dsh-workbuddy-connect 0.6.2 → 0.6.4

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as normalizeCredits, B as chatUserAgent, C as desktopAuthCandidatesFor, D as WorkBuddyUpstreamClient, E as WorkBuddyAtRestKeyProvider, F as PROBE_EFFORT_CANDIDATES, G as WORKBUDDY_APP_VERSION_FILENAME, H as readCliVersion, I as probeModel, J as readBundleVersion, K as appUserAgent, L as randomSentinel, M as prepareChatBody, N as prepareInternationalChatBody, O as classifyUpstreamError, P as regionOf, R as CN_APP_VERSION_FILENAME, S as defaultDesktopAuthPath, T as workbuddyOwnAuthPath, U as resolveChatIdentity, V as fallbackChatIdentity, W as validCliVersion, X as validAppVersion, Y as resolveAppVersion, _ as WorkBuddyCatalog, a as WORKBUDDY_HOST_HEARTBEAT_FILENAME, b as WorkBuddyCredentialStore, c as processStartTimeMs, d as writeHostHeartbeat, f as WORKBUDDY_CONNECT_VERSION, g as FALLBACK_WORKBUDDY_MODELS, h as FALLBACK_WORKBUDDY_AI_MODELS, i as variantFor, j as parseModelCatalog, k as modelWithCurrentPromotion, l as readHostHeartbeat, n as CN_VARIANT, o as clearHostHeartbeat, q as installedAppVersion, r as WORKBUDDY_VARIANTS, s as isHeartbeatProcessAlive, t as AI_VARIANT, u as workbuddyHostHeartbeatPath, v as WORKBUDDY_AUTH_FILENAME, w as parseWorkBuddyAuth, x as defaultDesktopAuthCandidates, y as WORKBUDDY_AUTH_FILE_ENV, z as FALLBACK_CN_APP_VERSION } from "./variants-B3Pa4EBr.js";
+import { A as extractDisplayErrorMessage, B as CN_APP_VERSION_FILENAME, C as WORKBUDDY_VARIANTS, D as WORKBUDDY_UPDATE_PATH, F as prepareInternationalChatBody, G as resolveChatIdentity, H as chatUserAgent, I as regionOf, J as appUserAgent, K as validCliVersion, L as PROBE_EFFORT_CANDIDATES, M as normalizeCredits, N as parseModelCatalog, O as WorkBuddyUpstreamClient, P as prepareChatBody, Q as validAppVersion, R as probeModel, S as CN_VARIANT, U as fallbackChatIdentity, V as FALLBACK_CN_APP_VERSION, W as readCliVersion, X as readBundleVersion, Y as installedAppVersion, Z as resolveAppVersion, _ as desktopAuthCandidatesFor, a as readHostHeartbeat, b as atRestKeyProviderFor, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as WORKBUDDY_AUTH_FILENAME, g as defaultDesktopAuthPath, h as defaultDesktopAuthCandidates, i as processStartTimeMs, j as modelWithCurrentPromotion, k as classifyUpstreamError, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as WORKBUDDY_AUTH_FILE_ENV, q as WORKBUDDY_APP_VERSION_FILENAME, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as parseWorkBuddyAuth, w as variantFor, x as AI_VARIANT, y as workbuddyOwnAuthPath, z as randomSentinel } from "./host-heartbeat-D9DvyLWz.js";
 import z from "@deepseek-ai/schemastery";
 import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { dirname, join, resolve } from "node:path";
@@ -770,7 +770,9 @@ function createWorkBuddyShim(options) {
 		req.on("close", () => controller.abort());
 		const result = await client.chatStream(credential, prepared, controller.signal);
 		if (!result.ok) {
-			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status}): ${result.message.slice(0, 400)}`);
+			const detail = extractDisplayErrorMessage(result.message) ?? result.message.slice(0, 400);
+			const statusNote = (result.status === 401 || result.status === 403) && result.kind !== "session_dead" ? "" : ` (http ${result.status})`;
+			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind}${statusNote}: ${detail}`);
 			return;
 		}
 		res.writeHead(200, {
@@ -1146,7 +1148,7 @@ var WorkBuddyProbeService = class {
 function safeMessage(error) {
 	return (error instanceof Error ? error.message : String(error)).replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]").slice(0, 500);
 }
-function json$1(res, status, body) {
+function json$2(res, status, body) {
 	const payload = JSON.stringify(body);
 	res.writeHead(status, {
 		"Content-Type": "application/json",
@@ -1245,17 +1247,17 @@ async function workBuddyWebStatus(deps) {
 function workBuddyStatusHandler(deps) {
 	return async (req, res) => {
 		if (req.method !== "GET") {
-			json$1(res, 405, { error: "method not allowed" });
+			json$2(res, 405, { error: "method not allowed" });
 			return;
 		}
 		if (!loopbackRequest(req)) {
-			json$1(res, 403, { error: "request-not-trusted" });
+			json$2(res, 403, { error: "request-not-trusted" });
 			return;
 		}
 		try {
-			json$1(res, 200, await workBuddyWebStatus(deps));
+			json$2(res, 200, await workBuddyWebStatus(deps));
 		} catch (error) {
-			json$1(res, 500, { error: safeMessage(error) });
+			json$2(res, 500, { error: safeMessage(error) });
 		}
 	};
 }
@@ -1274,6 +1276,308 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 	}, "dsh-workbuddy-connect: Web status route");
 }
 //#endregion
+//#region src/update.ts
+/**
+* Public update metadata and bounded version checking for WorkBuddy Connect.
+*
+* Two upstreams, strictly layered so the judgement never depends on the
+* enrichment: npm's dist-tags decide whether a newer release exists, and only
+* then is GitHub's release list consulted — one request that feeds both the
+* "versions behind" count and the per-release notes. Every upstream answer is
+* treated as untrusted input: bodies are size-capped while streaming, releases
+* are re-validated on the browser side by {@link parseWorkBuddyUpdateResult}
+* before anything renders.
+*
+* This module is host/browser shared and dependency-free by design (the client
+* bundle's runtime imports stay React + local modules only).
+*
+* @module dsh-workbuddy-connect/update
+*/
+const WORKBUDDY_REPOSITORY_URL = "https://github.com/corrinehu/dsh-workbuddy-connect";
+const WORKBUDDY_UPDATE_NPM_METADATA_URL = `https://registry.npmjs.org/-/package/dsh-workbuddy-connect/dist-tags`;
+const WORKBUDDY_UPDATE_RELEASES_API_URL = `${WORKBUDDY_REPOSITORY_URL.replace("https://github.com", "https://api.github.com/repos")}/releases?per_page=100`;
+const WORKBUDDY_RELEASE_PAGE_BASE = `${WORKBUDDY_REPOSITORY_URL}/releases/tag/`;
+const WORKBUDDY_UPDATE_MAX_METADATA_BYTES = 65536;
+const WORKBUDDY_UPDATE_MAX_RELEASES_BYTES = 1048576;
+/** GitHub caps one page at 100 releases; ours is far below that today. */
+const RELEASES_LIST_MAX = 100;
+const RELEASE_NAME_MAX_CHARS = 200;
+const RELEASE_NOTES_MAX_CHARS = 16e3;
+/** Parse one exact SemVer version, accepting the conventional leading `v`. */
+function parseWorkBuddyVersion(raw) {
+	if (typeof raw !== "string") return void 0;
+	const normalized = raw.startsWith("v") ? raw.slice(1) : raw;
+	const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u.exec(normalized);
+	if (match === null) return void 0;
+	const rawPrerelease = match[4] === void 0 ? [] : match[4].split(".");
+	if (rawPrerelease.some((identifier) => /^\d+$/u.test(identifier) && !/^(0|[1-9]\d*)$/u.test(identifier))) return void 0;
+	const prerelease = rawPrerelease.map((identifier) => /^(0|[1-9]\d*)$/u.test(identifier) ? Number(identifier) : identifier);
+	if (prerelease.some((identifier) => typeof identifier === "number" && !Number.isSafeInteger(identifier))) return void 0;
+	const parsed = {
+		major: Number(match[1]),
+		minor: Number(match[2]),
+		patch: Number(match[3]),
+		prerelease
+	};
+	return [
+		parsed.major,
+		parsed.minor,
+		parsed.patch
+	].every(Number.isSafeInteger) ? parsed : void 0;
+}
+/**
+* One canonical spelling per SemVer value: leading `v` and build metadata
+* fold away, so `v0.6.4`, `0.6.4`, and `0.6.4+build` dedupe as one release.
+* Returns `undefined` for unparseable input; callers drop those first.
+*/
+function canonicalWorkBuddyVersion(version) {
+	const parsed = parseWorkBuddyVersion(version);
+	if (parsed === void 0) return void 0;
+	return `${String(parsed.major)}.${String(parsed.minor)}.${String(parsed.patch)}` + (parsed.prerelease.length === 0 ? "" : `-${parsed.prerelease.join(".")}`);
+}
+function compareIdentifiers(left, right) {
+	if (typeof left === "number" && typeof right === "number") return left < right ? -1 : left > right ? 1 : 0;
+	if (typeof left === "number") return -1;
+	if (typeof right === "number") return 1;
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+/** Compare two versions using SemVer precedence (build metadata ignored). */
+function compareWorkBuddyVersions(left, right) {
+	const a = parseWorkBuddyVersion(left);
+	const b = parseWorkBuddyVersion(right);
+	if (a === void 0 || b === void 0) throw new TypeError("invalid WorkBuddy Connect version");
+	for (const [aPart, bPart] of [
+		[a.major, b.major],
+		[a.minor, b.minor],
+		[a.patch, b.patch]
+	]) if (aPart !== bPart) return aPart < bPart ? -1 : 1;
+	if (a.prerelease.length === 0 && b.prerelease.length !== 0) return 1;
+	if (a.prerelease.length !== 0 && b.prerelease.length === 0) return -1;
+	for (let index = 0; index < Math.max(a.prerelease.length, b.prerelease.length); index += 1) {
+		const aPart = a.prerelease[index];
+		const bPart = b.prerelease[index];
+		if (aPart === void 0) return -1;
+		if (bPart === void 0) return 1;
+		const comparison = compareIdentifiers(aPart, bPart);
+		if (comparison !== 0) return comparison;
+	}
+	return 0;
+}
+function boundedText(value, maxBytes) {
+	if (new TextEncoder().encode(value).byteLength > maxBytes) throw new RangeError("update response is too large");
+	return value;
+}
+async function readBoundedText(response, maxBytes) {
+	if (response.body === null) return boundedText(await response.text(), maxBytes);
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const next = await reader.read();
+			if (next.done) break;
+			total += next.value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel();
+				throw new RangeError("update response is too large");
+			}
+			chunks.push(decoder.decode(next.value, { stream: true }));
+		}
+		chunks.push(decoder.decode());
+		return chunks.join("");
+	} finally {
+		reader.releaseLock();
+	}
+}
+async function fetchBounded(fetchImpl, url, maxBytes, timeoutMs, headers) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => {
+		controller.abort(/* @__PURE__ */ new Error("update request timed out"));
+	}, timeoutMs);
+	try {
+		const response = await fetchImpl(url, {
+			headers,
+			signal: controller.signal
+		});
+		return {
+			response,
+			text: await readBoundedText(response, maxBytes)
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** Strip control characters, normalize newlines, and cap the length. */
+function cleanReleaseText(value, maxLength) {
+	if (typeof value !== "string" || value.length === 0) return void 0;
+	const clean = value.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/gu, "").replace(/\r\n?/gu, "\n").trim().slice(0, maxLength);
+	return clean.length === 0 ? void 0 : clean;
+}
+function cleanPublishedAt(value) {
+	return typeof value === "string" && /^\d{4}-\d{2}-\d{2}T/iu.test(value) ? value.slice(0, 64) : void 0;
+}
+/**
+* The `latest` dist-tag only. Pre-release channels are not this plugin's
+* release line, so recommending one would be wrong even when newer.
+*/
+function latestDistTag(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const tags = value["dist-tags"] ?? value;
+	if (typeof tags !== "object" || tags === null || Array.isArray(tags)) return void 0;
+	const candidate = tags["latest"];
+	return typeof candidate === "string" && parseWorkBuddyVersion(candidate) !== void 0 ? candidate : void 0;
+}
+function releasePageUrl(version) {
+	return `${WORKBUDDY_RELEASE_PAGE_BASE}v${version}`;
+}
+/**
+* Parse GitHub's release-list page into the in-range releases, newest first.
+* Unknown entry shapes are skipped, never fatal: the count and the notes both
+* degrade per-entry rather than dropping the whole judgement.
+*/
+function releasesInRange(currentVersion, latestVersion, value) {
+	if (!Array.isArray(value) || value.length > RELEASES_LIST_MAX) return void 0;
+	const releases = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const raw of value) {
+		if (typeof raw !== "object" || raw === null || Array.isArray(raw)) continue;
+		const entry = raw;
+		const tag = entry["tag_name"];
+		if (typeof tag !== "string") continue;
+		if (parseWorkBuddyVersion(tag) === void 0) continue;
+		if (compareWorkBuddyVersions(tag, currentVersion) <= 0 || compareWorkBuddyVersions(tag, latestVersion) > 0) continue;
+		const canonical = canonicalWorkBuddyVersion(tag);
+		if (canonical === void 0 || seen.has(canonical)) continue;
+		seen.add(canonical);
+		const name = cleanReleaseText(entry["name"], RELEASE_NAME_MAX_CHARS);
+		const notes = cleanReleaseText(entry["body"], RELEASE_NOTES_MAX_CHARS);
+		const publishedAt = cleanPublishedAt(entry["published_at"]);
+		releases.push({
+			version: tag,
+			...name === void 0 ? {} : { name },
+			...notes === void 0 ? {} : { notes },
+			...publishedAt === void 0 ? {} : { publishedAt }
+		});
+	}
+	releases.sort((left, right) => compareWorkBuddyVersions(right.version, left.version));
+	return releases;
+}
+/** Enrich an available update from GitHub's release list; degrade on failure. */
+async function releaseList(currentVersion, latestVersion, fetchImpl, timeoutMs) {
+	try {
+		const { response, text } = await fetchBounded(fetchImpl, WORKBUDDY_UPDATE_RELEASES_API_URL, WORKBUDDY_UPDATE_MAX_RELEASES_BYTES, timeoutMs, { accept: "application/vnd.github+json" });
+		if (!response.ok) return void 0;
+		return releasesInRange(currentVersion, latestVersion, JSON.parse(text));
+	} catch {
+		return;
+	}
+}
+/** Check npm's public dist-tags and enrich an available update with release notes. */
+async function checkWorkBuddyUpdate(options) {
+	const { currentVersion } = options;
+	if (parseWorkBuddyVersion(currentVersion) === void 0) return {
+		status: "unavailable",
+		currentVersion,
+		reason: "invalid-current-version"
+	};
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const timeoutMs = options.timeoutMs ?? 8e3;
+	let metadata;
+	try {
+		const { response, text } = await fetchBounded(fetchImpl, WORKBUDDY_UPDATE_NPM_METADATA_URL, WORKBUDDY_UPDATE_MAX_METADATA_BYTES, timeoutMs, { accept: "application/json" });
+		if (!response.ok) return {
+			status: "unavailable",
+			currentVersion,
+			reason: "registry-unavailable"
+		};
+		metadata = JSON.parse(text);
+	} catch (error) {
+		return {
+			status: "unavailable",
+			currentVersion,
+			reason: error instanceof SyntaxError || error instanceof RangeError ? "invalid-registry-response" : "registry-unavailable"
+		};
+	}
+	const latestVersion = latestDistTag(metadata);
+	if (latestVersion === void 0) return {
+		status: "unavailable",
+		currentVersion,
+		reason: "invalid-registry-response"
+	};
+	if (compareWorkBuddyVersions(latestVersion, currentVersion) <= 0) return {
+		status: "up-to-date",
+		currentVersion,
+		latestVersion: currentVersion
+	};
+	const releases = await releaseList(currentVersion, latestVersion, fetchImpl, timeoutMs);
+	return {
+		status: "update-available",
+		currentVersion,
+		latestVersion,
+		releaseUrl: releasePageUrl(latestVersion),
+		releases: releases ?? [],
+		...releases === void 0 ? {} : { versionsBehind: releases.length }
+	};
+}
+//#endregion
+//#region src/update-route.ts
+function json$1(res, status, value) {
+	const payload = JSON.stringify(value);
+	res.writeHead(status, {
+		"Content-Type": "application/json; charset=utf-8",
+		"Content-Length": Buffer.byteLength(payload),
+		"Cache-Control": "no-store",
+		"X-Content-Type-Options": "nosniff"
+	});
+	res.end(payload);
+}
+/** The same browser-origin gate the status route uses: DNS-rebinding pages die here. */
+function browserRequestAllowed(req) {
+	return hostIsLoopback(req.headers.host) && originIsLoopback(req.headers.origin);
+}
+/** Build the route handler; the caller owns registration and disposal. */
+function workBuddyUpdateHandler(options) {
+	return async (req, res) => {
+		if (req.method !== "GET") {
+			json$1(res, 405, { error: "method not allowed" });
+			return;
+		}
+		if (!browserRequestAllowed(req)) {
+			json$1(res, 403, { error: "forbidden" });
+			return;
+		}
+		let result;
+		try {
+			result = await checkWorkBuddyUpdate({
+				currentVersion: options.currentVersion,
+				...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+				timeoutMs: options.timeoutMs ?? 8e3
+			});
+		} catch {
+			result = {
+				status: "unavailable",
+				currentVersion: options.currentVersion,
+				reason: "registry-unavailable"
+			};
+		}
+		json$1(res, 200, result);
+	};
+}
+/** Register the update route on the optional host web server. */
+function registerWorkBuddyUpdateRoute(ctx, options) {
+	ctx.effect(() => {
+		const dispose = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_UPDATE_PATH,
+			handler: workBuddyUpdateHandler(options)
+		});
+		return () => {
+			dispose();
+		};
+	}, "dsh-workbuddy-connect: update route");
+}
+//#endregion
 //#region src/probe-route.ts
 /**
 * Probe control route: the only state-changing endpoint the plugin exposes.
@@ -1766,7 +2070,7 @@ function apply(ctx, config) {
 	* case that must not fall back to a shared preference bucket.
 	*/
 	const lastAccounts = /* @__PURE__ */ new Map();
-	const atRestKeysFor = (variant) => new WorkBuddyAtRestKeyProvider({ discovery: variant.id === CN_VARIANT.id ? "macos-workbuddy" : "none" });
+	const atRestKeysFor = (variant) => atRestKeyProviderFor(variant);
 	const runtimes = WORKBUDDY_VARIANTS.map((variant) => createVariantRuntime(config, variant, () => current(), (id) => lastIdentities.get(id), (id) => lastAccounts.get(id), atRestKeysFor(variant)));
 	const probeKey = createProbeKey();
 	let setMaximumContextWindow;
@@ -1841,6 +2145,7 @@ function apply(ctx, config) {
 		runtime.invalidate();
 	};
 	ctx.inject(["webServer"], (webCtx) => {
+		registerWorkBuddyUpdateRoute(webCtx, { currentVersion: WORKBUDDY_CONNECT_VERSION });
 		for (const runtime of runtimes) {
 			registerWorkBuddyStatusRoute(webCtx, {
 				path: runtime.variant.statusPath,

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-connect",
   "displayName": "DSH WorkBuddy Connect",
   "description": "将 WorkBuddy 桌面 App 包含的模型自动接入 DeepSeek Harness — bring WorkBuddy desktop app models into DeepSeek Harness with zero configuration.",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "author": "corrinehu",
   "keywords": [
     "dsh-plugin",