dsh-xdpool 2.4.1 → 2.4.2

package/CHANGELOG.md

@@ -1,6 +1,39 @@
 # Changelog
 本项目的所有重要变更都会记录在此文件。
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
+## 2.4.2 — 第二道内容指纹：`Web GUI` 那句，以及 assistant 历史
+> 2.4.1 之后仍有 11128。这一版补上第二道内容指纹，并把改写范围扩到 assistant 历史。修复来自社区 PR [#62](https://github.com/XDTrees/dsh-xdpool/pull/62)（[@jmglsi](https://github.com/jmglsi)），实测复核与发布由维护者完成。
+### 同一条提示词里还有第二道指纹
+2.4.1 只改写了 `You are an AI agent powered by DeepSeek Harness` 那一句的开头。把这一句改掉之后，请求仍然 `400 / 11128`，因为网关还在看提示词的另一段——介绍 Web GUI 的那一对句子：
+
+```
+You are interacting with the user through the DeepSeek Harness Web GUI
+whose URL the runtime context names. When the user refers to "this page",
+"this GUI", or "this app" without naming another target, they mean this GUI.
+```
+
+这两句是**合起来**才算的：单独发任一句都 `200`，两句凑齐就 `400`；在这对句子里做任何小改动都放行。所以这是第二道**内容指纹**，不是请求长度限制，也不是别的头。
+
+修法是把产品名后的 `Web GUI` 改称 `web interface`——保住原意的最小改动。改写清单仍是数组，这一条只是新的一行。
+
+### 被扫的是 system 和 assistant，user/tool 不扫
+同一句话放进 `assistant` 消息同样 `400`，改写后 `200`；放进 `user` 或 `tool` 则从来不管。这一条很重要：**只要历史里有一条助手回复带着这段文字，之后这个会话的每一次请求都会失败**。所以改写范围从「只改 system」扩到 system + assistant。
+
+### 实测（真实国内网关，改写前 → 改写后）
+| 请求体 | 修复前 | 修复后 |
+|---|---|---|
+| 主 agent 提示词（含 Web GUI 那对句子） | `400 / 11128` | `200` |
+| 同一对句子放在 `assistant` 历史里 | `400 / 11128` | `200` |
+| 两句合一的提示词（两道指纹同时在） | `400 / 11128` | `200` |
+| 埋进数百字长提示词中间 | `400 / 11128` | `200` |
+| 只有无关填充的长提示词（基线） | `200` | `200` |
+
+维护者复核时额外确认了一件事：DSH 当前版本真正发出的那几句（`The runtime context names the DeepSeek Harness implementation checkout…`、`… the DeepSeek Harness Web GUI at <url>.`、`Current DeepSeek Harness Web GUI URL: …`）**原样发送就是 `200`**，不触发任何检查——它们含产品名却不是模板命中的句式。也就是说命中的是句式，不是「出现产品名」；这也是为什么没有采用「把 `DeepSeek Harness` 全局替换成 `DSH`」那种更宽的改法：它会连 `D:\DeepSeek Harness\resources\app\dsh\` 这类要求模型逐字使用的路径一起改掉，而换不来任何额外的放行。
+### 同时并入的两个社区修复
+- **PR [#49](https://github.com/XDTrees/dsh-xdpool/pull/49)**（[@GIGIGIGIbaby](https://github.com/GIGIGIGIbaby)）：模型连通性探测的 `content` 改用内容块数组。宿主按 `content.some(...)` 校验每条出站消息，裸字符串没有 `.some`，探测在进程内就炸了，卡片上显示成 `content.some is not a function`——一个形状错误伪装成模型坏了。
+- **PR [#50](https://github.com/XDTrees/dsh-xdpool/pull/50)**（[@GIGIGIGIbaby](https://github.com/GIGIGIGIbaby)）：禁用按钮划过时会「消失」。`.dsm-btn:disabled:hover` 里的 `background:transparent` 优先级 (0,3,0)，压过了 `.dsm-btn-primary` 的填充色 (0,1,0)；主按钮文字是深色、为浅底设计的，底一变透明文字就看不见了。现在这条规则只保留 `transform` 部分。
+### 其他
+- 测试：新增指纹改写与被扫角色 9 例 + 运行时上下文指纹 5 例 + 探测请求形状 4 例 + 禁用按钮悬停 6 例，全套 72 文件 947 用例。
 ## 2.4.1 — 11128 的真正成因：system 内容指纹
 > 2.4.0 之后仍有用户撞上 `400 / 11128 Illegal API invocation from an unapproved channel`。定位下来，2.4.0 的归因是错的，这一版修的是真原因。
 ### 11128 不是身份头的问题，是 system 内容里的自报句

package/lib/bin.js

@@ -300,8 +300,11 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 *     it" above is the same finding from the other side).
 *   - it is case-insensitive (`you are an ai agent powered by deepseek harness`
 *     is blocked too).
-*   - only `role: "system"` is inspected: the same sentence in a `user` or
-*     `tool` message passes, and it is blocked in a second system message too.
+*   - the scanned roles are `system` and `assistant`: the same sentence in a
+*     `user` or `tool` message passes, and it is blocked in a second system
+*     message too. 2.4.1 recorded this as system-only; re-measured
+*     2026-10-21, an `assistant` message carrying the sentence 400s as well,
+*     so `prepareChatBody` rewrites both roles.
 *   - `deepseek harness` alone, or `powered by deepseek` alone, passes — the
 *     whole phrase is what matches.
 *   - replacing `powered by` with `running on` passes, which is the rewrite
@@ -313,14 +316,38 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 * lose its anchor tomorrow. Rewriting the phrase is what the report's repro
 * verified, so that is what this does.
 *
+* A SECOND FINGERPRINT (measured against the live domestic gateway 2026-10-21)
+*
+* Once the sentence above was rewritten, requests still 400/11128'd, and the
+* blocker turned out to be another region of the same DSH system prompt: the
+* runtime-context sentence pair
+*
+*   You are interacting with the user through the DeepSeek Harness Web GUI
+*   whose URL the runtime context names. When the user refers to "this page",
+*   "this GUI", or "this app" without naming another target, they mean this GUI.
+*
+* The pair is load-bearing: either sentence alone 200s, and so does the pair
+* with any small edit inside it — so this is a second CONTENT fingerprint, not
+* a prompt-length rule and not another header rule. Renaming the product's
+* "Web GUI" to "web interface" is the smallest edit that keeps the meaning for
+* the model and clears the check; it was verified at 200 against both a main
+* agent system prompt and a subagent system prompt, on the same account that
+* reproduced the 400.
+*
+* The same window in an `assistant` message also answers 400, and 200 after
+* this rewrite; `user` and `tool` messages are not scanned. That is why the
+* rewrite is applied to assistant history too — one past reply carrying a
+* fingerprint would otherwise fail every later request in the conversation.
+*
 * The list is an ARRAY because these fingerprints are appended to over time; a
 * future rejection should be one more row here, not a new code path.
 */
-const BANNED_SYSTEM_PHRASES = Object.freeze([[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"]]);
+const BANNED_SYSTEM_PHRASES = Object.freeze([[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"], [/DeepSeek Harness Web GUI/gi, "DeepSeek Harness web interface"]]);
 /**
-* Rewrite fingerprinted system content, leaving everything else byte-identical.
+* Rewrite fingerprinted system/assistant content, leaving everything else
+* byte-identical.
 *
-* System content arrives as either a plain string or an array of content blocks
+* Message content arrives as either a plain string or an array of content blocks
 * (an OpenAI-compatible body allows both), so both shapes are handled — fixing
 * only the string form would miss every request that carries an image or a
 * cache-control block.
@@ -962,9 +989,9 @@ var WorkBuddyUpstreamClient = class {
 	* Normalize an OpenAI chat-completions body for the WorkBuddy upstream:
 	* force `stream: true` (the upstream rejects non-streaming), convert the
 	* DSH `developer` role into `system` (upstream rejects `developer` with
-	* business code 11128), rewrite system content the gateway fingerprints as a
-	* non-official client (also 11128), and flatten `tool_choice` into its string
-	* form.
+	* business code 11128), rewrite fingerprinted system/assistant content the
+	* gateway reads as a non-official client (also 11128), and flatten
+	* `tool_choice` into its string form.
 	*
 	* This is the REGION-BLIND half. Everything here is measured good on both
 	* gateways, so it runs before the region is known — the pool lane picks its
@@ -989,7 +1016,7 @@ var WorkBuddyUpstreamClient = class {
 			if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
 			const message = value;
 			if (message["role"] === "developer") message["role"] = "system";
-			if (message["role"] === "system") message["content"] = sanitizeSystemContent(message["content"]);
+			if (message["role"] === "system" || message["role"] === "assistant") message["content"] = sanitizeSystemContent(message["content"]);
 		}
 		const choice = obj["tool_choice"];
 		if (typeof choice === "string") {

package/lib/client.js

@@ -1340,7 +1340,14 @@ window.__ModuleLoader__.load({
 .dsm-btn{appearance:none;font:inherit;cursor:pointer;border:1px solid transparent;border-radius:8px;padding:5px 14px;font-size:13px;line-height:1.5}
 .dsm-btn:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,#5686fe);outline-offset:1px}
 .dsm-btn:disabled{opacity:.4;cursor:default;filter:saturate(.35);transform:none}
-.dsm-btn:disabled:hover{transform:none;background:transparent}
+/* Only the transform is neutralised here. Every variant's hover background is
+   already gated with ":not(:disabled)", so a disabled button never acquires one
+   and this rule has nothing to undo — but background:transparent used to sit
+   beside it, and at specificity (0,3,0) it beat .dsm-btn-primary's (0,1,0)
+   fill. The primary label is a dark colour designed for a light background, so
+   on a dark panel the fill went transparent, the text stayed dark, and the
+   button appeared to vanish the moment the cursor reached it. */
+.dsm-btn:disabled:hover{transform:none}
 .dsm-btn-outline{border-color:var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary);background:transparent;font-weight:500}
 .dsm-btn-outline:hover:not(:disabled){color:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-label-dimmed);background:rgba(255,255,255,.04)}
 .dsm-btn-primary{background:var(--dsw-alias-label-primary,#e6e6e6);color:var(--dsw-alias-bg-layer-3,#202126)}
@@ -12188,7 +12195,7 @@ window.__ModuleLoader__.load({
 		*
 		* @module dsh-xdpool/version
 		*/
-		const POOL_VERSION = "2.4.1";
+		const POOL_VERSION = "2.4.2";
 		//#endregion
 		//#region src/client/PoolCard.tsx
 		/**

package/lib/index.d.ts

@@ -469,9 +469,9 @@ export declare class WorkBuddyUpstreamClient {
    * Normalize an OpenAI chat-completions body for the WorkBuddy upstream:
    * force `stream: true` (the upstream rejects non-streaming), convert the
    * DSH `developer` role into `system` (upstream rejects `developer` with
-   * business code 11128), rewrite system content the gateway fingerprints as a
-   * non-official client (also 11128), and flatten `tool_choice` into its string
-   * form.
+   * business code 11128), rewrite fingerprinted system/assistant content the
+   * gateway reads as a non-official client (also 11128), and flatten
+   * `tool_choice` into its string form.
    *
    * This is the REGION-BLIND half. Everything here is measured good on both
    * gateways, so it runs before the region is known — the pool lane picks its

package/lib/index.js

@@ -351,8 +351,11 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 *     it" above is the same finding from the other side).
 *   - it is case-insensitive (`you are an ai agent powered by deepseek harness`
 *     is blocked too).
-*   - only `role: "system"` is inspected: the same sentence in a `user` or
-*     `tool` message passes, and it is blocked in a second system message too.
+*   - the scanned roles are `system` and `assistant`: the same sentence in a
+*     `user` or `tool` message passes, and it is blocked in a second system
+*     message too. 2.4.1 recorded this as system-only; re-measured
+*     2026-10-21, an `assistant` message carrying the sentence 400s as well,
+*     so `prepareChatBody` rewrites both roles.
 *   - `deepseek harness` alone, or `powered by deepseek` alone, passes — the
 *     whole phrase is what matches.
 *   - replacing `powered by` with `running on` passes, which is the rewrite
@@ -364,14 +367,38 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 * lose its anchor tomorrow. Rewriting the phrase is what the report's repro
 * verified, so that is what this does.
 *
+* A SECOND FINGERPRINT (measured against the live domestic gateway 2026-10-21)
+*
+* Once the sentence above was rewritten, requests still 400/11128'd, and the
+* blocker turned out to be another region of the same DSH system prompt: the
+* runtime-context sentence pair
+*
+*   You are interacting with the user through the DeepSeek Harness Web GUI
+*   whose URL the runtime context names. When the user refers to "this page",
+*   "this GUI", or "this app" without naming another target, they mean this GUI.
+*
+* The pair is load-bearing: either sentence alone 200s, and so does the pair
+* with any small edit inside it — so this is a second CONTENT fingerprint, not
+* a prompt-length rule and not another header rule. Renaming the product's
+* "Web GUI" to "web interface" is the smallest edit that keeps the meaning for
+* the model and clears the check; it was verified at 200 against both a main
+* agent system prompt and a subagent system prompt, on the same account that
+* reproduced the 400.
+*
+* The same window in an `assistant` message also answers 400, and 200 after
+* this rewrite; `user` and `tool` messages are not scanned. That is why the
+* rewrite is applied to assistant history too — one past reply carrying a
+* fingerprint would otherwise fail every later request in the conversation.
+*
 * The list is an ARRAY because these fingerprints are appended to over time; a
 * future rejection should be one more row here, not a new code path.
 */
-const BANNED_SYSTEM_PHRASES = Object.freeze([[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"]]);
+const BANNED_SYSTEM_PHRASES = Object.freeze([[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"], [/DeepSeek Harness Web GUI/gi, "DeepSeek Harness web interface"]]);
 /**
-* Rewrite fingerprinted system content, leaving everything else byte-identical.
+* Rewrite fingerprinted system/assistant content, leaving everything else
+* byte-identical.
 *
-* System content arrives as either a plain string or an array of content blocks
+* Message content arrives as either a plain string or an array of content blocks
 * (an OpenAI-compatible body allows both), so both shapes are handled — fixing
 * only the string form would miss every request that carries an image or a
 * cache-control block.
@@ -1122,9 +1149,9 @@ var WorkBuddyUpstreamClient = class {
 	* Normalize an OpenAI chat-completions body for the WorkBuddy upstream:
 	* force `stream: true` (the upstream rejects non-streaming), convert the
 	* DSH `developer` role into `system` (upstream rejects `developer` with
-	* business code 11128), rewrite system content the gateway fingerprints as a
-	* non-official client (also 11128), and flatten `tool_choice` into its string
-	* form.
+	* business code 11128), rewrite fingerprinted system/assistant content the
+	* gateway reads as a non-official client (also 11128), and flatten
+	* `tool_choice` into its string form.
 	*
 	* This is the REGION-BLIND half. Everything here is measured good on both
 	* gateways, so it runs before the region is known — the pool lane picks its
@@ -1149,7 +1176,7 @@ var WorkBuddyUpstreamClient = class {
 			if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
 			const message = value;
 			if (message["role"] === "developer") message["role"] = "system";
-			if (message["role"] === "system") message["content"] = sanitizeSystemContent(message["content"]);
+			if (message["role"] === "system" || message["role"] === "assistant") message["content"] = sanitizeSystemContent(message["content"]);
 		}
 		const choice = obj["tool_choice"];
 		if (typeof choice === "string") {
@@ -17624,7 +17651,10 @@ async function probeModelConnectivity(llm, provider, model, options = {}) {
 			system: "You are being called by a connection test. Answer in one short word.",
 			messages: [{
 				role: "user",
-				content: PROBE_PROMPT
+				content: [{
+					type: "text",
+					text: PROBE_PROMPT
+				}]
 			}],
 			maxTokens: 24,
 			signal: timeout.signal

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-xdpool",
   "displayName": "DSH XD Pool",
   "description": "One DSH model pool for every free quota you have: merge all locally signed-in WorkBuddy accounts with auto-failover, sign in to 13 vendors by QR/web, aggregate 76 vendors' free tiers, plus a usage dashboard, model routing, a local OpenAI-compatible gateway and a points-automation suite.",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-xdpool#readme",