	if (!prepared.includes(SESSION_TITLE_PROMPT_HEAD)) return prepared;
+	let body;
+	try {
+		body = JSON.parse(prepared);
+	} catch {
+		return prepared;
+	}
+	if (typeof body !== "object" || body === null || Array.isArray(body)) return prepared;
+	const obj = body;
+	const messages = obj["messages"];
+	if (!Array.isArray(messages)) return prepared;
+	let titleText;
+	for (const value of messages) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return prepared;
+		const message = value;
+		if (message["role"] === "assistant" || message["role"] === "tool") return prepared;
+		if (message["role"] !== "user") continue;
+		if (titleText !== void 0) return prepared;
+		titleText = textOfContent(message["content"]);
+	}
+	if (titleText === void 0) return prepared;
+	if (!titleText.replace(/^\s+/u, "").startsWith(SESSION_TITLE_PROMPT_PREFIX)) return prepared;
+	obj["model"] = typeof options.model === "string" && options.model.trim() !== "" ? options.model.trim() : "wb-lite";
+	delete obj["reasoning_effort"];
+	delete obj["reasoning"];
+	return JSON.stringify(obj);
+}
+/**
 * Remove `reasoning_effort: "off"` when it would only ever fail (issue #83).
 *
 * The refusal table is keyed by exact model id, but the model a request
@@ -3957,7 +4089,7 @@ var WorkBuddyUpstreamClient = class {
 	onFallback;
 	identity;
 	/**
-	* Reports a fallback the catalog reader had to take.
+	* Reports an anomaly the reader or classifier had to tolerate.
 	*
 	* Injected rather than logged here because this module holds no logger on
 	* purpose — it is pure transport + parsing, so it stays importable from
@@ -3995,10 +4127,12 @@ var WorkBuddyUpstreamClient = class {
 			response
 		};
 		const text = (await response.text()).slice(0, ERROR_BODY_LIMIT);
+		const kind = classifyUpstreamError(response.status, text);
+		if (isUndecodablePolicyBody(text)) this.onFallback?.(`11140 失败体没有任何可解码的 displayMsg/displayTips/msg 字段，若上游调整了限制措辞或字段名，账号停权判定会全部漏判。失败体片段：${text.slice(0, 200)}`);
 		return {
 			ok: false,
 			status: response.status,
-			kind: classifyUpstreamError(response.status, text),
+			kind,
 			message: text,
 			detail: parseUpstreamErrorDetail(text)
 		};
@@ -6806,7 +6940,7 @@ function describeRosterSeenPayload(raw) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "5.8.1";
+const WORKBUDDY_CONNECT_VERSION = "5.8.3";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -6964,4 +7098,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { parseCreditMultiplier as $, isEncryptedCredentialError as A, isWorkbuddyBundle as At, WorkBuddyCredentialRejectedError as B, WorkBuddyCredentialStore as C, clearAtRestKeyCache as Ct, defaultDesktopAuthDirs as D, findWorkbuddyAppExecutable as Dt, defaultDesktopAuthCandidates as E, fetchAtRestKeyPayload as Et, workbuddyAccountId as F, workbuddyAppExecutableCandidates as Ft, forceNeutralHead as G, channelGateMemberOf as H, workbuddyOwnAuthPath as I, hostPeersInfo as It, isCredentialRejectedError as J, isContextTooLongBody as K, CONTEXT_OVERFLOW_MARKER as L, resolveDshHome as Lt, legacyWorkbuddyOwnAuthPath as M, macosNestedAppBundles as Mt, parseWorkBuddyAuth as N, openEncryptedField as Nt, defaultDesktopAuthPath as O, findWorkbuddyAppExecutableWithSource as Ot, preferredAccountName as P, readAtRestKey as Pt, openingEvidenceOfBody as Q, CREDENTIAL_REJECTED_CODE as R, withFileLock as Rt, WORKBUDDY_AUTH_FILE_ENV as S, WORKBUDDY_APP_EXECUTABLE_ENV as St, authFileName as T, deriveAtRestKeyId as Tt, classifyUpstreamError as U, WorkBuddyUpstreamClient as V, declaredTools as W, knownRegionOf as X, isFirstMessageGateBody as Y, modelIdOfBody as Z, deriveCatalog as _, parseQueueAnswer as _t, readHostHeartbeat as a, requestEvidenceOf as at, ENCRYPTED_CREDENTIAL_CODE as b, imageDefaultFor as bt, WORKBUDDY_CONNECT_VERSION as c, defaultOffModelIds as ct, rosterSeenPath as d, offRefused as dt, parseReasoning as et, piAiRuntimeInfo as f, recordRefusal as ft, applyContextBudgets as g, pickImageModel as gt, WorkBuddyCatalog as h, WorkBuddyImageError as ht, processStartTimeMs as i, regionOf as it, isVaultAccountId as j, macosBundleExecutable as jt, hasEncryptedCredentialFields as k, isEncryptedFieldWrapper as kt, createFileRosterSeenStore as l, lastRefusalFor as lt, FALLBACK_WORKBUDDY_MODELS_GLOBAL as m, DEFAULT_IMAGE_SIZE as mt, clearHostHeartbeat as n, perturbChannelFingerprints as nt, workbuddyHostHeartbeatPath as o, attachBusyLevels as ot, FALLBACK_WORKBUDDY_MODELS as p, withEffectiveOff as pt, isConversationIdGateBody as q, isHeartbeatProcessAlive as r, prepareChatBody as rt, writeHostHeartbeat as s, REFUSES_OFF_MODEL_IDS as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, parseUpstreamModel as tt, describeRosterSeenPayload as u, offDefaultFor as ut, fallbackModelsFor as v, queueNoticeText as vt, WorkBuddyEncryptedCredentialError as w, deriveAtRestKey as wt, WORKBUDDY_AUTH_FILENAME as x, nativeModalityOf as xt, withoutRouters as y, NATIVE_MODALITY_BY_MODEL_ID as yt, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as z, writeFileAtomic as zt };
+export { parseCreditMultiplier as $, isEncryptedCredentialError as A, isEncryptedFieldWrapper as At, WorkBuddyCredentialRejectedError as B, writeFileAtomic as Bt, WorkBuddyCredentialStore as C, WORKBUDDY_APP_EXECUTABLE_ENV as Ct, defaultDesktopAuthDirs as D, fetchAtRestKeyPayload as Dt, defaultDesktopAuthCandidates as E, deriveAtRestKeyId as Et, workbuddyAccountId as F, readAtRestKey as Ft, forceNeutralHead as G, channelGateMemberOf as H, workbuddyOwnAuthPath as I, workbuddyAppExecutableCandidates as It, isCredentialRejectedError as J, isContextTooLongBody as K, CONTEXT_OVERFLOW_MARKER as L, hostPeersInfo as Lt, legacyWorkbuddyOwnAuthPath as M, macosBundleExecutable as Mt, parseWorkBuddyAuth as N, macosNestedAppBundles as Nt, defaultDesktopAuthPath as O, findWorkbuddyAppExecutable as Ot, preferredAccountName as P, openEncryptedField as Pt, openingEvidenceOfBody as Q, CREDENTIAL_REJECTED_CODE as R, resolveDshHome as Rt, WORKBUDDY_AUTH_FILE_ENV as S, nativeModalityOf as St, authFileName as T, deriveAtRestKey as Tt, classifyUpstreamError as U, WorkBuddyUpstreamClient as V, declaredTools as W, knownRegionOf as X, isFirstMessageGateBody as Y, modelIdOfBody as Z, deriveCatalog as _, pickImageModel as _t, readHostHeartbeat as a, requestEvidenceOf as at, ENCRYPTED_CREDENTIAL_CODE as b, NATIVE_MODALITY_BY_MODEL_ID as bt, WORKBUDDY_CONNECT_VERSION as c, REFUSES_OFF_MODEL_IDS as ct, rosterSeenPath as d, offDefaultFor as dt, parseReasoning as et, piAiRuntimeInfo as f, offRefused as ft, applyContextBudgets as g, WorkBuddyImageError as gt, WorkBuddyCatalog as h, DEFAULT_IMAGE_SIZE as ht, processStartTimeMs as i, regionOf as it, isVaultAccountId as j, isWorkbuddyBundle as jt, hasEncryptedCredentialFields as k, findWorkbuddyAppExecutableWithSource as kt, createFileRosterSeenStore as l, defaultOffModelIds as lt, FALLBACK_WORKBUDDY_MODELS_GLOBAL as m, withEffectiveOff as mt, clearHostHeartbeat as n, perturbChannelFingerprints as nt, workbuddyHostHeartbeatPath as o, rewriteSessionTitleModel as ot, FALLBACK_WORKBUDDY_MODELS as p, recordRefusal as pt, isConversationIdGateBody as q, isHeartbeatProcessAlive as r, prepareChatBody as rt, writeHostHeartbeat as s, attachBusyLevels as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, parseUpstreamModel as tt, describeRosterSeenPayload as u, lastRefusalFor as ut, fallbackModelsFor as v, parseQueueAnswer as vt, WorkBuddyEncryptedCredentialError as w, clearAtRestKeyCache as wt, WORKBUDDY_AUTH_FILENAME as x, imageDefaultFor as xt, withoutRouters as y, queueNoticeText as yt, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as z, withFileLock as zt };

package/lib/index.d.ts

@@ -1403,6 +1403,20 @@ interface PrepareChatBodyOptions {
    * conversation whose trailing user messages are real turns.
    */
   keepPromptLast?: boolean;
+  /**
+   * Additional leading markers that mark a trailing `user` message as injected
+   * context, one literal prefix per entry.
+   *
+   * WHY. The built-in pattern at {@link INJECTED_USER_PREFIX} knows only the
+   * prefixes measured at the time it was written; a companion plugin (or a DSH
+   * update) that starts injecting new text would silently fall back to having
+   * its blocks recorded as the prompt. Each entry is matched LITERALLY at the
+   * start of the message text (after leading whitespace and the
+   * `billion-context` marker, which the built-in pattern tolerates) and OR'ed
+   * with the built-ins; entries are escaped, so no configuration value can turn
+   * the pattern invalid.
+   */
+  extraInjectedPrefixes?: readonly string[];
 }
 /**
  * Normalize an OpenAI chat-completions body for the WorkBuddy upstream: force
@@ -1468,7 +1482,7 @@ declare class WorkBuddyUpstreamClient {
   private readonly onFallback?;
   private readonly identity;
   /**
-   * Reports a fallback the catalog reader had to take.
+   * Reports an anomaly the reader or classifier had to tolerate.
    *
    * Injected rather than logged here because this module holds no logger on
    * purpose — it is pure transport + parsing, so it stays importable from
@@ -1973,6 +1987,24 @@ interface WorkBuddyShimOptions {
    * Default false: it changes bytes the upstream counts, so it is opt-in.
    */
   keepPromptLast?: boolean;
+  /**
+   * Extra literal prefixes (issue #133) treated like the harness's injected
+   * markers under `keepPromptLast`, for context blocks a companion plugin
+   * injects that the built-in list does not know about. Only read when
+   * `keepPromptLast` is on.
+   */
+  extraInjectedPrefixes?: readonly string[];
+  /**
+   * Move the host's session-title request onto the hidden lightweight model
+   * (issues #132/#133). Disabled by default; when enabled, a body recognized
+   * as the one-message title prompt is re-pointed at `model` (default
+   * `wb-lite`, measured 0 credits) instead of billing the main paid model.
+   * See `rewriteSessionTitleModel` for the fail-closed detection rules.
+   */
+  sessionTitle?: {
+    enabled?: boolean;
+    model?: string;
+  };
   /**
    * Pool failover for chat requests. Absent means no failover at all — the
    * pre-pool behaviour, where the selected account serves and its failure is
@@ -4825,6 +4857,34 @@ interface Config {
    * an explicit opt-in rather than a silent change on upgrade.
    */
   keepPromptLast?: boolean;
+  /**
+   * Extra literal prefixes (issue #133) treated like the harness's injected
+   * context markers when `keepPromptLast` is on, for injected blocks a
+   * companion plugin produces that the built-in list does not recognize. Each
+   * entry is matched literally at the start of a trailing `user` message.
+   */
+  extraInjectedPrefixes?: string[];
+  /**
+   * Move the host's session-title request onto the hidden lightweight model
+   * (issues #132/#133). Off by default: it is a real upstream request either
+   * way, and the rewrite changes which bucket it is billed against.
+   */
+  sessionTitle?: {
+    /**
+     * Whether title requests are re-pointed at {@link sessionTitle.model}.
+     * The host still fires the request exactly once per new session; the
+     * reporter measured the lightweight model at 0 credits for these calls
+     * (request volume still counts, and the evidence is reporter-level, not
+     * reproduced by this plugin).
+     */
+    enabled?: boolean;
+    /**
+     * Target model for the rewritten title request. Defaults to `wb-lite`,
+     * the hidden model the reporter measured; configurable in case the id
+     * changes or a region exposes a different one.
+     */
+    model?: string;
+  };
 }
 /**
  * Mark a schema's field as volatile on the DSH lines that support it.