dsh-workbuddy-xdpool 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -4,6 +4,50 @@
 
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 1.4.0 (2026-09-24)
+
+### 长对话不再撞死在上下文上限上
+
+以前聊到一定长度，就会弹出一个 `400 context_length_exceeded` 然后被送回主页，只能重开会话。
+现在会自动收缩上下文继续跑，不再打断你。
+
+这里其实有两层保险，各自管不同的情况：
+
+**第一层是 Harness 自带的。** DSH 本来就装了 `compaction-basic`，它会在发请求之前先算一遍 token
+压力，超了就摘要、重试。问题是它认错误的方式是「看这段文字像不像上下文溢出」，而插件原来报的是
+一句友好英文 —— `the conversation exceeds <模型名>'s context window` —— 恰好是它唯一认不出来的
+那种写法。于是它以为这是个普通的坏请求，跳过了恢复，直接把 400 抛给你。
+
+（顺带一个坑：上游 WorkBuddy 自己那句 `input length too long`／业务码 `11115`，同样不在它的
+识别清单里。所以「把上游原话原样透传」这条路也走不通，必须主动改写成它认得的措辞。）
+
+现在溢出时会输出它认得的写法，Harness 的自动摘要就接上了。
+
+**第二层是插件自己的。** 就算 Harness 那层没兜住（比如窗口值报得不准，或者你一口气粘了个巨大
+文件），插件会自己压缩一遍再重试一次：先丢最旧的回合，保留 system 和最近几轮；还放不下就把被丢
+掉的回合交给模型做个摘要塞回去；再不行才硬截断。摘要这一步哪怕失败也只会降级成直接截断，绝不
+会反过来让你的这一轮请求失败。
+
+### 「API 密钥无效」不再把所有账号卡死在第一个上
+
+账号池的本意是：某个号不行就换下一个。但错误分类里有个漏洞 —— HTTP 401 只有在响应体里恰好
+出现两条特定标记之一时，才会被认成「登录态失效」（可刷新、可轮换）。上游换个说法，比如
+「api密钥无效」、`invalid api key`、`unauthorized`，就掉进了兜底的 `client` 类。
+
+而 `client` 在轮换循环里是**终态**：直接 `break`，不再试后面的号。结果就是一个坏掉的号把整个池
+钉死在第一个账号上，2/3/4 号全都白装着。
+
+现在 401 和 403 无条件算「登录态失效」—— 刷新 token 然后换下一个号。另外把常见的中英文失效措辞
+也补进了标记清单，这样即便状态码不是 401（比如被包在 200 信封里）也还能认出来。
+
+### 其它
+
+- 顺手修了个压缩逻辑里的真 bug：它用同一个变量同时表示「留下来的」和「被丢掉的」，结果明明已经
+  砍到只剩几条，却报告「没有变化」，导致摘要功能整个跳过、根本没执行。
+- 新增两组测试：`context-overflow-contract.test.ts` 逐字复刻了 Harness 的错误匹配规则（它将来改
+  措辞时这个测试会变红，提醒你同步改）；`upstream-error-classification.test.ts` 钉住了上面那个
+  401 分类回归。
+
 ## 1.3.0 (2026-09-23)
 
 上一版把八类任务链接了进去，这一版修的是**「接进去了但你看不见」**的问题——功能在跑，界面上却没显示，等于白做。

package/lib/bin.js

@@ -29,6 +29,8 @@ const MODELS_CATALOG_PATH = "/v2/enterprises/personal/models";
 const GLOBAL_CONFIG_PATH = "/v3/config";
 const JSON_TIMEOUT_MS = 3e4;
 const ERROR_BODY_LIMIT = 4096;
+/** Cap on the reassembled compaction reply, guarding against a runaway stream. */
+const COMPLETION_TEXT_LIMIT = 65536;
 /** Insufficient-credit markers, ASCII lowercase plus the original Chinese. */
 const HARD_CREDIT_MARKERS = [
 	"insufficient credit",
@@ -47,8 +49,31 @@ const HARD_CREDIT_MARKERS = [
 	"额度用尽",
 	"没有积分"
 ];
-/** Session-invalidation markers that mean "sign in again in the WorkBuddy app". */
-const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
+/** Session-invalidation markers that mean "this credential is dead; use another".
+*  Kept alongside the HTTP-status rule in `classifyUpstreamError`: the status is
+*  enough for a direct 401/403, but some failures arrive wrapped in a 200
+*  envelope or a 4xx the gateway words differently. Adding the English and
+*  Chinese phrasings the upstream actually uses keeps those recoverable too —
+*  an unmatched one fell through to `client`, which is terminal in the shim
+*  and pinned the pool to the first account (the "API 密钥无效" bug). */
+const SESSION_DEAD_MARKERS = [
+	"Offline user session not found",
+	"12153",
+	"api key is invalid",
+	"invalid api key",
+	"invalid_api_key",
+	"api密钥无效",
+	"密钥无效",
+	"无效的密钥",
+	"unauthorized",
+	"token expired",
+	"token is invalid",
+	"login expired",
+	"please login",
+	"未登录",
+	"登录已失效",
+	"重新登录"
+];
 /**
 * Markers for "already checked in today".
 *
@@ -221,12 +246,82 @@ function envelopeError(status, envelope) {
 	return /* @__PURE__ */ new Error(`workbuddy upstream ${kind} (http ${status}): ${envelope.msg.slice(0, 160)}`);
 }
 /**
+* Read an OpenAI-style SSE chat stream and concatenate the assistant text.
+*
+* The upstream always streams (`stream: true` is forced on every chat body),
+* so a non-streaming internal call has to reassemble the deltas itself. Only
+* `choices[0].delta.content` is collected; reasoning deltas are dropped
+* because a compaction summary needs the final answer, not the scratchpad.
+*/
+async function readCompletionText(body) {
+	const decoder = new TextDecoder();
+	const reader = body.getReader();
+	let buffer = "";
+	let text = "";
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			buffer += decoder.decode(value, { stream: true });
+			let split = buffer.indexOf("\n\n");
+			while (split !== -1) {
+				const frame = buffer.slice(0, split);
+				buffer = buffer.slice(split + 2);
+				text += contentOfFrame(frame);
+				if (text.length > COMPLETION_TEXT_LIMIT) return text.slice(0, COMPLETION_TEXT_LIMIT);
+				split = buffer.indexOf("\n\n");
+			}
+		}
+		if (buffer.trim() !== "") text += contentOfFrame(buffer);
+	} finally {
+		reader.releaseLock?.();
+	}
+	return text;
+}
+/** Pull `choices[0].delta.content` (or a non-streaming `message.content`) out of one SSE frame. */
+function contentOfFrame(frame) {
+	let out = "";
+	for (const rawLine of frame.split(/\r?\n/u)) {
+		const line = rawLine.trim();
+		if (!line.startsWith("data:")) continue;
+		const payload = line.slice(5).trim();
+		if (payload === "" || payload === "[DONE]") continue;
+		let parsed;
+		try {
+			parsed = JSON.parse(payload);
+		} catch {
+			continue;
+		}
+		if (typeof parsed !== "object" || parsed === null) continue;
+		const choices = parsed["choices"];
+		if (!Array.isArray(choices) || choices.length === 0) continue;
+		const choice = choices[0];
+		const delta = choice["delta"];
+		if (typeof delta === "object" && delta !== null) {
+			const content = delta["content"];
+			if (typeof content === "string") out += content;
+		}
+		const message = choice["message"];
+		if (typeof message === "object" && message !== null) {
+			const content = message["content"];
+			if (typeof content === "string") out += content;
+		}
+		const data = parsed["data"];
+		if (typeof data === "object" && data !== null) {
+			const inner = data["content"];
+			if (typeof inner === "string") out += inner;
+		}
+	}
+	return out;
+}
+/**
 * Classify an upstream failure from its HTTP status and body excerpt.
 * Body markers win over status, because the upstream reuses 400/200 for
 * several distinct conditions.
 */
 function classifyUpstreamError(status, body) {
 	if (status === 402) return "hard_credit";
+	if (status === 401 || status === 403) return "session_dead";
 	const lower = body.toLowerCase();
 	for (const marker of HARD_CREDIT_MARKERS) if (lower.includes(marker.toLowerCase()) || body.includes(marker)) return "hard_credit";
 	for (const marker of SESSION_DEAD_MARKERS) if (body.includes(marker)) return "session_dead";
@@ -589,6 +684,51 @@ var WorkBuddyUpstreamClient = class {
 		}
 		return JSON.stringify(obj);
 	}
+	/**
+	* Parse a raw OpenAI chat body without normalising it.
+	*
+	* The compactor needs the message array as objects, while `chatStream` only
+	* accepts the serialised string form.
+	*/
+	parseChatBody(raw) {
+		let body;
+		try {
+			body = JSON.parse(raw);
+		} catch {
+			return;
+		}
+		if (typeof body !== "object" || body === null || Array.isArray(body)) return void 0;
+		return body;
+	}
+	/** Re-serialise `base` with a rewritten `messages` array, still normalised. */
+	buildChatBody(base, messages) {
+		return this.prepareChatBody(JSON.stringify({
+			...base,
+			messages
+		}));
+	}
+	/**
+	* Run one NON-streaming completion and return the assistant text.
+	*
+	* Used only for internal compaction (summarising dropped turns). The chat
+	* endpoint itself always streams, so this reassembles the SSE frames into a
+	* single string. Throws on any failure: the compactor then falls back to
+	* plain truncation rather than failing the user's turn.
+	*/
+	async completeChat(credential, prepared, signal) {
+		const response = await this.fetchImpl(`${chatBase(credential)}/v2/chat/completions`, {
+			method: "POST",
+			headers: chatHeaders(credential),
+			body: prepared,
+			...signal === void 0 ? {} : { signal }
+		});
+		if (!response.ok) {
+			const text = (await response.text().catch(() => "")).slice(0, ERROR_BODY_LIMIT);
+			throw new Error(`compaction upstream http ${response.status}: ${text}`);
+		}
+		if (response.body === null) throw new Error("compaction upstream returned no body");
+		return await readCompletionText(response.body);
+	}
 	/** Forward one chat completion. Never throws for upstream failures. */
 	async chatStream(credential, prepared, signal) {
 		let response;
@@ -3480,6 +3620,17 @@ var WorkBuddyScheduler = class {
 		this.logger.info?.(`automation travel ${account.label}: nothing to do (state=${travel.state})`);
 	}
 };
+[
+	"You are compacting an ongoing conversation so it can continue without the original history.",
+	"Summarise the transcript below into a dense briefing for the next assistant turn.",
+	"Preserve, in this order of priority:",
+	"1. explicit user requirements, constraints and corrections;",
+	"2. decisions already made, and the reasoning behind them;",
+	"3. concrete facts: file paths, identifiers, commands, numbers, error messages;",
+	"4. unfinished work and the current blocker.",
+	"Drop pleasantries, repetition and superseded attempts.",
+	"Write the briefing only — no preamble, no markdown fence."
+].join("\n");
 //#endregion
 //#region src/status.ts
 /** Format the per-model credit multipliers. */

package/lib/index.d.ts

@@ -164,6 +164,32 @@ export declare function expertActualUseEvent(expert: MarketExpert, conversationI
  */
 export declare function expertChatEvents(expert: MarketExpert, conversationId: string, requestId: string): Record<string, unknown>[];
 //#endregion
+//#region src/context-budget.d.ts
+/**
+ * Context-window budgeting for the WorkBuddy shim.
+ *
+ * The upstream answers `context_length_exceeded` (business code 11115) when a
+ * request overruns the model's window. Rather than bouncing that back to the
+ * user as a dead turn, the shim compacts the conversation on the fly:
+ *
+ *  1. estimate the prompt cost locally (cheap, no round trip);
+ *  2. drop the oldest turns while keeping `system` + the newest exchange;
+ *  3. if that still overruns, ask the model itself to summarise the middle of
+ *     the conversation and splice that summary back in as a system message.
+ *
+ * Everything here is pure and synchronous-free except `summarizeMessages`,
+ * which the caller drives through an injected chat function so this module
+ * stays testable without a network.
+ *
+ * @module dsh-workbuddy-xdpool/context-budget
+ */
+/** One OpenAI chat message, narrowed to the fields we must preserve. */
+interface ChatMessage {
+  role: string;
+  content: unknown;
+  [key: string]: unknown;
+}
+//#endregion
 //#region src/upstream.d.ts
 /** Upstream failure classes the shim maps onto distinct HTTP answers. */
 type UpstreamErrorKind = 'hard_credit' | 'soft_rate' | 'session_dead' | 'not_found' | 'server' | 'client';
@@ -388,6 +414,24 @@ export declare class WorkBuddyUpstreamClient {
    * business code 11128), and flatten `tool_choice` into its string form.
    */
   prepareChatBody(raw: string): string;
+  /**
+   * Parse a raw OpenAI chat body without normalising it.
+   *
+   * The compactor needs the message array as objects, while `chatStream` only
+   * accepts the serialised string form.
+   */
+  parseChatBody(raw: string): Record<string, unknown> | undefined;
+  /** Re-serialise `base` with a rewritten `messages` array, still normalised. */
+  buildChatBody(base: Record<string, unknown>, messages: readonly ChatMessage[]): string;
+  /**
+   * Run one NON-streaming completion and return the assistant text.
+   *
+   * Used only for internal compaction (summarising dropped turns). The chat
+   * endpoint itself always streams, so this reassembles the SSE frames into a
+   * single string. Throws on any failure: the compactor then falls back to
+   * plain truncation rather than failing the user's turn.
+   */
+  completeChat(credential: WorkBuddyCredential, prepared: string, signal?: AbortSignal): Promise<string>;
   /** Forward one chat completion. Never throws for upstream failures. */
   chatStream(credential: WorkBuddyCredential, prepared: string, signal?: AbortSignal): Promise<ChatStreamResult>;
   /** POST the token-refresh endpoint; the caller merges the outcome. */

package/lib/index.js

@@ -31,6 +31,8 @@ const MODELS_CATALOG_PATH = "/v2/enterprises/personal/models";
 const GLOBAL_CONFIG_PATH = "/v3/config";
 const JSON_TIMEOUT_MS = 3e4;
 const ERROR_BODY_LIMIT = 4096;
+/** Cap on the reassembled compaction reply, guarding against a runaway stream. */
+const COMPLETION_TEXT_LIMIT = 65536;
 /** Insufficient-credit markers, ASCII lowercase plus the original Chinese. */
 const HARD_CREDIT_MARKERS = [
 	"insufficient credit",
@@ -49,8 +51,31 @@ const HARD_CREDIT_MARKERS = [
 	"额度用尽",
 	"没有积分"
 ];
-/** Session-invalidation markers that mean "sign in again in the WorkBuddy app". */
-const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
+/** Session-invalidation markers that mean "this credential is dead; use another".
+*  Kept alongside the HTTP-status rule in `classifyUpstreamError`: the status is
+*  enough for a direct 401/403, but some failures arrive wrapped in a 200
+*  envelope or a 4xx the gateway words differently. Adding the English and
+*  Chinese phrasings the upstream actually uses keeps those recoverable too —
+*  an unmatched one fell through to `client`, which is terminal in the shim
+*  and pinned the pool to the first account (the "API 密钥无效" bug). */
+const SESSION_DEAD_MARKERS = [
+	"Offline user session not found",
+	"12153",
+	"api key is invalid",
+	"invalid api key",
+	"invalid_api_key",
+	"api密钥无效",
+	"密钥无效",
+	"无效的密钥",
+	"unauthorized",
+	"token expired",
+	"token is invalid",
+	"login expired",
+	"please login",
+	"未登录",
+	"登录已失效",
+	"重新登录"
+];
 /**
 * Markers for "already checked in today".
 *
@@ -223,12 +248,82 @@ function envelopeError(status, envelope) {
 	return /* @__PURE__ */ new Error(`workbuddy upstream ${kind} (http ${status}): ${envelope.msg.slice(0, 160)}`);
 }
 /**
+* Read an OpenAI-style SSE chat stream and concatenate the assistant text.
+*
+* The upstream always streams (`stream: true` is forced on every chat body),
+* so a non-streaming internal call has to reassemble the deltas itself. Only
+* `choices[0].delta.content` is collected; reasoning deltas are dropped
+* because a compaction summary needs the final answer, not the scratchpad.
+*/
+async function readCompletionText(body) {
+	const decoder = new TextDecoder();
+	const reader = body.getReader();
+	let buffer = "";
+	let text = "";
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			buffer += decoder.decode(value, { stream: true });
+			let split = buffer.indexOf("\n\n");
+			while (split !== -1) {
+				const frame = buffer.slice(0, split);
+				buffer = buffer.slice(split + 2);
+				text += contentOfFrame(frame);
+				if (text.length > COMPLETION_TEXT_LIMIT) return text.slice(0, COMPLETION_TEXT_LIMIT);
+				split = buffer.indexOf("\n\n");
+			}
+		}
+		if (buffer.trim() !== "") text += contentOfFrame(buffer);
+	} finally {
+		reader.releaseLock?.();
+	}
+	return text;
+}
+/** Pull `choices[0].delta.content` (or a non-streaming `message.content`) out of one SSE frame. */
+function contentOfFrame(frame) {
+	let out = "";
+	for (const rawLine of frame.split(/\r?\n/u)) {
+		const line = rawLine.trim();
+		if (!line.startsWith("data:")) continue;
+		const payload = line.slice(5).trim();
+		if (payload === "" || payload === "[DONE]") continue;
+		let parsed;
+		try {
+			parsed = JSON.parse(payload);
+		} catch {
+			continue;
+		}
+		if (typeof parsed !== "object" || parsed === null) continue;
+		const choices = parsed["choices"];
+		if (!Array.isArray(choices) || choices.length === 0) continue;
+		const choice = choices[0];
+		const delta = choice["delta"];
+		if (typeof delta === "object" && delta !== null) {
+			const content = delta["content"];
+			if (typeof content === "string") out += content;
+		}
+		const message = choice["message"];
+		if (typeof message === "object" && message !== null) {
+			const content = message["content"];
+			if (typeof content === "string") out += content;
+		}
+		const data = parsed["data"];
+		if (typeof data === "object" && data !== null) {
+			const inner = data["content"];
+			if (typeof inner === "string") out += inner;
+		}
+	}
+	return out;
+}
+/**
 * Classify an upstream failure from its HTTP status and body excerpt.
 * Body markers win over status, because the upstream reuses 400/200 for
 * several distinct conditions.
 */
 function classifyUpstreamError(status, body) {
 	if (status === 402) return "hard_credit";
+	if (status === 401 || status === 403) return "session_dead";
 	const lower = body.toLowerCase();
 	for (const marker of HARD_CREDIT_MARKERS) if (lower.includes(marker.toLowerCase()) || body.includes(marker)) return "hard_credit";
 	for (const marker of SESSION_DEAD_MARKERS) if (body.includes(marker)) return "session_dead";
@@ -696,6 +791,51 @@ var WorkBuddyUpstreamClient = class {
 		}
 		return JSON.stringify(obj);
 	}
+	/**
+	* Parse a raw OpenAI chat body without normalising it.
+	*
+	* The compactor needs the message array as objects, while `chatStream` only
+	* accepts the serialised string form.
+	*/
+	parseChatBody(raw) {
+		let body;
+		try {
+			body = JSON.parse(raw);
+		} catch {
+			return;
+		}
+		if (typeof body !== "object" || body === null || Array.isArray(body)) return void 0;
+		return body;
+	}
+	/** Re-serialise `base` with a rewritten `messages` array, still normalised. */
+	buildChatBody(base, messages) {
+		return this.prepareChatBody(JSON.stringify({
+			...base,
+			messages
+		}));
+	}
+	/**
+	* Run one NON-streaming completion and return the assistant text.
+	*
+	* Used only for internal compaction (summarising dropped turns). The chat
+	* endpoint itself always streams, so this reassembles the SSE frames into a
+	* single string. Throws on any failure: the compactor then falls back to
+	* plain truncation rather than failing the user's turn.
+	*/
+	async completeChat(credential, prepared, signal) {
+		const response = await this.fetchImpl(`${chatBase(credential)}/v2/chat/completions`, {
+			method: "POST",
+			headers: chatHeaders(credential),
+			body: prepared,
+			...signal === void 0 ? {} : { signal }
+		});
+		if (!response.ok) {
+			const text = (await response.text().catch(() => "")).slice(0, ERROR_BODY_LIMIT);
+			throw new Error(`compaction upstream http ${response.status}: ${text}`);
+		}
+		if (response.body === null) throw new Error("compaction upstream returned no body");
+		return await readCompletionText(response.body);
+	}
 	/** Forward one chat completion. Never throws for upstream failures. */
 	async chatStream(credential, prepared, signal) {
 		let response;
@@ -3798,6 +3938,286 @@ var WorkBuddyScheduler = class {
 	}
 };
 //#endregion
+//#region src/context-budget.ts
+/** Rough character-per-token ratio. CJK is ~1 token/char, latin ~1/4. */
+const CHARS_PER_TOKEN_LATIN = 4;
+const CHARS_PER_TOKEN_CJK = 1;
+/** Fixed per-message overhead the chat template adds (role markers etc.). */
+const PER_MESSAGE_TOKEN_OVERHEAD = 4;
+/** Every image/tool part costs at least this much once decoded. */
+const PER_PART_TOKEN_FLOOR = 16;
+/**
+* Estimate the token cost of one message's `content`.
+*
+* Deliberately conservative (over-estimates) so we compact slightly early
+* rather than discovering the overrun upstream.
+*/
+function estimateContentTokens(content) {
+	if (content === null || content === void 0) return 0;
+	if (typeof content === "string") return estimateTextTokens(content);
+	if (typeof content === "number" || typeof content === "boolean") return PER_PART_TOKEN_FLOOR;
+	if (Array.isArray(content)) {
+		let total = 0;
+		for (const part of content) total += estimateContentTokens(part);
+		return total;
+	}
+	if (typeof content === "object") {
+		const record = content;
+		let total = PER_PART_TOKEN_FLOOR;
+		for (const key of [
+			"text",
+			"image_url",
+			"input",
+			"content"
+		]) if (key in record) total += estimateContentTokens(record[key]);
+		if (total === PER_PART_TOKEN_FLOOR) total += estimateTextTokens(safeStringify(record));
+		return total;
+	}
+	return 0;
+}
+/** Estimate tokens for a plain string, accounting for CJK density. */
+function estimateTextTokens(text) {
+	if (text === "") return 0;
+	let cjk = 0;
+	for (const char of text) if (isCjk(char.codePointAt(0) ?? 0)) cjk += 1;
+	const latin = text.length - cjk;
+	return Math.ceil(cjk / CHARS_PER_TOKEN_CJK + latin / CHARS_PER_TOKEN_LATIN);
+}
+function isCjk(code) {
+	return code >= 12288 && code <= 12351 || code >= 12352 && code <= 12543 || code >= 13312 && code <= 19903 || code >= 19968 && code <= 40959 || code >= 63744 && code <= 64255 || code >= 65280 && code <= 65519 || code >= 131072 && code <= 191471;
+}
+function safeStringify(value) {
+	try {
+		return JSON.stringify(value) ?? "";
+	} catch {
+		return String(value);
+	}
+}
+/** Estimate the prompt cost of a whole message array. */
+function estimateMessagesTokens(messages) {
+	let total = 0;
+	for (const message of messages) {
+		total += PER_MESSAGE_TOKEN_OVERHEAD;
+		total += estimateContentTokens(message.content);
+		if (message["tool_calls"] !== void 0) total += estimateContentTokens(message["tool_calls"]);
+		if (message["name"] !== void 0) total += estimateTextTokens(String(message["name"]));
+	}
+	return total;
+}
+/** True when `role` carries instructions that must survive compaction. */
+function isPinnedRole(role) {
+	return role === "system" || role === "developer";
+}
+/**
+* Drop the oldest non-pinned messages until the estimate fits `budget`.
+*
+* Pinned (system/developer) messages and the newest `keepRecent` messages are
+* never dropped here — if those alone overrun the budget, the caller must fall
+* back to summarisation or give up.
+*/
+function compactMessages(messages, options) {
+	const keepRecent = Math.max(1, options.keepRecent ?? 4);
+	const estimate = estimateMessagesTokens(messages);
+	if (estimate <= options.budget) return {
+		messages: [...messages],
+		dropped: [],
+		tokens: estimate,
+		changed: false
+	};
+	const pinned = [];
+	const body = [];
+	for (const message of messages) if (isPinnedRole(message.role)) pinned.push(message);
+	else body.push(message);
+	const keep = Math.min(keepRecent, body.length);
+	const tail = body.slice(body.length - keep);
+	const head = body.slice(0, body.length - keep);
+	let dropCount = 0;
+	let candidate = [
+		...pinned,
+		...head,
+		...tail
+	];
+	let total = estimateMessagesTokens(candidate);
+	while (total > options.budget && dropCount < head.length) {
+		dropCount += 1;
+		candidate = [
+			...pinned,
+			...head.slice(dropCount),
+			...tail
+		];
+		total = estimateMessagesTokens(candidate);
+	}
+	const dropped = head.slice(0, dropCount);
+	return {
+		messages: candidate,
+		dropped,
+		tokens: total,
+		changed: dropCount > 0
+	};
+}
+/**
+* Drop the oldest messages, including pinned ones, as a last resort.
+*
+* Used when even a summary cannot bring the prompt under budget (for example a
+* single enormous pasted document). The newest message always survives.
+*/
+function hardTruncate(messages, budget) {
+	if (messages.length === 0) return {
+		messages: [],
+		dropped: [],
+		tokens: 0,
+		changed: false
+	};
+	let start = 0;
+	let candidate = [...messages];
+	let total = estimateMessagesTokens(candidate);
+	while (total > budget && start < messages.length - 1) {
+		start += 1;
+		candidate = messages.slice(start);
+		total = estimateMessagesTokens(candidate);
+	}
+	return {
+		messages: candidate,
+		dropped: messages.slice(0, start),
+		tokens: total,
+		changed: start > 0
+	};
+}
+/** Instructions handed to the model when we ask it to compact a conversation. */
+const SUMMARIZE_INSTRUCTION = [
+	"You are compacting an ongoing conversation so it can continue without the original history.",
+	"Summarise the transcript below into a dense briefing for the next assistant turn.",
+	"Preserve, in this order of priority:",
+	"1. explicit user requirements, constraints and corrections;",
+	"2. decisions already made, and the reasoning behind them;",
+	"3. concrete facts: file paths, identifiers, commands, numbers, error messages;",
+	"4. unfinished work and the current blocker.",
+	"Drop pleasantries, repetition and superseded attempts.",
+	"Write the briefing only — no preamble, no markdown fence."
+].join("\n");
+/** Render a message array as plain text for the summarisation prompt. */
+function transcriptOf(messages) {
+	const lines = [];
+	for (const message of messages) {
+		const role = message.role === "" ? "unknown" : message.role;
+		lines.push(`### ${role}`);
+		lines.push(renderContent(message.content));
+		if (message["tool_calls"] !== void 0) lines.push(renderContent(message["tool_calls"]));
+	}
+	return lines.join("\n");
+}
+function renderContent(content) {
+	if (content === null || content === void 0) return "";
+	if (typeof content === "string") return content;
+	if (Array.isArray(content)) return content.map((part) => renderContent(part)).filter((text) => text !== "").join("\n");
+	if (typeof content === "object") {
+		const record = content;
+		for (const key of [
+			"text",
+			"content",
+			"input"
+		]) if (typeof record[key] === "string") return record[key];
+		if (record["type"] !== void 0 && typeof record["type"] === "string") return `[${record["type"]}]`;
+		return safeStringify(record);
+	}
+	return String(content);
+}
+/** Build the synthetic system message that carries a compaction summary. */
+function summaryMessage(summary) {
+	return {
+		role: "system",
+		content: [
+			"The earlier part of this conversation was compacted to fit the model context window.",
+			"Briefing produced from the dropped turns:",
+			"",
+			summary.trim()
+		].join("\n")
+	};
+}
+/**
+* Compact `messages` to `budget`, summarising the dropped turns when possible.
+*
+* The summary is requested with a *bounded* transcript so the compaction call
+* itself can never overrun the window: if the dropped turns are huge, only the
+* newest slice of them is summarised, and the oldest are noted as elided.
+*/
+async function compactWithSummary(messages, options, deps, signal) {
+	const first = compactMessages(messages, options);
+	if (!first.changed) return {
+		messages: first.messages,
+		tokens: first.tokens,
+		summary: void 0,
+		skipped: void 0
+	};
+	const summaryBudget = Math.max(256, Math.floor(options.budget / 4));
+	let toSummarize = first.dropped;
+	let elided = 0;
+	while (estimateMessagesTokens(toSummarize) > summaryBudget && toSummarize.length > 1) {
+		toSummarize = toSummarize.slice(1);
+		elided += 1;
+	}
+	let summary;
+	let skipped;
+	try {
+		const instruction = elided > 0 ? `${SUMMARIZE_INSTRUCTION}\n\nNote: the ${elided} oldest turn(s) were elided before this transcript.` : SUMMARIZE_INSTRUCTION;
+		const suffix = elided > 0 ? `\n(the ${elided} oldest turn(s) were elided)` : "";
+		const request = [{
+			role: "system",
+			content: instruction
+		}, {
+			role: "user",
+			content: `${transcriptOf(toSummarize)}${suffix}`
+		}];
+		const text = await deps.complete(request, signal);
+		if (text.trim() !== "") summary = text.trim();
+		else skipped = "summariser returned an empty summary";
+	} catch (error) {
+		skipped = `summarisation failed: ${String(error)}`;
+	}
+	if (summary === void 0) return {
+		messages: first.messages,
+		skipped,
+		tokens: first.tokens
+	};
+	const withSummary = injectSummary(first.messages, summary);
+	if (estimateMessagesTokens(withSummary) > options.budget) {
+		const truncated = hardTruncate(withSummary, options.budget);
+		return {
+			messages: truncated.messages,
+			summary,
+			tokens: truncated.tokens
+		};
+	}
+	return {
+		messages: withSummary,
+		summary,
+		tokens: estimateMessagesTokens(withSummary)
+	};
+}
+/**
+* Re-insert a summary as: pinned instructions → summary → surviving tail.
+*
+* Order matters. Pinned (system/developer) messages must stay ahead of the
+* summary so that a later synthetic system message can never override the
+* harness's own instructions; the tail follows so the newest exchange is the
+* last thing the model reads.
+*
+* `compacted` is always derived from `original` by `compactMessages`, so the
+* pinned messages it carries are exactly the originals — no need to re-add
+* them from `original`.
+*/
+function injectSummary(compacted, summary) {
+	const pinned = [];
+	const rest = [];
+	for (const message of compacted) if (isPinnedRole(message.role)) pinned.push(message);
+	else rest.push(message);
+	return [
+		...pinned,
+		summaryMessage(summary),
+		...rest
+	];
+}
+//#endregion
 //#region src/shim.ts
 /**
 * Loopback OpenAI-compatible endpoint with multi-account failover.
@@ -3876,7 +4296,8 @@ function writeOpenAIError(res, status, kind, message) {
 }
 /** True when an upstream failure body means the request overran the model's
 *  context window (OpenAI `context_length_exceeded`, WorkBuddy code 11115 /
-*  "input length too long"). Surfaced as a friendly hint, never auto-truncated. */
+*  "input length too long"). The shim answers it by compacting the conversation
+*  in place and retrying once; see `recoverFromContextOverrun`. */
 function isContextTooLong(body) {
 	if (body.includes("context_length_exceeded")) return true;
 	if (body.includes("input length too long")) return true;
@@ -4038,25 +4459,7 @@ function createWorkBuddyShim(options) {
 			tried.push(account.label);
 			const result = await client.chatStream(account.credential, prepared, controller.signal);
 			if (result.ok) {
-				logger?.info?.(`dsh-workbuddy-xdpool: served by ${account.label}`);
-				pool.noteServed(account.id);
-				refreshBalance(account);
-				res.writeHead(200, {
-					"Content-Type": "text/event-stream",
-					"Cache-Control": "no-cache",
-					"Connection": "keep-alive",
-					"X-Accel-Buffering": "no"
-				});
-				let sawDone = false;
-				const body = Readable.fromWeb(result.response.body);
-				body.on("data", (chunk) => {
-					if (chunk.includes("[DONE]")) sawDone = true;
-				});
-				body.on("error", (error) => {
-					logger?.warn("dsh-workbuddy-xdpool: upstream stream failed mid-flight", error);
-					if (!sawDone && res.writable) res.end("data: [DONE]\n\n");
-				});
-				body.pipe(res);
+				await serveSuccessfulStream(res, account, result, logger, refreshBalance, pool);
 				return;
 			}
 			last = {
@@ -4084,7 +4487,21 @@ function createWorkBuddyShim(options) {
 			return;
 		}
 		if (isContextTooLong(last.message)) {
-			writeOpenAIError(res, 400, "context_length_exceeded", `${modelId === void 0 ? "the conversation exceeds this model's context window" : `the conversation exceeds ${modelId}'s context window`}. Shorten the conversation, start a new chat, or pick a model with a larger window (e.g. hy4-preview).`);
+			const recovered = await recoverFromContextOverrun({
+				raw,
+				modelId,
+				controller,
+				region,
+				logger,
+				client,
+				pool,
+				maxAttempts
+			});
+			if (recovered.ok) {
+				await serveSuccessfulStream(res, recovered.account, recovered.result, logger, refreshBalance, pool);
+				return;
+			}
+			writeOpenAIError(res, 400, "context_length_exceeded", contextOverflowMessage(modelId, recovered.detail));
 			return;
 		}
 		writeOpenAIError(res, KIND_STATUS[last.kind], last.kind, `workbuddy upstream ${last.kind} (http ${last.status}) after ${tried.length} account(s) [${tried.join(" → ")}]: ${last.message.slice(0, 400)}`);
@@ -4100,6 +4517,168 @@ function createWorkBuddyShim(options) {
 		})
 	};
 }
+/**
+* Build the overflow message the Harness must recognize.
+*
+* This is deliberately NOT free-form prose. `dsh-compaction-basic` decides
+* whether to compact-and-retry by running the text that reaches it through
+* `isContextWindowExceededError()` (`@deepseek-ai/dsh-llm`), whose matcher
+* accepts only specific phrasings:
+*
+*   - `context_length_exceeded` / `context window exceeded`
+*   - `maximum context length`
+*   - `<input|prompt|request|messages> too large|long for ... context`
+*   - `<input|prompt|request> exceeds the ... context window`
+*
+* The obvious friendly sentence ("the conversation exceeds this model's
+* context window") matches NONE of them, and neither does the WorkBuddy
+* upstream's own "input length too long" / code 11115. Emitting either meant
+* the Harness saw an unclassifiable 400, skipped its recovery path, and
+* surfaced a dead turn — the bug this function exists to prevent.
+*
+* The leading clause carries the machine-matched wording; the trailing clause
+* is what a human reads. Keep both in sync with
+* `tests/context-overflow-contract.test.ts`.
+*/
+function contextOverflowMessage(modelId, detail = "") {
+	return `This model's maximum context length was exceeded: the prompt is too large for ${modelId === void 0 ? "the model" : `model ${modelId}`}, and the conversation could not be compacted in place${detail === "" ? "" : ` (${detail})`}. Compact the conversation, or start a new chat.`;
+}
+/**
+* Serve one already-successful upstream stream as an SSE response.
+*
+* Extracted so the context-overrun recovery path reuses the exact same
+* bookkeeping (noteServed + background balance refresh) as a first-try hit.
+*/
+async function serveSuccessfulStream(res, account, result, logger, refreshBalance, pool) {
+	logger?.info?.(`dsh-workbuddy-xdpool: served by ${account.label}`);
+	pool.noteServed(account.id);
+	refreshBalance(account);
+	res.writeHead(200, {
+		"Content-Type": "text/event-stream",
+		"Cache-Control": "no-cache",
+		"Connection": "keep-alive",
+		"X-Accel-Buffering": "no"
+	});
+	let sawDone = false;
+	const body = Readable.fromWeb(result.response.body);
+	body.on("data", (chunk) => {
+		if (chunk.includes("[DONE]")) sawDone = true;
+	});
+	body.on("error", (error) => {
+		logger?.warn("dsh-workbuddy-xdpool: upstream stream failed mid-flight", error);
+		if (!sawDone && res.writable) res.end("data: [DONE]\n\n");
+	});
+	body.pipe(res);
+}
+/**
+* Compact an over-long conversation and retry it once.
+*
+* Strategy, in order:
+*  1. drop the oldest turns, keeping system messages and the newest exchange;
+*  2. ask the model to summarise the dropped turns and splice that summary in;
+*  3. hard-truncate as a last resort.
+*
+* Returns `ok: false` only when even a truncated prompt still overran — the
+* caller then surfaces the original actionable 400.
+*/
+async function recoverFromContextOverrun(options) {
+	const { raw, modelId, controller, region, logger, client, pool, maxAttempts } = options;
+	const parsed = client.parseChatBody(raw);
+	if (parsed === void 0) return {
+		ok: false,
+		detail: "request body was not parseable JSON"
+	};
+	const rawMessages = parsed["messages"];
+	if (!Array.isArray(rawMessages)) return {
+		ok: false,
+		detail: "request carried no messages array"
+	};
+	const messages = rawMessages.filter((value) => typeof value === "object" && value !== null && !Array.isArray(value));
+	if (messages.length === 0) return {
+		ok: false,
+		detail: "request carried no usable messages"
+	};
+	const overrunTokens = estimateMessagesTokens(messages);
+	const budget = Math.max(512, Math.floor(overrunTokens / 2));
+	logger?.warn(`dsh-workbuddy-xdpool: context overrun on ${modelId ?? "(no model)"} (~${overrunTokens} tokens); compacting to ~${budget} and retrying once`);
+	let summary;
+	let compacted = messages;
+	let compactionDetail = "";
+	try {
+		const summariser = await pool.acquire(modelId, region);
+		if (summariser === void 0) compactionDetail = "no account available to summarise with";
+		else {
+			const outcome = await compactWithSummary(messages, {
+				budget,
+				keepRecent: 6
+			}, { complete: async (request, signal) => {
+				const body = client.buildChatBody({
+					...parsed,
+					stream: true,
+					max_tokens: Math.max(256, Math.floor(budget / 2))
+				}, request);
+				return await client.completeChat(summariser.credential, body, signal ?? controller.signal);
+			} }, controller.signal);
+			compacted = outcome.messages;
+			summary = outcome.summary;
+			if (outcome.skipped !== void 0) compactionDetail = outcome.skipped;
+		}
+	} catch (error) {
+		compactionDetail = `summarisation failed: ${String(error)}`;
+	}
+	if (estimateMessagesTokens(compacted) > budget) compacted = hardTruncate(compacted, budget).messages;
+	if (summary === void 0 && estimateMessagesTokens(compacted) >= overrunTokens) return {
+		ok: false,
+		detail: compactionDetail === "" ? "compaction could not reduce the prompt" : compactionDetail
+	};
+	const retryBody = client.buildChatBody(parsed, compacted);
+	const tried = [];
+	for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+		if (controller.signal.aborted) return {
+			ok: false,
+			detail: "client disconnected"
+		};
+		const account = await pool.acquire(modelId, region);
+		if (account === void 0) return {
+			ok: false,
+			detail: "no account available after compaction"
+		};
+		tried.push(account.label);
+		const result = await client.chatStream(account.credential, retryBody, controller.signal);
+		if (result.ok) {
+			logger?.info?.(`dsh-workbuddy-xdpool: recovered from context overrun on ${modelId ?? "(no model)"} (summarised: ${summary === void 0 ? "no" : "yes"})`);
+			return {
+				ok: true,
+				account,
+				result
+			};
+		}
+		if (isContextTooLong(result.message)) return {
+			ok: false,
+			detail: "prompt still exceeded the window after compaction"
+		};
+		if (result.kind === "session_dead") {
+			await pool.refreshAccount(account.id);
+			continue;
+		}
+		if (result.kind === "hard_credit") {
+			pool.penalizeExhausted(account.id);
+			continue;
+		}
+		if (result.kind === "soft_rate") {
+			pool.penalize(account.id, parseRateLimitReset(result.message), modelId);
+			continue;
+		}
+		return {
+			ok: false,
+			detail: `upstream ${result.kind} after compaction`
+		};
+	}
+	return {
+		ok: false,
+		detail: `no account served the compacted request (tried ${tried.length})`
+	};
+}
 //#endregion
 //#region src/status.ts
 /** Build the status document. Never throws. */

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-xdpool",
   "displayName": "DSH WorkBuddy XD Pool",
   "description": "Merge every locally signed-in WorkBuddy account into DeepSeek Harness as one auto-failing-over model pool (multi-account rotation, live credits, daily check-in and model catalog).",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-workbuddy-xdpool#readme",