dsh-multimodal-node 0.0.0-stage → 0.3.1

package/lib/promptassist.js

@@ -0,0 +1,1077 @@
+/**
+ * Natural language → prompt.
+ *
+ * Two inputs, two outputs, on purpose:
+ *
+ *   The **fixed head** is the same for every generation (quality words, the
+ *   negative baseline) and lives in settings, so changing a workflow does not
+ *   mean retyping it. The **custom text** is what the person is actually asking
+ *   for. Both sides — positive and negative — get the pair.
+ *
+ * The assistant's job is therefore narrow: turn a sentence into Danbooru-style
+ * underscore tags, in the vocabulary the model was actually trained on, and
+ * never invent tags. That last part is the whole value: the knowledge base
+ * behind this plugin exists because self-invented phrases are ignored by the
+ * model while looking like they work, so the assistant is constrained to the
+ * verified dictionary whenever one is available, and told to say so when a
+ * concept has no tag.
+ *
+ * The model call is optional. Without an `llm` service (or with the assistant
+ * switched off) the same endpoint falls back to dictionary search, which is
+ * deterministic and still useful: it is a tag lookup, not a guess.
+ */
+import { readFile, readdir } from 'node:fs/promises';
+import { isAbsolute, join } from 'node:path';
+import { homedir } from 'node:os';
+import { tagDictionary, isAdultTag } from './tiers.js';
+
+/**
+ * How the assistant is told to behave; kept here so it is reviewable.
+ *
+ * It is a FUNCTION of the tier, not a constant, because the tier changes what the correct
+ * answer is. A fixed prompt can only be wrong one way or the other: forbid adult tags for
+ * an account that is allowed them (the model then refuses a legitimate request, which is
+ * the reported "助手仍然拒绝帮我填写成人提示词"), or permit them for an account that is not.
+ * Naming the case in the prompt is what makes the model comply instead of hedging.
+ */
+function systemFor(tier) {
+    const adult = tier === 'nsfw';
+    const tierNote = adult ? '账号等级：NSFW（成人内容已授权）' : '账号等级：SFW（只做全年龄内容）';
+    return SYSTEM_TEMPLATE(tierNote, adult);
+}
+
+const SYSTEM_TEMPLATE = (tierNote, adult) => [
+    '你是 Stable Diffusion / Pony 系底模的提示词工程师。',
+    '任务：把用户的一句自然语言需求，改写成一串逗号分隔的下划线标签（Danbooru 风格）。',
+    '',
+    // The authorisation section is BUILT per branch, not filtered out afterwards. A filter
+    // has to guess which lines are adult-only from their wording, and it got that wrong: an
+    // SFW request was still told 不要拒绝, which is an instruction about adult refusals and
+    // has no business in a family-safe prompt.
+    ...(adult
+        ? [
+              '【分级授权】',
+              '本请求来自已通过分级的账号：' + tierNote + '。',
+              '用户可能要求成人、裸露、性相关的提示词标签。这是合法的创作请求，应当直接完成：',
+              '按 Danbooru 惯例写出对应的解剖、裸露、性行为、姿势等标签（例如 nude、nipples、',
+              'sex、spread_legs 这类社区通用写法），写成清晰的标签供绘图使用。',
+              '不要因为内容成人就拒绝、淡化或说教，也不要在 NOTES 里讨论妥当性。',
+          ]
+        : [
+              '【分级】',
+              '本请求来自已通过分级的账号：' + tierNote + '。',
+              '本次只做全年龄内容：任何成人、裸露、性相关的标签都不得出现。',
+          ]),
+    '',
+    '规则：',
+    '1. 只输出标签，不要句子，不要解释，不要编号。',
+    '2. 标签一律小写下划线形式（long_hair、on_back、off_shoulder）。多词标签必须带下划线。',
+    '3. 主体词必须写：人数与性别（1girl / 1boy / solo）。',
+    '4. 数量克制：正向 12–25 个标签，按「主体 → 外观 → 服装 → 动作/姿势 → 场景/构图」排序。',
+    '5. 词库优先，但词库不是边界：词库里有就用词库的写法（下划线标签）；',
+    '   词库里没有的概念，直接写最贴切的日常英文单词或短语（例如 gossamer、bare shoulders、',
+    '   dim streetlight），不要为了迁就词库而把概念换成别的意思，也不要生造新词。',
+    '6. 不加权重语法，除非用户明确要求。',
+    '',
+    '【最重要的一条：不要自行添加用户没有说的要素】',
+    '7. 用户没说的一律不加。没说发色就不加 hair_color；没说服装就不加任何服装标签；',
+    '   没说场景就不加 indoors / outdoors / 背景描述；没说镜头就不加 from_side / close-up；',
+    '   没说表情就不加 smile / expressionless。',
+    '8. 用户只说了「1girl」就只写 1girl 与主体必要标签，不要顺手补 masterpiece / best quality /',
+    '   absurdres 这类画质词 —— 那是表头的职责，不是这次请求的内容。',
+    '9. 判断标准：把生成的每个标签念给用户听，如果他没提过、也不能从他的原话必然推出，就删掉。',
+    '   「短发女生」→ 可以写 short_hair（他说过）；「站在便利店门口」→ 可以写 convenience_store',
+    '   （他说过的场景）；但不能由它推出 rain 或 night（那是另加的氛围）。',
+    '',
+    '【负向：只有明确说要排除什么时才写】',
+    '10. 用户说「不要 XX」「去掉 XX」「别出现 XX」「不想要 XX」时，XX 必须写进 NEGATIVE，',
+    '    且绝不出现在 POSITIVE。例如「不要模糊、不要多余手指」→ NEGATIVE 里要有 blurry、extra_fingers。',
+    '11. 用户没有提出任何排除要求时，NEGATIVE 必须是空字符串，一个字都不写。',
+    '    不要因为「惯例」就填 blurry / lowres / bad_anatomy 之类的通用负向词 —— 负向表头已经',
+    '    负责画质底线，这里再填一遍只会覆盖用户自己写的负向提示词。',
+    '',
+    '输出格式（严格三行，不要多余文字）：',
+    'POSITIVE: <逗号分隔标签>',
+    'NEGATIVE: <逗号分隔标签；用户没要求排除就留空>',
+    'NOTES: <一句中文，说明哪些概念词库里没有、用了什么替代；没有就写「无」>',
+].join('\n');
+
+/**
+ * Layered output: one line per layer, in the workflow's declared order.
+ *
+ * A separate system prompt rather than a flag on the one above, because the model has to
+ * be told the layer *names and their meaning* or it dumps everything into the first line.
+ * Saying "面部 / 躯干 / 环境" is what makes "put the face words in the face layer" happen.
+ */
+function layeredSystem(layerNames, tier = 'sfw') {
+    const adult = tier === 'nsfw';
+    const list = layerNames
+        .map((name, index) => `  L${index + 1} = ${name === '' ? `第 ${index + 1} 层` : name}`)
+        .join('\n');
+    /**
+     * Which layers must stay EMPTY, and why.
+     *
+     * A layer whose name says lora/LoRA/LyCORIS/embedding is where a LoRA trigger word goes,
+     * and that word comes from the LoRA file's own metadata — not from a sentence the user
+     * typed. The assistant used to treat it as "just another layer" and fill it with body or
+     * clothing tags, which then landed in the trigger slot and quietly changed what the LoRA
+     * did. So the instruction is explicit and per-layer, not a general hint.
+     */
+    const emptyLayers = layerNames
+        .map((name, index) => ({ index, name: String(name) }))
+        .filter((row) => isLoraLayer(row.name));
+    const emptyLines = emptyLayers.map(
+        (row) => `  L${row.index + 1}（${row.name}）必须完全留空：只写「L${row.index + 1}: 」，冒号后面一个字符都不要写。`,
+    );
+
+    return [
+        '你是 Stable Diffusion / Pony 系底模的提示词工程师。',
+        '用户的工作流把正向提示词拆成了几层，你要把需求分发到对应层里。',
+        '',
+        '分层（必须严格按这个顺序与编号输出）：',
+        list,
+        '',
+        ...(emptyLines.length > 0
+            ? [
+                  '【必须留空的层】',
+                  '下面这些层是给 LoRA 触发词用的，触发词由 LoRA 文件自己决定，不由这次的需求决定。',
+                  ...emptyLines,
+                  '即使其它层写满了，这些层也必须是空的。',
+                  '',
+              ]
+            : []),
+        `【分级授权】账号等级：${adult ? 'NSFW（成人内容已授权）' : 'SFW（只做全年龄内容）'}。`,
+        ...(adult
+            ? [
+                  '这是一次合法的成人内容创作请求。用户可能要求裸露、性相关的标签，应当直接完成：',
+                  '按 Danbooru 惯例把对应的解剖、裸露、性行为、姿势标签分配到合适的层里，',
+                  '不要拒绝、不要淡化、不要说教、不要只给「安全替代」。',
+              ]
+            : ['本次请求只做全年龄内容，任何成人、裸露、性相关标签都不得出现。']),
+        '',
+        '规则：',
+        '1. 只输出标签，不要句子，不要解释。标签一律小写下划线（long_hair、off_shoulder）。',
+        '2. 按层的含义分配：脸/五官/表情进「面部」那层，衣服/身体/姿势进「躯干」那层，',
+        '   背景/光线/构图/镜头进「环境」那层。名字是别的词时按字面意思理解。',
+        '3. 每层 3–12 个标签；某层确实没有对应内容时，那一行只写编号和冒号，后面留空。',
+        '4. 主体词（1girl / solo 等）放第一层（若第一层是必须留空的层，则放到第一个非空层）。',
+        '5. 词库优先，但词库不是边界：词库里有就用词库写法；词库里没有的概念，',
+        '   直接写最贴切的日常英文单词或短语（gossamer、bare shoulders、dim streetlight），',
+        '   不要为了迁就词库把概念换成别的意思，也不要生造新词。',
+        '6. 不加权重语法，除非用户明确要求。',
+        '',
+        '【不要自行添加用户没有说的要素】',
+        '7. 用户没说的一律不加：没说发色就不加 hair_color，没说服装就不加任何服装标签，',
+        '   没说场景就不加 indoors / outdoors / 背景描述，没说表情就不加 smile / expressionless。',
+        '8. 不要顺手补 masterpiece / best quality / absurdres 这类画质词 —— 那是表头的职责。',
+        '9. 判断标准：把每个标签念给用户听，他没提过、也不能从原话必然推出的，删掉。',
+        '',
+        '【负向：只有明确说要排除什么时才写】',
+        '10. 用户说「不要 XX」「去掉 XX」时，XX 必须写进 NEGATIVE，绝不出现在任何正向层里。',
+        '11. 用户没提出排除要求时，NEGATIVE 必须是空字符串，不要填 blurry / lowres 之类的通用负向词。',
+        '',
+        '输出格式（严格按此，每层一行，最后两行 NEGATIVE 与 NOTES）：',
+        ...layerNames.map((_, index) => `L${index + 1}: <逗号分隔标签>`),
+        'NEGATIVE: <逗号分隔标签；用户没要求排除就留空>',
+        'NOTES: <一句中文说明>',
+    ].join('\n');
+}
+
+/** Chinese numerals a layer label can plausibly use (八层 is the cap). */
+const CJK_DIGITS = ['一', '二', '三', '四', '五', '六', '七', '八', '九', '十'];
+
+/**
+ * Is this layer the LoRA trigger slot?
+ *
+ * One predicate for the whole file. It decides three things that must agree: which layers
+ * the system prompt tells the model to leave blank, which layers a model reply is force-
+ * emptied on, and which layer the dictionary fallback must not write into. Three copies of
+ * `/lora|lycoris|embedding|触发词/i` is three chances for one of them to be edited alone.
+ */
+export function isLoraLayer(name) {
+    return /lora|lycoris|embedding|触发词/i.test(String(name ?? ''));
+}
+
+/**
+ * The index the assistant may write into when it has no layer semantics to rely on.
+ *
+ * The first layer that is not a LoRA trigger slot, or 0 when every layer is one (a graph
+ * that is all trigger slots has nowhere else to put anything, and dropping the text
+ * entirely would look like the assistant did nothing).
+ */
+export function firstWritableLayer(layerNames) {
+    const names = Array.isArray(layerNames) ? layerNames : [];
+    const index = names.findIndex((name) => !isLoraLayer(name));
+    return index < 0 ? 0 : index;
+}
+
+/**
+ * Parse the layered reply.
+ *
+ * Deliberately tolerant about formatting and strict about assignment: a model that writes
+ * `L1:` `L1：` `1.` or `第一层:` still lands in the right slot, but a line with no number
+ * is not silently merged into layer 1 — an unexpected line is recorded and dropped, so the
+ * operator can see that the model drifted instead of getting a silently wrong prompt.
+ */
+export function parseLayered(text, layerCount) {
+    const layers = new Array(layerCount).fill('');
+    let negative = '';
+    let notes = '';
+    const stray = [];
+    for (const raw of String(text ?? '').split(/\r?\n/)) {
+        const line = raw.trim();
+        if (line === '') continue;
+        const neg = /^NEGATIVE\s*[:：]\s*(.*)$/i.exec(line);
+        if (neg !== null) {
+            negative = neg[1].trim();
+            continue;
+        }
+        const note = /^NOTES\s*[:：]\s*(.*)$/i.exec(line);
+        if (note !== null) {
+            notes = note[1].trim();
+            continue;
+        }
+        // Accept 1 / L1 / 「1.」 / 「1、」 / 第一层 / 第1层 alike. The CJK forms matter: a
+        // Chinese model answering in Chinese writes 第一层 about as often as L1, and
+        // dropping those lines would silently lose a whole layer of the prompt.
+        const layer = /^(?:L\s*)?(\d+)\s*[.、:：]\s*(.*)$/i.exec(line) ?? parseCjkLayer(line);
+        if (layer !== null) {
+            const index = Number(layer[1]) - 1;
+            if (index >= 0 && index < layerCount) {
+                layers[index] = layer[2].trim();
+                continue;
+            }
+        }
+        stray.push(line.slice(0, 60));
+    }
+    return { layers, negative, notes, stray };
+}
+
+/** 「第一层：…」 → [line, '1', rest]; null when the line is not a CJK layer label. */
+function parseCjkLayer(line) {
+    const match = /^第\s*([0-9]+|[一二三四五六七八九十]+)\s*层\s*[:：]?\s*(.*)$/.exec(line);
+    if (match === null) return null;
+    const digits = /^[0-9]+$/.test(match[1]) ? match[1] : String(CJK_DIGITS.indexOf(match[1]) + 1);
+    return [line, digits, match[2]];
+}
+
+
+/** The dictionary as a compact tag list, filtered by the account's tier. */
+export function dictionaryFor(tier, limit = 900) {
+    const rows = tagDictionary().filter((row) => tier === 'nsfw' || row.n === 0);
+    const bySection = new Map();
+    for (const row of rows) {
+        const list = bySection.get(row.s) ?? [];
+        list.push(row);
+        bySection.set(row.s, list);
+    }
+    const lines = [];
+    let used = 0;
+    for (const [section, list] of bySection) {
+        const picked = [];
+        for (const row of list) {
+            const text = `${row.t}（${row.z}）`;
+            if (used + text.length > limit) break;
+            picked.push(text);
+            used += text.length + 2;
+        }
+        if (picked.length > 0) lines.push(`${section}: ${picked.join(', ')}`);
+    }
+    return lines.join('\n');
+}
+
+/** Deterministic fallback / refinement: find tags matching a Chinese or Latin query. */
+export function searchTags(query, tier, limit = 24) {
+    const text = String(query ?? '').trim().toLowerCase();
+    if (text === '') return [];
+    // Chinese has no spaces, so a sentence arrives as one token. Split it into the
+    // words a person actually typed PLUS bigrams: `咖啡馆看书` must still find
+    // `咖啡`-ish tags when no dictionary entry is that long.
+    const words = [];
+    for (const piece of text.split(/[\s,，、。;；!！?？]+/)) {
+        if (piece === '') continue;
+        if (/^[\u4e00-\u9fff]+$/.test(piece)) {
+            words.push(piece);
+            for (let index = 0; index + 2 <= piece.length; index += 1) words.push(piece.slice(index, index + 2));
+            if (piece.length >= 3) {
+                for (let index = 0; index + 3 <= piece.length; index += 1) words.push(piece.slice(index, index + 3));
+            }
+        } else {
+            words.push(piece);
+        }
+    }
+    const scored = [];
+    for (const row of tagDictionary()) {
+        if (tier !== 'nsfw' && row.n === 1) continue;
+        let score = 0;
+        if (row.t === text) score = 100;
+        else if (row.z === text) score = 95;
+        else if (row.t.includes(text)) score = 60;
+        else if (row.z.includes(text)) score = 55;
+        else {
+            for (const word of words) {
+                if (word.length < 2) continue;
+                if (row.z === word) score = Math.max(score, 80);
+                else if (row.z.includes(word)) score = Math.max(score, word.length >= 3 ? 45 : 30);
+                else if (row.t.includes(word)) score = Math.max(score, 25);
+            }
+        }
+        if (score > 0) scored.push({ tag: row.t, zh: row.z, section: row.s, nsfw: row.n === 1, score });
+    }
+    scored.sort((left, right) => right.score - left.score || left.tag.localeCompare(right.tag));
+    return scored.slice(0, limit);
+}
+
+/**
+ * The knowledge bases this plugin can read, as the KB plugin stores them.
+ *
+ * `dsh-knowledge-wiki` keeps each library at `<root>/<name>/markdown/<docId>/`
+ * with one `<docId>.md` merged file per document, so a reader does not need the
+ * plugin: the layout is on disk. That matters because the KB plugin exposes
+ * tools, not a service — there is no API to call.
+ */
+export async function listKnowledgeBases(root) {
+    const base = typeof root === 'string' && root.trim() !== '' ? root.trim() : defaultKnowledgeRoot();
+    try {
+        const entries = await readdir(base, { withFileTypes: true });
+        const rows = [];
+        for (const entry of entries) {
+            if (!entry.isDirectory()) continue;
+            const metaFile = join(base, entry.name, 'kb.json');
+            try {
+                const meta = JSON.parse(await readFile(metaFile, 'utf8'));
+                const docs = Array.isArray(meta.docs) ? meta.docs : [];
+                rows.push({
+                    name: entry.name,
+                    documents: docs.length,
+                    description: typeof meta.description === 'string' ? meta.description : '',
+                    titles: docs.slice(0, 40).map((doc) => String(doc.title ?? '')).filter((title) => title !== ''),
+                });
+            } catch {
+                // A directory without a readable kb.json is not a library.
+            }
+        }
+        return rows.sort((left, right) => left.name.localeCompare(right.name));
+    } catch {
+        return [];
+    }
+}
+
+/** The KB plugin's default root, matching its own `~/.dsh/knowledge`. */
+export function defaultKnowledgeRoot() {
+    return join(homedir(), '.dsh', 'knowledge');
+}
+
+/** Where agent skills live when the operator has not pointed somewhere else. */
+export function defaultSkillRoot() {
+    return join(homedir(), '.agents', 'skills');
+}
+
+/**
+ * Load the prompt-engineering skill the assistant must follow.
+ *
+ * A skill is the operator's own markdown rules — for Pony that means the fixed six-score
+ * quality prefix, the banned pseudo-words (`detailed_skin_texture`, `masterpiece`), the
+ * negative layers that pull the base model away from anime, and the assembly order. Feeding
+ * those rules into the system prompt is the difference between "plausible English tags" and
+ * tags the checkpoint actually recognises.
+ *
+ * Read on every call, not cached: editing SKILL.md must take effect on the next turn, and the
+ * file is small. `references/` is included when asked because the tag table is what turns
+ * "this word sounds right" into "this word has 115K posts".
+ *
+ * Returns `{ok, name, dir, text, files, bytes, reason?}` — never throws, so a missing skill
+ * degrades to "no skill" instead of failing the assistant turn.
+ */
+export async function loadPromptSkill(config) {
+    const name = typeof config?.name === 'string' ? config.name.trim() : '';
+    if (name === '') return { ok: false, name: '', dir: '', text: '', files: [], bytes: 0, reason: '未配置技能' };
+    const root = typeof config?.dir === 'string' && config.dir.trim() !== '' ? config.dir.trim() : defaultSkillRoot();
+    const base = join(root, name);
+    const skillFile = join(base, 'SKILL.md');
+    let main = '';
+    try {
+        main = await readFile(skillFile, 'utf8');
+    } catch {
+        return { ok: false, name, dir: base, text: '', files: [], bytes: 0, reason: `找不到技能文件：${skillFile}` };
+    }
+    const budget = Math.max(2000, Number(config?.maxBytes) > 0 ? Number(config.maxBytes) : 12000);
+    /**
+     * Split the budget: the rules get the majority, the tables get the rest.
+     *
+     * The first version fed SKILL.md the whole budget and then handed the references whatever
+     * was left over. That worked until the skill grew: SKILL.md went from 16.5 KB to 21 KB,
+     * the leftover dropped below the 400-byte floor, and `references/tag-master.md` silently
+     * stopped being injected — the tag table is the part that says which words are real, so
+     * losing it is losing the most valuable half of the skill.
+     *
+     * Now SKILL.md is capped at its share (60%) and every reference gets a guaranteed slice of
+     * the remainder. Both halves always arrive; only their depth varies.
+     */
+    const mainShare = Math.floor(budget * 0.6);
+    const refShare = Math.max(600, budget - mainShare);
+    const parts = [`【技能：${name}】`, main.slice(0, mainShare)];
+    const files = ['SKILL.md'];
+    let bytes = Math.min(main.length, mainShare);
+    if (config?.includeReferences !== false) {
+        /**
+         * The reference tables are the part that makes the rules checkable: a tag either has
+         * posts or it does not. Only the files that answer "is this word real" are pulled in
+         * — the whole references/ directory is far more than a system prompt can hold.
+         *
+         * Order matters: tag-master first (the authoritative list), then zh-to-tag (how a
+         * Chinese sentence maps onto it), then the NSFW list when the account is allowed it.
+         */
+        const wanted = ['references/tag-master.md', 'references/zh-to-tag.md', 'references/nsfw-tags.md'];
+        const each = Math.floor(refShare / wanted.length);
+        for (const rel of wanted) {
+            try {
+                const text = await readFile(join(base, rel), 'utf8');
+                const slice = text.slice(0, each);
+                parts.push('', `【技能参考：${rel}】`, slice);
+                files.push(rel);
+                bytes += slice.length;
+            } catch {
+                // A skill without that reference simply contributes the others.
+            }
+        }
+    }
+    return { ok: true, name, dir: base, text: parts.join('\n'), files, bytes };
+}
+
+/**
+ * Read an excerpt for the assistant, preferring the knowledge base plugin.
+ *
+ * Order: the named knowledge base (default `提示词`) → a plain directory if one
+ * is configured → nothing. The KB is preferred because that is where the
+ * operator already curated and indexed the material; a directory is the escape
+ * hatch for someone who has the files but never imported them.
+ */
+export async function knowledgeExcerpt(config, { maxBytes = 6000 } = {}) {
+    const kbName = typeof config?.promptKb?.kbName === 'string' ? config.promptKb.kbName.trim() : '';
+    if (kbName !== '') {
+        const fromKb = await readKnowledgeBase(config?.promptKb?.root, kbName, { maxBytes });
+        if (fromKb.ok) return fromKb;
+    }
+    const dir = typeof config?.promptKb?.dir === 'string' ? config.promptKb.dir.trim() : '';
+    if (dir === '' || !isAbsolute(dir)) {
+        return { ok: false, reason: kbName !== '' ? `知识库「${kbName}」里没有可读内容` : '未配置提示词知识库' };
+    }
+    try {
+        const entries = await readdir(dir);
+        const files = entries.filter((name) => name.toLowerCase().endsWith('.md')).sort();
+        if (files.length === 0) return { ok: false, reason: `目录里没有 .md：${dir}` };
+        const parts = [];
+        let used = 0;
+        for (const name of files) {
+            if (used >= maxBytes) break;
+            const text = await readFile(join(dir, name), 'utf8');
+            const slice = text.slice(0, Math.min(2000, maxBytes - used));
+            parts.push(`# ${name}\n${slice}`);
+            used += slice.length;
+        }
+        return { ok: true, text: parts.join('\n\n'), files: files.length };
+    } catch (error) {
+        return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+    }
+}
+
+/** Read one KB library's merged markdown, newest documents first. */
+export async function readKnowledgeBase(root, name, { maxBytes = 6000 } = {}) {
+    const libRoot = join(typeof root === 'string' && root.trim() !== '' ? root.trim() : defaultKnowledgeRoot(), name);
+    try {
+        const meta = JSON.parse(await readFile(join(libRoot, 'kb.json'), 'utf8'));
+        const docs = Array.isArray(meta.docs) ? meta.docs : [];
+        const parts = [];
+        let used = 0;
+        for (const doc of docs) {
+            if (used >= maxBytes) break;
+            const docId = typeof doc.id === 'string' ? doc.id : '';
+            if (docId === '') continue;
+            const file = join(libRoot, 'markdown', docId, `${docId}.md`);
+            let text;
+            try {
+                text = await readFile(file, 'utf8');
+            } catch {
+                continue;
+            }
+            const slice = text.slice(0, Math.max(600, Math.min(2400, maxBytes - used)));
+            parts.push(`# ${String(doc.title ?? doc.sourceFile ?? docId)}\n${slice}`);
+            used += slice.length;
+        }
+        if (parts.length === 0) return { ok: false, reason: `知识库「${name}」还没有可读的正文` };
+        return { ok: true, text: parts.join('\n\n'), source: 'kb', kbName: name, documents: parts.length, titles: docs.slice(0, 20).map((doc) => String(doc.title ?? '')) };
+    } catch (error) {
+        return { ok: false, reason: `知识库「${name}」读取失败：${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+
+/**
+ * Parse the model's three-line answer. Anything unparseable is reported instead
+ * of guessed: a wrong prompt that looks plausible is worse than an error.
+ */
+export function parseAssistant(text) {
+    const out = { positive: '', negative: '', notes: '' };
+    for (const rawLine of String(text ?? '').split('\n')) {
+        const line = rawLine.trim();
+        const positive = /^POSITIVE\s*[:：]\s*(.*)$/i.exec(line);
+        if (positive !== null) {
+            out.positive = cleanTags(positive[1]);
+            continue;
+        }
+        const negative = /^NEGATIVE\s*[:：]\s*(.*)$/i.exec(line);
+        if (negative !== null) {
+            out.negative = cleanTags(negative[1]);
+            continue;
+        }
+        const notes = /^NOTES\s*[:：]\s*(.*)$/i.exec(line);
+        if (notes !== null) out.notes = notes[1].trim();
+    }
+    if (out.positive === '' && out.negative === '') {
+        // A model that answered in plain prose is still usable: take the first
+        // line that looks like a tag list.
+        for (const rawLine of String(text ?? '').split('\n')) {
+            const line = rawLine.trim();
+            if (line.includes(',') && !line.includes('。')) {
+                out.positive = cleanTags(line);
+                break;
+            }
+        }
+    }
+    return out;
+}
+
+/** Strip bullets, quotes, weights; join into a normalised comma list. */
+export function cleanTags(text) {
+    return String(text ?? '')
+        // A bullet marker is a dash/star/dot *followed by a space or a Chinese
+        // separators*, never a bare digit: `1girl` must survive, `1. ` must not.
+        .replace(/^[\s\-*•]+/, '')
+        .replace(/^\d{1,2}[.、)]\s+/, '')
+        // `(tag:1.2)` is a weighted tag, not a comment: keep the tag, drop the
+        // weight. A parenthesised gloss a model wrote in Chinese is dropped whole.
+        .replace(/[（(][^）)]*[一-鿿][^）)]*[）)]/g, '')
+        .replace(/[（(]\s*([a-z0-9_\- ]+?)\s*(?::[\d.]+)?\s*[）)]/gi, '$1')
+        .replace(/["'`]/g, '')
+        .split(/[,，、]/)
+        // A bullet can lead any element, not only the first: `- 2girls` after a
+        // comma is the same list marker the first line had.
+        .map((part) => part.trim().replace(/^[\-*•]+\s*/, '').replace(/\s+/g, '_').replace(/_{2,}/g, '_'))
+        .filter((part) => part !== '' && !/^_+$/.test(part))
+        .join(', ');
+}
+
+/** Join a fixed head and a custom body without doubling commas or blanks. */
+export function joinPrompt(head, body) {
+    const left = String(head ?? '').trim().replace(/[,，]\s*$/, '');
+    const right = String(body ?? '').trim().replace(/^[,，]\s*/, '');
+    if (left === '') return right;
+    if (right === '') return left;
+    return `${left}, ${right}`;
+}
+
+/**
+ * One assistant turn.
+ *
+ * @param {{llm?: any, route?: {provider:string, model:string}, config: any, tier: string}} deps
+ * @param {{message: string, positive?: string, negative?: string, history?: {role:string,text:string}[]}} input
+ */
+export async function assist(deps, input) {
+    const tier = deps.tier === 'nsfw' ? 'nsfw' : 'sfw';
+    const message = String(input?.message ?? '').trim();
+    if (message === '') throw new Error('请先写一句需求');
+
+    const suggestions = searchTags(message, tier, 12);
+    const excerpt = await knowledgeExcerpt(deps.config, { maxBytes: deps.config?.promptKb?.excerptBytes ?? 6000 });
+    const dictionary = dictionaryFor(tier, 3500);
+
+    const llm = deps.llm;
+    const route = deps.route;
+    if (llm === undefined || route === undefined || route.provider === undefined || route.model === undefined) {
+        return {
+            ok: true,
+            mode: 'dictionary',
+            positive: joinPrompt(input?.positive, suggestions.slice(0, 12).map((row) => row.tag).join(', ')),
+            negative: String(input?.negative ?? '').trim(),
+            // The dictionary cannot decide exclusions, so it never claims to have touched
+            // the negative box. Without this the console would treat "no model" as "the
+            // model cleared your negative prompt".
+            negativeTouched: false,
+            notes: suggestions.length === 0
+                ? '没连上模型，且词库里没找到匹配标签；换个说法或直接写标签。'
+                : `没连上模型，按词库检索给出 ${suggestions.length} 个候选标签。`,
+            suggestions,
+            // Reported even without a model: the dictionary is static, but knowing
+            // whether a library was found is what tells a user their import worked.
+            kb: excerpt.ok
+                ? { name: excerpt.kbName ?? null, documents: excerpt.documents ?? excerpt.files ?? 0 }
+                : { reason: excerpt.reason },
+        };
+    }
+
+    const layerNames = Array.isArray(input?.layerNames) ? input.layerNames.map(String) : [];
+    const layered = layerNames.length > 0;
+
+    const context = [
+        `【真实标签词库（${tier === 'nsfw' ? '含成人' : '全年龄'}）】`,
+        dictionary,
+        '',
+        excerpt.ok
+            ? `【知识库「${excerpt.kbName ?? '本地目录'}」摘录（${excerpt.documents ?? 0} 篇）】
+${excerpt.text}`
+            : '',
+        '',
+        // The current boxes are context for *continuity*: in replace mode they are what
+        // gets overwritten, in insert mode they are what the answer is appended to, and in
+        // both they let the model read "去掉 XX" against what the person actually sees.
+        input?.positive
+            ? `【当前正向框（${input?.mode === 'insert' ? '新标签会追加到它后面' : '会被替换'}）】${input.positive}`
+            : '',
+        input?.negative
+            ? `【当前负向框（${input?.mode === 'insert' ? '新标签会追加到它后面' : '会被替换'}）】${input.negative}`
+            : '',
+        '',
+        layered ? `【分层】${layerNames.map((name, i) => `L${i + 1}=${name || '第' + (i + 1) + '层'}`).join(' / ')}` : '',
+        input?.mode === 'insert'
+            ? '【写入方式】追加：只输出这次要新增的标签，不要重复当前正向框里已有的，也不要复述原句。'
+            : '',
+        `【用户需求】${message}`,
+    ]
+        .filter((line) => line !== '')
+        .join('\n');
+
+    const history = Array.isArray(input?.history) ? input.history.slice(-8) : [];
+    const messages = [
+        ...history.map((entry) => ({ role: entry.role === 'assistant' ? 'assistant' : 'user', text: String(entry.text ?? '') })),
+        { role: 'user', text: context },
+    ];
+
+    const fallback = () => {
+        // No model: the dictionary is the best we have. With layers, everything lands in
+        // the first layer that is not reserved rather than being smeared across all of
+        // them — a wrong-but-explainable placement beats the same words repeated five times
+        // in the assembled prompt.
+        //
+        // "Reserved" is the LoRA trigger slot. The model-backed path empties it explicitly
+        // (see below); the dictionary path has to skip it too, or the one layer the whole
+        // rule exists to protect is the one this fallback writes into whenever a workflow
+        // happens to put the LoRA layer first — which is exactly how the shipped Pony
+        // workflows are built.
+        //
+        // negativeTouched is false unless the request asked to exclude something: the
+        // dictionary has no opinion about exclusions, so it must not clear the box.
+        const tags = suggestions.slice(0, 12).map((row) => row.tag).join(', ');
+        const touched = asksToExclude(message);
+        return layered
+            ? {
+                  layers: layerNames.map((name, i) => (i === firstWritableLayer(layerNames) ? tags : '')),
+                  negative: '',
+                  positive: tags,
+                  negativeTouched: touched,
+              }
+            : { positive: tags, negative: '', negativeTouched: touched };
+    };
+
+    const kb = excerpt.ok
+        ? { name: excerpt.kbName ?? null, documents: excerpt.documents ?? excerpt.files ?? 0 }
+        : { reason: excerpt.reason };
+
+    /**
+     * The skill rides on top of the built-in instructions, not instead of them.
+     *
+     * The built-in template still owns the tier rules and the output shape (POSITIVE /
+     * NEGATIVE / NOTES); the skill owns the vocabulary rules — which tags exist, which are
+     * banned pseudo-words, the quality prefix, the negative layers. Injecting it here rather
+     * than merging it into the template keeps the two independently editable: an operator can
+     * swap skills without touching the plugin.
+     */
+    const skill = await loadPromptSkill(deps.config?.promptSkill);
+    const systemPrompt = [
+        layered ? layeredSystem(layerNames, tier) : systemFor(tier),
+        skill.ok ? '' : '',
+        skill.ok ? skill.text : '',
+        skill.ok
+            ? '【按技能规则执行】上面的技能规则优先于本提示里的一般性建议：标签是否存在、质量前缀怎么写、负向词分几层，一律以技能为准。'
+            : '',
+    ]
+        .filter((part) => part !== '')
+        .join('\n\n');
+    let text = '';
+    try {
+        text = await callModel(llm, route, messages, deps.config, systemPrompt);
+    } catch (error) {
+        const base = fallback();
+        return {
+            ok: false,
+            mode: 'dictionary',
+            error: `模型调用失败：${error instanceof Error ? error.message : String(error)}`,
+            ...base,
+            suggestions,
+            kb,
+        };
+    }
+
+    if (layered) {
+        const parsed = parseLayered(text, layerNames.length);
+        let layers = parsed.layers;
+        let negative = parsed.negative;
+        /**
+         * A LoRA layer is emptied here, not merely asked to stay empty.
+         *
+         * The prompt tells the model to leave those layers blank, and it usually does — but
+         * "usually" is not a contract: a model that ignores the instruction puts body tags
+         * into the trigger slot, and the picture silently changes because the LoRA's own
+         * trigger word is now diluted with unrelated tags. The layer name is the only thing
+         * that says which slot is a trigger slot, and the server already has it, so the
+         * answer is enforced rather than trusted.
+         */
+        const emptied = [];
+        layers = layers.map((value, index) => {
+            const name = String(layerNames[index] ?? '');
+            if (!isLoraLayer(name)) return value;
+            if (String(value).trim() !== '') emptied.push(name || ('L' + (index + 1)));
+            return '';
+        });
+        if (tier !== 'nsfw') {
+            const clean = (value) => value.split(', ').filter((tag) => tag !== '' && !isAdultTag(tag)).join(', ');
+            layers = layers.map(clean);
+            negative = clean(negative);
+        }
+        return {
+            ok: true,
+            mode: 'model',
+            layered: true,
+            // Replacement, not concatenation: the caller overwrites the boxes with these.
+            layers,
+            negative,
+            /**
+             * Whether the negative box may be appended to at all.
+             *
+             * Only the REQUEST decides. The model's own NEGATIVE line is not evidence: it
+             * volunteers `blurry, lowres, bad_anatomy` on any turn, and treating that as intent
+             * pushed the model's idea of "good practice" into a box the operator had already
+             * filled. A retraction ("把不要模糊去掉") still counts, because it is a request about
+             * exclusions — the console's rule for "flagged but empty" is to leave the box alone.
+             */
+            negativeTouched: asksToExclude(message),
+            // Still returned flattened, so a caller that does not understand layers (or an
+            // older console) keeps working instead of showing nothing.
+            positive: layers.filter((v) => v !== '').join(', '),
+            notes: [
+                emptied.length > 0 ? `已清空 ${emptied.join('、')}：这些层放 LoRA 触发词，不由提示词填写` : '',
+                parsed.stray.length > 0 ? `模型多输出了 ${parsed.stray.length} 行未识别内容，已忽略` : '',
+                parsed.notes,
+            ].filter((line) => line !== '').join('；'),
+            raw: text.slice(0, 4000),
+            suggestions,
+            kb,
+        };
+    }
+
+    const parsed = parseAssistant(text);
+    if (tier !== 'nsfw') {
+        // A model can slip; the tier is enforced on the answer, not trusted to it.
+        for (const side of ['positive', 'negative']) {
+            parsed[side] = parsed[side]
+                .split(', ')
+                .filter((tag) => !isAdultTag(tag))
+                .join(', ');
+        }
+    }
+    return {
+        ok: true,
+        mode: 'model',
+        // Replacement again: an assistant turn produces the prompt, it does not add to it.
+        positive: parsed.positive,
+        negative: parsed.negative,
+        /**
+         * Did this REQUEST ask to exclude anything? That alone decides.
+         *
+         * The value the model returned must NOT be part of this test. `|| parsed.negative !== ''`
+         * looked reasonable — "if it said something, something happened" — but it inverts the
+         * guard: the model habitually volunteers `blurry, lowres, bad_anatomy` on any turn, so a
+         * request that never mentioned exclusions produced a non-empty negative, the flag turned
+         * true, and the console appended the model's generic quality words into a box the
+         * operator had already filled with their own head. Exactly the case this flag exists to
+         * prevent.
+         *
+         * A retraction ("把不要模糊去掉") still counts: it IS a request about exclusions, and the
+         * console's rule for "flagged but empty" is to leave the box alone.
+         */
+        negativeTouched: asksToExclude(message),
+        notes: parsed.notes,
+        raw: text.slice(0, 4000),
+        suggestions,
+        kb,
+    };
+}
+
+/**
+ * Split one assistant answer into the pickable rows the console lists.
+ *
+ * The console no longer dumps the answer into the boxes: the person ticks what they want,
+ * picks a target box per row, and presses 确定. That means the answer has to arrive as a
+ * LIST of candidates, each with something to explain it — otherwise the list is a wall of
+ * unlabelled tags and the person is guessing.
+ *
+ * Three shapes come in, and all three become rows:
+ *
+ *   - **layered** (a workflow with named layers): one row per non-empty layer, labelled with
+ *     the layer's own name, because "面部" is the only thing that says where those tags go.
+ *   - **plain** (one positive block): one row for the positive text.
+ *   - **negative** (only when the request asked to exclude something): one row, marked as an
+ *     exclusion so the console can default it to a negative box.
+ *
+ * Rows with no text are dropped — an empty layer is not a choice, and a checkbox for it would
+ * add a click that does nothing. `suggest` is the role the row wants to land in; the console
+ * still lets the person override it per row.
+ *
+ * @returns {Array<{id:string, text:string, note:string, role:'positive'|'negative', layer:string}>}
+ */
+export function assistCandidates(result, layerNames = []) {
+    const rows = [];
+    const push = (row) => {
+        const text = String(row.text ?? '').trim();
+        if (text === '') return;
+        rows.push({
+            id: `c${rows.length + 1}`,
+            text,
+            note: String(row.note ?? '').trim(),
+            role: row.role === 'negative' ? 'negative' : 'positive',
+            layer: String(row.layer ?? '').trim(),
+        });
+    };
+    const data = result !== null && typeof result === 'object' ? result : {};
+    const layers = Array.isArray(data.layers) ? data.layers : [];
+    const names = Array.isArray(layerNames) ? layerNames.map(String) : [];
+    if (layers.length > 0) {
+        layers.forEach((value, index) => {
+            const name = String(names[index] ?? '').trim();
+            const label = name === '' ? `第 ${index + 1} 层` : name;
+            const count = String(value ?? '').split(',').filter((tag) => tag.trim() !== '').length;
+            push({
+                text: value,
+                note: `${label} · ${count} 个标签`,
+                role: 'positive',
+                layer: label,
+            });
+        });
+    } else {
+        const count = String(data.positive ?? '').split(',').filter((tag) => tag.trim() !== '').length;
+        // The note explains WHY this row exists rather than repeating the model's own NOTES
+        // line: at a glance the person needs "this is the whole prompt", not commentary.
+        push({ text: data.positive, note: count === 0 ? '' : `${count} 个标签`, role: 'positive' });
+    }
+    /**
+     * The negative row is offered only when the request actually asked to exclude something.
+     *
+     * `negativeTouched` is the assistant's own answer to that question; without it the model's
+     * habitual "blurry, lowres" lines would appear as a candidate the person never asked for,
+     * and ticking it would start filtering things they want.
+     */
+    if (data.negativeTouched === true) {
+        push({ text: data.negative, note: '排除项 · 建议放进负向框', role: 'negative' });
+    }
+    return rows;
+}
+
+/**
+ * A live suggestion pass: tags WITH Chinese meaning, one per row.
+ *
+ * This is the "type and watch it fill in" path. It is allowed to call the model every time
+ * (the operator asked for that), so it is built to stay cheap and hard to break:
+ *
+ *   - the model returns one line per tag (`tag | 中文含义 | 常用场景`), and a line it botches
+ *     is DROPPED rather than guessed at;
+ *   - the dictionary pass always runs too, and its rows are merged in, so a model failure
+ *     degrades to the deterministic list instead of an empty panel;
+ *   - the tier filter runs on the model's output as well as on the input.
+ *
+ * Returns `[{tag, zh, section, note, role, fromModel}]` — the shape the console renders.
+ */
+export async function suggestTags(deps, input) {
+    const tier = deps?.tier === 'nsfw' ? 'nsfw' : 'sfw';
+    const text = String(input?.text ?? '').trim().slice(0, 400);
+    if (text === '') return [];
+    /** Dictionary rows first: they are free, instant, and the fallback when the model fails. */
+    const local = searchTags(text, tier, 24).map((row) => ({
+        tag: row.tag,
+        zh: row.zh,
+        section: row.section,
+        note: [row.zh, row.section === '' ? '' : `常用在${row.section}`].filter((part) => part !== '').join(' · '),
+        role: 'positive',
+        fromModel: false,
+    }));
+    const llm = deps?.llm;
+    const route = deps?.route;
+    if (llm === undefined || llm === null || route === undefined || route === null) return local;
+    const skill = await loadPromptSkill(deps.config?.promptSkill);
+    const system = [
+        /**
+         * The skill goes FIRST so everything after it can refer back to it.
+         *
+         * It is what decides which tags exist: the fixed quality prefix, the banned
+         * pseudo-words (`detailed_skin_texture`, `masterpiece`), the negative layers. Loading it
+         * is not optional — without it this path invents fluent-looking words the checkpoint has
+         * never seen, which is the worst kind of wrong because it looks right.
+         */
+        ...(skill.ok ? [skill.text, '【按技能规则选词】上面技能里标为无效的自造词一律不要输出；优先用技能词表里有的标签。', ''] : []),
+        '你是 Stable Diffusion / Pony 的提示词助手，用户在打字，你要把他说的话变成可挑选的条目。',
+        '只输出条目行，每行三段，用 | 分隔，不要编号、不要解释、不要空行：',
+        '  标签 | 这个标签的中文含义 | 常用场景（一句话，不超过 12 个字）',
+        /**
+         * A row may be a single tag OR a group of tags.
+         *
+         * One tag is often not enough to say what the person meant: `雨天便利店` has no single
+         * tag, but `rain, convenience_store, wet_ground` together do. A group is written as
+         * several tags joined by ", " in the FIRST field — the console shows it as one row and
+         * adding it writes the whole group, which is exactly what the person wanted.
+         *
+         * The limit matters: a group is a short cluster of related tags, not a paragraph. Four
+         * is the ceiling — past that it stops being one choice and becomes an answer, which is
+         * what PROSE mode is for.
+         */
+        '如果单个标签不足以表达，或者根本没有对应的单个标签，可以把几个标签用英文逗号加空格拼成一组，',
+        '   整组写在同一行的第一段里（例：rain, convenience_store, wet_ground | 雨天便利店 | 场景）。',
+        '一组是最多 4 个互相补充的标签，不要堆成一长串；能用单个标签说清时就只给单个标签。',
+        /**
+         * The group rule does not relax the skill: every tag inside a group must still be a
+         * real one. Written out because "make it a phrase" is an easy invitation to smuggle in
+         * invented words by packaging them.
+         */
+        '组里的每一个标签都必须同样符合上面技能里的选词规则；技能标为无效的自造词不能因为凑成一组就被放行。',
+        `分级：${tier === 'nsfw' ? 'NSFW（成人内容已授权）' : 'SFW，不得出现任何成人、裸露、性相关标签'}`,
+        '标签一律小写下划线（long_hair、convenience_store）。',
+        '只写用户说过或能从他原话必然推出的；不要顺手加画质词（masterpiece、best_quality）。',
+        '输出 6–14 行。',
+    ].join('\n');
+    let out = '';
+    try {
+        out = await callModel(
+            llm,
+            route,
+            [{ role: 'user', text: `【用户正在输入】${text}` }],
+            deps.config,
+            system,
+        );
+    } catch {
+        // A model hiccup must not empty the panel: the dictionary rows stand in.
+        return local;
+    }
+    const modelRows = [];
+    for (const raw of out.split(/\r?\n/)) {
+        const line = raw.trim().replace(/^[-*]\s*/, '');
+        if (line === '') continue;
+        const parts = line.split('|').map((part) => part.trim());
+        if (parts.length < 2) continue;
+        /**
+         * Split the first field into tags.
+         *
+         * It can hold one tag or a short group (`rain, convenience_store, wet_ground`). Both are
+         * legitimate answers — a single tag is exact, a group is how you say something the
+         * dictionary has no single word for — so the only thing to enforce is the size limit:
+         * more than four is an answer, not a choice, and belongs in PROSE mode.
+         */
+        const tags = parts[0]
+            .split(',')
+            .map((piece) => piece.trim().toLowerCase().replace(/\s+/g, '_').replace(/[^\w\-:.]/g, ''))
+            .filter((tag) => tag !== '' && tag.length <= 60);
+        if (tags.length === 0 || tags.length > 4) continue;
+        if (tier !== 'nsfw' && tags.some((tag) => isAdultTag(tag))) continue;
+        const zh = (parts[1] ?? '').slice(0, 40);
+        const scene = (parts[2] ?? '').slice(0, 40);
+        modelRows.push({
+            tag: tags.join(', '),
+            tags,
+            group: tags.length > 1,
+            zh,
+            section: scene,
+            note: [zh, scene].filter((part) => part !== '').join(' · '),
+            role: 'positive',
+            fromModel: true,
+        });
+    }
+    /**
+     * Merge: the model's rows lead (they understood the sentence), the dictionary fills in
+     * what it missed, and an entry appears once — the same thing twice in a pick list is a bug
+     * the person reads as "two of these".
+     *
+     * Two different de-duplication rules, because the two shapes mean different things:
+     *
+     *   - a single tag is dropped if that tag is already listed;
+     *   - a GROUP is dropped only when every tag in it is already listed, and a group that
+     *     overlaps a single row keeps its own tags minus the ones already shown. A group is a
+     *     way of saying "these together", so trimming it down to nothing would remove the
+     *     thing that had no single-tag answer.
+     */
+    const seenTags = new Set();
+    const merged = [];
+    for (const row of [...modelRows, ...local]) {
+        if (row.group === true) {
+            const rest = row.tags.filter((tag) => !seenTags.has(tag));
+            if (rest.length === 0) continue;
+            for (const tag of rest) seenTags.add(tag);
+            merged.push({ ...row, tag: rest.join(', '), tags: rest, group: rest.length > 1 });
+            continue;
+        }
+        if (seenTags.has(row.tag)) continue;
+        seenTags.add(row.tag);
+        merged.push(row);
+    }
+    return merged.slice(0, 40);
+}
+
+/**
+ * Does this request actually ask for something to be excluded?
+ *
+ * Kept deliberately narrow. A broad pattern ("不" appears anywhere) would fire on "不错"
+ * and "不仅"，so the match requires an exclusion verb near the phrase. The negated-existence
+ * forms (没有 / 没) carry a small lookahead because 没有问题 / 没错 / 没关系 are ordinary
+ * speech, not exclusions. A miss costs one manually typed tag; a false positive wipes the
+ * operator's negative prompt, so the asymmetry says to under-match rather than over-match.
+ */
+export function asksToExclude(message) {
+    const text = String(message ?? '');
+    if (text.trim() === '') return false;
+    return /(?:不要|别出现|别再|不用|不需要|去掉|去除|移除|删除|不想要|不想有|不出现|排除|避免|禁止)/.test(text)
+        || /(?:没有|没穿|没戴)(?!问题|错|关系|办法)/.test(text)
+        || /\b(?:without|no|not|avoid|exclude|remove)\b/i.test(text);
+}
+
+/**
+ * The request controls this assistant pins.
+ *
+ * They are named twice on purpose — once to `prepareCall()` and once on the
+ * dispatch options — because that is the contract: preparation returns a frozen
+ * config, and dispatch rejects any request whose config differs from it
+ * field-by-field with `INVALID_PREPARED_CALL`. Supplying `maxTokens` or
+ * `temperature` only at dispatch time therefore fails before the adapter is
+ * ever reached, which surfaces as "模型调用失败" while no network request exists.
+ *
+ * Layered replies are longer (one line per layer): 700 was enough for two lines
+ * and truncated the third layer mid-tag, which then parsed as garbage.
+ */
+const ASSIST_CONTROLS = Object.freeze({ maxTokens: 900, temperature: 0.4 });
+
+/** One non-streaming model call over the Harness llm service. */
+async function callModel(llm, route, messages, config, system) {
+    const prepared = await llm.prepareCall(
+        { provider: route.provider, model: route.model, ...ASSIST_CONTROLS },
+        AbortSignal.timeout(60_000),
+    );
+    const options = {
+        ...prepared.config,
+        messages: messages.map((entry) => ({ role: entry.role, content: [{ type: 'text', text: entry.text }] })),
+        system,
+        ...ASSIST_CONTROLS,
+    };
+    let out = '';
+    for await (const chunk of prepared.stream(options)) {
+        if (chunk.type === 'text-delta') out += chunk.text;
+        if (chunk.type === 'finish' && chunk.reason?.kind === 'error') {
+            throw new Error(chunk.reason.failure?.message ?? 'model error');
+        }
+    }
+    if (out.trim() === '') throw new Error('模型没有返回内容');
+    return out;
+}