dsh-deepseek-web-login 0.6.37 → 0.6.38

package/CHANGELOG.md

@@ -2,6 +2,70 @@
 
 本项目大致遵循语义化版本；日期为本地时间。
 
+## 0.6.38 — 2026-10-03
+
+工具调用协议从**裸 JSON** 改成**围栏包裹**（` ```dsh-tool `），根治"标记漏到正文"这一类问题。
+
+### 起因：用户拿 cuckoo 的分享页来对比
+
+用户问「为什么 cuckoo 不会出现 DSML 等内容，他不也是工具调用」。取它的分享页逐项统计：
+
+| | cuckoo | 我们（改之前） |
+|---|---|---|
+| 调用格式 | ` ```cuckoo ` **围栏代码块** | `{"tool_calls":[…]}` **裸 JSON** |
+| 页面里 `DSML` | **0** | 出现过 |
+| 页面里 `tool_calls` | **0** | 出现过 |
+| 页面里 `invoke` / `parameters` | **0** | 出现过 |
+
+**根因就在格式本身**：围栏**自带语法边界**，模型即使在围栏外多写一句废话也进不了正文；
+裸 JSON 没有边界 —— 模型在思考里写 JSON、或者在 JSON 前后多写一个字，整段直接成为正文。
+这也是为什么我们的规则 6 早就写着"禁止 XML 标记"却仍然漏：**禁令能约束内容，约束不了边界。**
+
+DSH 那侧**不用改**：我们把调用转成 `tool-call` 事件交给它，它只看事件、不看文本。
+
+### 改动
+
+**提示词**（两份，`TOOL_PROTOCOL_INSTRUCTIONS` 与串行版必须逐字一致）：
+
+- 示例与开头句改成 ` ```dsh-tool ` 包裹
+- rule 6 改为「必须用围栏包裹；不包裹的 JSON 与 XML 标记都会泄漏」
+
+**解析器**（`protocol.ts`）：
+
+- `stripCallFence()`：调用块前后**无条件**剥掉所有围栏（含 ```json 这类模型自选语言名）。
+  进入该函数的文本都已确定属于调用块，所以放宽是安全的。
+- `CALL_FENCE_OPEN_RE` + `sawCallFence`：在 `drain()` 里对**普通正文**判围栏。
+  ⚠️ 只认带 `dsh-tool` 的开栏，且**不**加"后面不是闭栏"的负向断言 ——
+  逐字符分块时开栏先到（JSON 还没来），那条断言会把它误判成闭栏而放行出去。
+- 闭栏只在本流见过开栏时才剥（`sawCallFence` 门控）。
+
+**没有动**：`extractBalancedJson` 要求 `{` 在开头这件事（靠捕获时先剥 head 解决）、
+DSH 侧的调用解析、裸 JSON 的支持路径（模型不听话时的兜底必须留着）。
+
+### 期间踩到的两个坑
+
+**① 放宽判据吃掉正常内容（真实回归）。** 一度无条件剥所有 ``` ⇒ `check-auto-continue` N03
+（正文里的 ```xml 示例）与 `check-tools-section` 各变红。曾试图用"独占一行的裸闭栏"补救，
+逐字符分块时闭栏还没成行、照样漏 user 的代码块。最终形态：**普通正文只认带 `dsh-tool` 的开栏**，
+闭栏靠 `sawCallFence` 配对。
+
+**② 围栏示例有体积成本。** `maxChars=5000` 的极小预算下，协议头占 3304/5000（66%），
+新增的围栏示例把工具定义挤掉了（`check-tools-section` 变红）。压掉 rule 6 与 rule 8 的冗余措辞后
+协议头 **2869 字符**（比改动前只多 55），工具定义恢复。`logic-test` 里加了一条上限断言
+（`< 3000`）防它悄悄涨回去。
+
+### 验证
+
+- `logic-test` 62 → **67 项**（5 条新围栏用例：整块/逐字符/按行三种分块 × 带散文、
+  正常代码块不许被剥、裸 JSON 兜底仍可用、协议指令必须要求围栏 + 体积上限）
+- `dev/probe-fenced-protocol.mjs`：7 种形态全部"调用提取成功 + 零泄漏"
+- DSML 矩阵 144/144 仍全拦得住
+- **四处变异手工确认打红**（脚本里的 `execFileSync` 在本机不可靠，变异写不进去 ⇒ 假"全绿"）：
+  开栏不扣留 → 2 红、flush 不剥闭栏 → 2 红、head 不剥围栏 → 1 红、`stripCallFence` 恒等 → 2 红
+- 又抓到一次**虚守卫**：提示词退回裸 JSON 时用例仍全绿（只查了 `includes('dsh-tool')`，
+  而围栏示例行里也有这个词）。补上"必须出现 `inside a fenced code block`"后变异正确打红。
+- `tsc` / smoke / 产物 / **64/64** 全过，真实留痕未污染
+
 ## 0.6.37 — 2026-10-03
 
 修 DSML 标记泄漏：`dsml-` 连字符变体**带空格**时整块原样上屏（用户分享页现场）。

package/lib/index.js

@@ -1449,22 +1449,24 @@ const HEAD_RATIO = .62;
 const PROTOCOL_SLACK_CHARS = 96;
 const TOOL_PROTOCOL_INSTRUCTIONS = `# Tool Calling Protocol
 
-You can call tools to complete the user's task. When you need a tool, output ONLY a single JSON object, with no other text before or after it:
+You can call tools to complete the user's task. When you need a tool, output a single JSON object inside a fenced code block, with no other text before or after it:
 
+\`\`\`dsh-tool
 {"tool_calls":[{"name":"<tool-name>","arguments":{<json-arguments>}}]}
+\`\`\`
 
 Rules:
 1. Put every tool you want to run in the "tool_calls" array (usually exactly one; a batch is allowed).
-2. Stop immediately after that JSON object. The runner executes the call(s) and returns the results to you as the next message.
+2. Stop immediately after the closing fence. The runner executes the call(s) and returns the results to you as the next message.
 3. Never fabricate, guess, or simulate tool output — always wait for the real result.
 4. When no tool is needed, answer normally in plain text and do NOT emit that JSON.
 5. "arguments" must be valid JSON (double-quoted strings, no trailing commas). When a value is a Windows path, escape backslashes as \\\\ (e.g. "C:\\\\Users\\\\me"); an unescaped single backslash makes the whole object unparsable. Close every brace: the call object and its "arguments" object each need their OWN closing "}" — one missing "}" makes the whole batch unparsable and the call will be discarded.
 5b. Two things break the JSON most often — check them before you emit:
    (a) QUOTES INSIDE A VALUE. A shell/PowerShell command very often contains double quotes, e.g. Get-ChildItem "$env:USERPROFILE\\.dsh". Every such inner double quote MUST be escaped as \\" inside the JSON string. An unescaped one ends the string early and discards the whole call.
    (b) LINE BREAKS INSIDE A VALUE. Never put a real line break inside a string; write \\n instead. When a command needs several statements, join them with ";" on ONE line, or use \\n escapes — do not paste them as actual newlines. Prefer single quotes inside commands to reduce escaping.
-6. Do NOT use XML/HTML-like markup for tool calls: no angle-bracket wrapper tags (no <tool_calls>, <invoke>, <parameter>), and none of the private delimiter-prefixed variants some DeepSeek surfaces use. The JSON object above is the ONLY accepted format. Markup is not just ignored — it leaks into the visible transcript (and into the web conversation) as broken output.
+6. Always wrap the JSON in a \`\`\`dsh-tool fence (see the example above). Do NOT use XML/HTML-like markup instead: no angle-bracket wrapper tags (no <tool_calls>, <invoke>, <parameter>), nor the private delimiter-prefixed variants some DeepSeek surfaces use. An unfenced object or any such markup leaks into the visible transcript and into the web conversation.
 7. Always answer in the same language the user writes in (these instructions are English only for precision; the JSON itself is language-neutral).
-8. NEVER reproduce the transcript. Do not restate previous turns, "[Tool Result …]" blocks, tool output, or the current prompt. Emit ONLY the calls you want to run right now. A payload that replays earlier calls or embeds tool results is discarded and costs a retry — measured case: a model emitted 15 replayed calls inside one 8152-char payload, and every one of them had to be thrown away.
+8. NEVER reproduce the transcript. Do not restate previous turns, "[Tool Result …]" blocks, tool output, or the current prompt. Emit ONLY the calls you want to run right now. A payload that replays earlier calls or embeds tool results is discarded and costs a retry.
 9. Keep each batch SMALL — at most 3 calls, and prefer exactly 1. If you need more, send them in successive steps. Long payloads are the ones that most often come out malformed.
 10. Each call must be able to run on its own: no shared shell variables across calls, no dependence on another call in the same batch.`;
 /**
@@ -1482,22 +1484,24 @@ Rules:
 */
 const SERIAL_TOOL_PROTOCOL_INSTRUCTIONS = `# Tool Calling Protocol
 
-You can call tools to complete the user's task. When you need a tool, output ONLY a single JSON object, with no other text before or after it:
+You can call tools to complete the user's task. When you need a tool, output a single JSON object inside a fenced code block, with no other text before or after it:
 
+\`\`\`dsh-tool
 {"tool_calls":[{"name":"<tool-name>","arguments":{<json-arguments>}}]}
+\`\`\`
 
 Rules:
 1. Put exactly ONE tool in the "tool_calls" array — one call per message, never a batch.
-2. Stop immediately after that JSON object. The runner executes the call and returns the result to you as the next message.
+2. Stop immediately after the closing fence. The runner executes the call and returns the result to you as the next message.
 3. Never fabricate, guess, or simulate tool output — always wait for the real result.
 4. When no tool is needed, answer normally in plain text and do NOT emit that JSON.
 5. "arguments" must be valid JSON (double-quoted strings, no trailing commas). When a value is a Windows path, escape backslashes as \\\\ (e.g. "C:\\\\Users\\\\me"); an unescaped single backslash makes the whole object unparsable. Close every brace: the call object and its "arguments" object each need their OWN closing "}" — one missing "}" makes the whole batch unparsable and the call will be discarded.
 5b. Two things break the JSON most often — check them before you emit:
    (a) QUOTES INSIDE A VALUE. A shell/PowerShell command very often contains double quotes, e.g. Get-ChildItem "$env:USERPROFILE\\.dsh". Every such inner double quote MUST be escaped as \\" inside the JSON string. An unescaped one ends the string early and discards the whole call.
    (b) LINE BREAKS INSIDE A VALUE. Never put a real line break inside a string; write \\n instead. When a command needs several statements, join them with ";" on ONE line, or use \\n escapes — do not paste them as actual newlines. Prefer single quotes inside commands to reduce escaping.
-6. Do NOT use XML/HTML-like markup for tool calls: no angle-bracket wrapper tags (no <tool_calls>, <invoke>, <parameter>), and none of the private delimiter-prefixed variants some DeepSeek surfaces use. The JSON object above is the ONLY accepted format. Markup is not just ignored — it leaks into the visible transcript (and into the web conversation) as broken output.
+6. Always wrap the JSON in a \`\`\`dsh-tool fence (see the example above). Do NOT use XML/HTML-like markup instead: no angle-bracket wrapper tags (no <tool_calls>, <invoke>, <parameter>), nor the private delimiter-prefixed variants some DeepSeek surfaces use. An unfenced object or any such markup leaks into the visible transcript and into the web conversation.
 7. Always answer in the same language the user writes in (these instructions are English only for precision; the JSON itself is language-neutral).
-8. NEVER reproduce the transcript. Do not restate previous turns, "[Tool Result …]" blocks, tool output, or the current prompt. Emit ONLY the calls you want to run right now. A payload that replays earlier calls or embeds tool results is discarded and costs a retry — measured case: a model emitted 15 replayed calls inside one 8152-char payload, and every one of them had to be thrown away.
+8. NEVER reproduce the transcript. Do not restate previous turns, "[Tool Result …]" blocks, tool output, or the current prompt. Emit ONLY the calls you want to run right now. A payload that replays earlier calls or embeds tool results is discarded and costs a retry.
 9. Do NOT batch. Emit one call, stop, and wait for its real result before you decide the next step. Needing several tools means several successive messages, one call each — the user has turned batching off for this session, so a multi-call array works against them.
 10. Unlike a batch, a call here MAY build on the previous step's result — read what came back and use it. That is the point of one-at-a-time. But never invent a result you have not received.`;
 /**
@@ -2006,9 +2010,30 @@ const DSML_PREFIX = `(?:${DSML_PREFIX_BODY})?`;
 /** 整组**必需**（给"必须有前缀才剥"的场合用，如 `invoke`）。 */
 const DSML_PREFIX_ONLY = `(?:${DSML_PREFIX_BODY})`;
 const XML_STARTER_RE = new RegExp(`<\\s*${DSML_PREFIX}(${WRAPPER_NAMES}|invoke)\\b`, "i");
-/** 代码围栏收尾（模型常把调用块放进 ``` 里）。 */
-const FENCE_TAIL_RE = /\n?[ \t]*```[a-zA-Z0-9]*[ \t]*\n?$/;
 const FENCE_HEAD_RE = /^[ \t]*\n?```[ \t]*\n?/;
+/** 捕获态里出现的围栏（含语言名、不要求行首）。 */
+const FENCE_ANY_HEAD_RE = /\n?[ \t]*```[ \t]*[a-zA-Z0-9_-]*[ \t]*\n?/;
+const CALL_FENCE_OPEN_RE = new RegExp(`\`\`\`[ \\t]*dsh-tool[ \\t]*\\n?`, "i");
+/**
+* 闭栏（可能带语言名）。**只在 sawCallFence 为真时使用** ——
+* 那表示开栏已经被剥掉，这个闭栏必定是调用块的另一半。
+*
+* ⚠️ 闭栏**不能**在 `drain()` 里按"位置"裸判（`/\n?```…$/` 那种）：用户正常回答里的
+* 代码块闭栏也会命中，逐字符分块时必现（`check-auto-continue` N03 抓到过）。
+*/
+const CALL_FENCE_TAIL_RE = /\n?[ \t]*```[ \t]*(?:[a-zA-Z0-9_-]*)[ \t]*\n?$/;
+/**
+* 剥掉**属于调用块**的围栏（0.6.38）。
+*
+* ⚠️ 这里可以**无条件剥所有围栏**（包括裸 ``` 和 ```json）：进入本函数的文本都已经
+* 确定属于一个调用块 —— 捕获态的 buffer，或紧跟其后残留的部分。
+* 那个"不要误伤用户代码块"的约束在**别处**（`drain()` 里对**普通正文**的判据），
+* 那里用 `CALL_FENCE_OPEN_RE` + `sawCallFence` 把关。
+* 模型也常用 ```json 包裹调用（`logic-test` 有用例守着），那些围栏同样该剥。
+*/
+function stripCallFence(text) {
+	return text.replace(/```[ \t]*[a-zA-Z0-9_-]*[ \t]*\n?/g, "");
+}
 /**
 * 开/收标签前缀（宽容写法）。严格解析与宽容解析**必须共用同一套**，否则会出现
 * 「findXmlToolCallEnd 认得出收尾、parseXmlToolCalls 认不出 invoke」→ 整块被降级成正文泄漏。
@@ -2628,7 +2653,7 @@ function parseToolCallJson(json) {
 * 注意：不配平的截断仍由 structuralRepairCandidates 的安全闸门拒绝（宁可不执行半条命令）。
 */
 function parseSalvagedToolCallJson(buffer) {
-	const text = buffer.replace(FENCE_HEAD_RE, "");
+	const text = buffer.replace(FENCE_ANY_HEAD_RE, "").replace(/^\s+/, "");
 	const direct = parseToolCallJson(text);
 	if (direct) return direct;
 	const balanced = extractBalancedJson(text);
@@ -2702,6 +2727,14 @@ var ToolCallStreamFilter = class {
 	capture = null;
 	abandoned = null;
 	knownTools;
+	/**
+	* 本次流里**我们剥掉过一个调用围栏的开栏**（0.6.38）。
+	*
+	* ⇒ 之后出现的闭栏必定是同一个调用块的收尾，可以安全剥掉。
+	* ⚠️ 有了这个标记才敢剥闭栏：否则"正文里正常的代码块"会被误伤
+	* （`check-auto-continue` N03 / `check-tools-section` 各有用例守着）。
+	*/
+	sawCallFence = false;
 	constructor(knownTools) {
 		this.knownTools = knownTools;
 	}
@@ -2736,7 +2769,8 @@ var ToolCallStreamFilter = class {
 			else out.text += stripStrayToolMarkup(captured.buffer);
 			this.capture = null;
 		}
-		out.text += stripStrayToolMarkup(this.pending);
+		const tailText = stripStrayToolMarkup(this.pending);
+		out.text += this.sawCallFence ? tailText.replace(CALL_FENCE_TAIL_RE, "") : tailText;
 		this.pending = "";
 		if (this.abandoned) out.rejected = this.abandoned;
 		return out;
@@ -2770,7 +2804,7 @@ var ToolCallStreamFilter = class {
 					};
 					else out.text += stripStrayToolMarkup(block);
 					this.capture = null;
-					this.pending = captured.buffer.slice(end).replace(FENCE_HEAD_RE, "") + this.pending;
+					this.pending = stripCallFence(captured.buffer.slice(end)) + this.pending;
 					continue;
 				}
 				const balanced = extractBalancedJson(captured.buffer);
@@ -2790,7 +2824,7 @@ var ToolCallStreamFilter = class {
 				if (calls) {
 					out.calls.push(...calls);
 					this.capture = null;
-					this.pending = captured.buffer.slice(balanced.end).replace(FENCE_HEAD_RE, "") + this.pending;
+					this.pending = stripCallFence(captured.buffer.slice(balanced.end)) + this.pending;
 					continue;
 				}
 				const head = captured.buffer.slice(0, balanced.end);
@@ -2811,9 +2845,9 @@ var ToolCallStreamFilter = class {
 			const useXml = xmlIndex !== -1 && (jsonIndex === -1 || xmlIndex < jsonIndex);
 			const index = useXml ? xmlIndex : jsonIndex;
 			if (index !== -1) {
-				let head = this.pending.slice(0, index);
-				const fence = FENCE_TAIL_RE.exec(head);
-				if (fence) head = head.slice(0, fence.index);
+				const rawHead = this.pending.slice(0, index);
+				const head = stripCallFence(rawHead);
+				if (head !== rawHead) this.sawCallFence = true;
 				out.text += head;
 				this.capture = {
 					mode: useXml ? "xml" : "json",
@@ -2823,6 +2857,13 @@ var ToolCallStreamFilter = class {
 				continue;
 			}
 			this.pending = stripStrayToolMarkup(this.pending);
+			const ownFence = CALL_FENCE_OPEN_RE.exec(this.pending);
+			if (ownFence) {
+				this.sawCallFence = true;
+				out.text += this.pending.slice(0, ownFence.index);
+				this.pending = this.pending.slice(ownFence.index);
+				return;
+			}
 			if (this.pending.length <= HOLD_BACK_CHARS) return;
 			const hold = partialMarkerSuffixLength(this.pending);
 			if (hold > 0) {
@@ -2830,6 +2871,11 @@ var ToolCallStreamFilter = class {
 				this.pending = this.pending.slice(this.pending.length - hold);
 				return;
 			}
+			if (this.sawCallFence && this.pending.includes("```")) {
+				out.text += this.pending.replace(CALL_FENCE_TAIL_RE, "");
+				this.pending = "";
+				return;
+			}
 			out.text += this.pending;
 			this.pending = "";
 			return;
@@ -10482,7 +10528,7 @@ async function checkForUpdate(current, fetchImpl) {
 * 兜底常量与 package.json 的一致性由 `tests/check-smoke.mjs` 守着，不会漂。
 */
 /** 与 package.json 保持一致的兜底版本（由测试保证不会漂）。 */
-const FALLBACK_VERSION = "0.6.37";
+const FALLBACK_VERSION = "0.6.38";
 let cached;
 /** 本插件版本（如 `0.1.26`）。 */
 function pluginVersion() {