dsh-workbuddy-bridge 0.5.5 → 0.5.6

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as variantFor, D as WorkBuddyUpstreamClient, S as WORKBUDDY_VARIANTS, Z as resolveAppVersion, a as readHostHeartbeat, c as WORKBUDDY_BRIDGE_VERSION, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, x as CN_VARIANT } from "./heartbeat-DYtNMdMm.js";
+import { C as variantFor, D as WorkBuddyUpstreamClient, Q as resolveAppVersion, S as WORKBUDDY_VARIANTS, a as readHostHeartbeat, c as WORKBUDDY_BRIDGE_VERSION, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, x as CN_VARIANT } from "./heartbeat-BOSjBL0B.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/cli/bin.ts

package/lib/{heartbeat-DYtNMdMm.js → heartbeat-BOSjBL0B.js}

@@ -367,14 +367,16 @@ const UPSTREAM_CODE_KINDS = {
 	"12153": "session_dead",
 	"11128": "client",
 	"11133": "client",
-	"11140": "client"
+	"11140": "client",
+	"11158": "client"
 };
 /** 业务码 → 失败类别：信封 code 非 0 时的第一落点。 */
 const ENVELOPE_CODE_KINDS = {
 	12153: "session_dead",
 	11128: "client",
 	11133: "client",
-	11140: "client"
+	11140: "client",
+	11158: "client"
 };
 /**
 * 文案兜底标记。**只在既无机器码也无业务码可依时使用**，且命中后必须记日志：
@@ -692,6 +694,30 @@ async function probeModel(options) {
 *
 * @module dsh-workbuddy-bridge/upstream
 */
+/**
+* Wait before each gate retry, in milliseconds; the length is the retry budget.
+*
+* Measured 2026-11-06 (CN gateway): the first attempt of a conversation is refused
+* and the identical request answers 200 at +0.74 s. Two steps cover that window
+* with room to spare; a third would only add latency to a turn that is genuinely
+* blocked.
+*/
+const GATE_RETRY_DELAYS_MS = [400, 1200];
+/** Abortable delay: a cancelled turn must not keep retrying. */
+async function sleep(ms, signal) {
+	if (signal?.aborted === true) return;
+	await new Promise((resolve) => {
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		const onAbort = () => {
+			clearTimeout(timer);
+			resolve();
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
 const CN_CHAT_BASE = "https://copilot.tencent.com";
 const CN_BILLING_BASE = "https://www.codebuddy.cn";
 const GLOBAL_BASE = "https://www.workbuddy.ai";
@@ -1057,8 +1083,8 @@ function neutralizeAssistantExtras(message) {
 */
 function rewriteChannelGateSentences(text) {
 	let out = text;
-	for (const [from, to] of [...IDENTITY_REWRITES, ...FILE_REFERENCE_REWRITES]) if (out.includes(from)) out = out.split(from).join(to);
-	return out;
+	for (const [from, to] of IDENTITY_REWRITES) if (out.includes(from)) out = out.split(from).join(to);
+	return out.replace(FILE_REFERENCE_PARAGRAPH, FILE_REFERENCE_REPLACEMENT);
 }
 /**
 * Apply the signature rewrites to one string; see {@link neutralizeChannelSignature}.
@@ -1069,46 +1095,93 @@ function rewriteChannelGateSentences(text) {
 * so a U+200B separator was equivalent to not rewriting at all.
 */
 function neutralizeSignatureText(text) {
-	return rewriteChannelGateSentences(text.replace(CHANNEL_OPENER, "$1You are an AI agent.").replace(CHANNEL_SIGNATURE_PHRASE, "the agent runtime"));
+	return replaceBrandPhrase(rewriteChannelGateSentences(text).replace(CHANNEL_OPENER, "$1You are an AI agent."));
+}
+/** What the product phrase becomes; see {@link replaceBrandPhrase}. */
+const BRAND_PHRASE_REPLACEMENT = "the agent runtime";
+/**
+* The phrase as it appears after an article the sentence already wrote
+* (`… through the DeepSeek Harness web interface`).
+*
+* Matched **with** that article so the replacement supplies the only one:
+* replacing the bare phrase there produced `through the the agent runtime`,
+* which is what this pattern exists to prevent. It also collapses whatever
+* whitespace run separated the three words, so the sentence reads normally
+* afterwards. The trailing slash guard is the same one the bare pattern uses, so
+* a real `…/DeepSeek Harness/…` path is still never touched.
+*/
+const CHANNEL_SIGNATURE_PHRASE_AFTER_ARTICLE = /\bthe[\s\u00A0]+DeepSeek[\s\u00A0]+Harness(?![\\/])/gi;
+/**
+* Replace the brand phrase with a neutral noun phrase, in both of the forms a
+* sentence can use it.
+*
+* The replacement carries its own `the` because the phrase is normally the
+* subject of a mid-sentence clause (`Powered by DeepSeek Harness.` → `Powered by
+* the agent runtime.`). The article-bearing spelling is handled first and
+* absorbs that article; the bare spelling then gets the article from the
+* replacement. One pattern cannot do both, because the replacement text is a
+* constant.
+*/
+function replaceBrandPhrase(text) {
+	return text.replace(CHANNEL_SIGNATURE_PHRASE_AFTER_ARTICLE, BRAND_PHRASE_REPLACEMENT).replace(CHANNEL_SIGNATURE_PHRASE, BRAND_PHRASE_REPLACEMENT);
 }
 /**
 * DSH's identity lines. The gate matches each one **independently** (measured
 * 2026-10-29 by two probes on the sibling plugin), so a body whose brand is
 * already neutralized still fails on these.
+*
+* These rows match the host's **original** wording and therefore run before the
+* brand pass (see {@link neutralizeSignatureText}). A `to` side must not
+* reintroduce the brand: the brand pass that follows would rewrite it again,
+* and the second pass would then produce a different string — the
+* non-idempotence the idempotence test catches.
 */
 const IDENTITY_REWRITES = [
 	["You are a helpful AI assistant.", "You are a capable AI helper."],
 	["You are an AI assistant", "You are an AI agent."],
 	["You are a coding agent powered by the ", "You are a coding agent running on the "],
-	["You are interacting with the user through the DeepSeek Harness web interface", "You are working with the user inside the DeepSeek Harness web interface"],
+	["You are interacting with the user through the DeepSeek web interface", "You are working with the user inside the agent runtime web interface"],
 	["Agent Teams is available in this session", "Agent Teams is enabled for this session"]
 ];
 /**
 * The @-path paragraph `@deepseek-ai/dsh-file-reference` injects into every
-* system prompt — a **combination** fingerprint, not one magic sentence:
-* every sentence alone answers 200, the paragraph answers 400, and rewriting
-* one sentence breaks it (all three measured on 2026-10-27→29 by the two
-* reference plugins). Hence one row per sentence: a single whole-paragraph
-* literal would stop matching the moment the host rewords one word.
-*
-* The `from` strings come from the upstream reports' wording. A capture of THIS
-* host (issue #25 diagnostic, `~/.dsh/workbuddy-sent-body.json`) shows it
-* already ships several of the neutralized forms, so most rows are no-ops here
-* and are kept for hosts that still send the originals. Only `from` strings a
-* measurement actually produced appear in the table — an unmatched sentence
-* passes through byte-identical rather than being guessed at.
+* system prompt.
+*
+* **Whole-paragraph replacement, measured.** The gateway answers 200 to each
+* sentence alone and 400 to the paragraph, i.e. the match unit is the paragraph,
+* not a sentence. Everything short of replacing it leaves the count above the
+* threshold, and that includes the sibling implementation's one-word insertion —
+* measured 2026-11-06 against this gateway, on a real 92 KB turn:
+*
+* | form sent in \`system\`                              | refused |
+* | ---                                                | ---     |
+* | original paragraph                                 | 3/3     |
+* | original + \`that\` inserted into the first sentence | 3/3     |
+* | **replaced with the neutral paragraph below**       | **0/3** |
+* | removed outright                                    | 0/3     |
+*
+* The rule matches the paragraph by its shape rather than by one literal string:
+* the host has shipped at least two wordings (this repo's own older rewrite
+* produced "Tokens prefixed with @ are paths that the user explicitly
+* referenced."), and a literal would silently stop matching the next time the host
+* reworded a word. The `@` glyph and its meaning survive in the replacement: the
+* model still has to know what a leading `@` means, only the phrasing the gate
+* reads is gone.
+*
+* Idempotent by construction: the replacement contains none of the shapes the
+* pattern looks for.
+*/
+const FILE_REFERENCE_PARAGRAPH = /(?:Paths prefixed with @|Tokens prefixed with @|Tokens starting with @)[\s\S]{0,600}?quotes a path containing spaces\./iu;
+/** What the paragraph becomes; see {@link FILE_REFERENCE_PARAGRAPH}. */
+const FILE_REFERENCE_REPLACEMENT = "A token beginning with @ names a location the user pointed at. Resolve relative ones from the project folder and treat absolute ones as host paths. A trailing slash means a directory, otherwise it is a file. Quote a path containing spaces with @\"...\".";
+/**
+* The same paragraph as an older release of this plugin left it in history.
+*
+* A `to` side becomes a fingerprint once the gate has been measured against it,
+* and a session that ran 0.5.5 carries those forms in its `assistant` echo. They
+* are matched by the same pattern above, so nothing extra is needed here — this
+* note exists because the pattern's alternation is what makes that true.
 */
-const FILE_REFERENCE_REWRITES = [
-	["Paths prefixed with @ point to files the user referenced.", "Tokens starting with @ are locations the user explicitly named."],
-	["Relative paths resolve against the working directory;", "Relative paths are resolved against the workspace root;"],
-	["absolute paths identify files or directories on the host.", "absolute paths point at files or directories on the host."],
-	["A trailing slash marks a directory:", "A trailing slash indicates a directory:"],
-	["list it when its contents matter.", "list it whenever its contents matter."],
-	["Anything else is a file:", "Everything else is a file:"],
-	["use the read tool when its contents are needed,", "use the read tool whenever you need its contents,"],
-	["and do not claim to have inspected it before reading.", "and never claim to have inspected it before reading it."],
-	["@\"...\" quotes a path containing spaces.", "A path containing spaces is quoted with @\"...\"."]
-];
 /**
 * The opener DSH puts at the head of every system prompt.
 *
@@ -1143,6 +1216,23 @@ const CHANNEL_GATE_COPY = /请求被拦截/;
 function isChannelGateBody(body) {
 	return CHANNEL_GATE_CODE.test(body) || CHANNEL_GATE_COPY.test(body);
 }
+/**
+* The plan-limit refusal: the account's tier does not include the model
+* (issue #24, measured on a free international account).
+*
+* Two shapes, because the code can be in the envelope or written into the
+* message text — `{"code":11158,"msg":"model [gpt-6-luna] is not allowed for
+* user type [personal_free_user]", "displayMsg":{…}}`. Both must be recognised
+* for the same reason as the channel gate: the actionable advice (pick another
+* model) is not guessable from `请求被拦截`-style copy, and retrying the same
+* model can never succeed.
+*/
+const PLAN_LIMIT_CODE = /\b11158\b/;
+const PLAN_LIMIT_COPY = /is not allowed for user type/i;
+/** True when an upstream body says the account's plan excludes the model. */
+function isPlanLimitBody(body) {
+	return PLAN_LIMIT_CODE.test(body) || PLAN_LIMIT_COPY.test(body);
+}
 /** Rewrite `role: "developer"` messages to `role: "system"` (upstream rejects developer). */
 function normalizeDeveloperRole(obj) {
 	const messages = obj["messages"];
@@ -1224,11 +1314,28 @@ var WorkBuddyUpstreamClient = class {
 	resolveAppVersion;
 	/** Chat-identity resolver; see {@link WorkBuddyUpstreamClientOptions.resolveChatIdentity}. */
 	resolveChatIdentity;
+	/** Request observer; see {@link WorkBuddyUpstreamClientOptions.onChatRequest}. */
+	onChatRequest;
+	/** Outcome observer; see {@link WorkBuddyUpstreamClientOptions.onChatOutcome}. */
+	onChatOutcome;
 	/** Provenance of the most recent successful catalog fetch, for the card. */
 	lastCatalog;
 	constructor(options = {}) {
 		this.resolveAppVersion = options.resolveAppVersion ?? (() => resolveAppVersion());
 		this.resolveChatIdentity = options.resolveChatIdentity ?? ((region) => resolveChatIdentity(region));
+		this.onChatRequest = options.onChatRequest;
+		this.onChatOutcome = options.onChatOutcome;
+	}
+	/**
+	* Report an outcome without letting an observer break the request it observes.
+	*
+	* Both observers exist for diagnostics, so their failure must stay invisible to
+	* the message being diagnosed.
+	*/
+	reportOutcome(outcome) {
+		try {
+			this.onChatOutcome?.(outcome);
+		} catch {}
 	}
 	/**
 	* POST the chat endpoint; a successful answer is the raw SSE response.
@@ -1253,35 +1360,72 @@ var WorkBuddyUpstreamClient = class {
 			userAgent = chatUserAgent(fallbackChatIdentity(region), region);
 		}
 		const body = region === "global" ? prepareInternationalChatBody(bodyJson) : prepareChatBody(bodyJson);
-		let response;
+		const url = `${chatBase(credential)}/v2/chat/completions`;
+		const headers = {
+			...chatHeaders(credential, userAgent),
+			Authorization: `Bearer ${credential.accessToken}`
+		};
 		try {
-			response = await fetch(`${chatBase(credential)}/v2/chat/completions`, {
-				method: "POST",
-				headers: {
-					...chatHeaders(credential, userAgent),
-					Authorization: `Bearer ${credential.accessToken}`
-				},
-				body,
-				...signal === void 0 ? {} : { signal }
+			this.onChatRequest?.({
+				url,
+				headers,
+				body
 			});
-		} catch (error) {
-			return {
-				ok: false,
-				status: 0,
-				kind: "server",
-				message: `transport error: ${String(error)}`
+		} catch {}
+		let response;
+		let attempt = 0;
+		/** The last refusal, kept for the report once the retry budget is spent. */
+		let refusal;
+		for (;;) {
+			attempt++;
+			try {
+				response = await fetch(url, {
+					method: "POST",
+					headers,
+					body,
+					...signal === void 0 ? {} : { signal }
+				});
+			} catch (error) {
+				this.reportOutcome({
+					status: 0,
+					message: `transport error: ${String(error)}`
+				});
+				return {
+					ok: false,
+					status: 0,
+					kind: "server",
+					message: `transport error: ${String(error)}`
+				};
+			}
+			if (response.ok) {
+				this.reportOutcome({ status: response.status });
+				return {
+					ok: true,
+					response
+				};
+			}
+			const text = (await response.text()).slice(0, ERROR_BODY_LIMIT);
+			refusal = {
+				status: response.status,
+				text
 			};
+			if (!isChannelGateBody(text) || attempt > GATE_RETRY_DELAYS_MS.length) break;
+			if (signal?.aborted === true) break;
+			await sleep(GATE_RETRY_DELAYS_MS[attempt - 1], signal);
 		}
-		if (response.ok) return {
-			ok: true,
-			response
+		const last = refusal ?? {
+			status: response.status,
+			text: ""
 		};
-		const text = (await response.text()).slice(0, ERROR_BODY_LIMIT);
+		this.reportOutcome({
+			status: last.status,
+			message: last.text
+		});
 		return {
 			ok: false,
-			status: response.status,
-			kind: classifyUpstreamError(response.status, text),
-			message: text
+			status: last.status,
+			kind: classifyUpstreamError(last.status, last.text),
+			message: last.text
 		};
 	}
 	/** POST the token-refresh endpoint; the caller merges the outcome. */
@@ -4021,7 +4165,7 @@ var WorkBuddyCatalog = class {
 };
 //#endregion
 //#region src/version.ts
-const WORKBUDDY_BRIDGE_VERSION = "0.5.5";
+const WORKBUDDY_BRIDGE_VERSION = "0.5.6";
 //#endregion
 //#region src/web/heartbeat.ts
 /**
@@ -4192,4 +4336,4 @@ function isHeartbeatProcessAlive(heartbeat) {
 	return startAtMs <= heartbeat.registeredAt;
 }
 //#endregion
-export { normalizeCredits as A, CN_APP_VERSION_FILENAME as B, variantFor as C, WorkBuddyUpstreamClient as D, WORKBUDDY_STATUS_PATH as E, PROBE_EFFORT_CANDIDATES as F, resolveChatIdentity as G, chatUserAgent as H, probeModel as I, appUserAgent as J, validCliVersion as K, randomSentinel as L, prepareChatBody as M, prepareInternationalChatBody as N, isChannelGateBody as O, regionOf as P, validAppVersion as Q, classifyUpstreamError as R, WORKBUDDY_VARIANTS as S, WORKBUDDY_PROBE_PATH as T, fallbackChatIdentity as U, FALLBACK_CN_APP_VERSION as V, readCliVersion as W, readBundleVersion as X, installedAppVersion as Y, resolveAppVersion as Z, desktopAuthCandidatesFor as _, readHostHeartbeat as a, AI_VARIANT as b, WORKBUDDY_BRIDGE_VERSION as c, WorkBuddyCatalog as d, WORKBUDDY_AUTH_FILENAME as f, defaultDesktopAuthPath as g, defaultDesktopAuthCandidates as h, processStartTimeMs as i, parseModelCatalog as j, modelWithCurrentPromotion as k, FALLBACK_WORKBUDDY_AI_MODELS as l, WorkBuddyCredentialStore as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, WORKBUDDY_AUTH_FILE_ENV as p, WORKBUDDY_APP_VERSION_FILENAME as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, FALLBACK_WORKBUDDY_MODELS as u, parseWorkBuddyAuth as v, WORKBUDDY_CREDIT_PATH as w, CN_VARIANT as x, workbuddyOwnAuthPath as y, upstreamDisplayMessage as z };
+export { validAppVersion as $, modelWithCurrentPromotion as A, upstreamDisplayMessage as B, variantFor as C, WorkBuddyUpstreamClient as D, WORKBUDDY_STATUS_PATH as E, regionOf as F, readCliVersion as G, FALLBACK_CN_APP_VERSION as H, PROBE_EFFORT_CANDIDATES as I, WORKBUDDY_APP_VERSION_FILENAME as J, resolveChatIdentity as K, probeModel as L, parseModelCatalog as M, prepareChatBody as N, isChannelGateBody as O, prepareInternationalChatBody as P, resolveAppVersion as Q, randomSentinel as R, WORKBUDDY_VARIANTS as S, WORKBUDDY_PROBE_PATH as T, chatUserAgent as U, CN_APP_VERSION_FILENAME as V, fallbackChatIdentity as W, installedAppVersion as X, appUserAgent as Y, readBundleVersion as Z, desktopAuthCandidatesFor as _, readHostHeartbeat as a, AI_VARIANT as b, WORKBUDDY_BRIDGE_VERSION as c, WorkBuddyCatalog as d, WORKBUDDY_AUTH_FILENAME as f, defaultDesktopAuthPath as g, defaultDesktopAuthCandidates as h, processStartTimeMs as i, normalizeCredits as j, isPlanLimitBody as k, FALLBACK_WORKBUDDY_AI_MODELS as l, WorkBuddyCredentialStore as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, WORKBUDDY_AUTH_FILE_ENV as p, validCliVersion as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, FALLBACK_WORKBUDDY_MODELS as u, parseWorkBuddyAuth as v, WORKBUDDY_CREDIT_PATH as w, CN_VARIANT as x, workbuddyOwnAuthPath as y, classifyUpstreamError as z };

package/lib/index.d.ts

@@ -656,6 +656,33 @@ interface WorkBuddyUpstreamClientOptions {
    * billing never consult it — those requests keep their long-standing headers.
    */
   resolveChatIdentity?: (region: WorkBuddyRegion) => Promise<ChatIdentity>;
+  /**
+   * Observes the final chat request — URL, complete headers, exact body — before
+   * it leaves. Diagnostic only; see `llm/capture.ts` for why headers are as
+   * load-bearing as the body when a request is refused on content.
+   *
+   * Kept as an injected hook rather than a built-in file write so the client
+   * stays free of filesystem policy, and so a test can assert the exact bytes
+   * without touching a disk.
+   */
+  onChatRequest?: (request: {
+    url: string;
+    headers: Record<string, string>;
+    body: string;
+  }) => void;
+  /**
+   * Observes how the chat request ended — the verdict that belongs to the
+   * request {@link onChatRequest} just reported. Status `0` is a transport
+   * failure.
+   *
+   * Paired with the request hook rather than left to the caller, because only
+   * this function sees both halves; splitting them is how a captured body gets
+   * paired with another request's verdict.
+   */
+  onChatOutcome?: (outcome: {
+    status: number;
+    message?: string;
+  }) => void;
 }
 /**
  * Upstream HTTP client. One instance serves the whole plugin; requests take
@@ -673,9 +700,20 @@ declare class WorkBuddyUpstreamClient {
   private readonly resolveAppVersion;
   /** Chat-identity resolver; see {@link WorkBuddyUpstreamClientOptions.resolveChatIdentity}. */
   private readonly resolveChatIdentity;
+  /** Request observer; see {@link WorkBuddyUpstreamClientOptions.onChatRequest}. */
+  private readonly onChatRequest;
+  /** Outcome observer; see {@link WorkBuddyUpstreamClientOptions.onChatOutcome}. */
+  private readonly onChatOutcome;
   /** Provenance of the most recent successful catalog fetch, for the card. */
   lastCatalog: WorkBuddyCatalogFetch | undefined;
   constructor(options?: WorkBuddyUpstreamClientOptions);
+  /**
+   * Report an outcome without letting an observer break the request it observes.
+   *
+   * Both observers exist for diagnostics, so their failure must stay invisible to
+   * the message being diagnosed.
+   */
+  private reportOutcome;
   /**
    * POST the chat endpoint; a successful answer is the raw SSE response.
    *

package/lib/index.js

@@ -1,9 +1,9 @@
-import { A as normalizeCredits, B as CN_APP_VERSION_FILENAME, C as variantFor, D as WorkBuddyUpstreamClient, F as PROBE_EFFORT_CANDIDATES, G as resolveChatIdentity, H as chatUserAgent, I as probeModel, J as appUserAgent, K as validCliVersion, L as randomSentinel, M as prepareChatBody, N as prepareInternationalChatBody, O as isChannelGateBody, P as regionOf, Q as validAppVersion, R as classifyUpstreamError, S as WORKBUDDY_VARIANTS, U as fallbackChatIdentity, V as FALLBACK_CN_APP_VERSION, W as readCliVersion, X as readBundleVersion, Y as installedAppVersion, Z as resolveAppVersion, _ as desktopAuthCandidatesFor, a as readHostHeartbeat, b as AI_VARIANT, c as WORKBUDDY_BRIDGE_VERSION, d as WorkBuddyCatalog, f as WORKBUDDY_AUTH_FILENAME, g as defaultDesktopAuthPath, h as defaultDesktopAuthCandidates, i as processStartTimeMs, j as parseModelCatalog, k as modelWithCurrentPromotion, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as WORKBUDDY_AUTH_FILE_ENV, q as WORKBUDDY_APP_VERSION_FILENAME, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as parseWorkBuddyAuth, w as WORKBUDDY_CREDIT_PATH, x as CN_VARIANT, y as workbuddyOwnAuthPath, z as upstreamDisplayMessage } from "./heartbeat-DYtNMdMm.js";
+import { $ as validAppVersion, A as modelWithCurrentPromotion, B as upstreamDisplayMessage, C as variantFor, D as WorkBuddyUpstreamClient, F as regionOf, G as readCliVersion, H as FALLBACK_CN_APP_VERSION, I as PROBE_EFFORT_CANDIDATES, J as WORKBUDDY_APP_VERSION_FILENAME, K as resolveChatIdentity, L as probeModel, M as parseModelCatalog, N as prepareChatBody, O as isChannelGateBody, P as prepareInternationalChatBody, Q as resolveAppVersion, R as randomSentinel, S as WORKBUDDY_VARIANTS, U as chatUserAgent, V as CN_APP_VERSION_FILENAME, W as fallbackChatIdentity, X as installedAppVersion, Y as appUserAgent, Z as readBundleVersion, _ as desktopAuthCandidatesFor, a as readHostHeartbeat, b as AI_VARIANT, c as WORKBUDDY_BRIDGE_VERSION, d as WorkBuddyCatalog, f as WORKBUDDY_AUTH_FILENAME, g as defaultDesktopAuthPath, h as defaultDesktopAuthCandidates, i as processStartTimeMs, j as normalizeCredits, k as isPlanLimitBody, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as WORKBUDDY_AUTH_FILE_ENV, q as validCliVersion, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as parseWorkBuddyAuth, w as WORKBUDDY_CREDIT_PATH, x as CN_VARIANT, y as workbuddyOwnAuthPath, z as classifyUpstreamError } from "./heartbeat-BOSjBL0B.js";
 import z from "@deepseek-ai/schemastery";
 import { dirname, join, resolve } from "node:path";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { ReasoningEffortId, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
@@ -648,6 +648,139 @@ var WorkBuddyPiAiAdapter = class extends PiAiAdapter {
 		};
 	}
 };
+/** The capture log under `$DSH_HOME`; one JSON object per line. */
+const CAPTURE_LOG_FILENAME = ".workbuddy-captures.jsonl";
+/**
+* Held across the request/response pair.
+*
+* A single slot is deliberate rather than a map: this is a human-driven
+* diagnostic, the host serialises one turn at a time, and the cost of a
+* collision (one record with another's verdict) is a re-run, not a wrong fix.
+* A map would need per-request ids threaded through the client for no gain here.
+*/
+let pending;
+/** Where the log goes right now, or `undefined` when disarmed. */
+function captureTarget() {
+	const fromEnv = process.env["WORKBUDDY_CAPTURE_BODY"];
+	if (fromEnv !== void 0 && fromEnv.trim() !== "") return fromEnv;
+	try {
+		const home = resolveDshHome();
+		return existsSync(join(home, ".workbuddy-capture.on")) ? join(home, CAPTURE_LOG_FILENAME) : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Strip credential material before anything is written.
+*
+* The log is meant to be pasted into an issue. A bearer token in it would hand
+* the reporter's account to whoever reads the issue, so redaction happens on the
+* way in rather than being left to whoever copies the file.
+*/
+function redacted(headers) {
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) {
+		const lowered = name.toLowerCase();
+		out[name] = lowered === "authorization" || lowered === "cookie" || lowered.includes("token") ? "[redacted]" : value;
+	}
+	return out;
+}
+/**
+* A non-reversible fingerprint of the bearer token, for comparing two runs.
+*
+* The token itself stays out of the log, but "was this the same token?" is a real
+* question when the same body and headers answer 200 on a replay and 400 from the
+* host: a token refresh between the two makes them different requests. A digest
+* answers it without storing the secret.
+*/
+function tokenFingerprint(headers) {
+	const entry = Object.entries(headers).find(([name]) => name.toLowerCase() === "authorization");
+	if (entry === void 0) return void 0;
+	const token = entry[1].replace(/^Bearer\s+/i, "");
+	if (token === "") return void 0;
+	return createHash("sha256").update(token).digest("hex").slice(0, 12);
+}
+/**
+* Remember the request that is about to leave.
+*
+* Called from the client's `onChatRequest` hook, i.e. after every header and the
+* body are final and before the fetch — so what is recorded is what the upstream
+* receives, not what the caller intended.
+*/
+function rememberChatRequest(url, headers, body) {
+	if (captureTarget() === void 0) return;
+	pending = {
+		url,
+		headers: redacted(headers),
+		body,
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		token: tokenFingerprint(headers)
+	};
+}
+/**
+* The most recent request this process captured, with its verdict.
+*
+* Exists so a maintainer can re-send the exact refused request from **inside**
+* the host process: the same body, headers and token answered 200 from a separate
+* process and 400 from the host, which leaves the sending process as the only
+* remaining variable.
+*
+* Falls back to the capture log's last line, because the in-memory slot does not
+* survive a plugin reload — and a reload is exactly when the experiment is
+* needed.
+*/
+function lastCapturedRequest() {
+	if (lastRequest !== void 0) return lastRequest;
+	const target = captureTarget();
+	if (target === void 0 || !existsSync(target)) return void 0;
+	try {
+		const last = readFileSync(target, "utf8").split("\n").filter((line) => line.trim() !== "").at(-1);
+		if (last === void 0) return void 0;
+		const record = JSON.parse(last);
+		if (typeof record.body !== "string") return void 0;
+		return {
+			body: record.body,
+			at: record.at ?? "",
+			status: record.status ?? 0,
+			headers: record.headers ?? {}
+		};
+	} catch {
+		return;
+	}
+}
+/** Set by {@link rememberChatRequest} and refreshed by {@link recordChatOutcome}. */
+let lastRequest;
+/**
+* Append the pending request with its verdict.
+*
+* `status` 0 means a transport failure. A missing pending request (a caller that
+* skips the hook) writes nothing rather than inventing a record.
+*/
+function recordChatOutcome(status, message) {
+	const target = captureTarget();
+	const entry = pending;
+	pending = void 0;
+	if (entry !== void 0) lastRequest = {
+		body: entry.body,
+		at: entry.at,
+		status,
+		headers: entry.headers
+	};
+	if (target === void 0 || entry === void 0) return;
+	const line = JSON.stringify({
+		at: entry.at,
+		url: entry.url,
+		status,
+		...message === void 0 ? {} : { message: message.slice(0, 400) },
+		tokenFingerprint: entry.token,
+		headers: entry.headers,
+		bodyLength: entry.body.length,
+		body: entry.body
+	});
+	try {
+		appendFileSync(target, `${line}\n`, { mode: 384 });
+	} catch {}
+}
 //#endregion
 //#region src/llm/loopback.ts
 /**
@@ -797,8 +930,24 @@ const KIND_STATUS = {
 * guidance itself, echoed back into a later request, cannot re-arm the gate.
 * No status digits (see {@link failureMessage}) and no retry advice: retrying
 * the same poisoned conversation reproduces the refusal.
+*
+* The running version rides along (issue #30): the same symptom reaches users
+* on two very different layers — an install older than the fix, and a residual
+* trigger after it — and without the version the user cannot tell which layer
+* they are on, so the first thing they check is their account.
+*/
+function channelGateHint() {
+	return ` — 渠道校验拦截（11-128）。请新开会话重试；若持续出现，先更新插件（当前 ${WORKBUDDY_BRIDGE_VERSION}） / blocked by channel verification (11-128): start a new conversation, and update the plugin if it persists (running ${WORKBUDDY_BRIDGE_VERSION})`;
+}
+/**
+* What to do when the account's plan excludes the requested model (issue #24).
+*
+* No retry advice, because no retry can help: the model is not on this tier,
+* and only picking a different model succeeds. The upstream's own
+* `displayMsg` ("Your account type does not support this model.") says what is
+* wrong but not what to do, which is the gap this fills.
 */
-const CHANNEL_GATE_HINT = " — 渠道校验拦截（11-128）。请新开会话重试；若持续出现，先更新插件 / blocked by channel verification (11-128): start a new conversation, and update the plugin if it persists";
+const PLAN_LIMIT_HINT = " — 当前账号套餐不包含这个模型（11158），请换用其他模型 / your plan does not include this model (11158): pick another one";
 function writeJson(res, status, body) {
 	const payload = JSON.stringify(body);
 	res.writeHead(status, {
@@ -828,17 +977,20 @@ function writeOpenAIError(res, status, kind, message) {
 * written for a human ("账号存在异常行为，已被限制使用"), while the body is a JSON
 * document whose `msg` is often a machine phrase such as `request illegal`.
 *
-* The channel-gate code (`11-128`) appends {@link CHANNEL_GATE_HINT}: its raw
+* The channel-gate code (`11-128`) appends {@link channelGateHint}: its raw
 * body is `{"message":"请求被拦截，请重新发送","type":"client","code":"client"}`,
 * which on its own reads as a transient hiccup the user should simply retry —
 * the two actions that actually help (a new conversation; update the plugin)
-* are not guessable from it.
+* are not guessable from it. A plan-limit refusal (`11158`) appends
+* {@link PLAN_LIMIT_HINT} for the same reason: the fix is "pick another model",
+* which the upstream copy does not say.
 */
 function failureMessage(result) {
 	const reason = upstreamDisplayMessage(result.message) ?? result.message.slice(0, 400);
 	const head = `workbuddy upstream ${result.kind}`;
 	const line = result.kind === "session_dead" ? `${head} (http ${result.status}): ${reason}` : `${head}: ${reason}`;
-	return isChannelGateBody(result.message) ? `${line}${CHANNEL_GATE_HINT}` : line;
+	const gated = isChannelGateBody(result.message) ? `${line}${channelGateHint()}` : line;
+	return isPlanLimitBody(result.message) ? `${gated}${PLAN_LIMIT_HINT}` : gated;
 }
 /** Read a request body with a size cap; over-limit bodies fail the request. */ function readBody$1(req) {
 	return new Promise((resolve, reject) => {
@@ -1656,6 +1808,22 @@ async function workBuddyWebStatus(deps) {
 /** The status route's request handler, extracted so tests can mount it on a bare server. */
 function workBuddyStatusHandler(deps) {
 	return async (req, res) => {
+		if (req.method === "POST") {
+			if (deps.replayCaptured === void 0) {
+				json$2(res, 405, { error: "method not allowed" });
+				return;
+			}
+			if (!loopbackRequest$1(req)) {
+				json$2(res, 403, { error: "request-not-trusted" });
+				return;
+			}
+			try {
+				json$2(res, 200, await deps.replayCaptured());
+			} catch (error) {
+				json$2(res, 500, { error: safeMessage(error) });
+			}
+			return;
+		}
 		if (req.method !== "GET") {
 			json$2(res, 405, { error: "method not allowed" });
 			return;
@@ -2037,7 +2205,14 @@ function fallbackFor(variant) {
 }
 /** Build one variant's stores and probe state. */
 function createVariantRuntime(config, variant, identityOf, accountOf, creditIndex) {
-	const client = new WorkBuddyUpstreamClient();
+	const client = new WorkBuddyUpstreamClient({
+		onChatRequest: ({ url, headers, body }) => {
+			rememberChatRequest(url, headers, body);
+		},
+		onChatOutcome: (outcome) => {
+			recordChatOutcome(outcome.status, outcome.message);
+		}
+	});
 	const configured = configuredAuthFile(config, variant);
 	const store = new WorkBuddyCredentialStore({
 		variant,
@@ -2318,6 +2493,19 @@ function apply(ctx, refs) {
 				catalog: () => catalogSection(runtime),
 				probe: () => probeSection(runtime, config().probeConsent),
 				probeKey,
+				replayCaptured: async () => {
+					const captured = lastCapturedRequest();
+					if (captured === void 0) return { error: "nothing captured" };
+					const credential = await runtime.store.resolve();
+					const result = await runtime.client.chatStream(credential, captured.body);
+					return {
+						ok: result.ok,
+						replayedStatus: result.ok ? result.response.status : result.status,
+						capturedAt: captured.at,
+						capturedStatus: captured.status,
+						bodyLength: captured.body.length
+					};
+				},
 				visibility: () => {
 					const account = runtime.account();
 					return account === void 0 ? void 0 : {

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-bridge",
   "displayName": "DSH WorkBuddy Bridge",
   "description": "将 WorkBuddy 桌面 App 包含的模型自动接入 DeepSeek Harness — bring WorkBuddy desktop app models into DeepSeek Harness with zero configuration.",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "author": "zlZayn",
   "keywords": [
     "dsh",