dsh-workbuddy-bridge 0.5.4 → 0.5.6

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as variantFor, D as WorkBuddyUpstreamClient, S as WORKBUDDY_VARIANTS, X as resolveAppVersion, a as readHostHeartbeat, c as WORKBUDDY_BRIDGE_VERSION, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, x as CN_VARIANT } from "./heartbeat-CKHC_c0-.js";
+import { C as variantFor, D as WorkBuddyUpstreamClient, Q as resolveAppVersion, S as WORKBUDDY_VARIANTS, a as readHostHeartbeat, c as WORKBUDDY_BRIDGE_VERSION, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, x as CN_VARIANT } from "./heartbeat-BOSjBL0B.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/cli/bin.ts

package/lib/{heartbeat-CKHC_c0-.js → heartbeat-BOSjBL0B.js}

@@ -367,14 +367,16 @@ const UPSTREAM_CODE_KINDS = {
 	"12153": "session_dead",
 	"11128": "client",
 	"11133": "client",
-	"11140": "client"
+	"11140": "client",
+	"11158": "client"
 };
 /** 业务码 → 失败类别：信封 code 非 0 时的第一落点。 */
 const ENVELOPE_CODE_KINDS = {
 	12153: "session_dead",
 	11128: "client",
 	11133: "client",
-	11140: "client"
+	11140: "client",
+	11158: "client"
 };
 /**
 * 文案兜底标记。**只在既无机器码也无业务码可依时使用**，且命中后必须记日志：
@@ -692,6 +694,30 @@ async function probeModel(options) {
 *
 * @module dsh-workbuddy-bridge/upstream
 */
+/**
+* Wait before each gate retry, in milliseconds; the length is the retry budget.
+*
+* Measured 2026-11-06 (CN gateway): the first attempt of a conversation is refused
+* and the identical request answers 200 at +0.74 s. Two steps cover that window
+* with room to spare; a third would only add latency to a turn that is genuinely
+* blocked.
+*/
+const GATE_RETRY_DELAYS_MS = [400, 1200];
+/** Abortable delay: a cancelled turn must not keep retrying. */
+async function sleep(ms, signal) {
+	if (signal?.aborted === true) return;
+	await new Promise((resolve) => {
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		const onAbort = () => {
+			clearTimeout(timer);
+			resolve();
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
 const CN_CHAT_BASE = "https://copilot.tencent.com";
 const CN_BILLING_BASE = "https://www.codebuddy.cn";
 const GLOBAL_BASE = "https://www.workbuddy.ai";
@@ -1049,11 +1075,114 @@ function neutralizeAssistantExtras(message) {
 		if (typeof args === "string") fn["arguments"] = neutralizeSignatureText(args);
 	}
 }
-/** Apply the two signature rewrites to one string; see {@link neutralizeChannelSignature}. */
+/**
+* Rewrite the measured channel-gate fingerprints in one text blob.
+*
+* Exported for tests and for callers that assemble a body themselves.
+* Idempotent: every `to` differs from its `from` and recreates no other `from`.
+*/
+function rewriteChannelGateSentences(text) {
+	let out = text;
+	for (const [from, to] of IDENTITY_REWRITES) if (out.includes(from)) out = out.split(from).join(to);
+	return out.replace(FILE_REFERENCE_PARAGRAPH, FILE_REFERENCE_REPLACEMENT);
+}
+/**
+* Apply the signature rewrites to one string; see {@link neutralizeChannelSignature}.
+*
+* Every rewrite is a **real wording change**. The zero-width-space variant this
+* function used until 2026-10-29 is retired: both reference implementations
+* measured that the CN gateway normalizes invisible characters before matching,
+* so a U+200B separator was equivalent to not rewriting at all.
+*/
 function neutralizeSignatureText(text) {
-	return text.replace(CHANNEL_OPENER, "$1You are an AI agent.").replace(CHANNEL_SIGNATURE_PHRASE, `DeepSeek${ZERO_WIDTH_SPACE}$1Harness`);
+	return replaceBrandPhrase(rewriteChannelGateSentences(text).replace(CHANNEL_OPENER, "$1You are an AI agent."));
+}
+/** What the product phrase becomes; see {@link replaceBrandPhrase}. */
+const BRAND_PHRASE_REPLACEMENT = "the agent runtime";
+/**
+* The phrase as it appears after an article the sentence already wrote
+* (`… through the DeepSeek Harness web interface`).
+*
+* Matched **with** that article so the replacement supplies the only one:
+* replacing the bare phrase there produced `through the the agent runtime`,
+* which is what this pattern exists to prevent. It also collapses whatever
+* whitespace run separated the three words, so the sentence reads normally
+* afterwards. The trailing slash guard is the same one the bare pattern uses, so
+* a real `…/DeepSeek Harness/…` path is still never touched.
+*/
+const CHANNEL_SIGNATURE_PHRASE_AFTER_ARTICLE = /\bthe[\s\u00A0]+DeepSeek[\s\u00A0]+Harness(?![\\/])/gi;
+/**
+* Replace the brand phrase with a neutral noun phrase, in both of the forms a
+* sentence can use it.
+*
+* The replacement carries its own `the` because the phrase is normally the
+* subject of a mid-sentence clause (`Powered by DeepSeek Harness.` → `Powered by
+* the agent runtime.`). The article-bearing spelling is handled first and
+* absorbs that article; the bare spelling then gets the article from the
+* replacement. One pattern cannot do both, because the replacement text is a
+* constant.
+*/
+function replaceBrandPhrase(text) {
+	return text.replace(CHANNEL_SIGNATURE_PHRASE_AFTER_ARTICLE, BRAND_PHRASE_REPLACEMENT).replace(CHANNEL_SIGNATURE_PHRASE, BRAND_PHRASE_REPLACEMENT);
 }
 /**
+* DSH's identity lines. The gate matches each one **independently** (measured
+* 2026-10-29 by two probes on the sibling plugin), so a body whose brand is
+* already neutralized still fails on these.
+*
+* These rows match the host's **original** wording and therefore run before the
+* brand pass (see {@link neutralizeSignatureText}). A `to` side must not
+* reintroduce the brand: the brand pass that follows would rewrite it again,
+* and the second pass would then produce a different string — the
+* non-idempotence the idempotence test catches.
+*/
+const IDENTITY_REWRITES = [
+	["You are a helpful AI assistant.", "You are a capable AI helper."],
+	["You are an AI assistant", "You are an AI agent."],
+	["You are a coding agent powered by the ", "You are a coding agent running on the "],
+	["You are interacting with the user through the DeepSeek web interface", "You are working with the user inside the agent runtime web interface"],
+	["Agent Teams is available in this session", "Agent Teams is enabled for this session"]
+];
+/**
+* The @-path paragraph `@deepseek-ai/dsh-file-reference` injects into every
+* system prompt.
+*
+* **Whole-paragraph replacement, measured.** The gateway answers 200 to each
+* sentence alone and 400 to the paragraph, i.e. the match unit is the paragraph,
+* not a sentence. Everything short of replacing it leaves the count above the
+* threshold, and that includes the sibling implementation's one-word insertion —
+* measured 2026-11-06 against this gateway, on a real 92 KB turn:
+*
+* | form sent in \`system\`                              | refused |
+* | ---                                                | ---     |
+* | original paragraph                                 | 3/3     |
+* | original + \`that\` inserted into the first sentence | 3/3     |
+* | **replaced with the neutral paragraph below**       | **0/3** |
+* | removed outright                                    | 0/3     |
+*
+* The rule matches the paragraph by its shape rather than by one literal string:
+* the host has shipped at least two wordings (this repo's own older rewrite
+* produced "Tokens prefixed with @ are paths that the user explicitly
+* referenced."), and a literal would silently stop matching the next time the host
+* reworded a word. The `@` glyph and its meaning survive in the replacement: the
+* model still has to know what a leading `@` means, only the phrasing the gate
+* reads is gone.
+*
+* Idempotent by construction: the replacement contains none of the shapes the
+* pattern looks for.
+*/
+const FILE_REFERENCE_PARAGRAPH = /(?:Paths prefixed with @|Tokens prefixed with @|Tokens starting with @)[\s\S]{0,600}?quotes a path containing spaces\./iu;
+/** What the paragraph becomes; see {@link FILE_REFERENCE_PARAGRAPH}. */
+const FILE_REFERENCE_REPLACEMENT = "A token beginning with @ names a location the user pointed at. Resolve relative ones from the project folder and treat absolute ones as host paths. A trailing slash means a directory, otherwise it is a file. Quote a path containing spaces with @\"...\".";
+/**
+* The same paragraph as an older release of this plugin left it in history.
+*
+* A `to` side becomes a fingerprint once the gate has been measured against it,
+* and a session that ran 0.5.5 carries those forms in its `assistant` echo. They
+* are matched by the same pattern above, so nothing extra is needed here — this
+* note exists because the pattern's alternation is what makes that true.
+*/
+/**
 * The opener DSH puts at the head of every system prompt.
 *
 * Leading whitespace and a BOM are tolerated (group 1 carries them through to
@@ -1069,8 +1198,41 @@ const CHANNEL_OPENER = /^([\s\uFEFF]*)You\s+are\s+an\s+AI\s+agent\s+powered\s+by
 * sentence reads identically.
 */
 const CHANNEL_SIGNATURE_PHRASE = /(?<![\\/])DeepSeek([\s\u00A0]+)Harness(?![\\/])/gi;
-/** U+200B: invisible to a reader and to the model, breaks a substring match. */
-const ZERO_WIDTH_SPACE = "​";
+/**
+* The upstream refusal that means "content filter", not "bad request".
+*
+* Two shapes reach us and both must be recognised:
+*
+* - the documented gate form, `{"code":11-128,"msg":"Illegal API invocation…"}`;
+* - the shape issue #25 actually renders (reproduced 2026-10-29):
+*   `{"message":"请求被拦截，请重新发送","type":"client","code":"client"}` — **no
+*   `11-128` anywhere**, so a code-only test misses the exact case the hint
+*   exists for.
+*/
+const CHANNEL_GATE_CODE = /\b11-128\b/;
+/** The CN gateway's user-facing block copy, which survives even when the code does not. */
+const CHANNEL_GATE_COPY = /请求被拦截/;
+/** True when an upstream body is a channel-gate refusal; see {@link CHANNEL_GATE_CODE}. */
+function isChannelGateBody(body) {
+	return CHANNEL_GATE_CODE.test(body) || CHANNEL_GATE_COPY.test(body);
+}
+/**
+* The plan-limit refusal: the account's tier does not include the model
+* (issue #24, measured on a free international account).
+*
+* Two shapes, because the code can be in the envelope or written into the
+* message text — `{"code":11158,"msg":"model [gpt-6-luna] is not allowed for
+* user type [personal_free_user]", "displayMsg":{…}}`. Both must be recognised
+* for the same reason as the channel gate: the actionable advice (pick another
+* model) is not guessable from `请求被拦截`-style copy, and retrying the same
+* model can never succeed.
+*/
+const PLAN_LIMIT_CODE = /\b11158\b/;
+const PLAN_LIMIT_COPY = /is not allowed for user type/i;
+/** True when an upstream body says the account's plan excludes the model. */
+function isPlanLimitBody(body) {
+	return PLAN_LIMIT_CODE.test(body) || PLAN_LIMIT_COPY.test(body);
+}
 /** Rewrite `role: "developer"` messages to `role: "system"` (upstream rejects developer). */
 function normalizeDeveloperRole(obj) {
 	const messages = obj["messages"];
@@ -1152,11 +1314,28 @@ var WorkBuddyUpstreamClient = class {
 	resolveAppVersion;
 	/** Chat-identity resolver; see {@link WorkBuddyUpstreamClientOptions.resolveChatIdentity}. */
 	resolveChatIdentity;
+	/** Request observer; see {@link WorkBuddyUpstreamClientOptions.onChatRequest}. */
+	onChatRequest;
+	/** Outcome observer; see {@link WorkBuddyUpstreamClientOptions.onChatOutcome}. */
+	onChatOutcome;
 	/** Provenance of the most recent successful catalog fetch, for the card. */
 	lastCatalog;
 	constructor(options = {}) {
 		this.resolveAppVersion = options.resolveAppVersion ?? (() => resolveAppVersion());
 		this.resolveChatIdentity = options.resolveChatIdentity ?? ((region) => resolveChatIdentity(region));
+		this.onChatRequest = options.onChatRequest;
+		this.onChatOutcome = options.onChatOutcome;
+	}
+	/**
+	* Report an outcome without letting an observer break the request it observes.
+	*
+	* Both observers exist for diagnostics, so their failure must stay invisible to
+	* the message being diagnosed.
+	*/
+	reportOutcome(outcome) {
+		try {
+			this.onChatOutcome?.(outcome);
+		} catch {}
 	}
 	/**
 	* POST the chat endpoint; a successful answer is the raw SSE response.
@@ -1181,35 +1360,72 @@ var WorkBuddyUpstreamClient = class {
 			userAgent = chatUserAgent(fallbackChatIdentity(region), region);
 		}
 		const body = region === "global" ? prepareInternationalChatBody(bodyJson) : prepareChatBody(bodyJson);
-		let response;
+		const url = `${chatBase(credential)}/v2/chat/completions`;
+		const headers = {
+			...chatHeaders(credential, userAgent),
+			Authorization: `Bearer ${credential.accessToken}`
+		};
 		try {
-			response = await fetch(`${chatBase(credential)}/v2/chat/completions`, {
-				method: "POST",
-				headers: {
-					...chatHeaders(credential, userAgent),
-					Authorization: `Bearer ${credential.accessToken}`
-				},
-				body,
-				...signal === void 0 ? {} : { signal }
+			this.onChatRequest?.({
+				url,
+				headers,
+				body
 			});
-		} catch (error) {
-			return {
-				ok: false,
-				status: 0,
-				kind: "server",
-				message: `transport error: ${String(error)}`
+		} catch {}
+		let response;
+		let attempt = 0;
+		/** The last refusal, kept for the report once the retry budget is spent. */
+		let refusal;
+		for (;;) {
+			attempt++;
+			try {
+				response = await fetch(url, {
+					method: "POST",
+					headers,
+					body,
+					...signal === void 0 ? {} : { signal }
+				});
+			} catch (error) {
+				this.reportOutcome({
+					status: 0,
+					message: `transport error: ${String(error)}`
+				});
+				return {
+					ok: false,
+					status: 0,
+					kind: "server",
+					message: `transport error: ${String(error)}`
+				};
+			}
+			if (response.ok) {
+				this.reportOutcome({ status: response.status });
+				return {
+					ok: true,
+					response
+				};
+			}
+			const text = (await response.text()).slice(0, ERROR_BODY_LIMIT);
+			refusal = {
+				status: response.status,
+				text
 			};
+			if (!isChannelGateBody(text) || attempt > GATE_RETRY_DELAYS_MS.length) break;
+			if (signal?.aborted === true) break;
+			await sleep(GATE_RETRY_DELAYS_MS[attempt - 1], signal);
 		}
-		if (response.ok) return {
-			ok: true,
-			response
+		const last = refusal ?? {
+			status: response.status,
+			text: ""
 		};
-		const text = (await response.text()).slice(0, ERROR_BODY_LIMIT);
+		this.reportOutcome({
+			status: last.status,
+			message: last.text
+		});
 		return {
 			ok: false,
-			status: response.status,
-			kind: classifyUpstreamError(response.status, text),
-			message: text
+			status: last.status,
+			kind: classifyUpstreamError(last.status, last.text),
+			message: last.text
 		};
 	}
 	/** POST the token-refresh endpoint; the caller merges the outcome. */
@@ -3949,7 +4165,7 @@ var WorkBuddyCatalog = class {
 };
 //#endregion
 //#region src/version.ts
-const WORKBUDDY_BRIDGE_VERSION = "0.5.4";
+const WORKBUDDY_BRIDGE_VERSION = "0.5.6";
 //#endregion
 //#region src/web/heartbeat.ts
 /**
@@ -4120,4 +4336,4 @@ function isHeartbeatProcessAlive(heartbeat) {
 	return startAtMs <= heartbeat.registeredAt;
 }
 //#endregion
-export { parseModelCatalog as A, FALLBACK_CN_APP_VERSION as B, variantFor as C, WorkBuddyUpstreamClient as D, WORKBUDDY_STATUS_PATH as E, probeModel as F, validCliVersion as G, fallbackChatIdentity as H, randomSentinel as I, installedAppVersion as J, WORKBUDDY_APP_VERSION_FILENAME as K, classifyUpstreamError as L, prepareInternationalChatBody as M, regionOf as N, modelWithCurrentPromotion as O, PROBE_EFFORT_CANDIDATES as P, upstreamDisplayMessage as R, WORKBUDDY_VARIANTS as S, WORKBUDDY_PROBE_PATH as T, readCliVersion as U, chatUserAgent as V, resolveChatIdentity as W, resolveAppVersion as X, readBundleVersion as Y, validAppVersion as Z, desktopAuthCandidatesFor as _, readHostHeartbeat as a, AI_VARIANT as b, WORKBUDDY_BRIDGE_VERSION as c, WorkBuddyCatalog as d, WORKBUDDY_AUTH_FILENAME as f, defaultDesktopAuthPath as g, defaultDesktopAuthCandidates as h, processStartTimeMs as i, prepareChatBody as j, normalizeCredits as k, FALLBACK_WORKBUDDY_AI_MODELS as l, WorkBuddyCredentialStore as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, WORKBUDDY_AUTH_FILE_ENV as p, appUserAgent as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, FALLBACK_WORKBUDDY_MODELS as u, parseWorkBuddyAuth as v, WORKBUDDY_CREDIT_PATH as w, CN_VARIANT as x, workbuddyOwnAuthPath as y, CN_APP_VERSION_FILENAME as z };
+export { validAppVersion as $, modelWithCurrentPromotion as A, upstreamDisplayMessage as B, variantFor as C, WorkBuddyUpstreamClient as D, WORKBUDDY_STATUS_PATH as E, regionOf as F, readCliVersion as G, FALLBACK_CN_APP_VERSION as H, PROBE_EFFORT_CANDIDATES as I, WORKBUDDY_APP_VERSION_FILENAME as J, resolveChatIdentity as K, probeModel as L, parseModelCatalog as M, prepareChatBody as N, isChannelGateBody as O, prepareInternationalChatBody as P, resolveAppVersion as Q, randomSentinel as R, WORKBUDDY_VARIANTS as S, WORKBUDDY_PROBE_PATH as T, chatUserAgent as U, CN_APP_VERSION_FILENAME as V, fallbackChatIdentity as W, installedAppVersion as X, appUserAgent as Y, readBundleVersion as Z, desktopAuthCandidatesFor as _, readHostHeartbeat as a, AI_VARIANT as b, WORKBUDDY_BRIDGE_VERSION as c, WorkBuddyCatalog as d, WORKBUDDY_AUTH_FILENAME as f, defaultDesktopAuthPath as g, defaultDesktopAuthCandidates as h, processStartTimeMs as i, normalizeCredits as j, isPlanLimitBody as k, FALLBACK_WORKBUDDY_AI_MODELS as l, WorkBuddyCredentialStore as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, WORKBUDDY_AUTH_FILE_ENV as p, validCliVersion as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, FALLBACK_WORKBUDDY_MODELS as u, parseWorkBuddyAuth as v, WORKBUDDY_CREDIT_PATH as w, CN_VARIANT as x, workbuddyOwnAuthPath as y, classifyUpstreamError as z };

package/lib/index.d.ts

@@ -656,6 +656,33 @@ interface WorkBuddyUpstreamClientOptions {
    * billing never consult it — those requests keep their long-standing headers.
    */
   resolveChatIdentity?: (region: WorkBuddyRegion) => Promise<ChatIdentity>;
+  /**
+   * Observes the final chat request — URL, complete headers, exact body — before
+   * it leaves. Diagnostic only; see `llm/capture.ts` for why headers are as
+   * load-bearing as the body when a request is refused on content.
+   *
+   * Kept as an injected hook rather than a built-in file write so the client
+   * stays free of filesystem policy, and so a test can assert the exact bytes
+   * without touching a disk.
+   */
+  onChatRequest?: (request: {
+    url: string;
+    headers: Record<string, string>;
+    body: string;
+  }) => void;
+  /**
+   * Observes how the chat request ended — the verdict that belongs to the
+   * request {@link onChatRequest} just reported. Status `0` is a transport
+   * failure.
+   *
+   * Paired with the request hook rather than left to the caller, because only
+   * this function sees both halves; splitting them is how a captured body gets
+   * paired with another request's verdict.
+   */
+  onChatOutcome?: (outcome: {
+    status: number;
+    message?: string;
+  }) => void;
 }
 /**
  * Upstream HTTP client. One instance serves the whole plugin; requests take
@@ -673,9 +700,20 @@ declare class WorkBuddyUpstreamClient {
   private readonly resolveAppVersion;
   /** Chat-identity resolver; see {@link WorkBuddyUpstreamClientOptions.resolveChatIdentity}. */
   private readonly resolveChatIdentity;
+  /** Request observer; see {@link WorkBuddyUpstreamClientOptions.onChatRequest}. */
+  private readonly onChatRequest;
+  /** Outcome observer; see {@link WorkBuddyUpstreamClientOptions.onChatOutcome}. */
+  private readonly onChatOutcome;
   /** Provenance of the most recent successful catalog fetch, for the card. */
   lastCatalog: WorkBuddyCatalogFetch | undefined;
   constructor(options?: WorkBuddyUpstreamClientOptions);
+  /**
+   * Report an outcome without letting an observer break the request it observes.
+   *
+   * Both observers exist for diagnostics, so their failure must stay invisible to
+   * the message being diagnosed.
+   */
+  private reportOutcome;
   /**
    * POST the chat endpoint; a successful answer is the raw SSE response.
    *

package/lib/index.js

@@ -1,9 +1,9 @@
-import { A as parseModelCatalog, B as FALLBACK_CN_APP_VERSION, C as variantFor, D as WorkBuddyUpstreamClient, F as probeModel, G as validCliVersion, H as fallbackChatIdentity, I as randomSentinel, J as installedAppVersion, K as WORKBUDDY_APP_VERSION_FILENAME, L as classifyUpstreamError, M as prepareInternationalChatBody, N as regionOf, O as modelWithCurrentPromotion, P as PROBE_EFFORT_CANDIDATES, R as upstreamDisplayMessage, S as WORKBUDDY_VARIANTS, U as readCliVersion, V as chatUserAgent, W as resolveChatIdentity, X as resolveAppVersion, Y as readBundleVersion, Z as validAppVersion, _ as desktopAuthCandidatesFor, a as readHostHeartbeat, b as AI_VARIANT, c as WORKBUDDY_BRIDGE_VERSION, d as WorkBuddyCatalog, f as WORKBUDDY_AUTH_FILENAME, g as defaultDesktopAuthPath, h as defaultDesktopAuthCandidates, i as processStartTimeMs, j as prepareChatBody, k as normalizeCredits, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as WORKBUDDY_AUTH_FILE_ENV, q as appUserAgent, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as parseWorkBuddyAuth, w as WORKBUDDY_CREDIT_PATH, x as CN_VARIANT, y as workbuddyOwnAuthPath, z as CN_APP_VERSION_FILENAME } from "./heartbeat-CKHC_c0-.js";
+import { $ as validAppVersion, A as modelWithCurrentPromotion, B as upstreamDisplayMessage, C as variantFor, D as WorkBuddyUpstreamClient, F as regionOf, G as readCliVersion, H as FALLBACK_CN_APP_VERSION, I as PROBE_EFFORT_CANDIDATES, J as WORKBUDDY_APP_VERSION_FILENAME, K as resolveChatIdentity, L as probeModel, M as parseModelCatalog, N as prepareChatBody, O as isChannelGateBody, P as prepareInternationalChatBody, Q as resolveAppVersion, R as randomSentinel, S as WORKBUDDY_VARIANTS, U as chatUserAgent, V as CN_APP_VERSION_FILENAME, W as fallbackChatIdentity, X as installedAppVersion, Y as appUserAgent, Z as readBundleVersion, _ as desktopAuthCandidatesFor, a as readHostHeartbeat, b as AI_VARIANT, c as WORKBUDDY_BRIDGE_VERSION, d as WorkBuddyCatalog, f as WORKBUDDY_AUTH_FILENAME, g as defaultDesktopAuthPath, h as defaultDesktopAuthCandidates, i as processStartTimeMs, j as normalizeCredits, k as isPlanLimitBody, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as WORKBUDDY_AUTH_FILE_ENV, q as validCliVersion, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as parseWorkBuddyAuth, w as WORKBUDDY_CREDIT_PATH, x as CN_VARIANT, y as workbuddyOwnAuthPath, z as classifyUpstreamError } from "./heartbeat-BOSjBL0B.js";
 import z from "@deepseek-ai/schemastery";
 import { dirname, join, resolve } from "node:path";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { ReasoningEffortId, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
@@ -648,6 +648,139 @@ var WorkBuddyPiAiAdapter = class extends PiAiAdapter {
 		};
 	}
 };
+/** The capture log under `$DSH_HOME`; one JSON object per line. */
+const CAPTURE_LOG_FILENAME = ".workbuddy-captures.jsonl";
+/**
+* Held across the request/response pair.
+*
+* A single slot is deliberate rather than a map: this is a human-driven
+* diagnostic, the host serialises one turn at a time, and the cost of a
+* collision (one record with another's verdict) is a re-run, not a wrong fix.
+* A map would need per-request ids threaded through the client for no gain here.
+*/
+let pending;
+/** Where the log goes right now, or `undefined` when disarmed. */
+function captureTarget() {
+	const fromEnv = process.env["WORKBUDDY_CAPTURE_BODY"];
+	if (fromEnv !== void 0 && fromEnv.trim() !== "") return fromEnv;
+	try {
+		const home = resolveDshHome();
+		return existsSync(join(home, ".workbuddy-capture.on")) ? join(home, CAPTURE_LOG_FILENAME) : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Strip credential material before anything is written.
+*
+* The log is meant to be pasted into an issue. A bearer token in it would hand
+* the reporter's account to whoever reads the issue, so redaction happens on the
+* way in rather than being left to whoever copies the file.
+*/
+function redacted(headers) {
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) {
+		const lowered = name.toLowerCase();
+		out[name] = lowered === "authorization" || lowered === "cookie" || lowered.includes("token") ? "[redacted]" : value;
+	}
+	return out;
+}
+/**
+* A non-reversible fingerprint of the bearer token, for comparing two runs.
+*
+* The token itself stays out of the log, but "was this the same token?" is a real
+* question when the same body and headers answer 200 on a replay and 400 from the
+* host: a token refresh between the two makes them different requests. A digest
+* answers it without storing the secret.
+*/
+function tokenFingerprint(headers) {
+	const entry = Object.entries(headers).find(([name]) => name.toLowerCase() === "authorization");
+	if (entry === void 0) return void 0;
+	const token = entry[1].replace(/^Bearer\s+/i, "");
+	if (token === "") return void 0;
+	return createHash("sha256").update(token).digest("hex").slice(0, 12);
+}
+/**
+* Remember the request that is about to leave.
+*
+* Called from the client's `onChatRequest` hook, i.e. after every header and the
+* body are final and before the fetch — so what is recorded is what the upstream
+* receives, not what the caller intended.
+*/
+function rememberChatRequest(url, headers, body) {
+	if (captureTarget() === void 0) return;
+	pending = {
+		url,
+		headers: redacted(headers),
+		body,
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		token: tokenFingerprint(headers)
+	};
+}
+/**
+* The most recent request this process captured, with its verdict.
+*
+* Exists so a maintainer can re-send the exact refused request from **inside**
+* the host process: the same body, headers and token answered 200 from a separate
+* process and 400 from the host, which leaves the sending process as the only
+* remaining variable.
+*
+* Falls back to the capture log's last line, because the in-memory slot does not
+* survive a plugin reload — and a reload is exactly when the experiment is
+* needed.
+*/
+function lastCapturedRequest() {
+	if (lastRequest !== void 0) return lastRequest;
+	const target = captureTarget();
+	if (target === void 0 || !existsSync(target)) return void 0;
+	try {
+		const last = readFileSync(target, "utf8").split("\n").filter((line) => line.trim() !== "").at(-1);
+		if (last === void 0) return void 0;
+		const record = JSON.parse(last);
+		if (typeof record.body !== "string") return void 0;
+		return {
+			body: record.body,
+			at: record.at ?? "",
+			status: record.status ?? 0,
+			headers: record.headers ?? {}
+		};
+	} catch {
+		return;
+	}
+}
+/** Set by {@link rememberChatRequest} and refreshed by {@link recordChatOutcome}. */
+let lastRequest;
+/**
+* Append the pending request with its verdict.
+*
+* `status` 0 means a transport failure. A missing pending request (a caller that
+* skips the hook) writes nothing rather than inventing a record.
+*/
+function recordChatOutcome(status, message) {
+	const target = captureTarget();
+	const entry = pending;
+	pending = void 0;
+	if (entry !== void 0) lastRequest = {
+		body: entry.body,
+		at: entry.at,
+		status,
+		headers: entry.headers
+	};
+	if (target === void 0 || entry === void 0) return;
+	const line = JSON.stringify({
+		at: entry.at,
+		url: entry.url,
+		status,
+		...message === void 0 ? {} : { message: message.slice(0, 400) },
+		tokenFingerprint: entry.token,
+		headers: entry.headers,
+		bodyLength: entry.body.length,
+		body: entry.body
+	});
+	try {
+		appendFileSync(target, `${line}\n`, { mode: 384 });
+	} catch {}
+}
 //#endregion
 //#region src/llm/loopback.ts
 /**
@@ -790,6 +923,31 @@ const KIND_STATUS = {
 	server: 502,
 	client: 400
 };
+/**
+* What to do when the gateway refuses a request on content (code `11-128`).
+*
+* Two actions only, and the copy keeps the code spelled `11-128` so that the
+* guidance itself, echoed back into a later request, cannot re-arm the gate.
+* No status digits (see {@link failureMessage}) and no retry advice: retrying
+* the same poisoned conversation reproduces the refusal.
+*
+* The running version rides along (issue #30): the same symptom reaches users
+* on two very different layers — an install older than the fix, and a residual
+* trigger after it — and without the version the user cannot tell which layer
+* they are on, so the first thing they check is their account.
+*/
+function channelGateHint() {
+	return ` — 渠道校验拦截（11-128）。请新开会话重试；若持续出现，先更新插件（当前 ${WORKBUDDY_BRIDGE_VERSION}） / blocked by channel verification (11-128): start a new conversation, and update the plugin if it persists (running ${WORKBUDDY_BRIDGE_VERSION})`;
+}
+/**
+* What to do when the account's plan excludes the requested model (issue #24).
+*
+* No retry advice, because no retry can help: the model is not on this tier,
+* and only picking a different model succeeds. The upstream's own
+* `displayMsg` ("Your account type does not support this model.") says what is
+* wrong but not what to do, which is the gap this fills.
+*/
+const PLAN_LIMIT_HINT = " — 当前账号套餐不包含这个模型（11158），请换用其他模型 / your plan does not include this model (11158): pick another one";
 function writeJson(res, status, body) {
 	const payload = JSON.stringify(body);
 	res.writeHead(status, {
@@ -818,14 +976,23 @@ function writeOpenAIError(res, status, kind, message) {
 * The upstream's own `displayMsg` wins over the raw body: it is the sentence
 * written for a human ("账号存在异常行为，已被限制使用"), while the body is a JSON
 * document whose `msg` is often a machine phrase such as `request illegal`.
+*
+* The channel-gate code (`11-128`) appends {@link channelGateHint}: its raw
+* body is `{"message":"请求被拦截，请重新发送","type":"client","code":"client"}`,
+* which on its own reads as a transient hiccup the user should simply retry —
+* the two actions that actually help (a new conversation; update the plugin)
+* are not guessable from it. A plan-limit refusal (`11158`) appends
+* {@link PLAN_LIMIT_HINT} for the same reason: the fix is "pick another model",
+* which the upstream copy does not say.
 */
 function failureMessage(result) {
 	const reason = upstreamDisplayMessage(result.message) ?? result.message.slice(0, 400);
 	const head = `workbuddy upstream ${result.kind}`;
-	return result.kind === "session_dead" ? `${head} (http ${result.status}): ${reason}` : `${head}: ${reason}`;
+	const line = result.kind === "session_dead" ? `${head} (http ${result.status}): ${reason}` : `${head}: ${reason}`;
+	const gated = isChannelGateBody(result.message) ? `${line}${channelGateHint()}` : line;
+	return isPlanLimitBody(result.message) ? `${gated}${PLAN_LIMIT_HINT}` : gated;
 }
-/** Read a request body with a size cap; over-limit bodies fail the request. */
-function readBody$1(req) {
+/** Read a request body with a size cap; over-limit bodies fail the request. */ function readBody$1(req) {
 	return new Promise((resolve, reject) => {
 		const chunks = [];
 		let size = 0;
@@ -1641,6 +1808,22 @@ async function workBuddyWebStatus(deps) {
 /** The status route's request handler, extracted so tests can mount it on a bare server. */
 function workBuddyStatusHandler(deps) {
 	return async (req, res) => {
+		if (req.method === "POST") {
+			if (deps.replayCaptured === void 0) {
+				json$2(res, 405, { error: "method not allowed" });
+				return;
+			}
+			if (!loopbackRequest$1(req)) {
+				json$2(res, 403, { error: "request-not-trusted" });
+				return;
+			}
+			try {
+				json$2(res, 200, await deps.replayCaptured());
+			} catch (error) {
+				json$2(res, 500, { error: safeMessage(error) });
+			}
+			return;
+		}
 		if (req.method !== "GET") {
 			json$2(res, 405, { error: "method not allowed" });
 			return;
@@ -2022,7 +2205,14 @@ function fallbackFor(variant) {
 }
 /** Build one variant's stores and probe state. */
 function createVariantRuntime(config, variant, identityOf, accountOf, creditIndex) {
-	const client = new WorkBuddyUpstreamClient();
+	const client = new WorkBuddyUpstreamClient({
+		onChatRequest: ({ url, headers, body }) => {
+			rememberChatRequest(url, headers, body);
+		},
+		onChatOutcome: (outcome) => {
+			recordChatOutcome(outcome.status, outcome.message);
+		}
+	});
 	const configured = configuredAuthFile(config, variant);
 	const store = new WorkBuddyCredentialStore({
 		variant,
@@ -2303,6 +2493,19 @@ function apply(ctx, refs) {
 				catalog: () => catalogSection(runtime),
 				probe: () => probeSection(runtime, config().probeConsent),
 				probeKey,
+				replayCaptured: async () => {
+					const captured = lastCapturedRequest();
+					if (captured === void 0) return { error: "nothing captured" };
+					const credential = await runtime.store.resolve();
+					const result = await runtime.client.chatStream(credential, captured.body);
+					return {
+						ok: result.ok,
+						replayedStatus: result.ok ? result.response.status : result.status,
+						capturedAt: captured.at,
+						capturedStatus: captured.status,
+						bodyLength: captured.body.length
+					};
+				},
 				visibility: () => {
 					const account = runtime.account();
 					return account === void 0 ? void 0 : {

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-bridge",
   "displayName": "DSH WorkBuddy Bridge",
   "description": "将 WorkBuddy 桌面 App 包含的模型自动接入 DeepSeek Harness — bring WorkBuddy desktop app models into DeepSeek Harness with zero configuration.",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "author": "zlZayn",
   "keywords": [
     "dsh",
@@ -90,6 +90,7 @@
     "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
     "@deepseek-ai/dsh-llm": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
     "@deepseek-ai/dsh-llm-pi-ai": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-session": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
     "@deepseek-ai/dsh-settings": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
     "@deepseek-ai/schemastery": "^3.18.4",
     "@earendil-works/pi-ai": "^1.1.0",
@@ -116,6 +117,7 @@
     "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
     "@deepseek-ai/dsh-llm": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
     "@deepseek-ai/dsh-llm-pi-ai": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-session": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
     "@deepseek-ai/dsh-settings": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
     "@deepseek-ai/dsh-util-code-language": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
     "@deepseek-ai/dsh-util-workspace-path": "^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
@@ -127,7 +129,7 @@
     "@types/react": "~18.3.1",
     "@types/react-dom": "^18.3.7",
     "@types/react-test-renderer": "^18.3.1",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^4.1.12",
     "anser": "^2.3.5",
     "clsx": "^2.1.1",
     "diff": "^9.0.0",
@@ -158,7 +160,7 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.70.1",
     "unrun": "^0.3.1",
-    "vitest": "^4.1.11",
+    "vitest": "^4.1.12",
     "zustand": "^5.0.15"
   },
   "scripts": {