dsh-plugin-subscription-oauth 0.16.3 → 0.17.1

package/lib/providers/model-cache.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The last model listing each route read from its own endpoint, kept on disk.
+ *
+ * A live listing is the authority on which models a subscription serves and what
+ * each one is: its display name, context window, input modalities and reasoning
+ * ladder. Asking for it on every picker query would spend a request per refresh and
+ * still show nothing while the endpoint is unreachable, so the answer is read once,
+ * cached here, and reused as the route's catalog until the next discovery.
+ *
+ * That cache replaces the model table this build used to ship by hand: the same
+ * curated list, except it is now the endpoint's own answer rather than a roster that
+ * goes stale between releases. A hardcoded table cannot learn that a model was
+ * released, renamed or retired; a cached live read can, and it is read from disk
+ * rather than the network on the path that matters.
+ *
+ * The endpoint's own payload is stored verbatim rather than a pre-digested catalog, so
+ * the route re-derives everything it publishes — picker rows, fast variants, context
+ * variants — from the same parse it uses on a fresh read. A later build that reads more
+ * of a payload therefore benefits from a cache written by an earlier one.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/model-cache
+ */
+/**
+ * Keep each route's last live listing on disk.
+ *
+ * Reads are tolerant: a missing, unreadable, unparsable or stale-version file yields
+ * no cache rather than an error, because a cache miss must only mean "ask the
+ * endpoint", never a broken picker. Writes are atomic, so a crash mid-write cannot
+ * leave a half-written document behind.
+ */
+export declare class ModelCatalogCache {
+    private readonly file;
+    /**
+     * @param file - absolute path of the cache document.
+     */
+    constructor(file: string);
+    /**
+     * Whatever one route last cached.
+     *
+     * The payload is opaque here: a route writes what it needs to rebuild its catalog
+     * (Kimi stores the decoded rows of `/models`; a route that derives fast variants from
+     * a second listing stores both). It re-validates on read.
+     *
+     * @param provider - provider route key.
+     * @returns the cached payload, or undefined when there is no usable cache.
+     */
+    read(provider: string): Promise<unknown>;
+    /**
+     * Record what the endpoint just reported for one route.
+     *
+     * @param provider - provider route key.
+     * @param payload - what that route needs to rebuild its catalog.
+     */
+    write(provider: string, payload: unknown): Promise<void>;
+    /** Load the document, or undefined when it is absent or unusable. */
+    private load;
+}

package/lib/providers/model-cache.js

@@ -0,0 +1,105 @@
+/**
+ * The last model listing each route read from its own endpoint, kept on disk.
+ *
+ * A live listing is the authority on which models a subscription serves and what
+ * each one is: its display name, context window, input modalities and reasoning
+ * ladder. Asking for it on every picker query would spend a request per refresh and
+ * still show nothing while the endpoint is unreachable, so the answer is read once,
+ * cached here, and reused as the route's catalog until the next discovery.
+ *
+ * That cache replaces the model table this build used to ship by hand: the same
+ * curated list, except it is now the endpoint's own answer rather than a roster that
+ * goes stale between releases. A hardcoded table cannot learn that a model was
+ * released, renamed or retired; a cached live read can, and it is read from disk
+ * rather than the network on the path that matters.
+ *
+ * The endpoint's own payload is stored verbatim rather than a pre-digested catalog, so
+ * the route re-derives everything it publishes — picker rows, fast variants, context
+ * variants — from the same parse it uses on a fresh read. A later build that reads more
+ * of a payload therefore benefits from a cache written by an earlier one.
+ *
+ * @module dsh-plugin-subscription-oauth/providers/model-cache
+ */
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+/**
+ * On-disk shape version.
+ *
+ * Bumped when a route's parse of a cached payload changes meaning, so a document
+ * written by an older understanding is discarded rather than misread.
+ */
+const CACHE_VERSION = 1;
+/**
+ * Keep each route's last live listing on disk.
+ *
+ * Reads are tolerant: a missing, unreadable, unparsable or stale-version file yields
+ * no cache rather than an error, because a cache miss must only mean "ask the
+ * endpoint", never a broken picker. Writes are atomic, so a crash mid-write cannot
+ * leave a half-written document behind.
+ */
+export class ModelCatalogCache {
+    file;
+    /**
+     * @param file - absolute path of the cache document.
+     */
+    constructor(file) {
+        this.file = file;
+    }
+    /**
+     * Whatever one route last cached.
+     *
+     * The payload is opaque here: a route writes what it needs to rebuild its catalog
+     * (Kimi stores the decoded rows of `/models`; a route that derives fast variants from
+     * a second listing stores both). It re-validates on read.
+     *
+     * @param provider - provider route key.
+     * @returns the cached payload, or undefined when there is no usable cache.
+     */
+    async read(provider) {
+        const document = await this.load();
+        const cached = document?.providers[provider];
+        if (cached === undefined || cached.payload === undefined || cached.payload === null)
+            return undefined;
+        if (Array.isArray(cached.payload) && cached.payload.length === 0)
+            return undefined;
+        return cached.payload;
+    }
+    /**
+     * Record what the endpoint just reported for one route.
+     *
+     * @param provider - provider route key.
+     * @param payload - what that route needs to rebuild its catalog.
+     */
+    async write(provider, payload) {
+        if (payload === undefined || payload === null)
+            return;
+        if (Array.isArray(payload) && payload.length === 0)
+            return;
+        const document = await this.load() ?? { version: CACHE_VERSION, providers: {} };
+        document.providers[provider] = { fetchedAt: Date.now(), payload };
+        await mkdir(path.dirname(this.file), { recursive: true });
+        // Write beside the target and rename, so a reader never sees a partial document.
+        const temporary = `${this.file}.${process.pid}.tmp`;
+        await writeFile(temporary, `${JSON.stringify(document, null, 2)}\n`, 'utf8');
+        await rename(temporary, this.file);
+    }
+    /** Load the document, or undefined when it is absent or unusable. */
+    async load() {
+        try {
+            const parsed = JSON.parse(await readFile(this.file, 'utf8'));
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+                return undefined;
+            const record = parsed;
+            if (record['version'] !== CACHE_VERSION)
+                return undefined;
+            const providers = record['providers'];
+            if (typeof providers !== 'object' || providers === null || Array.isArray(providers))
+                return undefined;
+            return { version: CACHE_VERSION, providers: providers };
+        }
+        catch {
+            // Absent, unreadable or corrupt: a miss, not a failure.
+            return undefined;
+        }
+    }
+}

package/lib/providers/responses-stream.d.ts

@@ -57,6 +57,14 @@ export interface ResponsesStreamInput<S extends SessionBase> {
     models?: () => Promise<readonly string[]>;
     /** Called when a call proved the stored credential unusable. */
     onCredentialRejected?: (account: string) => void;
+    /**
+     * Called when the endpoint answered a request by naming the model id to use instead.
+     *
+     * The request is retried with that id, so the turn still succeeds; the caller records
+     * the rename so the next turn goes straight to the current id instead of learning it
+     * again from a refused request.
+     */
+    onModelRenamed?: (from: string, to: string) => void;
     /** Rewrite a thrown failure before it is mapped, e.g. to name the fix. */
     describeFailure?(error: unknown): unknown;
     /** Called when a model in the chain was skipped, with the reason. */

package/lib/providers/responses-stream.js

@@ -14,7 +14,7 @@
 import { EMPTY_RESPONSE_CODE, LlmError } from '@deepseek-ai/dsh-llm';
 import { allowanceScheduler } from '../auth/allowance-scheduler.js';
 import { streamResponses } from '../translate/responses.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, unknownModelReplacement } from './common.js';
 /**
  * Minimum beat between dispatch attempts on one route, so a refused account is not
  * re-hit at once and a sweep across the pool does not become a burst. opencodex keeps
@@ -161,10 +161,26 @@ export async function* streamProviderResponses(options, input) {
                         continue;
                     let response = await request(options, model, token.accessToken, watchdog.signal);
                     if (response.status === 401 || response.status === 403) {
-                        token = await tokens.resolve(token.account, true);
-                        response = await request(options, model, token.accessToken, watchdog.signal);
-                        if (response.status === 401 || response.status === 403) {
-                            input.onCredentialRejected?.(token.account);
+                        // Two different failures share this status: a credential the provider no
+                        // longer accepts, and a model id it does not know. Only the first is answered
+                        // by a token refresh — treating a model rename that way would refresh a
+                        // healthy token and, worse, mark the account as needing a new sign-in. The
+                        // body says which it is, so it is read before deciding, and an unknown model
+                        // is retried once under the id the provider named.
+                        const refusal = await httpLlmError(response, label);
+                        const replacement = unknownModelReplacement(refusal.message);
+                        if (replacement !== undefined) {
+                            lastError = refusal;
+                            input.onModelRenamed?.(model, replacement);
+                            input.onFallback?.(model, replacement, reasonOf(refusal));
+                            response = await request(options, replacement, token.accessToken, watchdog.signal);
+                        }
+                        else {
+                            token = await tokens.resolve(token.account, true);
+                            response = await request(options, model, token.accessToken, watchdog.signal);
+                            if (response.status === 401 || response.status === 403) {
+                                input.onCredentialRejected?.(token.account);
+                            }
                         }
                     }
                     // A spent allowance moves to the next account (when the provider supports

package/lib/providers/workbuddy-provider.d.ts

@@ -13,8 +13,25 @@ export interface WorkBuddyProviderOptions {
     credentialFile: string;
     /** Abandon a stream after this much silence. */
     streamIdleTimeoutMs: number;
+    /**
+     * Whether WorkBuddy's own console listing is consulted for the catalog.
+     *
+     * The listing is the authority on which models an account serves; switching this off
+     * leaves the seed table in place and reads nothing.
+     */
+    discovery?: boolean;
     /** Model the picker preselects. */
     defaultModel?: string;
+    /**
+     * WorkBuddy's last listing, from this plugin's cache.
+     *
+     * The cached table is what the picker shows before any request: the console's own answer
+     * from the last read, so a release does not need a plugin update and a refresh does not
+     * need a request.
+     */
+    cachedListing?: () => Promise<unknown>;
+    /** Record what a live listing just produced, replacing the cached table. */
+    saveListing?: (payload: unknown) => Promise<void>;
     /** Shared model-visibility preferences. */
     preferences: ModelPreferences;
     /** Invoked when the catalog or its visibility changed. */

package/lib/providers/workbuddy-provider.js

@@ -11,7 +11,7 @@ import { LOGIN_CANCELLED_MESSAGE } from '../auth/device-flow.js';
 import path from 'node:path';
 import { readSpendLedger } from './workbuddy-credits.js';
 import { finishWorkBuddySignIn, parseWorkBuddySession, readWorkBuddyUsage, refreshWorkBuddyToken, startWorkBuddySignIn, workbuddyRefreshable, workbuddyStale, claimWorkBuddyCheckin, listWorkBuddyTasks, acceptWorkBuddyTasks, claimWorkBuddyTask, WORKBUDDY_EARLY_MS, } from '../auth/workbuddy-flow.js';
-import { WorkBuddyAdapter, WORKBUDDY_CODE_URL, WORKBUDDY_CATALOG, WORKBUDDY_DEFAULT_MODEL, WORKBUDDY_PROVIDER_ID, WORKBUDDY_PROVIDER_NAME, } from './workbuddy.js';
+import { WorkBuddyAdapter, WORKBUDDY_CODE_URL, WORKBUDDY_DEFAULT_MODEL, WORKBUDDY_FALLBACK_CONTEXT_WINDOW, WORKBUDDY_PROVIDER_ID, WORKBUDDY_PROVIDER_NAME, } from './workbuddy.js';
 import { ProviderController } from '../auth/provider-controller.js';
 import { proxiedFetch } from '../http.js';
 /** Wait, honouring cancellation. */
@@ -133,12 +133,17 @@ export function createWorkBuddyProvider(options) {
     });
     const spendFile = path.join(path.dirname(options.credentialFile), 'workbuddy-spend.json');
     const adapter = new WorkBuddyAdapter({
+        // Consulting the console's listing is what keeps the catalog from going stale: a model
+        // released, renamed or retired server-side appears without a plugin update.
+        discovery: options.discovery ?? true,
         streamIdleTimeoutMs: options.streamIdleTimeoutMs,
         tokens,
         spendFile,
         ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
         hiddenModels: () => options.preferences.hiddenIds(WORKBUDDY_PROVIDER_ID),
         userModels: () => options.preferences.extraIds(WORKBUDDY_PROVIDER_ID),
+        ...options.cachedListing === undefined ? {} : { cachedListing: options.cachedListing },
+        ...options.saveListing === undefined ? {} : { saveListing: options.saveListing },
         fetchFn,
     });
     /** The stored session's fields as the token a request or meter signs with. */
@@ -157,13 +162,17 @@ export function createWorkBuddyProvider(options) {
         displayName: WORKBUDDY_PROVIDER_NAME,
         codeUrl: WORKBUDDY_CODE_URL,
         credentialFile: options.credentialFile,
-        // WorkBuddy ships a fixed catalog; there is no discovery endpoint.
-        discovery: false,
+        // WorkBuddy's own console route lists the models an account may use; it is read once
+        // and cached, and a picker query never asks the endpoint.
+        discovery: options.discovery ?? true,
         defaultModel: options.defaultModel ?? WORKBUDDY_DEFAULT_MODEL,
         catalog: () => adapter.catalogEntries(),
         catalogOwn: () => adapter.ownCatalogEntries(),
-        fallbackContextWindow: WORKBUDDY_CATALOG[0]?.contextWindow ?? 0,
-        discover: () => Promise.resolve(undefined),
+        fallbackContextWindow: WORKBUDDY_FALLBACK_CONTEXT_WINDOW,
+        // The token is handed over rather than the session it came from; the adapter reads the
+        // session back, so each account is attributed to its own enterprise.
+        discover: (accessToken) => adapter.fetchCatalog(accessToken),
+        applyDiscovery: (ids) => { adapter.discover(ids); },
         usage: async (_accessToken, account) => {
             const held = await store.get(account);
             if (held === undefined)
@@ -178,7 +187,6 @@ export function createWorkBuddyProvider(options) {
             { key: 'endpoint', value: 'https://copilot.tencent.com' },
             { key: 'credentialFile', value: options.credentialFile },
         ],
-        applyDiscovery: () => { },
     };
     const controller = new ProviderController({
         spec,

package/lib/providers/workbuddy.d.ts

@@ -3,8 +3,15 @@
  *
  * WorkBuddy chats are chat completions at `https://copilot.tencent.com/v2/chat/completions`,
  * streamed only, and the API refuses a request whose User-Agent is not
- * `WorkBuddy/<version>`. The route ships the China build's catalog (Hy, GLM, Kimi,
- * DeepSeek, MiniMax). Adapted from magpie's `workbuddy` for this plugin's contracts.
+ * `WorkBuddy/<version>`. The model table this route publishes is the console's own
+ * listing — `GET /console/enterprises/<enterpriseId || personal>/models`, the route
+ * WorkBuddy's web console reads — fetched once and kept in this plugin's cache (see
+ * {@link WorkBuddyAdapter.hydrate} and {@link WorkBuddyAdapter.fetchCatalog}).
+ * {@link WORKBUDDY_CATALOG} is the cold-start seed used until a listing has been read,
+ * the fallback when a read fails, and the metadata overlay for a row the listing
+ * describes only partly, so a model released, renamed or retired server-side reaches the
+ * picker without a plugin update and without a request per refresh.
+ * Adapted from magpie's `workbuddy` for this plugin's contracts.
  *
  * @module dsh-plugin-subscription-oauth/providers/workbuddy
  */
@@ -19,8 +26,28 @@ export declare const WORKBUDDY_PROVIDER_ID = "workbuddy";
 export declare const WORKBUDDY_PROVIDER_NAME = "WorkBuddy";
 /** Where the Settings page sends someone to get an account. */
 export declare const WORKBUDDY_CODE_URL = "https://copilot.tencent.com";
-/** The model the picker preselects. */
-export declare const WORKBUDDY_DEFAULT_MODEL = "hy4-preview-f";
+/**
+ * The model the picker preselects.
+ *
+ * The console's own default, and a row its listing actually serves, so the page's
+ * "recommended" marker never names a model the picker cannot offer. The previous value
+ * (`hy4-preview-f`) was a seed-table spelling the live listing does not serve — it offers
+ * `hy4-preview` — which is the staleness this route no longer keeps in its catalog.
+ */
+export declare const WORKBUDDY_DEFAULT_MODEL = "auto";
+/** Context advertised for a listed id neither the listing nor the seed table describes. */
+export declare const WORKBUDDY_FALLBACK_CONTEXT_WINDOW = 168000;
+/**
+ * The console route that lists the models one account may use.
+ *
+ * The scope segment is the enterprise the session is attributed to, or `personal` for an
+ * account that states none. This is the route WorkBuddy's own console reads; it is not
+ * one of the plugin's `/v2` API routes, which is why probing those found nothing.
+ *
+ * @param enterpriseId - the session's enterprise, when it has one.
+ * @returns the absolute listing URL.
+ */
+export declare function workbuddyModelsUrl(enterpriseId?: string): string;
 /** One signed-in WorkBuddy session, as stored. */
 export interface WorkBuddyStored {
     accessToken: string;
@@ -34,15 +61,35 @@ export interface WorkBuddyStored {
     tokenType?: string;
     refreshExpiresAt?: number;
 }
-/** The catalog the route serves. */
+/**
+ * The seed table the route falls back to when no listing has been read (see
+ * {@link CN_MODELS}).
+ *
+ * A table this build ships, never the roster: WorkBuddy's own listing decides which
+ * models exist, and each row's own figures decide what they are. This is only the
+ * cold-start membership and the overlay for what a listing leaves unsaid.
+ */
 export declare const WORKBUDDY_CATALOG: readonly CatalogEntry[];
 /** Constructor dependencies for {@link WorkBuddyAdapter}. */
 export interface WorkBuddyAdapterOptions {
+    /** Whether the console's live model listing is consulted. */
+    discovery: boolean;
     streamIdleTimeoutMs: number;
     tokens: TokenManager<WorkBuddySession>;
     onWarn?: (message: string) => void;
     hiddenModels?: () => Promise<ReadonlySet<string>>;
     userModels?: () => Promise<readonly string[]>;
+    /**
+     * The listing WorkBuddy's console answered last, as this plugin's cache kept it.
+     *
+     * Read once per session, before the first catalog query, so the picker offers the real
+     * models without asking the console anything. A route that fetched once and cached the
+     * answer has no reason to fetch again on every refresh; the Settings "refresh models"
+     * action is what re-reads it.
+     */
+    cachedListing?: () => Promise<unknown>;
+    /** Record what a live listing just produced, replacing the cached table. */
+    saveListing?: (payload: unknown) => Promise<void>;
     /** Where per-account credit spends accumulate; beside the credential file. */
     spendFile?: string;
     fetchFn?: FetchFn;
@@ -51,19 +98,101 @@ export interface WorkBuddyAdapterOptions {
 export declare class WorkBuddyAdapter extends LlmAdapter {
     private readonly options;
     private readonly fetchFn;
+    /**
+     * The catalog this route serves: entries derived from WorkBuddy's own listing, either
+     * the one just read or the one the cache kept from the last read.
+     *
+     * Undefined means neither source has produced a listing yet, so the seed table
+     * ({@link WORKBUDDY_CATALOG}) is what the picker shows.
+     */
+    private live;
+    /** Whether the cached listing has been read; it is read at most once per session. */
+    private hydrated;
     constructor(options: WorkBuddyAdapterOptions);
     providerInfo(provider: string): LlmProviderInfo;
+    /**
+     * Adopt one listing as this route's catalog.
+     *
+     * Everything the picker shows is derived here from WorkBuddy's own answer: which models
+     * exist (the account's `cli` agent when the listing states one), in the order that
+     * listing states them, each with the name, window, modalities and reasoning rung its row
+     * states. The seed table is consulted only for what a row leaves unsaid, so a live
+     * figure is never overridden by a shipped guess.
+     *
+     * @param payload - the decoded listing, or the `{models, agents}` object a cache kept.
+     * @returns the entries to publish, in picker order.
+     */
+    private adoptListing;
+    /**
+     * Read the cached listing, once, so the picker works without asking the console.
+     *
+     * Called before the first catalog query. A read failure is a cache miss, never a
+     * failure: the route falls back to its seed table until a listing is fetched, so a
+     * broken cache can never empty the picker.
+     */
+    hydrate(): Promise<void>;
     listModels(_provider: string): Promise<readonly LlmModelInfo[]>;
     private hidden;
+    /**
+     * The catalog to present: the models WorkBuddy's listing named, in the order its own
+     * console states them, each with the metadata that listing stated.
+     *
+     * The seed table is the membership only while no listing has been read, and the metadata
+     * overlay for a row the listing describes partly. It is never allowed to add a row back:
+     * a model the console stopped serving must leave the picker without a plugin update,
+     * which is the whole point of reading the listing instead of shipping a roster.
+     */
+    private shippedCatalog;
     /** The catalog the Settings list reads. */
     catalogEntries(): readonly CatalogEntry[];
     /** The entries the route itself serves, without hand-added extras. */
     ownCatalogEntries(): readonly CatalogEntry[];
+    /**
+     * Adopt the ids a caller reports as the served set, without a listing.
+     *
+     * {@link fetchCatalog} already derived the entries from the listing it read, and the
+     * controller reports those same ids back here; the entries it recorded are kept, so a
+     * live name, window or rung is not replaced by the seed table's. A caller that only has
+     * ids (a test, another discovery path) gets the seed table's metadata where it knows the
+     * id and conservative entries otherwise.
+     *
+     * @param ids - model ids the caller reports.
+     */
+    discover(ids: readonly string[]): void;
     resolveModel(_provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    /**
+     * Read WorkBuddy's own console listing and adopt it as this route's catalog.
+     *
+     * This is the one place a model table is produced, and it is WorkBuddy's own answer: the
+     * account's `cli` agent decides which models are available, and each row states its own
+     * name, window, modalities and reasoning rung (see {@link adoptListing}). The payload is
+     * also handed to {@link WorkBuddyAdapterOptions.saveListing}, so the next session starts
+     * from this table instead of asking again — the Settings "refresh models" action is what
+     * re-reads it, and a picker query never does.
+     *
+     * A failed or empty read keeps the catalog the route already had, and says so once.
+     *
+     * @param accessToken - bearer for the account.
+     * @param enterpriseId - the enterprise to read; taken from the stored session when omitted.
+     * @param signal - optional cancellation.
+     * @returns the model ids now served, or undefined when the listing is unavailable.
+     */
+    fetchCatalog(accessToken: string, enterpriseId?: string, signal?: AbortSignal): Promise<readonly string[] | undefined>;
+    /**
+     * The stored session one access token belongs to.
+     *
+     * Discovery is handed the account's token rather than the session it came from, and the
+     * console route is attributed by that session's own fields, so the session is read back
+     * here. The first account whose stored token matches wins; a token that matches none
+     * falls back to the route's current session. A read failure is never fatal — the listing
+     * is still read with the token the caller passed.
+     *
+     * @param accessToken - the token discovery was called with.
+     * @returns the session's fields as a signable token, or undefined when none was readable.
+     */
+    private sessionFor;
     providerRetryPolicy(): undefined;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
-    /** The current turn's billed credit, read off the last usage frame. */
-    private turnCredit;
     /** The stored session's fields as the token the request signs with. */
     private tokenOf;
     private requestBody;
@@ -72,21 +201,19 @@ export declare class WorkBuddyAdapter extends LlmAdapter {
      *
      * A tool name may hold only letters, digits, `_`, `-`; another character is refused, and
      * a schema with a union at the parameter root or a `\0` escape is turned away by the
-     * model. Each unsafe name is made safe and the safe→original map kept on the adapter so
-     * the model's calls can be renamed back in the answer. Adapted from magpie's fitTools.
+     * model. Each unsafe name is made safe and the safe→original map returned to the caller
+     * so the model's calls can be renamed back in the answer. Adapted from magpie's fitTools.
      *
      * @param tools - the declared tool schemas, when any.
+     * @param history - the request's assistant/tool turns, renamed in place to the safe names.
      * @returns the mended wire tools, or undefined when there are none.
      */
     private fittedTools;
-    /** The safe→original tool names to restore in the answer. */
-    private safeToolNames;
-    /** The assistant/tool history of the request being built, for renaming past calls. */
-    private historyMessages;
     /**
      * Restore the original tool names the model was given, in one parsed chunk.
      *
      * @param value - a decoded SSE payload.
+     * @param names - the safe→original map the request that produced this stream mended.
      * @returns whether any name changed.
      */
     private namedBack;