dsh-persona-forge 0.2.1 → 0.3.0

package/lib/index.js

@@ -40,8 +40,18 @@ export const inject = []
 const DEFAULT_CONFIG = {
   /** What the composer does after a rewrite settles. */
   sendMode: 'review',
-  /** Run the technical-fact preservation check after each rewrite. */
-  factCheck: true,
+  /**
+   * Run the SECOND, model-based preservation check after each rewrite.
+   *
+   * OFF by default. It is the only thing that can see a requirement reworded
+   * weaker, or a behavioural constraint added in prose — but it doubles the
+   * latency and the token cost of every single send, and the free local check
+   * (lib/preserve.js) already proves the common and most damaging failure: a
+   * dropped identifier, path, version or number. Paying a model call on every
+   * send to re-check what a string comparison answers for nothing is a bad
+   * default; turn it on when the drafts are technical enough to warrant it.
+   */
+  factCheck: false,
   /** Watch the card directory and reload the catalog on change. */
   watchCards: true,
 }
@@ -51,7 +61,10 @@ function resolveConfig(raw) {
   const source = raw !== null && typeof raw === 'object' ? raw : {}
   return {
     sendMode: source.sendMode === 'direct' ? 'direct' : 'review',
-    factCheck: source.factCheck !== false,
+    // Only an explicit `true` enables it. Anything else — absent, null, a typo —
+    // leaves the cheap default, because the cost of this check is paid on every
+    // send and the local check already covers the common failure.
+    factCheck: source.factCheck === true,
     watchCards: source.watchCards !== false,
   }
 }

package/lib/preserve.js

@@ -0,0 +1,138 @@
+/**
+ * The deterministic half of the preservation check.
+ *
+ * The plugin has two ways to notice that a rewrite changed the request rather
+ * than its voice:
+ *
+ *  1. This module — free, instant, provable. It compares the technical tokens
+ *     of the draft against the rewrite: identifiers, file paths, versions,
+ *     numbers, flags, and named technologies.
+ *  2. An optional second model call — costs tokens and latency, but is the only
+ *     thing that can see a *semantic* change (a requirement quietly weakened,
+ *     a constraint invented in prose).
+ *
+ * They are complementary, and the split is deliberate: the most common and most
+ * damaging failure is a dropped identifier, path or number, and that is exactly
+ * what a token comparison proves for free. Paying a second model call on every
+ * send to catch it would be wasteful, so this check always runs and the model
+ * call is opt-in.
+ *
+ * WHAT THIS CANNOT SEE, and must never be presented as covering:
+ *  - a requirement reworded into something weaker while keeping every token;
+ *  - a behavioural constraint added in ordinary prose;
+ *  - a quantity expressed in Chinese words (「两次」) rather than digits;
+ *  - a bare lowercase English word that is not a path, flag or identifier.
+ * The optional model check exists for exactly those.
+ *
+ * @module dsh-persona-forge/preserve
+ */
+
+/** Words that carry no technical meaning, so their absence proves nothing. */
+const STOP_WORDS = new Set([
+  'the', 'a', 'an', 'and', 'or', 'to', 'of', 'for', 'is', 'are', 'was', 'were',
+  'be', 'been', 'being', 'it', 'its', 'this', 'that', 'these', 'those', 'in',
+  'on', 'at', 'by', 'with', 'from', 'as', 'if', 'then', 'than', 'so', 'not',
+  'no', 'do', 'does', 'did', 'can', 'could', 'should', 'would', 'will',
+  'shall', 'may', 'might', 'must', 'i', 'you', 'we', 'they', 'he', 'she', 'my',
+  'your', 'our', 'their', 'me', 'us', 'them', 'here', 'there', 'when', 'where',
+  'which', 'who', 'what', 'how', 'why', 'all', 'any', 'some', 'each', 'every',
+  'but', 'also', 'just', 'please', 'thanks', 'thank', 'need', 'want', 'make',
+  'use', 'get', 'set', 'let', 'say', 'write', 'read', 'run', 'fix', 'add',
+  'new', 'old', 'one', 'two', 'first', 'last', 'next', 'then', 'now',
+])
+
+/**
+ * One ordered alternation, so a token is matched exactly once and no fact is
+ * double-counted. Order is specificity: a code span before a version, a version
+ * before a bare number.
+ *
+ * A capitalised word is included because named technologies (`Rust`, `Python`,
+ * `Docker`) are technical facts; matching is case-insensitive downstream, so
+ * sentence-initial prose (`Write …`) cannot be reported as lost when the
+ * rewrite lowercases it.
+ * @type {RegExp}
+ */
+const TOKEN = new RegExp([
+  '`[^`\\n]{1,80}`', // an inline code span, spaces and all
+  'v?\\d+(?:\\.\\d+)+(?:[-+][A-Za-z0-9.]+)?', // a version: v1.2.3, 1.2.3-beta
+  '[A-Za-z_][A-Za-z0-9_-]*(?:[./][A-Za-z0-9_-]+)+', // a path or dotted name: a.js, src/main.rs
+  '[A-Za-z_][A-Za-z0-9_]*_[A-Za-z0-9_]+', // snake_case
+  '[a-z][A-Za-z0-9]*[A-Z][A-Za-z0-9]*', // camelCase
+  '[A-Z][A-Z0-9]{1,}', // an acronym: API, HTTP, README
+  '--[A-Za-z][A-Za-z0-9-]*', // a long flag: --watch
+  '[A-Z][a-z]{2,}', // a capitalised word: Rust, Docker
+  '\\d+(?:\\.\\d+)*', // a bare number
+].join('|'), 'g')
+
+/**
+ * Collect the technical facts a text asserts, as a case-insensitive multiset.
+ *
+ * A multiset, not a set: a draft mentioning `8080` twice and a rewrite
+ * mentioning it once has lost a fact, and counting occurrences is what catches
+ * that.
+ * @param {string} text - the draft or the rewrite.
+ * @returns {Map<string, number>} lowercased token to occurrence count.
+ */
+export function factsIn(text) {
+  const counts = new Map()
+  for (const match of String(text ?? '').matchAll(TOKEN)) {
+    // A code span keeps its inner text; the backticks are punctuation.
+    const token = match[0].replace(/^`|`$/g, '').trim().toLowerCase()
+    if (token === '') continue
+    if (STOP_WORDS.has(token)) continue
+    // A single letter or digit carries no meaning worth comparing.
+    if (token.replace(/[^a-z0-9]/g, '').length < 2) continue
+    counts.set(token, (counts.get(token) ?? 0) + 1)
+  }
+  return counts
+}
+
+/**
+ * Whether a token is structurally unmistakable — a path, version, number, flag
+ * or code span — as opposed to a bare word.
+ *
+ * Only these may be reported as INVENTED. A bear word can legitimately appear
+ * in a rewrite as ceremony: the persona's own name ("Omnissiah"), a form of
+ * address, a flourish. Reporting those as "you added a fact" would fire on
+ * every successful zealot rewrite, which is precisely the check's job to allow.
+ * @param {string} token - a lowercased token.
+ * @returns whether it is structural.
+ */
+function isStructural(token) {
+  if (/[0-9]/.test(token)) return true
+  if (/[./_@-]/.test(token)) return true
+  return false
+}
+
+/**
+ * Compare a rewrite against its draft for lost or invented technical facts.
+ *
+ * Reports `drift` only for things a token comparison can actually prove, and
+ * names them, so the panel can show exactly what went missing instead of a
+ * vague warning. Everything it cannot prove is `ok` — never a false alarm.
+ * @param {string} original - the user's draft.
+ * @param {string} rewritten - the rewrite under review.
+ * @returns {{state: 'ok'|'drift', missing: string[], added: string[]}} the verdict.
+ */
+export function compareFacts(original, rewritten) {
+  const before = factsIn(original)
+  const after = factsIn(rewritten)
+  const missing = []
+  const added = []
+  for (const [token, count] of before) {
+    // Case-insensitive, already: a rewrite may legitimately recase a word.
+    const kept = after.get(token) ?? 0
+    if (kept < count) missing.push(token)
+  }
+  for (const token of after.keys()) {
+    if (!before.has(token) && isStructural(token)) added.push(token)
+  }
+  // Keep the report readable: a long list is noise, and the first few are what
+  // the user needs to act on.
+  const cap = (list) => list.sort().slice(0, 12)
+  return {
+    state: missing.length > 0 || added.length > 0 ? 'drift' : 'ok',
+    missing: cap(missing),
+    added: cap(added),
+  }
+}

package/lib/prompts.js

@@ -75,12 +75,20 @@ const FIDELITY_RULES = {
 
 /**
  * Build the system prompt of one rewrite call.
+ *
+ * `fidelity` is a PARAMETER rather than read off the card: the caller may
+ * narrow a strategy card to voice-only for a single message, and a prompt built
+ * from `card.fidelity` would silently ignore that. The response would report
+ * the narrowed fidelity while the model still received the strategy rules —
+ * a setting that appears to work and does nothing.
  * @param card - the normalized persona card.
  * @param intensity - the effective intensity (the card's, or a caller override).
  * @param examples - the effective conversion examples for that intensity.
+ * @param fidelity - the effective fidelity (the card's, or a narrowed override).
  * @returns the system prompt text.
  */
-export function buildSystemPrompt(card, intensity, examples) {
+export function buildSystemPrompt(card, intensity, examples, fidelity) {
+  const effectiveFidelity = fidelity ?? card.fidelity
   const parts = [
     'You rewrite a user\'s message into the voice of a character, for an AI coding assistant.',
     '',
@@ -92,7 +100,7 @@ export function buildSystemPrompt(card, intensity, examples) {
     ...card.description !== undefined ? ['## Character summary', card.description, ''] : [],
     ...INTENSITY_RULES[intensity] ?? INTENSITY_RULES.medium,
     '',
-    ...FIDELITY_RULES[card.fidelity] ?? FIDELITY_RULES.style,
+    ...FIDELITY_RULES[effectiveFidelity] ?? FIDELITY_RULES.style,
     '',
     '## Speaker direction (most common failure — read carefully)',
     'The character described above is the ASSISTANT\'s identity. The message you are rewriting belongs to the USER.',
@@ -156,6 +164,159 @@ export function renderTemplate(template, text) {
   return `${template}\n\n${text}`
 }
 
+/**
+ * System prompt of the character-card generator. The user supplies a rough
+ * idea ("a grumpy lighthouse keeper"); this asks the model to turn it into a
+ * complete card.
+ *
+ * The two load-bearing rules of this plugin apply to the GENERATED card too,
+ * not only to hand-written ones. A card whose `examples` replace requirements
+ * with atmosphere teaches the rewriting model to do exactly that, so the
+ * generator is held to the same standard as the bundled cards: every example
+ * must carry its technical facts across, and the style must state the speaker
+ * direction.
+ */
+const CARD_DRAFT_SYSTEM = [
+  'You design a character card for a prompt-rewriting tool.',
+  'The card describes a character voice. A later step will rewrite the user\'s messages into that voice.',
+  '',
+  'Answer with ONE JSON object and nothing else. No prose, no code fences, no comments.',
+  '',
+  'Fields:',
+  '- "id": lowercase letters, digits and hyphens only, 2-40 chars, descriptive of the character.',
+  '- "name": the character name, at most 40 chars, in the same language as the idea.',
+  '- "icon": exactly one emoji.',
+  '- "description": one sentence describing the voice, at most 80 chars, same language as the idea.',
+  '- "style": 3-8 sentences of instructions for the rewriting model, in the language of the idea.',
+  '- "intensity": one of "light", "medium", "strong", "zealot".',
+  '- "examplesByIntensity": an object with ALL FOUR keys "light", "medium", "strong" and "zealot".',
+  '  Each key holds an array of 1 to 2 objects, each {"from": "...", "to": "..."}.',
+  '  The four levels must be genuinely different: "light" adds only a touch of flavour;',
+  '  "medium" frames the request clearly; "strong" gives the voice real weight while keeping',
+  '  the request the first thing the reader sees; "zealot" ritualizes throughout without',
+  '  ever burying the request.',
+  '',
+  'The "style" field MUST state the speaker direction explicitly. The character is the',
+  'ASSISTANT\'s identity, and the message being rewritten belongs to the USER, so the rewrite',
+  'speaks in the user\'s voice and addresses the character. If the character is an authority,',
+  'a deity or a machine-god, the user is the petitioner — never the authority. Say this in',
+  'the style text, and do not write the character\'s own speech.',
+  '',
+  'The "examplesByIntensity" entries are the most important part and are graded strictly:',
+  'each "from" is a plain user request, each "to" is that SAME request rewritten in the voice.',
+  'Every technical fact in "from" — every file name, identifier, number, version, path,',
+  'command and constraint — must still be present in "to". Change only the voice.',
+  'Never replace a concrete requirement with atmosphere.',
+  'Write the examples in the same language as the idea.',
+  '',
+  'Do not describe a task-checker, a reviewer or a tester as the character. The character is',
+  'a voice for the user\'s own requests, not an agent that performs the request.',
+].join('\n')
+
+/**
+ * Build the user message of the card generator.
+ * @param brief - the user's rough description of the character.
+ * @param takenIds - ids already in use, so a new card does not silently collide.
+ * @returns the user message body.
+ */
+export function frameCardBrief(brief, takenIds = []) {
+  const safe = brief.replace(/<\/?(idea|taken)>/gi, '<\\/$1>')
+  const parts = ['Character idea:', '<idea>', safe, '</idea>']
+  if (takenIds.length > 0) {
+    parts.push(
+      '',
+      'These ids are already in use; choose a DIFFERENT id:',
+      '<taken>',
+      takenIds.join(', '),
+      '</taken>',
+    )
+  }
+  return parts.join('\n')
+}
+
+/** Coerce one generated example into a `{ from, to }` pair, or undefined. */
+function draftExampleOf(raw) {
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return undefined
+  const from = typeof raw.from === 'string' ? raw.from.trim() : ''
+  const to = typeof raw.to === 'string' ? raw.to.trim() : ''
+  if (from === '' || to === '') return undefined
+  return { from, to }
+}
+
+/**
+ * Turn the model's raw answer into a card-shaped object, without trusting it.
+ *
+ * The model is asked for bare JSON but may wrap it in a fence or bracket it
+ * with a sentence; the first balanced-looking object is recovered and parsed.
+ * Structural problems are reported as an error so the route can answer with a
+ * clear message instead of half-filling the form. Field-level problems are
+ * left to `normalizeCard`, which is the single validator for both generated
+ * and hand-written cards.
+ * @param text - the model's raw answer.
+ * @returns the candidate card document, or a diagnostic.
+ */
+export function parseCardDraft(text) {
+  const trimmed = (text ?? '').trim()
+  if (trimmed === '') return { error: 'the model returned nothing' }
+  // Drop a whole-output code fence, with or without a language tag.
+  const fenced = /^```[a-zA-Z0-9_-]*\s*\n([\s\S]*?)\n?```$/.exec(trimmed)
+  const body = (fenced?.[1] ?? trimmed).trim()
+  let raw = body
+  if (!body.startsWith('{')) {
+    // Recover the outermost object from surrounding prose. Slicing to the last
+    // brace is what makes a trailing sentence harmless.
+    const start = body.indexOf('{')
+    const end = body.lastIndexOf('}')
+    if (start === -1 || end <= start) return { error: 'the model did not return a JSON object' }
+    raw = body.slice(start, end + 1)
+  }
+  let parsed
+  try {
+    parsed = JSON.parse(raw)
+  } catch (error) {
+    return { error: `the model returned invalid JSON: ${error instanceof Error ? error.message : String(error)}` }
+  }
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    return { error: 'the model did not return a JSON object' }
+  }
+  const document = {
+    // `fidelity` is deliberately NOT taken from the model. Whether a card may
+    // add behavioural constraints is the user's decision, and a generated card
+    // should never quietly acquire that power. It defaults to voice-only and
+    // the user can raise it deliberately in the form.
+    fidelity: 'style',
+    mode: 'llm',
+  }
+  for (const field of ['id', 'name', 'icon', 'description']) {
+    if (typeof parsed[field] === 'string' && parsed[field].trim() !== '') document[field] = parsed[field].trim()
+  }
+  if (typeof parsed.style === 'string' && parsed.style.trim() !== '') document.style = parsed.style.trim()
+  // Intensity is copied through as-is: `normalizeCard` is the single validator
+  // and clamps an unknown rung to its default, so this module needs no copy of
+  // the enum and cannot drift from the store's ladder.
+  if (typeof parsed.intensity === 'string' && parsed.intensity.trim() !== '') {
+    document.intensity = parsed.intensity.trim()
+  }
+  if (Array.isArray(parsed.examples)) {
+    const examples = parsed.examples.map(draftExampleOf).filter((example) => example !== undefined)
+    if (examples.length > 0) document.examples = examples
+  }
+  // Per-intensity demonstrations are the reason the four-rung ladder does
+  // anything at all, so a generated card carries them. A rung with no usable
+  // pair is simply absent here; `examplesFor` then falls back to the flat list
+  // rather than demonstrating nothing.
+  if (parsed.examplesByIntensity !== null && typeof parsed.examplesByIntensity === 'object' && !Array.isArray(parsed.examplesByIntensity)) {
+    const byIntensity = {}
+    for (const [level, list] of Object.entries(parsed.examplesByIntensity)) {
+      if (!Array.isArray(list)) continue
+      const examples = list.map(draftExampleOf).filter((example) => example !== undefined)
+      if (examples.length > 0) byIntensity[level] = examples
+    }
+    if (Object.keys(byIntensity).length > 0) document.examplesByIntensity = byIntensity
+  }
+  return { document }
+}
+
 /** System prompt of the technical-fact preservation check. */
 const FACT_CHECK_SYSTEM = [
   'You compare two versions of one user request and report whether the rewrite preserved the technical content.',
@@ -215,4 +376,4 @@ export function parseFactCheck(text) {
   return { state: 'unavailable', reason: `unparseable verdict: ${trimmed.slice(0, 120)}` }
 }
 
-export { FACT_CHECK_SYSTEM }
+export { FACT_CHECK_SYSTEM, CARD_DRAFT_SYSTEM }

package/lib/routes.js

@@ -20,6 +20,7 @@ import {
   CARD_RESET_ENDPOINT,
   CARD_DIFF_ENDPOINT,
   REVEAL_ENDPOINT,
+  CARD_DRAFT_ENDPOINT,
 } from './shared/protocol.js'
 import { isTrustedRequest } from './loopback.js'
 import { readBoundedJson, writeJson } from './http.js'
@@ -32,8 +33,12 @@ import {
   parseFactCheck,
   renderTemplate,
   FACT_CHECK_SYSTEM,
+  CARD_DRAFT_SYSTEM,
+  frameCardBrief,
+  parseCardDraft,
 } from './prompts.js'
 import { rewriteDraft, checkPreservation } from './rewrite.js'
+import { compareFacts } from './preserve.js'
 
 /** Largest accepted request body. */
 const MAX_BODY_BYTES = 512 * 1024
@@ -191,6 +196,9 @@ async function serve(deps, req, res) {
     case CARD_DIFF_ENDPOINT:
       await serveCardDiff(deps, res)
       return
+    case CARD_DRAFT_ENDPOINT:
+      await serveCardDraft(deps, body, req, res)
+      return
     case REVEAL_ENDPOINT:
       await serveReveal(deps, res)
       return
@@ -206,6 +214,11 @@ async function serve(deps, req, res) {
 async function serveCards(deps, res) {
   try {
     const catalog = await deps.store.list()
+    // Tell the client which model an AI draft would run on, so the settings
+    // page can SHOW it instead of the user having to guess. The settings slot
+    // receives no session id from the shell, so this is the harness default —
+    // reported honestly rather than described as "the session's model".
+    const draftRoute = resolveRoute(deps.ctx, undefined)
     writeJson(res, 200, {
       ok: true,
       value: {
@@ -214,6 +227,7 @@ async function serveCards(deps, res) {
         directory: catalog.directory,
         sendMode: deps.readConfig().sendMode,
         factCheck: deps.readConfig().factCheck,
+        draftModel: draftRoute === undefined ? null : { provider: draftRoute.provider, model: draftRoute.model },
       },
     })
   } catch (error) {
@@ -289,6 +303,116 @@ async function serveReveal(deps, res) {
   }
 }
 
+/** Largest accepted character brief, in characters. */
+const MAX_BRIEF_CHARS = 4_000
+
+/** Largest output requested when generating a card. */
+const DRAFT_MAX_TOKENS = 2_048
+
+/**
+ * Turn a rough character idea into a filled-in card on the session's own model.
+ *
+ * This is a PREFILL, never a write: the candidate card travels back to the
+ * browser, which drops it into the card form for the user to review, edit and
+ * save through the ordinary save route. Nothing here touches the card
+ * directory, so a bad generation cannot damage the catalog.
+ *
+ * The generated document is put through the SAME `normalizeCard` the save path
+ * uses, so a card this route produces can never be one the save path would
+ * reject — and the browser receives a fully normalized card rather than raw
+ * model output.
+ */
+async function serveCardDraft(deps, body, req, res) {
+  const brief = typeof body.brief === 'string' ? body.brief.trim() : ''
+  const sessionId = typeof body.sessionId === 'string' && body.sessionId !== '' ? body.sessionId : undefined
+  if (brief === '') {
+    writeJson(res, 422, { ok: false, error: { code: 'rejected', message: 'the character idea is empty' } })
+    return
+  }
+  if (brief.length > MAX_BRIEF_CHARS) {
+    writeJson(res, 422, {
+      ok: false,
+      error: { code: 'rejected', message: `the character idea exceeds ${MAX_BRIEF_CHARS} characters`, params: { max: MAX_BRIEF_CHARS } },
+    })
+    return
+  }
+
+  const route = resolveRoute(deps.ctx, sessionId)
+  if (route === undefined) {
+    writeJson(res, 409, {
+      ok: false,
+      error: {
+        code: 'unconfigured',
+        message: 'no model route resolved: send one message in this session first, or set a default model',
+      },
+    })
+    return
+  }
+  let llm
+  try {
+    llm = deps.ctx.get('llm')
+  } catch {
+    llm = undefined
+  }
+  if (llm === undefined || typeof llm.stream !== 'function') {
+    writeJson(res, 500, { ok: false, error: { code: 'internal', message: 'the llm service is unavailable' } })
+    return
+  }
+
+  // Cancel the model call when the browser goes away mid-flight.
+  const callerAbort = new AbortController()
+  const onClose = () => {
+    if (!res.writableEnded) callerAbort.abort()
+  }
+  res.on('close', onClose)
+  try {
+    let takenIds = []
+    try {
+      takenIds = (await deps.store.list()).cards.map((card) => card.id)
+    } catch {
+      // A catalog that cannot be read only costs the collision hint.
+    }
+    const result = await rewriteDraft(llm, {
+      provider: route.provider,
+      model: route.model,
+      system: CARD_DRAFT_SYSTEM,
+      userMessage: frameCardBrief(brief, takenIds),
+      maxTokens: DRAFT_MAX_TOKENS,
+      signal: callerAbort.signal,
+    })
+    const parsed = parseCardDraft(result.text)
+    if (parsed.error !== undefined) {
+      writeJson(res, 502, { ok: false, error: { code: 'upstream', message: parsed.error } })
+      return
+    }
+    const normalized = normalizeCard(parsed.document, { fallbackId: undefined, source: 'user' })
+    if (normalized.error !== undefined) {
+      writeJson(res, 502, {
+        ok: false,
+        error: { code: 'upstream', message: `the model produced an unusable card: ${normalized.error}` },
+      })
+      return
+    }
+    writeJson(res, 200, {
+      ok: true,
+      value: {
+        card: normalized.card,
+        provider: route.provider,
+        model: route.model,
+        elapsedMs: result.elapsedMs,
+      },
+    })
+  } catch (error) {
+    const code = errorCodeOf(error)
+    writeJson(res, code === 'timeout' ? 504 : code === 'unconfigured' ? 409 : 502, {
+      ok: false,
+      error: { code, message: error instanceof Error ? error.message : String(error) },
+    })
+  } finally {
+    res.off('close', onClose)
+  }
+}
+
 /** One rewrite, plus the optional preservation check. */
 async function serveRewrite(deps, body, req, res) {
   const text = typeof body.text === 'string' ? body.text : ''
@@ -318,10 +442,29 @@ async function serveRewrite(deps, body, req, res) {
   const intensity = typeof body.intensity === 'string' && ['light', 'medium', 'strong', 'zealot'].includes(body.intensity)
     ? body.intensity
     : card.intensity
-  // A caller may not widen fidelity beyond what the card declares: strategy
-  // rewriting can add behavioural constraints, which is the card author's
-  // decision, not a per-message toggle.
-  const fidelity = card.fidelity
+
+  // Mode: the card's own, unless the caller asks for the other one AND the card
+  // can actually honour it. A template card with no `style` cannot be rewritten
+  // by a model, and an llm card with no `template` has nothing to substitute —
+  // so an override the card cannot satisfy falls back to the card's own mode
+  // rather than failing the request.
+  const canTemplate = typeof card.template === 'string' && card.template.trim() !== ''
+  const canRewrite = typeof card.style === 'string' && card.style.trim() !== ''
+  const mode = body.mode === 'template' && canTemplate
+    ? 'template'
+    : body.mode === 'llm' && canRewrite
+      ? 'llm'
+      : card.mode
+
+  // Fidelity may be NARROWED per message, never widened.
+  //
+  // A `strategy` card may be asked to behave as voice-only for one message:
+  // that only ever removes the extra behavioural constraints, so it is strictly
+  // safer than the card's own default. The reverse is refused — a `style` card
+  // can never be told to start adding behavioural constraints, because that
+  // changes the request beyond what the card's author allowed, and a per-message
+  // toggle is exactly the wrong place to grant that power.
+  const fidelity = card.fidelity === 'strategy' && body.fidelity === 'style' ? 'style' : card.fidelity
 
   // Cancel the model call when the browser goes away mid-flight.
   const callerAbort = new AbortController()
@@ -330,7 +473,7 @@ async function serveRewrite(deps, body, req, res) {
   }
   res.on('close', onClose)
   try {
-    if (card.mode === 'template') {
+    if (mode === 'template') {
       const rendered = renderTemplate(card.template ?? '', text)
       writeJson(res, 200, {
         ok: true,
@@ -343,6 +486,9 @@ async function serveRewrite(deps, body, req, res) {
           fidelity,
           intensity,
           elapsedMs: 0,
+          // No model ran, so there is nothing a preservation check could
+          // disagree with: the draft is inserted verbatim.
+          facts: { state: 'ok', missing: [], added: [] },
           factCheck: { state: 'skipped', reason: 'template mode replaces the draft verbatim' },
         },
       })
@@ -371,7 +517,7 @@ async function serveRewrite(deps, body, req, res) {
       return
     }
 
-    const system = buildSystemPrompt(card, intensity, examplesFor(card, intensity))
+    const system = buildSystemPrompt(card, intensity, examplesFor(card, intensity), fidelity)
     const result = await rewriteDraft(llm, {
       provider: route.provider,
       model: route.model,
@@ -381,10 +527,23 @@ async function serveRewrite(deps, body, req, res) {
       signal: callerAbort.signal,
     })
 
-    // The preservation check is advisory: it never blocks a rewrite, it only
-    // annotates it so the review panel can warn before the user sends.
+    // Two layers of preservation checking, deliberately split:
+    //
+    //  - `facts` runs ALWAYS. It is a token comparison in this process: no
+    //    tokens, no latency, and it proves the common failure outright (a
+    //    dropped identifier, path, version or number).
+    //  - `factCheck` is the optional second model call, for what a token
+    //    comparison cannot see at all — a requirement reworded weaker, or a
+    //    behavioural constraint invented in prose.
+    //
+    // The caller may switch the model check per request; the plugin config is
+    // the default. An explicit boolean from the client wins, so the settings
+    // toggle is authoritative for the person using it.
+    const facts = compareFacts(text, result.text)
+
+    const wantModelCheck = typeof body.modelCheck === 'boolean' ? body.modelCheck : config.factCheck
     let factCheck = { state: 'skipped', reason: 'disabled in settings' }
-    if (config.factCheck) {
+    if (wantModelCheck) {
       const verdict = await checkPreservation(llm, {
         provider: route.provider,
         model: route.model,
@@ -407,6 +566,7 @@ async function serveRewrite(deps, body, req, res) {
         fidelity,
         intensity,
         elapsedMs: result.elapsedMs,
+        facts,
         factCheck,
       },
     })

package/lib/shared/protocol.js

@@ -43,3 +43,13 @@ export const CARD_DIFF_ENDPOINT = `${PREFIX}/cards/diff`
 
 /** Open (creating if needed) the user card directory in the OS file manager. */
 export const REVEAL_ENDPOINT = `${PREFIX}/reveal`
+
+/**
+ * Turn a rough character idea into a filled-in card, using the session's model.
+ *
+ * The result is only ever a PREFILL for the card form: it is returned to the
+ * browser and never written to disk by this route. The user reviews it, edits
+ * it if they want, and saves it themselves through the existing save route —
+ * so a bad generation costs a reload, not a corrupted card catalog.
+ */
+export const CARD_DRAFT_ENDPOINT = `${PREFIX}/cards/draft`