dsh-workbuddy-connect 0.7.7 → 0.7.9

package/lib/{host-heartbeat-FytEpUGO.js → host-heartbeat-SJaZ33tR.js}

@@ -1,11 +1,226 @@
-import { readFile, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir, release } from "node:os";
 import { basename, dirname, join } from "node:path";
-import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
-import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { execFile, execFileSync } from "node:child_process";
 import { accessSync, constants, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+//#region node_modules/.pnpm/@deepseek-ai+dsh-atomic-write@0.2.1-rc.2_@deepseek-ai+cordis@4.0.5/node_modules/@deepseek-ai/dsh-atomic-write/lib/index.js
+/**
+* Zero-dependency atomic file replacement and writer coordination.
+* `writeFileAtomic` writes a random-suffix sibling with exclusive create and
+* the caller's permission bits, then renames it over the target, so readers
+* observe either the old or the new complete content and a replaced file ends
+* up with exactly the stated mode. `withFileLock` serializes cross-process
+* writers of one file through a `wx`-created `<file>.lock` sibling, so a
+* read-modify-write cycle can never resurrect a state another writer just
+* replaced; readers stay lock-free because the rename commit is atomic. A lock
+* whose recorded holder process no longer exists is taken over.
+* @module @deepseek-ai/dsh-atomic-write
+*/
+const WINDOWS_TRANSIENT_RENAME_ERRORS = /* @__PURE__ */ new Set([
+	"EACCES",
+	"EBUSY",
+	"EPERM"
+]);
+const WINDOWS_RENAME_RETRY_INITIAL_MS = 20;
+const WINDOWS_RENAME_RETRY_MAX_MS = 200;
+const WINDOWS_RENAME_RETRY_LIMIT = 8;
+/** Whether Windows reported temporary interference with an atomic replacement. */
+function isTransientWindowsRenameError(error) {
+	if (process.platform !== "win32") return false;
+	return WINDOWS_TRANSIENT_RENAME_ERRORS.has(error?.code ?? "");
+}
+/** Replace the target after bounded retries for transient Windows interference. */
+async function renameAtomicTemp(temp, filename) {
+	let delay = WINDOWS_RENAME_RETRY_INITIAL_MS;
+	for (let retries = 0;; retries += 1) {
+		try {
+			await rename(temp, filename);
+			return;
+		} catch (error) {
+			if (!isTransientWindowsRenameError(error)) throw error;
+			if (retries >= WINDOWS_RENAME_RETRY_LIMIT) throw error;
+		}
+		await new Promise((resolve) => setTimeout(resolve, delay));
+		delay = Math.min(delay * 2, WINDOWS_RENAME_RETRY_MAX_MS);
+	}
+}
+/**
+* Replace `filename` with `content` in one atomic step, creating parent
+* directories. The content is first written to a random-suffix sibling opened
+* with exclusive create (`wx`): the open refuses to follow a symlink planted
+* at the temp path, and the fresh inode carries `options.mode` through the
+* rename, so replacing a wider-permission file narrows it without a chmod
+* race. The rename also replaces a symlinked target itself instead of writing
+* through to its referent, and the same-directory sibling keeps the rename on
+* one filesystem. Windows replacement retries transient `EACCES`, `EBUSY`,
+* and `EPERM` failures for a bounded interval while the complete temp file
+* remains the rename source. On any remaining failure the temp file is
+* removed and the failure rethrown. Crash durability (fsync) is out of scope.
+* @param filename - final path receiving the content.
+* @param content - complete next file content.
+* @param options - permission bits for the replacement inode.
+*/
+async function writeFileAtomic(filename, content, options) {
+	await mkdir(dirname(filename), {
+		recursive: true,
+		...options.dirMode === void 0 ? {} : { mode: options.dirMode }
+	});
+	const temp = `${filename}.${randomBytes(6).toString("hex")}.tmp`;
+	try {
+		await writeFile(temp, content, {
+			mode: options.mode,
+			flag: "wx"
+		});
+		await renameAtomicTemp(temp, filename);
+	} catch (error) {
+		await rm(temp, { force: true });
+		throw error;
+	}
+}
+/** Whether an exclusive create found an existing lock. */
+async function isLockContention(error, lockPath) {
+	const code = error?.code;
+	if (code === "EEXIST") return true;
+	if (code !== "EPERM") return false;
+	try {
+		await lstat(lockPath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Whether the holder a `<pid>\n` record names is proven gone: a signal probe finds no such process. */
+function holderExited(record) {
+	if (!/^\d+\n$/.test(record)) return false;
+	const pid = Number(record.trim());
+	if (pid === 0 || pid > 2147483647) return false;
+	if (pid === process.pid) return false;
+	try {
+		process.kill(pid, 0);
+		return false;
+	} catch (error) {
+		return error.code === "ESRCH";
+	}
+}
+/** The lock file's content, or undefined when it cannot be read. */
+async function readLockRecord(lockPath) {
+	try {
+		return await readFile(lockPath, "utf8");
+	} catch (error) {
+		return;
+	}
+}
+/**
+* Remove the lock when its recorded holder exited. Contenders that read the
+* same record serialize on a claim file named after it. Under the claim, the
+* claimant re-reads the lock and probes its PID again, and removes it only
+* when it still holds that record and that PID is still gone: the record's
+* holder can no longer release it, and no other contender can remove it
+* without the claim, so a removal never deletes a lock another contender
+* acquired after the dead holder's, including one whose holder reused the PID.
+* @returns Whether this call removed the dead holder's lock.
+*/
+async function takeOverExitedLock(lockPath) {
+	const record = await readLockRecord(lockPath);
+	if (record === void 0 || !holderExited(record)) return false;
+	const claim = `${lockPath}.takeover-${createHash("sha256").update(record).digest("hex").slice(0, 16)}`;
+	try {
+		await writeFile(claim, `${process.pid}\n`, {
+			mode: 384,
+			flag: "wx"
+		});
+	} catch (error) {
+		const code = error.code;
+		if (code === "EEXIST" || code === "EPERM") return false;
+		throw error;
+	}
+	try {
+		if (await readLockRecord(lockPath) !== record || !holderExited(record)) return false;
+		try {
+			await rm(lockPath, { force: true });
+		} catch (error) {
+			return false;
+		}
+		return true;
+	} finally {
+		await rm(claim, { force: true }).catch((error) => {});
+	}
+}
+/**
+* Retry cadence for a contended lock. These stay robustness invariants of the
+* cross-process write protocol rather than deployment tunables: they govern how
+* often a contender asks, which no caller has a reason to vary.
+*/
+const LOCK_RETRY_INITIAL_MS = 20;
+const LOCK_RETRY_MAX_MS = 200;
+/**
+* How long a contender waits when the caller states no limit — sized for the
+* render-and-rename cycle every call site had when this package was written.
+* Expiry fails the contender rather than guessing whether the existing lock
+* still has an owner. How long is *worth* waiting is a property of the
+* operation the lock holder runs, which is why {@link FileLockOptions.waitMs}
+* exists; the value here is the floor for an operation that does file work
+* alone.
+*/
+const DEFAULT_LOCK_WAIT_MS = 2e3;
+/**
+* Hold the cross-process writer lock for `filename` around one operation. The
+* lock is a `wx`-created sibling (`<filename>.lock`); paired with the
+* rename-based commit of {@link writeFileAtomic}, readers stay lock-free and
+* only writers contend. `EEXIST` is contention directly; an `EPERM` is
+* contention only when a fresh `lstat` confirms the lock path exists, covering
+* Windows exclusive-create behavior. Windows retries one unconfirmed EPERM
+* because the holder can release before the probe; a repeated unconfirmed
+* permission error is rethrown. The lock records its holder's PID. A contender
+* removes the lock and retries at once when no process with that PID exists
+* (`ESRCH`); any other lock, including one whose holder exists under another
+* user (`EPERM`) or whose record is incomplete, is waited for. Contention backs
+* off exponentially and times out after the deadline. A holder whose PID a
+* live process reused keeps its lock until an operator removes it. Takeover
+* proves only that the recorded process exited: an operation that starts other
+* writers must stop them with it or leave its successor a way to find them.
+* PIDs are compared on the contender's host, so writers on other hosts or in
+* other PID namespaces sharing the file are unsupported and could both hold
+* the lock. The parent directory must exist.
+* @param filename - the file whose writers this lock serializes.
+* @param operation - the read-render-commit cycle to run while holding the lock.
+* @param options - acquisition options; omitted waits {@link DEFAULT_LOCK_WAIT_MS}.
+* @returns the operation's result; the lock releases on both outcomes.
+*/
+async function withFileLock(filename, operation, options) {
+	const lockPath = `${filename}.lock`;
+	const deadline = Date.now() + (options?.waitMs ?? DEFAULT_LOCK_WAIT_MS);
+	let delay = LOCK_RETRY_INITIAL_MS;
+	let retriedUnconfirmedPermissionError = false;
+	for (;;) {
+		options?.signal?.throwIfAborted();
+		try {
+			await writeFile(lockPath, `${process.pid}\n`, {
+				mode: 384,
+				flag: "wx"
+			});
+			break;
+		} catch (error) {
+			if (!await isLockContention(error, lockPath)) {
+				if (process.platform !== "win32" || error?.code !== "EPERM" || retriedUnconfirmedPermissionError) throw error;
+				retriedUnconfirmedPermissionError = true;
+			} else if (await takeOverExitedLock(lockPath)) continue;
+		}
+		if (Date.now() >= deadline) throw new Error(`atomic-write: timed out waiting for the writer lock at ${lockPath}`);
+		await setTimeout$1(delay, void 0, { signal: options?.signal });
+		delay = Math.min(delay * 2, LOCK_RETRY_MAX_MS);
+	}
+	try {
+		options?.signal?.throwIfAborted();
+		return await operation();
+	} finally {
+		await rm(lockPath, { force: true });
+	}
+}
+//#endregion
 //#region src/app-version.ts
 /**
 * The international desktop app's version, used as the `/v3/config` UA.
@@ -1519,7 +1734,41 @@ function parseModelCatalog(data, international = false, promoBadges) {
 	}
 	const models = cliIds.map((id) => byId.get(id)).filter((model) => model !== void 0);
 	if (models.length === 0) throw new Error("workbuddy model catalog resolved to an empty list");
-	return models;
+	return disambiguateDisplayNames(models);
+}
+/**
+* Make display names unique within one catalog.
+*
+* The CN document names both `hy3` and `hy3-x` "Hy3" — two neighbouring rows
+* whose rates differ (`x0.00` free versus `x0.05`), so the picker and the probe
+* card render two identical rows and the user cannot tell which one they are
+* paying for. The static fallback spells the second one "Hy3-X", but the live
+* fetch overwrote that correction: as soon as the roster gained the id, the
+* collision came back through the parse path.
+*
+* The suffix comes from the id itself — whatever follows the shared name stem
+* — so `hy3-x` reads "Hy3-X" again. Ids are untouched: they are the wire
+* contract the request path and the shim route on. Only exact (case-
+* insensitive) collisions are rewritten; a distinct upstream name such as
+* `MiniMax-M3` for `minimax-m3-pay` keeps the upstream's own wording.
+*/
+function disambiguateDisplayNames(models) {
+	const seen = /* @__PURE__ */ new Set();
+	return models.map((model) => {
+		const key = model.name.trim().toLowerCase();
+		if (!seen.has(key)) {
+			seen.add(key);
+			return model;
+		}
+		const tail = model.id.toLowerCase().startsWith(key) ? model.id.slice(key.length) : "";
+		if (tail === "") return model;
+		const name = `${model.name}${tail.toUpperCase()}`;
+		seen.add(name.toLowerCase());
+		return {
+			...model,
+			name
+		};
+	});
 }
 /** Extract the promotions covering `model` from the `modelPromotions` array. */
 function parsePromotions(value, model) {
@@ -3436,12 +3685,12 @@ var WorkBuddyCredentialStore = class {
 */
 /**
 * Static CLI models observed on the CN endpoint (re-verified against the live
-* `/v3/config` document 2026-09-23, including the thinking-effort and billing
+* `/v3/config` document 2026-10-17, including the thinking-effort and billing
 * metadata). The upstream refresh replaces this list at startup; it exists so
 * the provider registers with a usable catalog even while the first fetch is
 * in flight or offline.
 *
-* The list tracks the `cli` agent's model roster exactly — the 16 models it
+* The list tracks the `cli` agent's model roster exactly — the 19 models it
 * offered that day. The roster churns quickly (`auto`, `kimi-k3-1`,
 * `minimax-m3` each appeared or vanished within days, and a competing patch's
 * 2026-09-22 snapshot named three ids that were gone a day later), so this
@@ -3452,6 +3701,11 @@ var WorkBuddyCredentialStore = class {
 * document, and the `free` flag follows the normalized `x0.00` credits
 * marker.
 *
+* Image capability is also verbatim, and it moved since the previous capture:
+* `glm-5.2` and `glm-5.1` now report `supportsImages: false`. Claiming it for
+* them admitted an attachment the upstream then rejected after the message was
+* durable, so this table follows the document rather than the old snapshot.
+*
 * Deliberately NOT baked in: promotional badges. `限时免费` and friends are
 * dynamic console-side promotions with no reliable validity window, so a
 * static table would keep them alive long after the offers end. The live
@@ -3463,7 +3717,7 @@ const FALLBACK_WORKBUDDY_MODELS = [
 	{
 		id: "hy4-preview",
 		name: "Hy4 preview",
-		contextWindow: 1e6,
+		contextWindow: 96e4,
 		maxTokens: 64e3,
 		supportsImages: true,
 		reasoning: {
@@ -3512,6 +3766,52 @@ const FALLBACK_WORKBUDDY_MODELS = [
 			free: false
 		}
 	},
+	{
+		id: "step-5-preview",
+		name: "Step-5-Preview",
+		contextWindow: 1e6,
+		maxTokens: 64e3,
+		supportsImages: true,
+		reasoning: {
+			supports: true,
+			onlyReasoning: true,
+			supportedEfforts: [
+				"low",
+				"medium",
+				"high"
+			],
+			defaultEffort: "high",
+			canDisableThinking: false
+		},
+		billing: {
+			credits: "x0.00 credits",
+			free: true
+		}
+	},
+	{
+		id: "space-bunny",
+		name: "Space-Bunny",
+		contextWindow: 1e6,
+		maxTokens: 128e3,
+		supportsImages: true,
+		reasoning: {
+			supports: true,
+			onlyReasoning: true,
+			supportedEfforts: [
+				"low",
+				"medium",
+				"high",
+				"xhigh",
+				"max"
+			],
+			defaultEffort: "max",
+			canDisableThinking: false
+		},
+		billing: {
+			credits: "x0.08 credits",
+			free: false
+		}
+	},
 	{
 		id: "deepseek-v4.1-flash",
 		name: "Deepseek-V4.1-Flash",
@@ -3521,11 +3821,16 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		reasoning: {
 			supports: true,
 			onlyReasoning: true,
+			supportedEfforts: [
+				"low",
+				"high",
+				"max"
+			],
 			defaultEffort: "high",
-			canDisableThinking: false
+			canDisableThinking: true
 		},
 		billing: {
-			credits: "x0.03 credits",
+			credits: "x0.11 credits",
 			free: false
 		}
 	},
@@ -3538,7 +3843,12 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		reasoning: {
 			supports: true,
 			onlyReasoning: true,
-			defaultEffort: "medium",
+			supportedEfforts: [
+				"low",
+				"high",
+				"max"
+			],
+			defaultEffort: "max",
 			canDisableThinking: false
 		},
 		billing: {
@@ -3561,19 +3871,41 @@ const FALLBACK_WORKBUDDY_MODELS = [
 				"max"
 			],
 			defaultEffort: "high",
-			canDisableThinking: true
+			canDisableThinking: false
 		},
 		billing: {
 			credits: "x0.06 credits",
 			free: false
 		}
 	},
+	{
+		id: "glm-5.3-flashx",
+		name: "GLM-5.3-FlashX",
+		contextWindow: 1e6,
+		maxTokens: 131072,
+		supportsImages: true,
+		reasoning: {
+			supports: true,
+			onlyReasoning: true,
+			supportedEfforts: [
+				"low",
+				"high",
+				"max"
+			],
+			defaultEffort: "high",
+			canDisableThinking: false
+		},
+		billing: {
+			credits: "x0.14 credits",
+			free: false
+		}
+	},
 	{
 		id: "glm-5.2",
 		name: "GLM-5.2",
 		contextWindow: 1e6,
 		maxTokens: 64e3,
-		supportsImages: true,
+		supportsImages: false,
 		reasoning: {
 			supports: true,
 			onlyReasoning: true,
@@ -3590,7 +3922,7 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		name: "GLM-5.1",
 		contextWindow: 2e5,
 		maxTokens: 48e3,
-		supportsImages: true,
+		supportsImages: false,
 		reasoning: {
 			supports: true,
 			onlyReasoning: true,
@@ -3620,10 +3952,10 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		}
 	},
 	{
-		id: "minimax-m3",
+		id: "minimax-m3-pay",
 		name: "MiniMax-M3",
 		contextWindow: 512e3,
-		maxTokens: 64e3,
+		maxTokens: 128e3,
 		supportsImages: true,
 		reasoning: {
 			supports: true,
@@ -3649,12 +3981,12 @@ const FALLBACK_WORKBUDDY_MODELS = [
 			canDisableThinking: false
 		},
 		billing: {
-			credits: "x0.19 credits",
+			credits: "x0.26 credits",
 			free: false
 		}
 	},
 	{
-		id: "kimi-k3-1",
+		id: "kimi-k3-2",
 		name: "Kimi-K3",
 		contextWindow: 1e6,
 		maxTokens: 32e3,
@@ -3666,7 +3998,7 @@ const FALLBACK_WORKBUDDY_MODELS = [
 			canDisableThinking: false
 		},
 		billing: {
-			credits: "x1.62 credits",
+			credits: "x1.62",
 			free: false
 		}
 	},
@@ -4210,7 +4542,7 @@ var WorkBuddyCatalog = class {
 };
 //#endregion
 //#region src/version.ts
-const WORKBUDDY_CONNECT_VERSION = "0.7.7";
+const WORKBUDDY_CONNECT_VERSION = "0.7.9";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -1129,12 +1129,12 @@ declare class WorkBuddyCredentialStore {
 type WorkBuddyModelInfo = WorkBuddyUpstreamModel;
 /**
  * Static CLI models observed on the CN endpoint (re-verified against the live
- * `/v3/config` document 2026-09-23, including the thinking-effort and billing
+ * `/v3/config` document 2026-10-17, including the thinking-effort and billing
  * metadata). The upstream refresh replaces this list at startup; it exists so
  * the provider registers with a usable catalog even while the first fetch is
  * in flight or offline.
  *
- * The list tracks the `cli` agent's model roster exactly — the 16 models it
+ * The list tracks the `cli` agent's model roster exactly — the 19 models it
  * offered that day. The roster churns quickly (`auto`, `kimi-k3-1`,
  * `minimax-m3` each appeared or vanished within days, and a competing patch's
  * 2026-09-22 snapshot named three ids that were gone a day later), so this
@@ -1145,6 +1145,11 @@ type WorkBuddyModelInfo = WorkBuddyUpstreamModel;
  * document, and the `free` flag follows the normalized `x0.00` credits
  * marker.
  *
+ * Image capability is also verbatim, and it moved since the previous capture:
+ * `glm-5.2` and `glm-5.1` now report `supportsImages: false`. Claiming it for
+ * them admitted an attachment the upstream then rejected after the message was
+ * durable, so this table follows the document rather than the old snapshot.
+ *
  * Deliberately NOT baked in: promotional badges. `限时免费` and friends are
  * dynamic console-side promotions with no reliable validity window, so a
  * static table would keep them alive long after the offers end. The live