dsh-qoder-connect 0.2.0 → 0.2.2

package/lib/index.d.ts

@@ -2,10 +2,10 @@ import z from "@deepseek-ai/schemastery";
 import "@earendil-works/pi-ai";
 import { GenerateOptions, StreamChunk } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { AttachmentStore } from "@deepseek-ai/dsh-attachment";
 import { IncomingMessage, ServerResponse } from "node:http";
 import { Context } from "@deepseek-ai/cordis";
 import { SettingsNamespace } from "@deepseek-ai/dsh-settings";
-import { AttachmentStore } from "@deepseek-ai/dsh-attachment";
 //#region src/paths.d.ts
 /**
  * The plugin's data directory — the ONE place every file the plugin owns
@@ -1448,16 +1448,14 @@ declare const QUOTA_POLL_DEFAULT_MS = 300000;
 declare const QUOTA_POLL_MIN_MS = 60000;
 declare const Config: z<Config>;
 /**
- * Every field each settings section owns, and therefore every field the live
- * configuration has to carry through.
+ * The field groups the configuration is merged from, one list per card.
  *
- * One list per section, shared by the merge and by the test that pins it to
- * the schema. Writing the merge out by hand is what broke auto check-in: the
- * `qoder-quota` section grew four fields (`autoCheckInCN`, `autoCheckInGlobal`,
- * `checkInMinuteCN`, `checkInMinuteGlobal`) while the merge kept copying only
- * the three that predated them, so `current().autoCheckInCN` read `undefined`
- * forever and the scheduler saw the toggle as permanently off. The card saved
- * it, the file held it, and nothing ever acted on it.
+ * Writing the merge out by hand is what broke auto check-in: the quota group
+ * grew four fields (`autoCheckInCN`, `autoCheckInGlobal`, `checkInMinuteCN`,
+ * `checkInMinuteGlobal`) while the merge kept copying only the three that
+ * predated them, so `current().autoCheckInCN` read `undefined` forever and the
+ * scheduler saw the toggle as permanently off. The card saved it, the file
+ * held it, and nothing ever acted on it.
  */
 declare const CN_SECTION_KEYS: readonly ["probeConsent", "useMaximumContextWindowCN", "modelContextWindowsCN", "disabledModelsCN"];
 declare const GLOBAL_SECTION_KEYS: readonly ["useMaximumContextWindow", "modelContextWindows", "disabledModels"];

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as QODER_GLOBAL_AUTH_PATH, B as patTail, C as probeModel, D as FALLBACK_QODER_MODELS, E as qoderCatalogPath, F as QODER_STATUS_PATH, G as qoderMachineIdPath, H as qoderOwnAuthPath, I as QODER_AUTH_FILENAME, K as qoderPluginDataDir, L as QODER_PAT_ENV_CN, M as QODER_GLOBAL_STATUS_PATH, N as QODER_PROBE_PATH, O as QoderCatalog, P as QODER_SETTINGS_FACE_PATH, R as QODER_PAT_ENV_GLOBAL, S as PROBE_EFFORT_CANDIDATES, T as QoderCatalogStore, U as QODER_DATA_DIR_ENV, V as qoderCredentialIdentity, W as QODER_DATA_DIR_NAME, _ as modelInfoOf, a as QODER_HOST_HEARTBEAT_FILENAME, b as createQoderTransport, c as processStartTimeMs, d as writeHostHeartbeat, f as QODER_CONNECT_VERSION, g as kindFromQoderFailure, h as classifyUpstreamError, i as variantFor, j as QODER_GLOBAL_PROBE_PATH, k as QODER_AUTH_PATH, l as qoderHostHeartbeatPath, m as QoderUpstreamClient, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as KIND_STATUS, q as qoderStateDir, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, v as normalizeCredits, w as randomSentinel, x as getMachineId, y as validateApiKey, z as QoderCredentialStore } from "./variants-DuEgaUad.js";
+import { A as QODER_GLOBAL_AUTH_PATH, B as patTail, C as probeModel, D as FALLBACK_QODER_MODELS, E as qoderCatalogPath, F as QODER_STATUS_PATH, G as qoderMachineIdPath, H as qoderOwnAuthPath, I as QODER_AUTH_FILENAME, K as qoderPluginDataDir, L as QODER_PAT_ENV_CN, M as QODER_GLOBAL_STATUS_PATH, N as QODER_PROBE_PATH, O as QoderCatalog, P as QODER_SETTINGS_FACE_PATH, R as QODER_PAT_ENV_GLOBAL, S as PROBE_EFFORT_CANDIDATES, T as QoderCatalogStore, U as QODER_DATA_DIR_ENV, V as qoderCredentialIdentity, W as QODER_DATA_DIR_NAME, _ as modelInfoOf, a as QODER_HOST_HEARTBEAT_FILENAME, b as createQoderTransport, c as processStartTimeMs, d as writeHostHeartbeat, f as QODER_CONNECT_VERSION, g as kindFromQoderFailure, h as classifyUpstreamError, i as variantFor, j as QODER_GLOBAL_PROBE_PATH, k as QODER_AUTH_PATH, l as qoderHostHeartbeatPath, m as QoderUpstreamClient, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as KIND_STATUS, q as qoderStateDir, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, v as normalizeCredits, w as randomSentinel, x as getMachineId, y as validateApiKey, z as QoderCredentialStore } from "./variants-CFI6-cGn.js";
 import z from "@deepseek-ai/schemastery";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
@@ -7,10 +7,8 @@ import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
-import { homedir } from "node:os";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
-import yamlModule from "js-yaml";
 //#region src/loopback.ts
 /**
 * Shared loopback gates for the plugin's local HTTP surfaces: the loopback
@@ -1660,8 +1658,6 @@ function appendHintRow(agent, kind, text) {
 *
 * @module dsh-qoder-connect/settings-store
 */
-const yaml = yamlModule;
-const loadYaml = typeof yaml.load === "function" ? yaml.load : yaml.default?.load;
 /** Settings file name inside the plugin data directory. */
 const SETTINGS_FILE_NAME = "settings.json";
 /** This plugin's data directory (shared with the credential and caches). */
@@ -1691,61 +1687,11 @@ function writeSettings(values) {
 	writeFileSync(tmp, `${JSON.stringify(values, null, 2)}\n`, "utf8");
 	renameSync(tmp, path);
 }
-/** Resolve `$DSH_HOME` the way the Host does, without importing a Host package. */
-function dshHome() {
-	const fromEnv = process.env.DSH_HOME?.trim() || void 0;
-	if (fromEnv !== void 0) return fromEnv;
-	return join(homedir(), ".dsh");
-}
-/**
-* Read this plugin's sections out of the legacy settings document.
-*
-* The 0.1.5 host kept every plugin's settings in `$DSH_HOME/settings.yaml`;
-* 0.1.7 renames it to `settings.yaml.imported` once, on the first boot, and
-* imports only the sections whose names match a profile entry id. This
-* plugin's 0.1.5 sections were keyed by its SERVED NAMESPACES (`qoder`,
-* `qoder-global`, `qoder-quota`), which name no entry in the profile — the row
-* is `llm-qoder` — so the platform refuses them and their data survives only
-* in the renamed document. Reading it here recovers that data independently of
-* the platform's import, its section-name mapping, and its timing.
-*
-* @param namespaces - the section names the 0.1.5 host keyed this plugin's
-*   settings under (one per served section).
-* @returns the union of those sections' fields, or undefined when the document
-*   is absent, unreadable, or holds none of them.
-*/
-function readLegacySections(namespaces) {
-	let path;
-	for (const name of ["settings.yaml", "settings.yaml.imported"]) {
-		const candidate = join(dshHome(), name);
-		if (existsSync(candidate)) {
-			path = candidate;
-			break;
-		}
-	}
-	if (path === void 0 || loadYaml === void 0) return void 0;
-	let document;
-	try {
-		document = loadYaml(readFileSync(path, "utf8"));
-	} catch {
-		return;
-	}
-	if (document === null || typeof document !== "object") return void 0;
-	const merged = {};
-	let found = false;
-	for (const ns of namespaces) {
-		const section = document[ns];
-		if (section === null || typeof section !== "object" || Array.isArray(section)) continue;
-		Object.assign(merged, section);
-		found = true;
-	}
-	return found ? merged : void 0;
-}
 /**
 * Reserved bookkeeping key: how many writes the settings card has made through
-* this store. Its presence separates "the file holds migration seed" from "the
-* file holds the user's live edits" — see the seed rule in ./index.ts. Field
-* readers address their fields by name and never collide with it.
+* this store. Its presence separates "the file holds the startup seed" from
+* "the file holds the user's live edits" — see the seed rule in ./index.ts.
+* Field readers address their fields by name and never collide with it.
 */
 const WRITE_MARK = "__writes";
 /**
@@ -1765,12 +1711,10 @@ var SettingsStore = class {
 	/**
 	* Whether the settings card has ever written through this store.
 	*
-	* False during the migration window — the window where a 0.1.5 settings.yaml
-	* import (which lands only after the Loader settles, i.e. AFTER this plugin's
-	* first apply) can still deliver the user's real values, and where a first
-	* seed may have been taken before that import. While false the entry config
-	* stays authoritative; once the card writes, the file is — a runtime edit
-	* must never be regressed by a stale profile row.
+	* Until it has, the entry config stays the fallback layer (a hand-edited
+	* profile row can still seed a fresh install); once the card writes, the
+	* file is authoritative — a runtime edit must never be regressed by a stale
+	* profile row.
 	*/
 	get edited() {
 		return typeof this.user[WRITE_MARK] === "number" && this.user[WRITE_MARK] > 0;
@@ -1996,37 +1940,15 @@ const Config = z.object({
 	checkInMinuteGlobal: CHECK_IN_MINUTE_FIELD,
 	quotaPollMs: QUOTA_POLL_FIELD
 });
-z.object({
-	probeConsent: PROBE_CONSENT_FIELD,
-	useMaximumContextWindowCN: MAXIMUM_CONTEXT_WINDOW_CN_FIELD,
-	modelContextWindowsCN: MODEL_CONTEXT_WINDOWS_FIELD,
-	disabledModelsCN: DISABLED_MODELS_FIELD
-});
-z.object({
-	useMaximumContextWindow: MAXIMUM_CONTEXT_WINDOW_FIELD,
-	modelContextWindows: MODEL_CONTEXT_WINDOWS_FIELD,
-	disabledModels: DISABLED_MODELS_FIELD
-});
-z.object({
-	sidebarQuotaCN: QUOTA_TOGGLE_FIELD,
-	sidebarQuotaGlobal: QUOTA_TOGGLE_FIELD,
-	autoCheckInCN: AUTO_CHECK_IN_FIELD,
-	autoCheckInGlobal: AUTO_CHECK_IN_FIELD,
-	checkInMinuteCN: CHECK_IN_MINUTE_FIELD,
-	checkInMinuteGlobal: CHECK_IN_MINUTE_FIELD,
-	quotaPollMs: QUOTA_POLL_FIELD
-});
 /**
-* Every field each settings section owns, and therefore every field the live
-* configuration has to carry through.
-*
-* One list per section, shared by the merge and by the test that pins it to
-* the schema. Writing the merge out by hand is what broke auto check-in: the
-* `qoder-quota` section grew four fields (`autoCheckInCN`, `autoCheckInGlobal`,
-* `checkInMinuteCN`, `checkInMinuteGlobal`) while the merge kept copying only
-* the three that predated them, so `current().autoCheckInCN` read `undefined`
-* forever and the scheduler saw the toggle as permanently off. The card saved
-* it, the file held it, and nothing ever acted on it.
+* The field groups the configuration is merged from, one list per card.
+*
+* Writing the merge out by hand is what broke auto check-in: the quota group
+* grew four fields (`autoCheckInCN`, `autoCheckInGlobal`, `checkInMinuteCN`,
+* `checkInMinuteGlobal`) while the merge kept copying only the three that
+* predated them, so `current().autoCheckInCN` read `undefined` forever and the
+* scheduler saw the toggle as permanently off. The card saved it, the file
+* held it, and nothing ever acted on it.
 */
 const CN_SECTION_KEYS = [
 	"probeConsent",
@@ -2081,10 +2003,6 @@ function readConfig(config) {
 }
 /** Stable identity key used by credentials, probe records, and catalog entries. */
 const credentialIdentity = qoderCredentialIdentity;
-/** The settings namespace a variant's card and provider directory entry use. */
-function settingsNamespaceFor(variant) {
-	return variant.id === CHINA_VARIANT.id ? QODER_SETTINGS_NS : QODER_GLOBAL_SETTINGS_NS;
-}
 /**
 * The static catalog a variant serves before its first successful fetch.
 *
@@ -2314,15 +2232,7 @@ async function startVariant(ctx, runtime, seedCatalog) {
 		let releaseDirectory;
 		try {
 			releaseAdapter = ctx.llm.registerAdapter([variant.id], qoder.adapter);
-			const host017 = (() => {
-				try {
-					return ctx.get?.("configEditor") !== void 0;
-				} catch {
-					return false;
-				}
-			})();
-			const entryId = ctx.fiber?.entry?.options?.id;
-			const settingsNs = host017 && entryId !== void 0 ? entryId : settingsNamespaceFor(variant);
+			const settingsNs = ctx.fiber?.entry?.options?.id ?? variant.id;
 			releaseDirectory = ctx.llm.registerConfigurableProviders([{
 				provider: variant.id,
 				displayName: variant.displayName,
@@ -2558,43 +2468,22 @@ function validateSettingsPatch(patch) {
 	}
 }
 /**
-* When the profile tree last recomposed, module-level so every apply sees it.
-*
-* The legacy settings.yaml import writes the profile patch one section at a
-* time for seconds after the Loader settles, emitting this event on every
-* write. Cleaning up our row in that window is futile — the import's next
-* section simply writes it back — so the cleanup waits for the tree to fall
-* quiet first.
-*/
-let lastConfigReloadAt = Date.now();
-/** Wait until the profile tree has been quiet (the legacy import finished). */
-async function waitForProfileQuiet() {
-	const deadline = Date.now() + 12e4;
-	for (;;) {
-		if (Date.now() - lastConfigReloadAt >= 5e3) return;
-		if (Date.now() >= deadline) return;
-		await new Promise((resolve) => setTimeout(resolve, 1e3));
-	}
-}
-/**
 * Delete this plugin's own fields from the profile entry config, leaving every
 * other key of the row untouched.
 *
 * One-time, right after the settings file has been seeded: the entry returns to
-* its shipped state, so no second source of truth remains. Both write APIs are
-* probed — `configEditor` (0.1.7) first, then the settings service's namespace
-* `replace` (0.1.5), which rebuilds each of this plugin's three sections from
-* the foreign keys alone.
+* its shipped state, so no second source of truth remains. The write rides
+* `configEditor` — the 0.1.7 profile-patch editor — probed on the plugin
+* context first and on the settings service's owner context second, because
+* that is where the host root mounts it.
 *
 * @param ctx - plugin context.
 * @param ownKeys - this plugin's declared config fields.
-* @param namespaces - the 0.1.5 section namespaces this plugin owns.
 */
-async function cleanupEntryConfig(ctx, ownKeys, namespaces) {
+async function cleanupEntryConfig(ctx, ownKeys) {
 	const attempts = 10;
 	for (let attempt = 0; attempt < attempts; attempt++) try {
-		if (attempt === 0) await waitForProfileQuiet();
-		else await new Promise((resolve) => setTimeout(resolve, 2e3 + Math.random() * 1e3));
+		if (attempt > 0) await new Promise((resolve) => setTimeout(resolve, 2e3 + Math.random() * 1e3));
 		const probe = ctx;
 		const editor = (typeof probe.get === "function" ? (() => {
 			try {
@@ -2626,16 +2515,6 @@ async function cleanupEntryConfig(ctx, ownKeys, namespaces) {
 			});
 			return;
 		}
-		await new Promise((resolve) => {
-			ctx.inject(["settings"], (settingsCtx) => {
-				const settings = settingsCtx.settings;
-				if (typeof settings?.replace !== "function" || typeof settings.installSection !== "function") {
-					resolve(void 0);
-					return;
-				}
-				Promise.all(namespaces.map((ns) => Promise.resolve(settings.replace(ns, {})).catch(() => void 0))).then(() => resolve(void 0));
-			});
-		});
 		return;
 	} catch (error) {
 		if (attempt === 9) {
@@ -2672,63 +2551,41 @@ function apply(ctx, config) {
 		...store.values()
 	});
 	/**
-	* One-time migration: per field — the file never held it → take the entry;
-	* the card HAS written this file → keep the file; the entry carries a
-	* NON-DEFAULT value → take the entry (the legacy settings.yaml import lands
-	* only after the Loader settles, i.e. after this plugin's first apply, and a
-	* seed taken inside that window can hold a stale or mis-encoded value); the
-	* entry only carries the schema default → keep the file.
+	* One-time seed: per field — the file never held it → take the entry; the
+	* card HAS written this file → keep the file; the entry carries a
+	* NON-DEFAULT value → take the entry; the entry only carries the schema
+	* default → keep the file.
 	*
 	* That last clause is load-bearing: a bundle layer's insert config does NOT
 	* reach the composition (verified with `dsh --dump-config`), so once the
 	* one-time cleanup has emptied the entry row the entry answers pure defaults —
 	* treating those as authoritative would erase the user's values on the next
-	* boot. Re-checked on every apply, which is also what closes the legacy
-	* import's timing window.
+	* boot. Re-checked on every apply, which is also what closes the volatile
+	* commit timing window.
 	*
 	* When the entry is authoritative, its own fields are then deleted from the
 	* profile row, so no second source of truth remains.
 	*/
 	const migrateOwnSettings = () => {
-		const legacy = readLegacySections([
-			QODER_SETTINGS_NS,
-			QODER_GLOBAL_SETTINGS_NS,
-			QODER_QUOTA_SETTINGS_NS
-		]);
 		const seeded = {};
 		for (const key of CONFIG_KEYS) {
 			const entryValue = readField(config, key);
-			const legacyValue = legacy === void 0 ? void 0 : legacy[key];
 			if (!Object.hasOwn(store.user, key)) {
 				if (entryValue !== void 0 && JSON.stringify(entryValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = entryValue;
-				else if (legacyValue !== void 0 && JSON.stringify(legacyValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = legacyValue;
 				else if (entryValue !== void 0) seeded[key] = entryValue;
-				else if (legacyValue !== void 0) seeded[key] = legacyValue;
 				continue;
 			}
 			if (store.edited) continue;
-			if (entryValue !== void 0 && JSON.stringify(entryValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) {
-				seeded[key] = entryValue;
-				continue;
-			}
-			if (legacyValue !== void 0 && JSON.stringify(legacyValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = legacyValue;
+			if (entryValue !== void 0 && JSON.stringify(entryValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = entryValue;
 		}
 		if (Object.keys(seeded).length === 0) return;
 		store.patch(seeded);
-		cleanupEntryConfig(ctx, CONFIG_KEYS, [
-			QODER_SETTINGS_NS,
-			QODER_GLOBAL_SETTINGS_NS,
-			QODER_QUOTA_SETTINGS_NS
-		]);
+		cleanupEntryConfig(ctx, CONFIG_KEYS);
 	};
 	migrateOwnSettings();
-	const eventSink = ctx;
-	eventSink.on("loader/volatile-update", () => {
+	ctx.on("loader/volatile-update", () => {
 		migrateOwnSettings();
 	});
-	eventSink.on("app-boot/config-reload", () => {
-		lastConfigReloadAt = Date.now();
-	});
 	/** Timers and in-flight work belonging to this plugin instance. */
 	let stopped = false;
 	const timers = [];

package/lib/{variants-DuEgaUad.js → variants-CFI6-cGn.js}

@@ -7,6 +7,8 @@ import { fileURLToPath } from "node:url";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { EMPTY_RESPONSE_CODE, LlmError, ProviderRequestId, ReasoningEffortId, ToolCallId, attributionHeaders, contentHasImage, createAssistantMessage, createToolResultMessage, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { homedir } from "node:os";
+import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
+import { requestImageDimensions } from "@deepseek-ai/dsh-attachment";
 import { execFileSync } from "node:child_process";
 //#region src/paths.ts
 /**
@@ -1035,10 +1037,40 @@ function getQoderClaimCampaignUrl(region = "global", campaignId) {
 }
 //#endregion
 //#region src/qoder/transport/machine-id.ts
+/**
+* The machine id Qoder's own desktop CLI keeps at
+* `$HOME/.qoder/.auth/machine_id`.
+*
+* Strictly a read source for this plugin: when the official client generated
+* one, the transport reuses it so the same device presents one stable
+* identity upstream. The plugin never writes there — that tree belongs to
+* the official CLI.
+*/
+function officialMachineIdPath() {
+	return join(homedir(), ".qoder", ".auth", "machine_id");
+}
+/**
+* The trusted locations consulted when a caller nominates no chain: the
+* official Qoder CLI's id first, this plugin's own seed second.
+*
+* A freshly created id is saved ONLY at the end of the chain, which is now
+* always inside the plugin's data directory. An earlier default ended the
+* chain at `~/.dsh/qoder/machine_id`, derived from `os.homedir()` rather
+* than the resolved harness home, so any host with `DSH_HOME` pointed at
+* another location got a device credential scattered into the wrong `$HOME`
+* — outside every profile, with no owner deleting it. That fallback is
+* gone.
+*/
 function defaultMachineIdPaths() {
-	return [join(homedir(), ".qoder", ".auth", "machine_id"), join(homedir(), ".dsh", "qoder", "machine_id")];
+	return [officialMachineIdPath(), qoderMachineIdPath()];
 }
-/** Read Qoder's machine id or create the DSH-owned fallback. */
+/**
+* Read Qoder's machine id, or create this plugin's seed at the chain's end.
+*
+* `paths` is the read chain; its last entry doubles as the create point.
+* Passing no chain defaults to {@link defaultMachineIdPaths}; passing an
+* empty array nominates no save location, which keeps the id process-local.
+*/
 function getMachineId(paths = defaultMachineIdPaths()) {
 	for (const path of paths) {
 		if (!existsSync(path)) continue;
@@ -1049,7 +1081,8 @@ function getMachineId(paths = defaultMachineIdPaths()) {
 	}
 	const machineId = crypto.randomUUID();
 	const savePath = paths.at(-1);
-	if (savePath !== void 0) try {
+	if (savePath === void 0) return machineId;
+	try {
 		mkdirSync(dirname(savePath), { recursive: true });
 		writeFileSync(savePath, machineId, {
 			encoding: "utf8",
@@ -1262,22 +1295,34 @@ async function readLimitedText(response, maxBytes, label) {
 	}
 	if (!response.body) return "";
 	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
+	const chunks = [];
 	let bytes = 0;
-	let text = "";
 	try {
 		while (true) {
 			const { done, value } = await reader.read();
 			if (done) break;
 			bytes += value.byteLength;
 			if (bytes > maxBytes) throw new QoderLlmError(`${label} exceeded its response size limit.`, "MALFORMED_RESPONSE");
-			text += decoder.decode(value, { stream: true });
+			chunks.push(value);
 		}
-		return text + decoder.decode();
 	} finally {
 		await reader.cancel().catch(() => void 0);
 		reader.releaseLock();
 	}
+	let payload = Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)));
+	const encoding = (response.headers.get("content-encoding") ?? "").toLowerCase();
+	const looksGzipped = payload.length >= 2 && payload[0] === 31 && payload[1] === 139;
+	if (encoding !== "" || looksGzipped) {
+		try {
+			if (encoding.includes("gzip") || encoding === "" && looksGzipped) payload = gunzipSync(payload);
+			else if (encoding.includes("br")) payload = brotliDecompressSync(payload);
+			else if (encoding.includes("deflate")) payload = inflateSync(payload);
+		} catch {
+			throw new QoderLlmError(`${label} arrived compressed but could not be decompressed.`, "MALFORMED_RESPONSE");
+		}
+		if (payload.byteLength > maxBytes) throw new QoderLlmError(`${label} exceeded its response size limit.`, "MALFORMED_RESPONSE");
+	}
+	return new TextDecoder().decode(payload);
 }
 var SingleFlight = class {
 	flights = /* @__PURE__ */ new Map();
@@ -1330,6 +1375,7 @@ async function openApiJsonRequest(fetchImpl, options) {
 	try {
 		const headers = {
 			accept: "application/json",
+			"accept-encoding": "identity",
 			"user-agent": options.userAgent ?? defaultUserAgent,
 			"cosy-version": "1.0.1",
 			"cosy-clienttype": "5",
@@ -1647,6 +1693,7 @@ async function fetchQoderModels(credentials, options = {}) {
 			method: "GET",
 			headers: {
 				accept: "application/json",
+				"accept-encoding": "identity",
 				...buildAuthHeaders(null, url, credentials)
 			},
 			signal: deadline.signal
@@ -1686,9 +1733,16 @@ async function fetchQoderModels(credentials, options = {}) {
 function unsupported(message) {
 	return new QoderLlmError(message, "UNSUPPORTED_CONTENT");
 }
-function toolResultText(block) {
+/**
+* Flatten one tool-result message's content to wire text.
+*
+* DSH 0.1.7 models a tool result as a first-class `role: 'tool'` message
+* (before 0.1.6 it was a `tool-result` block inside a user message); either
+* way the payload is a content array whose text/图像 blocks this flattens.
+*/
+function toolResultText(content) {
 	let text = "";
-	for (const nested of block.content) {
+	for (const nested of content) {
 		if (nested.type === "image") continue;
 		if (nested.type !== "text") throw unsupported(`Qoder tool results support text only; received nested ${String(nested.type)} content.`);
 		text += nested.text;
@@ -1699,16 +1753,19 @@ function toolResultText(block) {
 * Check message shapes without performing any provider I/O.
 *
 * Callers run this before resolving credentials so an invalid request never
-* consumes a Qoder subscription.
+* consumes a Qoder subscription. The input is DSH's request shape — durable
+* messages and one-shot user inputs alike; only `role` and `content` are read.
 */
 function validateMessageShapes(messages) {
 	for (const message of messages) {
-		const toolResults = message.content.filter((block) => block.type === "tool-result");
-		if (toolResults.length > 0) {
-			if (message.role !== "user" || toolResults.length !== message.content.length) throw unsupported("Qoder tool-result messages cannot contain sibling content or use a non-user role.");
-			for (const result of toolResults) toolResultText(result);
+		if (message.role === "tool") {
+			for (const block of message.content) {
+				if (block.type === "text" || block.type === "image") continue;
+				throw unsupported(`Qoder tool results support text and image content only; received ${String(block.type)}.`);
+			}
 			continue;
 		}
+		if (message.role === "developer") throw unsupported("Qoder transport does not support developer messages (dynamic tool addition/removal).");
 		for (const block of message.content) {
 			if (block.type === "text") continue;
 			if (block.type === "image") {
@@ -1737,10 +1794,12 @@ async function resolveImagePart(block, context) {
 	if (attachments === void 0) throw new QoderLlmError("Qoder image input requires the DSH attachment service.", "ATTACHMENT");
 	let image;
 	try {
-		const limits = attachments.imageLimits;
+		const { width: sourceWidth, height: sourceHeight } = block.attachment;
+		const projected = requestImageDimensions(sourceWidth, sourceHeight, attachments.imageLimits.maxImagePixels);
 		image = await attachments.readImageRequest(block.attachment, {
-			maxPixels: limits.maxImagePixels,
-			maxBytes: limits.maxImageBytes
+			width: projected.width,
+			height: projected.height,
+			maxBytes: attachments.imageLimits.maxImageBytes
 		}, signal);
 	} catch (error) {
 		if (signal?.aborted) throw new QoderLlmError("Qoder image preparation was aborted.", "ABORTED", { cause: error });
@@ -1781,26 +1840,22 @@ async function validateAndTranslateMessages(messages, systemPrompt, attachments,
 		content: systemPrompt
 	});
 	for (const message of messages) {
-		const toolResults = message.content.filter((block) => block.type === "tool-result");
-		if (toolResults.length > 0) {
-			if (message.role !== "user" || toolResults.length !== message.content.length) throw unsupported("Qoder tool-result messages cannot contain sibling content or use a non-user role.");
-			for (const result of toolResults) {
+		if (message.role === "tool") {
+			output.push({
+				role: "tool",
+				tool_call_id: String(message.toolCallId),
+				content: toolResultText(message.content)
+			});
+			const images = message.content.filter((block) => block.type === "image");
+			if (images.length > 0) {
+				if (attachments !== void 0) enforceImageLimits(images, attachments);
 				output.push({
-					role: "tool",
-					tool_call_id: String(result.toolCallId),
-					content: toolResultText(result)
+					role: "user",
+					content: [{
+						type: "text",
+						text: `[${images.length} image${images.length === 1 ? "" : "s"} returned by the previous tool call]`
+					}, ...await Promise.all(images.map((image) => resolveImagePart(image, context)))]
 				});
-				const images = result.content.filter((block) => block.type === "image");
-				if (images.length > 0) {
-					if (attachments !== void 0) enforceImageLimits(images, attachments);
-					output.push({
-						role: "user",
-						content: [{
-							type: "text",
-							text: `[${images.length} image${images.length === 1 ? "" : "s"} returned by the previous tool call]`
-						}, ...await Promise.all(images.map((image) => resolveImagePart(image, context)))]
-					});
-				}
 			}
 			continue;
 		}
@@ -1843,6 +1898,7 @@ async function validateAndTranslateMessages(messages, systemPrompt, attachments,
 				if (message.role === "assistant") reasoningText += block.text;
 				continue;
 			}
+			throw unsupported(`Qoder transport encountered unsupported block type: ${String(block.type)}`);
 		}
 		if (message.role === "assistant") {
 			const hasReasoning = preserveThinking && reasoningText.length > 0;
@@ -1861,6 +1917,7 @@ async function validateAndTranslateMessages(messages, systemPrompt, attachments,
 				userContent[pending.slot] = await resolveImagePart(pending.block, context);
 			}));
 		}
+		if (message.role === "developer") continue;
 		output.push({
 			role: message.role,
 			content: hasImage ? userContent.filter((part) => part !== void 0) : text
@@ -4388,7 +4445,7 @@ const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_CONTEXT_WINDOW = 18e4;
 //#endregion
 //#region src/version.ts
-const QODER_CONNECT_VERSION = "0.2.0";
+const QODER_CONNECT_VERSION = "0.2.2";
 //#endregion
 //#region src/host-heartbeat.ts
 /**