dsh-workbuddy-connect 0.3.2 → 0.5.0

package/lib/host-heartbeat-BSsKUoB8.js

@@ -1,1198 +0,0 @@
-import { readFile, rm, stat, writeFile } from "node:fs/promises";
-import { homedir, release } from "node:os";
-import { basename, join } from "node:path";
-import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
-import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
-import { execFileSync } from "node:child_process";
-//#region src/auth.ts
-/**
-* WorkBuddy credential resolution. The primary source is the WorkBuddy
-* desktop app's own auth file, read-only; a plugin-owned copy under
-* `$DSH_HOME` holds token refreshes so the desktop file is never written.
-* The effective credential is whichever of the two expires later, so a
-* refresh by either side wins.
-*
-* @module dsh-workbuddy-connect/auth
-*/
-/** Basename of the plugin-owned credential copy inside the Harness home. */
-const WORKBUDDY_AUTH_FILENAME = ".workbuddy-auth.json";
-/** Env variable that overrides the desktop auth-file location. */
-const WORKBUDDY_AUTH_FILE_ENV = "WORKBUDDY_AUTH_FILE";
-/** Current on-disk format of the plugin-owned copy; readers reject others. */
-const OWN_FORMAT_VERSION = 1;
-/** Plugin-owned copy path inside the Harness home. */
-function workbuddyOwnAuthPath() {
-	return join(resolveDshHome(), WORKBUDDY_AUTH_FILENAME);
-}
-const DESKTOP_AUTH_RELATIVE_PATH = [
-	"CodeBuddyExtension",
-	"Data",
-	"Public",
-	"auth",
-	"workbuddy-desktop.info"
-];
-/** Whether this Linux process is running inside Windows Subsystem for Linux. */
-function isWsl() {
-	if (process.platform !== "linux") return false;
-	if (process.env["WSL_DISTRO_NAME"] !== void 0 || process.env["WSL_INTEROP"] !== void 0) return true;
-	return release().toLowerCase().includes("microsoft");
-}
-/** Convert a Windows drive path to WSL's conventional `/mnt/<drive>` form. */
-function windowsPathForWsl(value) {
-	const path = value?.trim();
-	if (!path) return void 0;
-	if (path.startsWith("/")) return path;
-	const drivePath = /^([a-z]):[\\/](.*)$/iu.exec(path);
-	if (drivePath === null) return void 0;
-	return join("/mnt", drivePath[1].toLowerCase(), ...drivePath[2].split(/[\\/]+/u));
-}
-/** Windows desktop credential candidates visible from a WSL process. */
-function wslDesktopAuthCandidates(home) {
-	const profile = windowsPathForWsl(process.env["USERPROFILE"]) ?? join("/mnt/c/Users", basename(home));
-	const localAppData = windowsPathForWsl(process.env["LOCALAPPDATA"]) ?? join(profile, "AppData", "Local");
-	const roamingAppData = windowsPathForWsl(process.env["APPDATA"]) ?? join(profile, "AppData", "Roaming");
-	return [join(localAppData, ...DESKTOP_AUTH_RELATIVE_PATH), join(roamingAppData, ...DESKTOP_AUTH_RELATIVE_PATH)];
-}
-/**
-* Platform-default candidates for the WorkBuddy desktop app's auth file, in
-* probe order. Windows probes both AppData roots: current builds write under
-* `%LOCALAPPDATA%` (Local), older ones under `%APPDATA%` (Roaming). WSL probes
-* those same Windows locations through its mounted Windows profile before the
-* native Linux location.
-*/
-function defaultDesktopAuthCandidates() {
-	const home = homedir();
-	if (process.platform === "darwin") return [join(home, "Library", "Application Support", "CodeBuddyExtension", "Data", "Public", "auth", "workbuddy-desktop.info")];
-	if (process.platform === "win32") return [join(home, "AppData", "Local", "CodeBuddyExtension", "Data", "Public", "auth", "workbuddy-desktop.info"), join(home, "AppData", "Roaming", "CodeBuddyExtension", "Data", "Public", "auth", "workbuddy-desktop.info")];
-	if (process.platform === "linux") {
-		const linux = join(home, ".config", ...DESKTOP_AUTH_RELATIVE_PATH);
-		return isWsl() ? [...wslDesktopAuthCandidates(home), linux] : [linux];
-	}
-	return [];
-}
-/** First platform-default candidate; see {@link defaultDesktopAuthCandidates}. */
-function defaultDesktopAuthPath() {
-	return defaultDesktopAuthCandidates()[0];
-}
-/** Normalize an expiry that may arrive in seconds or milliseconds. */
-function expiryToMs(value) {
-	if (value <= 0) return 0;
-	return value > 0xe8d4a51000 ? value : value * 1e3;
-}
-function optionalString(value) {
-	return typeof value === "string" && value !== "" ? value : void 0;
-}
-/**
-* Parse a WorkBuddy auth document in either on-disk shape: the plugin OAuth
-* nested form `{"auth":{...},"account":{...}}` and the flat panel form.
-* Returns undefined when the document carries no access token.
-*/
-function parseWorkBuddyAuth(text) {
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch {
-		return;
-	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
-	const document = parsed;
-	let auth;
-	let identity;
-	if (typeof document["auth"] === "object" && document["auth"] !== null) {
-		auth = document["auth"];
-		identity = typeof document["account"] === "object" && document["account"] !== null ? document["account"] : {};
-	} else {
-		auth = document;
-		identity = document;
-	}
-	const accessToken = typeof auth["accessToken"] === "string" ? auth["accessToken"] : "";
-	if (accessToken === "") return void 0;
-	const expiresAtMs = typeof auth["expiresAt"] === "number" ? expiryToMs(auth["expiresAt"]) : 0;
-	const refreshExpiresAtMs = typeof auth["refreshExpiresAt"] === "number" ? expiryToMs(auth["refreshExpiresAt"]) : void 0;
-	const enterpriseId = optionalString(identity["enterpriseId"]);
-	const nickname = optionalString(identity["nickname"]);
-	return {
-		accessToken,
-		refreshToken: typeof auth["refreshToken"] === "string" ? auth["refreshToken"] : "",
-		expiresAtMs,
-		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
-		domain: optionalString(auth["domain"]) ?? "",
-		uid: optionalString(identity["uid"]) ?? "",
-		...enterpriseId === void 0 ? {} : { enterpriseId },
-		...nickname === void 0 ? {} : { nickname },
-		source: "desktop"
-	};
-}
-/** Serialize the plugin-owned copy. */
-function ownDocument(credential) {
-	return {
-		version: OWN_FORMAT_VERSION,
-		credential
-	};
-}
-/** Parse the plugin-owned copy; other versions and shapes are rejected. */
-function parseOwnDocument(text) {
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch {
-		return;
-	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
-	const document = parsed;
-	if (document["version"] !== OWN_FORMAT_VERSION) return void 0;
-	if (typeof document["credential"] !== "object" || document["credential"] === null) return void 0;
-	const stored = document["credential"];
-	const accessToken = typeof stored["accessToken"] === "string" ? stored["accessToken"] : "";
-	if (accessToken === "") return void 0;
-	const refreshExpiresAtMs = typeof stored["refreshExpiresAtMs"] === "number" ? stored["refreshExpiresAtMs"] : void 0;
-	const enterpriseId = optionalString(stored["enterpriseId"]);
-	const nickname = optionalString(stored["nickname"]);
-	return {
-		accessToken,
-		refreshToken: typeof stored["refreshToken"] === "string" ? stored["refreshToken"] : "",
-		expiresAtMs: typeof stored["expiresAtMs"] === "number" ? stored["expiresAtMs"] : 0,
-		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
-		domain: optionalString(stored["domain"]) ?? "",
-		uid: optionalString(stored["uid"]) ?? "",
-		...enterpriseId === void 0 ? {} : { enterpriseId },
-		...nickname === void 0 ? {} : { nickname },
-		source: "dsh"
-	};
-}
-/** Whether a filesystem error reports an absent path. */
-function isENOENT(error) {
-	return error?.code === "ENOENT";
-}
-/**
-* Read-only credential store with demand-driven refresh.
-*
-* Refresh policy: refresh only when the access token is inside the margin
-* (or already expired), keep the refreshed credential in the plugin-owned
-* copy, and never write the desktop app's file. A failed refresh still
-* returns a not-yet-expired token so an unreachable refresh endpoint does
-* not take down a working session.
-*/
-var WorkBuddyCredentialStore = class {
-	refresh;
-	refreshMarginMs;
-	ownPath;
-	desktopPathOverride;
-	inflight;
-	constructor(options) {
-		this.refresh = options.refresh;
-		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
-		this.ownPath = options.ownPath ?? workbuddyOwnAuthPath();
-		this.desktopPathOverride = options.desktopPath;
-	}
-	/**
-	* Configuration precedence for the desktop file: the plugin's configured
-	* path, then the environment variable, then the platform defaults. An
-	* explicit path is used verbatim; the defaults are a probe order.
-	*/
-	resolveDesktopCandidates() {
-		const fromEnv = process.env[WORKBUDDY_AUTH_FILE_ENV];
-		const explicit = this.desktopPathOverride ?? (fromEnv !== void 0 && fromEnv.trim() !== "" ? fromEnv : void 0);
-		if (explicit !== void 0) return [explicit];
-		return defaultDesktopAuthCandidates();
-	}
-	resolveDesktopPath() {
-		return this.resolveDesktopCandidates()[0];
-	}
-	/**
-	* Repoint the desktop file; a settings change applies on the next read.
-	*/
-	setDesktopPath(path) {
-		this.desktopPathOverride = path;
-	}
-	/** The resolved desktop auth-file path, for diagnostics. */
-	desktopAuthPath() {
-		return this.resolveDesktopPath();
-	}
-	/** The plugin-owned copy path, for diagnostics. */
-	ownAuthPath() {
-		return this.ownPath;
-	}
-	/** Read the freshest stored credential without refreshing anything. */
-	async current() {
-		const [desktop, own] = await Promise.all([this.readDesktop(), this.readOwn()]);
-		if (desktop === void 0) return own;
-		if (own === void 0) return desktop;
-		return own.expiresAtMs > desktop.expiresAtMs ? own : desktop;
-	}
-	/**
-	* The credential to send upstream: {@link current}, refreshed on demand.
-	* Single-flight, so parallel requests share one refresh.
-	*/
-	async resolve() {
-		const credential = await this.current();
-		if (credential === void 0) {
-			const candidates = this.resolveDesktopCandidates();
-			const desktop = candidates.length > 0 ? candidates.join(" or ") : "(no desktop path on this platform)";
-			throw new Error(`workbuddy: no signed-in WorkBuddy account found; sign in once in the WorkBuddy desktop app (expected ${desktop} or WORKBUDDY_AUTH_FILE), or refresh an existing session`);
-		}
-		if (!this.needsRefresh(credential)) return credential;
-		this.inflight ??= this.refreshNow(credential).finally(() => {
-			this.inflight = void 0;
-		});
-		return this.inflight;
-	}
-	/** Read-only sign-in summary; never refreshes and never throws. */
-	async status() {
-		try {
-			const credential = await this.current();
-			if (credential === void 0) return { state: "signed-out" };
-			return {
-				state: "signed-in",
-				expiresAtMs: credential.expiresAtMs,
-				...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs: credential.refreshExpiresAtMs },
-				...credential.nickname === void 0 ? {} : { nickname: credential.nickname },
-				...credential.domain === "" ? {} : { domain: credential.domain },
-				source: credential.source
-			};
-		} catch {
-			return { state: "signed-out" };
-		}
-	}
-	/** Remove the plugin-owned copy; the desktop file is untouched. */
-	async logout() {
-		await rm(this.ownPath, { force: true });
-		await rm(`${this.ownPath}.lock`, { force: true });
-	}
-	needsRefresh(credential) {
-		if (credential.expiresAtMs <= 0) return true;
-		return Date.now() + this.refreshMarginMs >= credential.expiresAtMs;
-	}
-	async refreshNow(credential) {
-		if (credential.refreshToken === "") {
-			if (credential.expiresAtMs > Date.now() + 3e4) return credential;
-			throw new Error("workbuddy: access token expired and no refresh token is stored; sign in again in the WorkBuddy desktop app");
-		}
-		try {
-			const outcome = await this.refresh(credential);
-			const refreshed = {
-				...credential,
-				accessToken: outcome.accessToken,
-				...outcome.refreshToken === void 0 ? {} : { refreshToken: outcome.refreshToken },
-				expiresAtMs: outcome.expiresInSec !== void 0 ? Date.now() + outcome.expiresInSec * 1e3 : credential.expiresAtMs,
-				...outcome.domain === void 0 || outcome.domain === "" ? {} : { domain: outcome.domain },
-				source: "dsh"
-			};
-			await this.saveOwn(refreshed);
-			return refreshed;
-		} catch (error) {
-			if (credential.expiresAtMs > Date.now() + 3e4) return credential;
-			throw new Error(`workbuddy: token refresh failed and the access token is expired (${String(error)}); open the WorkBuddy desktop app once to sign in again`);
-		}
-	}
-	async saveOwn(credential) {
-		await withFileLock(this.ownPath, async () => {
-			await writeFileAtomic(this.ownPath, `${JSON.stringify(ownDocument(credential), null, 2)}\n`, {
-				mode: 384,
-				dirMode: 448
-			});
-		});
-	}
-	/**
-	* Read the first desktop candidate that exists. Only an absent file
-	* (ENOENT) falls through to the next candidate; a file that is present
-	* but unparsable is authoritative for its slot, so a stale older-version
-	* file never silently wins over a broken newer one.
-	*/
-	async readDesktop() {
-		for (const desktopPath of this.resolveDesktopCandidates()) try {
-			return parseWorkBuddyAuth(await readFile(desktopPath, "utf8"));
-		} catch (error) {
-			if (!isENOENT(error)) throw error;
-		}
-	}
-	async readOwn() {
-		try {
-			return parseOwnDocument(await readFile(this.ownPath, "utf8"));
-		} catch (error) {
-			if (isENOENT(error)) return void 0;
-			return;
-		}
-	}
-	/** Whether any desktop-file candidate exists as a regular file; diagnostics only. */
-	async desktopFilePresent() {
-		for (const desktopPath of this.resolveDesktopCandidates()) try {
-			if ((await stat(desktopPath)).isFile()) return true;
-		} catch {}
-		return false;
-	}
-};
-//#endregion
-//#region src/catalog.ts
-/**
-* Static CLI models observed on the CN endpoint (re-verified against the live
-* catalog 2026-09-01, including the thinking-effort and billing metadata). The
-* upstream refresh replaces this list at startup; it exists so the provider
-* registers with a usable catalog even while the first fetch is in flight or
-* offline.
-*
-* The list tracks the `cli` agent's model roster exactly: the 15 models the
-* desktop CLI offers. Reasoning metadata is taken verbatim from the live
-* endpoint — each model's supported effort set and whether thinking can be
-* disabled — and the `free` flag follows the upstream `x0.00` credits marker.
-*/
-const FALLBACK_WORKBUDDY_MODELS = [
-	{
-		id: "auto",
-		name: "Auto",
-		contextWindow: 168e3,
-		maxTokens: 32e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			defaultEffort: "high",
-			canDisableThinking: false
-		},
-		billing: { free: false }
-	},
-	{
-		id: "hy3",
-		name: "Hy3",
-		contextWindow: 192e3,
-		maxTokens: 64e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			defaultEffort: "high",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x0.00",
-			badges: ["限时免费"],
-			free: true
-		}
-	},
-	{
-		id: "glm-5.2",
-		name: "GLM-5.2",
-		contextWindow: 1e6,
-		maxTokens: 48e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			defaultEffort: "medium",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x0.79 credits",
-			badges: ["夜间折扣"],
-			free: false
-		}
-	},
-	{
-		id: "glm-5.1",
-		name: "GLM-5.1",
-		contextWindow: 2e5,
-		maxTokens: 48e3,
-		supportsImages: false,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			defaultEffort: "medium",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x0.79 credits",
-			free: false
-		}
-	},
-	{
-		id: "glm-5v-turbo",
-		name: "GLM-5v-Turbo",
-		contextWindow: 2e5,
-		maxTokens: 64e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			defaultEffort: "medium",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x0.71 credits",
-			free: false
-		}
-	},
-	{
-		id: "kimi-k3-1",
-		name: "Kimi-K3",
-		contextWindow: 1e6,
-		maxTokens: 32e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			defaultEffort: "medium",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x1.62 credits",
-			free: false
-		}
-	},
-	{
-		id: "kimi-k2.7",
-		name: "Kimi-K2.7-Code",
-		contextWindow: 256e3,
-		maxTokens: 32e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			defaultEffort: "medium",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x0.57 credits",
-			free: false
-		}
-	},
-	{
-		id: "kimi-k2.6",
-		name: "Kimi-K2.6",
-		contextWindow: 256e3,
-		maxTokens: 32e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			defaultEffort: "medium",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x0.52 credits",
-			free: false
-		}
-	},
-	{
-		id: "minimax-m3",
-		name: "MiniMax-M3",
-		contextWindow: 512e3,
-		maxTokens: 128e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			defaultEffort: "medium",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x0.25 credits",
-			free: false
-		}
-	},
-	{
-		id: "deepseek-v4-flash",
-		name: "Deepseek-V4-Flash",
-		contextWindow: 1e6,
-		maxTokens: 5e4,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			defaultEffort: "high",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x0.17 credits",
-			free: false
-		}
-	},
-	{
-		id: "deepseek-v4-pro",
-		name: "Deepseek-V4-Pro",
-		contextWindow: 1e6,
-		maxTokens: 5e4,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			defaultEffort: "high",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x0.51 credits",
-			free: false
-		}
-	},
-	{
-		id: "hy4-preview",
-		name: "Hy4 preview",
-		contextWindow: 1e6,
-		maxTokens: 64e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			supportedEfforts: ["high"],
-			defaultEffort: "high",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x0.00",
-			badges: ["限时免费"],
-			free: true
-		}
-	},
-	{
-		id: "hy3-x",
-		name: "Hy3",
-		contextWindow: 192e3,
-		maxTokens: 64e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			supportedEfforts: ["low", "high"],
-			defaultEffort: "high",
-			canDisableThinking: false
-		},
-		billing: {
-			credits: "x0.05",
-			free: false
-		}
-	},
-	{
-		id: "glm-5.3",
-		name: "GLM-5.3",
-		contextWindow: 1e6,
-		maxTokens: 48e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			supportedEfforts: [
-				"low",
-				"high",
-				"xhigh"
-			],
-			defaultEffort: "high",
-			canDisableThinking: true
-		},
-		billing: {
-			credits: "x0.79",
-			free: false
-		}
-	},
-	{
-		id: "glm-5.3-flash",
-		name: "GLM-5.3-Flash",
-		contextWindow: 1e6,
-		maxTokens: 32e3,
-		supportsImages: true,
-		reasoning: {
-			supports: true,
-			onlyReasoning: true,
-			supportedEfforts: [
-				"low",
-				"high",
-				"max"
-			],
-			defaultEffort: "high",
-			canDisableThinking: true
-		},
-		billing: {
-			credits: "x0.06",
-			free: false
-		}
-	}
-];
-/** Mutable catalog shared by the shim's `/v1/models` and the adapter. */
-var WorkBuddyCatalog = class {
-	models = FALLBACK_WORKBUDDY_MODELS;
-	/** Current entries; the fallback list until the upstream answer lands. */
-	current() {
-		return this.models;
-	}
-	/** Replace the list; callers invalidate their adapter snapshot after this. */
-	set(models) {
-		this.models = [...models];
-	}
-};
-//#endregion
-//#region src/upstream.ts
-const CN_CHAT_BASE = "https://copilot.tencent.com";
-const CN_BILLING_BASE = "https://www.codebuddy.cn";
-const GLOBAL_BASE = "https://www.workbuddy.ai";
-const CLIENT_UA = "CLI/2.63.2 CodeBuddy/2.63.2";
-const JSON_TIMEOUT_MS = 3e4;
-const ERROR_BODY_LIMIT = 4096;
-/** Insufficient-credit markers, ASCII lowercase plus the original Chinese. */
-const HARD_CREDIT_MARKERS = [
-	"insufficient credit",
-	"no credit",
-	"credit exhausted",
-	"out of credit",
-	"quota exceeded",
-	"quota exhaust",
-	"payment required",
-	"credit not enough",
-	"not enough credit",
-	"积分不足",
-	"额度不足",
-	"余额不足",
-	"积分用完",
-	"额度用尽",
-	"没有积分"
-];
-/** The concrete effort spellings WorkBuddy exposes on the wire. */
-const EFFORT_VALUES = [
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max"
-];
-/** Promotional badge keys the upstream tags carry, minus their color suffix. */
-const BADGE_PREFIX = "badge:";
-/** Parse the upstream `reasoning` object into {@link WorkBuddyModelReasoning}. */
-function resolveUpstreamReasoning(wrapped) {
-	const supports = wrapped["supportsReasoning"] === true;
-	const onlyReasoning = wrapped["onlyReasoning"] === true;
-	const rawReasoning = wrapped["reasoning"];
-	let supportedEfforts;
-	let defaultEffort;
-	let canDisableThinking = true;
-	if (typeof rawReasoning === "object" && rawReasoning !== null && !Array.isArray(rawReasoning)) {
-		const reasoning = rawReasoning;
-		const rawEfforts = reasoning["supportedEfforts"];
-		if (Array.isArray(rawEfforts)) {
-			const efforts = rawEfforts.filter((value) => typeof value === "string" && EFFORT_VALUES.includes(value));
-			if (efforts.length > 0) supportedEfforts = efforts;
-		}
-		if (typeof reasoning["defaultEffort"] === "string" && EFFORT_VALUES.includes(reasoning["defaultEffort"])) defaultEffort = reasoning["defaultEffort"];
-		else if (typeof reasoning["effort"] === "string" && EFFORT_VALUES.includes(reasoning["effort"])) defaultEffort = reasoning["effort"];
-		canDisableThinking = reasoning["canDisableThinking"] === true;
-	}
-	return { reasoning: {
-		supports,
-		onlyReasoning,
-		...supportedEfforts === void 0 ? {} : { supportedEfforts },
-		...defaultEffort === void 0 ? {} : { defaultEffort },
-		canDisableThinking
-	} };
-}
-/**
-* Reduce an upstream credits string to its language-neutral display form.
-*
-* The host LLM seam carries this text to the browser, and the host has no
-* locale service — whatever string is produced here is shown verbatim in every
-* UI language. The upstream is inconsistent in a way that matters: some catalog
-* rows report a bare multiplier (`x0.79`) and others append a unit word
-* (`x0.79 credits`), and the unit word would pin the display to English.
-* Dropping a trailing `credits` (case-insensitive, singular or plural) yields
-* the one spelling that reads identically in every language.
-*
-* @param credits - raw upstream credits string, e.g. `"x0.79 credits"`.
-* @returns the bare multiplier, or undefined when nothing displayable remains.
-*/
-function normalizeCredits(credits) {
-	if (credits === void 0) return void 0;
-	const trimmed = credits.trim();
-	if (trimmed === "") return void 0;
-	if (/^credits?$/iu.test(trimmed)) return void 0;
-	const bare = trimmed.replace(/\s+credits?$/iu, "").trim();
-	return bare === "" ? void 0 : bare;
-}
-/** Parse the upstream `tags` / `credits` fields into billing metadata. */
-function resolveUpstreamBilling(wrapped) {
-	const rawCredits = wrapped["credits"];
-	const credits = typeof rawCredits === "string" && rawCredits.trim() !== "" ? rawCredits.trim() : void 0;
-	const badges = [];
-	const rawTags = wrapped["tags"];
-	if (Array.isArray(rawTags)) for (const tag of rawTags) {
-		if (typeof tag !== "string") continue;
-		if (!tag.toLowerCase().startsWith(BADGE_PREFIX)) continue;
-		const label = tag.slice(6).split(":")[0] ?? tag.slice(6);
-		if (label !== "") badges.push(label);
-	}
-	const free = credits !== void 0 && /^x?0\.0+$/u.test(credits);
-	return { billing: {
-		...credits === void 0 ? {} : { credits },
-		...badges.length === 0 ? {} : { badges },
-		free
-	} };
-}
-/** Session-invalidation markers that mean "sign in again in the WorkBuddy app". */
-const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
-/** Classify an upstream failure from its HTTP status and body excerpt. */
-function classifyUpstreamError(status, body) {
-	if (status === 402) return "hard_credit";
-	const lower = body.toLowerCase();
-	for (const marker of HARD_CREDIT_MARKERS) if (lower.includes(marker.toLowerCase()) || body.includes(marker)) return "hard_credit";
-	for (const marker of SESSION_DEAD_MARKERS) if (body.includes(marker)) return "session_dead";
-	if (status === 429) return "soft_rate";
-	if (status === 404) return "not_found";
-	if (status >= 500) return "server";
-	if (status >= 400) return "client";
-	return "client";
-}
-/** Region for a login domain; an empty domain means CN (matching upstream tooling). */
-function regionOf(domain) {
-	const lowered = domain.trim().toLowerCase();
-	if (lowered === "workbuddy.ai" || lowered.endsWith(".workbuddy.ai")) return "global";
-	return "cn";
-}
-function chatBase(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_CHAT_BASE;
-}
-function billingBase(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_BILLING_BASE;
-}
-function originReferer(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_BILLING_BASE;
-}
-/** Headers every upstream request shares. */
-function commonHeaders(credential) {
-	return {
-		"Accept": "application/json, text/plain, */*",
-		"X-Requested-With": "XMLHttpRequest",
-		"Origin": originReferer(credential),
-		"Referer": `${originReferer(credential)}/`,
-		"User-Agent": CLIENT_UA
-	};
-}
-/** Chat request headers, including the X-No-* conventions the official CLI uses. */
-function chatHeaders(credential) {
-	return {
-		...commonHeaders(credential),
-		"Content-Type": "application/json",
-		...credential.uid === "" ? { "X-No-User-Id": "1" } : { "X-User-Id": credential.uid },
-		...credential.enterpriseId === void 0 || credential.enterpriseId === "" ? { "X-No-Enterprise-Id": "1" } : { "X-Enterprise-Id": credential.enterpriseId },
-		...credential.domain === "" ? { "X-No-Department-Info": "1" } : { "X-Domain": credential.domain },
-		"X-Product": "SaaS"
-	};
-}
-/** Refresh-endpoint headers; X-Refresh-Token appears here and nowhere else. */
-function refreshHeaders(credential) {
-	const headers = {
-		...commonHeaders(credential),
-		"X-Refresh-Token": credential.refreshToken,
-		"X-Auth-Refresh-Source": "workbuddy"
-	};
-	if (credential.enterpriseId !== void 0 && credential.enterpriseId !== "") headers["X-Enterprise-Id"] = credential.enterpriseId;
-	return headers;
-}
-/** Billing request headers. */
-function billingHeaders(credential) {
-	const headers = {
-		"Authorization": `Bearer ${credential.accessToken}`,
-		"Accept": "application/json",
-		"Content-Type": "application/json"
-	};
-	if (credential.uid !== "") headers["X-User-Id"] = credential.uid;
-	if (credential.enterpriseId !== void 0 && credential.enterpriseId !== "") {
-		headers["X-Enterprise-Id"] = credential.enterpriseId;
-		headers["X-Tenant-Id"] = credential.enterpriseId;
-	}
-	if (credential.domain !== "") headers["X-Domain"] = credential.domain;
-	return headers;
-}
-/**
-* Normalize an OpenAI chat-completions body for the WorkBuddy upstream:
-* force `stream: true` (the upstream rejects non-streaming), flatten
-* `tool_choice` (the upstream's field is a string; object forms return 400),
-* and rewrite `developer` messages as `system`.
-*
-* The `developer` rewrite is load-bearing: pi-ai emits the system prompt as
-* `role: "developer"` (the OpenAI convention it adopted), but the WorkBuddy
-* upstream rejects that role with HTTP 400 code 11128 ("Illegal API
-* invocation from an unapproved channel"). Rewriting to `system` is the
-* compatible spelling the upstream accepts.
-*/
-function prepareChatBody(source) {
-	let body;
-	try {
-		body = JSON.parse(source);
-	} catch {
-		return source;
-	}
-	if (typeof body !== "object" || body === null || Array.isArray(body)) return source;
-	const obj = body;
-	obj["stream"] = true;
-	normalizeDeveloperRole(obj);
-	normalizeToolChoice(obj);
-	return JSON.stringify(obj);
-}
-/** Rewrite `role: "developer"` messages to `role: "system"` (upstream rejects developer). */
-function normalizeDeveloperRole(obj) {
-	const messages = obj["messages"];
-	if (!Array.isArray(messages)) return;
-	for (const message of messages) {
-		if (typeof message !== "object" || message === null || Array.isArray(message)) continue;
-		const wrapped = message;
-		if (wrapped["role"] === "developer") wrapped["role"] = "system";
-	}
-}
-/** Rewrite OpenAI `tool_choice` spellings into the upstream's string form. */
-function normalizeToolChoice(obj) {
-	const suppress = () => {
-		delete obj["tools"];
-		delete obj["functions"];
-	};
-	if (!("tool_choice" in obj)) return;
-	const choice = obj["tool_choice"];
-	if (typeof choice === "string") {
-		if (choice.trim().toLowerCase() === "none") {
-			delete obj["tool_choice"];
-			suppress();
-		}
-		return;
-	}
-	if (typeof choice === "object" && choice !== null && !Array.isArray(choice)) {
-		const wrapped = choice;
-		const type = typeof wrapped["type"] === "string" ? wrapped["type"].trim().toLowerCase() : "";
-		if (type === "none") {
-			delete obj["tool_choice"];
-			suppress();
-		} else if (type === "auto" || type === "required") obj["tool_choice"] = type;
-		else if (type === "function") {
-			const fn = typeof wrapped["function"] === "object" && wrapped["function"] !== null ? wrapped["function"] : void 0;
-			let name = typeof fn?.["name"] === "string" ? fn["name"] : "";
-			if (name === "" && typeof wrapped["name"] === "string") name = wrapped["name"];
-			name = name.trim();
-			obj["tool_choice"] = name !== "" ? name : "auto";
-		} else delete obj["tool_choice"];
-		return;
-	}
-	delete obj["tool_choice"];
-}
-async function readEnvelope(response) {
-	const text = await response.text();
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch {
-		throw new Error(`workbuddy upstream returned non-JSON (http ${response.status}): ${text.slice(0, 160)}`);
-	}
-	if (typeof parsed !== "object" || parsed === null) throw new Error(`workbuddy upstream returned an unexpected document (http ${response.status})`);
-	const document = parsed;
-	return {
-		code: typeof document["code"] === "number" ? document["code"] : 0,
-		msg: typeof document["msg"] === "string" ? document["msg"] : "",
-		data: "data" in document ? document["data"] : void 0
-	};
-}
-/** Fail an envelope whose business code is non-zero, classified like HTTP errors. */
-function envelopeError(status, envelope) {
-	const kind = classifyUpstreamError(status, envelope.msg);
-	return /* @__PURE__ */ new Error(`workbuddy upstream ${kind} (http ${status}): ${envelope.msg.slice(0, 160)}`);
-}
-/**
-* Upstream HTTP client. One instance serves the whole plugin; requests take
-* the credential explicitly so token refreshes apply on the next call.
-*/
-var WorkBuddyUpstreamClient = class {
-	/** POST the chat endpoint; a successful answer is the raw SSE response. */
-	async chatStream(credential, bodyJson, signal) {
-		let response;
-		try {
-			response = await fetch(`${chatBase(credential)}/v2/chat/completions`, {
-				method: "POST",
-				headers: {
-					...chatHeaders(credential),
-					"Authorization": `Bearer ${credential.accessToken}`
-				},
-				body: bodyJson,
-				...signal === void 0 ? {} : { signal }
-			});
-		} catch (error) {
-			return {
-				ok: false,
-				status: 0,
-				kind: "server",
-				message: `transport error: ${String(error)}`
-			};
-		}
-		if (response.ok) return {
-			ok: true,
-			response
-		};
-		const text = (await response.text()).slice(0, ERROR_BODY_LIMIT);
-		return {
-			ok: false,
-			status: response.status,
-			kind: classifyUpstreamError(response.status, text),
-			message: text
-		};
-	}
-	/** POST the token-refresh endpoint; the caller merges the outcome. */
-	async refreshToken(credential) {
-		const response = await fetch(`${chatBase(credential)}/v2/plugin/auth/token/refresh`, {
-			method: "POST",
-			headers: refreshHeaders(credential),
-			signal: AbortSignal.timeout(JSON_TIMEOUT_MS)
-		});
-		const envelope = await readEnvelope(response);
-		if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
-		const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
-		const accessToken = typeof data["accessToken"] === "string" ? data["accessToken"] : "";
-		if (accessToken === "") throw new Error("workbuddy token refresh returned no accessToken; sign in again in the WorkBuddy app");
-		const outcome = { accessToken };
-		if (typeof data["refreshToken"] === "string" && data["refreshToken"] !== "") outcome.refreshToken = data["refreshToken"];
-		if (typeof data["expiresIn"] === "number" && data["expiresIn"] > 0) outcome.expiresInSec = data["expiresIn"];
-		if (typeof data["domain"] === "string" && data["domain"] !== "") outcome.domain = data["domain"];
-		return outcome;
-	}
-	/** GET the personal model catalog and keep the `cli` agent's models only. */
-	async fetchModels(credential) {
-		const response = await fetch(`${chatBase(credential)}/console/enterprises/personal/models`, {
-			headers: {
-				"Authorization": `Bearer ${credential.accessToken}`,
-				"Accept": "application/json",
-				"Origin": originReferer(credential),
-				"Referer": `${originReferer(credential)}/`,
-				"User-Agent": CLIENT_UA
-			},
-			signal: AbortSignal.timeout(JSON_TIMEOUT_MS)
-		});
-		const envelope = await readEnvelope(response);
-		if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
-		const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
-		const rawModels = Array.isArray(data["models"]) ? data["models"] : [];
-		const agents = Array.isArray(data["agents"]) ? data["agents"] : [];
-		let cliIds;
-		for (const agent of agents) if (typeof agent === "object" && agent !== null) {
-			const wrapped = agent;
-			if (wrapped["name"] === "cli" && Array.isArray(wrapped["models"])) {
-				cliIds = wrapped["models"].filter((id) => typeof id === "string");
-				break;
-			}
-		}
-		if (cliIds === void 0 || cliIds.length === 0) throw new Error("workbuddy model catalog lists no cli agent models");
-		const byId = /* @__PURE__ */ new Map();
-		for (const model of rawModels) {
-			if (typeof model !== "object" || model === null) continue;
-			const wrapped = model;
-			const id = typeof wrapped["id"] === "string" ? wrapped["id"] : "";
-			if (id === "" || wrapped["disabled"] === true) continue;
-			const input = typeof wrapped["maxInputTokens"] === "number" ? wrapped["maxInputTokens"] : 0;
-			const output = typeof wrapped["maxOutputTokens"] === "number" ? wrapped["maxOutputTokens"] : 0;
-			if (input <= 0 || output <= 0) continue;
-			byId.set(id, {
-				id,
-				name: typeof wrapped["name"] === "string" && wrapped["name"] !== "" ? wrapped["name"] : id,
-				contextWindow: input,
-				maxTokens: output,
-				supportsImages: wrapped["supportsImages"] === true && wrapped["disabledMultimodal"] !== true,
-				...resolveUpstreamReasoning(wrapped),
-				...resolveUpstreamBilling(wrapped)
-			});
-		}
-		const models = cliIds.map((id) => byId.get(id)).filter((model) => model !== void 0);
-		if (models.length === 0) throw new Error("workbuddy model catalog resolved to an empty list");
-		return models;
-	}
-	/** POST the billing endpoint for the aggregated remaining credit. */
-	async fetchCredits(credential) {
-		const now = /* @__PURE__ */ new Date();
-		const format = (date) => [
-			date.getFullYear().toString().padStart(4, "0"),
-			(date.getMonth() + 1).toString().padStart(2, "0"),
-			date.getDate().toString().padStart(2, "0")
-		].join("-") + " " + [
-			date.getHours().toString().padStart(2, "0"),
-			date.getMinutes().toString().padStart(2, "0"),
-			date.getSeconds().toString().padStart(2, "0")
-		].join(":");
-		const response = await fetch(`${billingBase(credential)}/v2/billing/meter/get-user-resource`, {
-			method: "POST",
-			headers: billingHeaders(credential),
-			body: JSON.stringify({
-				PageNumber: 1,
-				PageSize: 100,
-				ProductCode: "p_tcaca",
-				Status: [0, 3],
-				PackageEndTimeRangeBegin: format(now),
-				PackageEndTimeRangeEnd: format(new Date(now.getTime() + 3185136e6))
-			}),
-			signal: AbortSignal.timeout(JSON_TIMEOUT_MS)
-		});
-		const envelope = await readEnvelope(response);
-		if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
-		const responseWrapper = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
-		const data = typeof responseWrapper["Response"] === "object" && responseWrapper["Response"] !== null ? responseWrapper["Response"] : {};
-		const inner = typeof data["Data"] === "object" && data["Data"] !== null ? data["Data"] : {};
-		const rawAccounts = Array.isArray(inner["Accounts"]) ? inner["Accounts"] : [];
-		const accounts = [];
-		let total = 0;
-		for (const raw of rawAccounts) {
-			if (typeof raw !== "object" || raw === null) continue;
-			const account = raw;
-			const numberField = (key) => typeof account[key] === "number" ? account[key] : 0;
-			const size = numberField("CycleCapacitySize");
-			const cycleRemain = numberField("CycleCapacityRemain");
-			const cycleUsed = numberField("CycleCapacityUsed");
-			const capacityRemain = numberField("CapacityRemain");
-			let remain;
-			if (size > 0) remain = cycleRemain;
-			else if (cycleRemain > 0 || cycleUsed > 0) remain = cycleRemain;
-			else remain = capacityRemain;
-			if (remain < 0) remain = 0;
-			total += remain;
-			accounts.push({
-				packageName: typeof account["PackageName"] === "string" ? account["PackageName"] : "(unnamed)",
-				remain,
-				size: size > 0 ? size : numberField("CapacitySize")
-			});
-		}
-		return {
-			total,
-			accounts
-		};
-	}
-};
-//#endregion
-//#region src/version.ts
-const WORKBUDDY_CONNECT_VERSION = "0.3.2";
-//#endregion
-//#region src/host-heartbeat.ts
-/**
-* Host-side heartbeat: a small JSON file written under `$DSH_HOME` once the
-* `workbuddy` provider is registered. The status CLI reads it to report
-* whether the host bundle is alive, independent of the browser card.
-*
-* The browser (client) bundle cannot write files; its health is reported
-* only through `console.error` on failure (see `src/client/index.tsx`).
-* This asymmetry is intentional: the host is the load-bearing half, and
-* a missing heartbeat unambiguously means the host never started.
-*
-* @module dsh-workbuddy-connect/host-heartbeat
-*/
-/** Basename of the host heartbeat file inside the Harness home. */
-const WORKBUDDY_HOST_HEARTBEAT_FILENAME = ".workbuddy-host-heartbeat.json";
-/** Current on-disk heartbeat format; readers reject others. */
-const HEARTBEAT_FORMAT_VERSION = 1;
-/** Absolute path of the host heartbeat file. */
-function workbuddyHostHeartbeatPath() {
-	return join(resolveDshHome(), WORKBUDDY_HOST_HEARTBEAT_FILENAME);
-}
-/**
-* Write (or overwrite) the heartbeat after the host bundle registered the
-* provider. A failed write is non-fatal: the host is already running, and
-* the status CLI will simply report "heartbeat missing" rather than failing.
-*/
-async function writeHostHeartbeat() {
-	const document = {
-		version: HEARTBEAT_FORMAT_VERSION,
-		package: "dsh-workbuddy-connect",
-		pluginVersion: WORKBUDDY_CONNECT_VERSION,
-		registeredAt: Date.now(),
-		pid: process.pid
-	};
-	try {
-		await writeFile(workbuddyHostHeartbeatPath(), JSON.stringify(document), "utf8");
-	} catch {}
-}
-/** Remove the heartbeat on plugin disposal so a stale file does not linger. */
-async function clearHostHeartbeat() {
-	try {
-		await rm(workbuddyHostHeartbeatPath(), { force: true });
-	} catch {}
-}
-/** Read and validate the heartbeat; returns `undefined` when absent or malformed. */
-async function readHostHeartbeat() {
-	let raw;
-	try {
-		raw = await readFile(workbuddyHostHeartbeatPath(), "utf8");
-	} catch {
-		return;
-	}
-	try {
-		const parsed = JSON.parse(raw);
-		if (parsed.version === HEARTBEAT_FORMAT_VERSION && parsed.package === "dsh-workbuddy-connect" && typeof parsed.registeredAt === "number" && typeof parsed.pid === "number") return {
-			version: HEARTBEAT_FORMAT_VERSION,
-			package: "dsh-workbuddy-connect",
-			pluginVersion: typeof parsed.pluginVersion === "string" ? parsed.pluginVersion : "unknown",
-			registeredAt: parsed.registeredAt,
-			pid: parsed.pid
-		};
-	} catch {}
-}
-/**
-* Absolute start time (epoch ms) of the process holding `pid`, or `undefined`
-* when it cannot be determined (no such PID, platform lacks a readable source).
-*
-* - macOS / Linux: `ps -o lstart=` prints a local-time "EEE MMM DD HH:MM:SS YYYY";
-*   `Date.parse` resolves it against the local clock, which matches how
-*   `registeredAt` (a `Date.now()` absolute value) is expressed.
-* - Windows: WMI `CreationDate` is UTC (`YYYYMMDDHHMMSS.mmm+zzzz`); parsed with
-*   `Date.UTC`, again comparable to `registeredAt`.
-*
-* Failures return `undefined` so callers can fall back to plain PID liveness
-* rather than mis-report a running host as dead.
-*/
-function processStartTimeMs(pid) {
-	try {
-		if (process.platform === "win32") {
-			const m = execFileSync("wmic", [
-				"process",
-				"where",
-				`processid=${pid}`,
-				"get",
-				"CreationDate"
-			], {
-				encoding: "utf8",
-				windowsHide: true
-			}).match(/(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})\.\d+([+-]\d{4})/);
-			if (m === null) return void 0;
-			const [, y, mo, d, h, mi, s] = m;
-			const ms = Date.UTC(Number(y), Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s));
-			return Number.isFinite(ms) ? ms : void 0;
-		}
-		const out = execFileSync("ps", [
-			"-o",
-			"lstart=",
-			"-p",
-			String(pid)
-		], {
-			encoding: "utf8",
-			env: {
-				...process.env,
-				LC_ALL: "C",
-				LANG: "C"
-			}
-		}).trim();
-		if (out === "") return void 0;
-		const ms = Date.parse(out);
-		return Number.isFinite(ms) ? ms : void 0;
-	} catch {
-		return;
-	}
-}
-/**
-* Whether the heartbeat's PID is still alive *and* still the same process that
-* registered it. A stale heartbeat (host crashed without clearing the file)
-* is distinguished from a live host by two checks:
-*
-* 1. `process.kill(pid, 0)` — the PID exists (signal 0 tests existence).
-* 2. The process holding that PID started at or before `registeredAt`. A host
-*    that registered the heartbeat must have been started before writing it,
-*    so `start <= registeredAt`; a recycled PID belongs to an unrelated process
-*    started after the host died, so `start > registeredAt` correctly reads dead.
-*
-* PID-only detection is not enough: after a crash the OS may hand the same PID
-* to an unrelated process, and the un-cleared stale heartbeat would otherwise
-* produce a false "Host running". When the process start time cannot be read
-* (e.g. unsupported platform) the check degrades to plain PID liveness.
-*/
-function isHeartbeatProcessAlive(heartbeat) {
-	try {
-		process.kill(heartbeat.pid, 0);
-	} catch {
-		return false;
-	}
-	const startAtMs = processStartTimeMs(heartbeat.pid);
-	if (startAtMs === void 0) return true;
-	return startAtMs <= heartbeat.registeredAt;
-}
-//#endregion
-export { workbuddyOwnAuthPath as S, WORKBUDDY_AUTH_FILE_ENV as _, readHostHeartbeat as a, defaultDesktopAuthPath as b, WORKBUDDY_CONNECT_VERSION as c, normalizeCredits as d, prepareChatBody as f, WORKBUDDY_AUTH_FILENAME as g, WorkBuddyCatalog as h, processStartTimeMs as i, WorkBuddyUpstreamClient as l, FALLBACK_WORKBUDDY_MODELS as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, regionOf as p, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, classifyUpstreamError as u, WorkBuddyCredentialStore as v, parseWorkBuddyAuth as x, defaultDesktopAuthCandidates as y };