dsh-xdpool 2.4.1 → 2.4.3

package/lib/index.js

@@ -2,9 +2,9 @@ import { createRequire } from "node:module";
 import { basename, dirname, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import crypto, { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { appendFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, truncateSync, writeFileSync } from "node:fs";
 import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { appendFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, truncateSync } from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createProvider } from "@earendil-works/pi-ai";
@@ -351,8 +351,11 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 *     it" above is the same finding from the other side).
 *   - it is case-insensitive (`you are an ai agent powered by deepseek harness`
 *     is blocked too).
-*   - only `role: "system"` is inspected: the same sentence in a `user` or
-*     `tool` message passes, and it is blocked in a second system message too.
+*   - the scanned roles are `system` and `assistant`: the same sentence in a
+*     `user` or `tool` message passes, and it is blocked in a second system
+*     message too. 2.4.1 recorded this as system-only; re-measured
+*     2026-10-21, an `assistant` message carrying the sentence 400s as well,
+*     so `prepareChatBody` rewrites both roles.
 *   - `deepseek harness` alone, or `powered by deepseek` alone, passes — the
 *     whole phrase is what matches.
 *   - replacing `powered by` with `running on` passes, which is the rewrite
@@ -364,14 +367,38 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 * lose its anchor tomorrow. Rewriting the phrase is what the report's repro
 * verified, so that is what this does.
 *
+* A SECOND FINGERPRINT (measured against the live domestic gateway 2026-10-21)
+*
+* Once the sentence above was rewritten, requests still 400/11128'd, and the
+* blocker turned out to be another region of the same DSH system prompt: the
+* runtime-context sentence pair
+*
+*   You are interacting with the user through the DeepSeek Harness Web GUI
+*   whose URL the runtime context names. When the user refers to "this page",
+*   "this GUI", or "this app" without naming another target, they mean this GUI.
+*
+* The pair is load-bearing: either sentence alone 200s, and so does the pair
+* with any small edit inside it — so this is a second CONTENT fingerprint, not
+* a prompt-length rule and not another header rule. Renaming the product's
+* "Web GUI" to "web interface" is the smallest edit that keeps the meaning for
+* the model and clears the check; it was verified at 200 against both a main
+* agent system prompt and a subagent system prompt, on the same account that
+* reproduced the 400.
+*
+* The same window in an `assistant` message also answers 400, and 200 after
+* this rewrite; `user` and `tool` messages are not scanned. That is why the
+* rewrite is applied to assistant history too — one past reply carrying a
+* fingerprint would otherwise fail every later request in the conversation.
+*
 * The list is an ARRAY because these fingerprints are appended to over time; a
 * future rejection should be one more row here, not a new code path.
 */
-const BANNED_SYSTEM_PHRASES = Object.freeze([[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"]]);
+const BANNED_SYSTEM_PHRASES = Object.freeze([[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"], [/DeepSeek Harness Web GUI/gi, "DeepSeek Harness web interface"]]);
 /**
-* Rewrite fingerprinted system content, leaving everything else byte-identical.
+* Rewrite fingerprinted system/assistant content, leaving everything else
+* byte-identical.
 *
-* System content arrives as either a plain string or an array of content blocks
+* Message content arrives as either a plain string or an array of content blocks
 * (an OpenAI-compatible body allows both), so both shapes are handled — fixing
 * only the string form would miss every request that carries an image or a
 * cache-control block.
@@ -1122,9 +1149,9 @@ var WorkBuddyUpstreamClient = class {
 	* Normalize an OpenAI chat-completions body for the WorkBuddy upstream:
 	* force `stream: true` (the upstream rejects non-streaming), convert the
 	* DSH `developer` role into `system` (upstream rejects `developer` with
-	* business code 11128), rewrite system content the gateway fingerprints as a
-	* non-official client (also 11128), and flatten `tool_choice` into its string
-	* form.
+	* business code 11128), rewrite fingerprinted system/assistant content the
+	* gateway reads as a non-official client (also 11128), and flatten
+	* `tool_choice` into its string form.
 	*
 	* This is the REGION-BLIND half. Everything here is measured good on both
 	* gateways, so it runs before the region is known — the pool lane picks its
@@ -1149,7 +1176,7 @@ var WorkBuddyUpstreamClient = class {
 			if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
 			const message = value;
 			if (message["role"] === "developer") message["role"] = "system";
-			if (message["role"] === "system") message["content"] = sanitizeSystemContent(message["content"]);
+			if (message["role"] === "system" || message["role"] === "assistant") message["content"] = sanitizeSystemContent(message["content"]);
 		}
 		const choice = obj["tool_choice"];
 		if (typeof choice === "string") {
@@ -3512,6 +3539,9 @@ var WorkBuddyAccountPool = class {
 	* the LRU order: re-binding deletes then re-inserts.
 	*/
 	affinity = /* @__PURE__ */ new Map();
+	/** Where the bindings above are persisted; undefined keeps them in memory. */
+	affinityPath;
+	affinitySaveTimer;
 	lastScanAtMs = 0;
 	/**
 	* The account id the user pinned, or undefined for none.
@@ -3621,6 +3651,8 @@ var WorkBuddyAccountPool = class {
 		this.distribution = options.distribution ?? "priority";
 		this.persistent = options.persistent ?? false;
 		this.storePath = accountStorePath();
+		this.affinityPath = options.affinityPath;
+		if (this.affinityPath !== void 0) this.loadAffinity();
 	}
 	/**
 	* Re-apply configuration that only affects discovery and cooldown policy,
@@ -3896,6 +3928,49 @@ var WorkBuddyAccountPool = class {
 			if (oldest === void 0) break;
 			this.affinity.delete(oldest);
 		}
+		this.scheduleAffinitySave();
+	}
+	/**
+	* Restore bindings written by a previous process.
+	*
+	* Tolerant like the other state files: a malformed document or one bad entry
+	* must not take the pool down, and an account id that no longer exists is
+	* simply never matched (the next acquire re-picks and rebinds).
+	*/
+	loadAffinity() {
+		if (this.affinityPath === void 0) return;
+		try {
+			const bindings = JSON.parse(readFileSync(this.affinityPath, "utf8")).bindings;
+			if (typeof bindings !== "object" || bindings === null || Array.isArray(bindings)) return;
+			for (const [key, value] of Object.entries(bindings)) {
+				if (key === "" || typeof value !== "string" || value === "") continue;
+				this.affinity.set(key, value);
+			}
+			while (this.affinity.size > STICKY_AFFINITY_LIMIT) {
+				const oldest = this.affinity.keys().next().value;
+				if (oldest === void 0) break;
+				this.affinity.delete(oldest);
+			}
+		} catch {}
+	}
+	/** Write the bindings back, coalescing a burst into one atomic rename. */
+	scheduleAffinitySave() {
+		if (this.affinityPath === void 0 || this.affinitySaveTimer !== void 0) return;
+		this.affinitySaveTimer = setTimeout(() => {
+			this.affinitySaveTimer = void 0;
+			const path = this.affinityPath;
+			if (path === void 0) return;
+			try {
+				mkdirSync(dirname(path), { recursive: true });
+				writeFileSync(`${path}.tmp`, `${JSON.stringify({
+					version: 1,
+					bindings: Object.fromEntries(this.affinity)
+				}, null, 2)}
+`, "utf8");
+				renameSync(`${path}.tmp`, path);
+			} catch {}
+		}, 500);
+		this.affinitySaveTimer.unref?.();
 	}
 	/**
 	* `sticky`: the account this conversation already used, when it can still
@@ -10601,9 +10676,20 @@ function normalizeRelay(raw) {
 	if (typeof value.port === "number" && Number.isInteger(value.port)) relay.port = value.port;
 	const key = text$5(value.key);
 	if (key !== "") relay.key = key;
+	if (Array.isArray(value.models)) relay.models = normalizeRelayModels(value.models);
 	return Object.keys(relay).length === 0 ? void 0 : relay;
 }
 /**
+* A shared-model list, cleaned: trimmed, de-duplicated, non-strings dropped.
+*
+* One helper for both doors into the field — reading the file and merging a
+* patch — so a list saved from the card is stored exactly as a list loaded from
+* disk would be, and the gateway cannot see two spellings of one selection.
+*/
+function normalizeRelayModels(raw) {
+	return [...new Set(raw.map((entry) => text$5(entry)).filter((entry) => entry !== ""))];
+}
+/**
 * Write the store atomically: a sibling `.tmp` first, then a rename.
 *
 * Same discipline as the ignore list. A process killed mid-write must leave
@@ -10736,6 +10822,7 @@ async function updateRelaySetting(patch) {
 		if (key === "") delete after.key;
 		else after.key = key;
 	}
+	if (patch.models !== void 0) after.models = normalizeRelayModels(patch.models);
 	const next = { ...current };
 	if (Object.keys(after).length === 0) delete next.relay;
 	else next.relay = after;
@@ -17624,7 +17711,10 @@ async function probeModelConnectivity(llm, provider, model, options = {}) {
 			system: "You are being called by a connection test. Answer in one short word.",
 			messages: [{
 				role: "user",
-				content: PROBE_PROMPT
+				content: [{
+					type: "text",
+					text: PROBE_PROMPT
+				}]
 			}],
 			maxTokens: 24,
 			signal: timeout.signal
@@ -18007,6 +18097,259 @@ function paidAlternativeFor(model, models) {
 	return paidSiblingOf(model, models);
 }
 //#endregion
+//#region src/channel-lane.ts
+/**
+* A request this lane will not serve as written, and that is the caller's to fix.
+*
+* Kept as its own type so the route can answer 400 for it: a refused image and a
+* dead upstream must not read the same to a client, and neither must read like a
+* success that quietly dropped the picture.
+*/
+var ChannelRequestError = class extends Error {};
+/** The image types the host's attachment store will hold. */
+const IMAGE_MEDIA_TYPES = /* @__PURE__ */ new Set([
+	"image/png",
+	"image/jpeg",
+	"image/webp",
+	"image/gif"
+]);
+/**
+* Read one OpenAI `image_url` value into the store's input form.
+*
+* Every rejection names itself, because the alternative — dropping the part and
+* continuing — is what let a model answer about an image it never received.
+*/
+function interpretImagePart(url) {
+	const target = url.trim();
+	if (/^https?:\/\//iu.test(target)) return {
+		ok: false,
+		reason: "remote image URLs are not fetched by this gateway; send a base64 data URL"
+	};
+	if (!target.startsWith("data:")) return {
+		ok: false,
+		reason: "only base64 data URLs can be forwarded as images"
+	};
+	const comma = target.indexOf(",");
+	if (comma < 0) return {
+		ok: false,
+		reason: "image data URL has no payload"
+	};
+	const meta = target.slice(5, comma);
+	if (!meta.toLowerCase().includes(";base64")) return {
+		ok: false,
+		reason: "image data URL must be base64-encoded"
+	};
+	const declared = meta.split(";")[0]?.toLowerCase() ?? "";
+	const mediaType = declared === "image/jpg" ? "image/jpeg" : declared;
+	if (!mediaType.startsWith("image/")) return {
+		ok: false,
+		reason: `image part carries a ${mediaType || "unnamed"} payload, not an image`
+	};
+	if (!IMAGE_MEDIA_TYPES.has(mediaType)) return {
+		ok: false,
+		reason: `unsupported image type ${mediaType}; the host stores png, jpeg, webp or gif`
+	};
+	const bytes = Buffer.from(target.slice(comma + 1), "base64");
+	if (bytes.length === 0) return {
+		ok: false,
+		reason: "image payload is empty"
+	};
+	return {
+		ok: true,
+		data: new Uint8Array(bytes),
+		mediaType
+	};
+}
+/** How long a listing is reused before it is asked again. */
+const LISTING_TTL_MS = 6e4;
+/**
+* Build the channel lane.
+*
+* `providers` is supplied rather than derived here: the caller knows which
+* channels are mounted and which are pool-owned, and importing `channels.ts`
+* would pull the pack mount into this module.
+*/
+function createChannelLane(options) {
+	const { llm, providers, toId, attachments, logger } = options;
+	const cache = /* @__PURE__ */ new Map();
+	const inflight = /* @__PURE__ */ new Map();
+	const fetchRows = (channel) => {
+		const hit = cache.get(channel);
+		if (hit !== void 0 && Date.now() - hit.at < LISTING_TTL_MS) return Promise.resolve(hit.rows);
+		const running = inflight.get(channel);
+		if (running !== void 0) return running;
+		const tracked = llm.listModels(channel).then((models) => models.map((model) => ({
+			id: toId(channel, model.id),
+			channel,
+			modelId: model.id,
+			name: model.name ?? model.id
+		}))).catch((error) => {
+			logger?.warn?.(`dsh-xdpool: channel ${channel} listed no models: ${String(error)}`);
+			return [];
+		}).then((rows) => {
+			cache.set(channel, {
+				at: Date.now(),
+				rows
+			});
+			inflight.delete(channel);
+			return rows;
+		});
+		inflight.set(channel, tracked);
+		return tracked;
+	};
+	return {
+		rows: async () => (await Promise.all(providers().map(fetchRows))).flat(),
+		resolve: (id) => {
+			const separator = id.indexOf(":");
+			if (separator <= 0 || separator === id.length - 1) return void 0;
+			const channel = id.slice(0, separator);
+			if (!providers().includes(channel)) return void 0;
+			return {
+				channel,
+				modelId: id.slice(separator + 1)
+			};
+		},
+		turn: (input) => runTurn({
+			llm,
+			attachments: attachments?.(),
+			...input
+		})
+	};
+}
+/**
+* Forward one OpenAI message as the host's typed content blocks.
+*
+* Text and image parts carry over. Anything else is dropped rather than
+* guessed at: inventing a block shape the provider was never told about fails
+* upstream with an error that names neither the message nor the part.
+*
+* An image that cannot be carried is a refusal, not a drop — see the module
+* note on why `{ type: 'image', url }` was the wrong answer.
+*/
+async function toHostMessage(message, attachments) {
+	const role = typeof message.role === "string" ? message.role : "user";
+	const content = message.content;
+	if (typeof content === "string") return {
+		role,
+		content: content === "" ? [] : [{
+			type: "text",
+			text: content
+		}]
+	};
+	if (!Array.isArray(content)) return {
+		role,
+		content: []
+	};
+	const blocks = [];
+	for (const part of content) {
+		if (typeof part !== "object" || part === null) continue;
+		const block = part;
+		if (block.type === "text" && typeof block.text === "string") {
+			blocks.push({
+				type: "text",
+				text: block.text
+			});
+			continue;
+		}
+		if (block.type === "image_url" && typeof block.image_url === "object" && block.image_url !== null) {
+			const url = block.image_url.url;
+			if (typeof url !== "string" || url.trim() === "") continue;
+			if (attachments === void 0) throw new ChannelRequestError("this gateway build has no attachment store, so images cannot be forwarded");
+			const reading = interpretImagePart(url);
+			if (!reading.ok) throw new ChannelRequestError(reading.reason);
+			const ref = await attachments.saveImage({
+				data: reading.data,
+				mediaType: reading.mediaType
+			});
+			blocks.push({
+				type: "image",
+				attachment: ref
+			});
+		}
+	}
+	return {
+		role,
+		content: blocks
+	};
+}
+/** The host's finish reason, in the OpenAI spelling. */
+function mapFinishReason(reason) {
+	const kind = typeof reason === "object" && reason !== null ? reason.kind : reason;
+	if (kind === "toolUse" || kind === "tool_use") return "tool_calls";
+	if (kind === "length") return "length";
+	if (kind === "aborted") return "abort";
+	return "stop";
+}
+/** Fold host chunks into OpenAI delta objects. */
+function toChannelEvent(chunk) {
+	switch (chunk.type) {
+		case "text-delta": return {
+			kind: "delta",
+			delta: { content: String(chunk.text ?? "") }
+		};
+		case "reasoning-delta": return {
+			kind: "delta",
+			delta: { reasoning_content: String(chunk.text ?? "") }
+		};
+		case "tool-call-delta": {
+			const id = String(chunk.id ?? "");
+			const name = typeof chunk.name === "string" ? chunk.name : void 0;
+			const fn = { arguments: String(chunk.argumentsDelta ?? "") };
+			if (name !== void 0 && name !== "") fn.name = name;
+			const call = {
+				index: 0,
+				function: fn
+			};
+			if (id !== "") call.id = id;
+			return {
+				kind: "delta",
+				delta: { tool_calls: [call] }
+			};
+		}
+		case "usage": {
+			const usage = chunk.usage;
+			if (usage === void 0) return void 0;
+			const prompt = Number(usage.input ?? usage.inputTokens ?? 0);
+			const completion = Number(usage.output ?? usage.outputTokens ?? 0);
+			return {
+				kind: "usage",
+				usage: {
+					prompt_tokens: prompt,
+					completion_tokens: completion,
+					total_tokens: Number(usage.total ?? usage.totalTokens ?? prompt + completion)
+				}
+			};
+		}
+		case "finish": return {
+			kind: "done",
+			finishReason: mapFinishReason(chunk.reason)
+		};
+		default: return;
+	}
+}
+/** Drive one turn through the host seam. */
+async function* runTurn(input) {
+	const { llm, channel, modelId, body, signal, attachments } = input;
+	const incoming = Array.isArray(body.messages) ? body.messages : [];
+	const converted = [];
+	for (const message of incoming) converted.push(await toHostMessage(message, attachments));
+	const system = converted.filter((message) => message.role === "system");
+	const options = {
+		provider: channel,
+		model: modelId,
+		messages: converted.filter((message) => message.role !== "system"),
+		signal
+	};
+	if (system.length > 0) options.system = system[0].content;
+	if (typeof body.max_tokens === "number") options.maxTokens = body.max_tokens;
+	if (typeof body.temperature === "number") options.temperature = body.temperature;
+	if (Array.isArray(body.tools) && body.tools.length > 0) options.tools = body.tools;
+	for await (const chunk of llm.stream(options)) {
+		const event = toChannelEvent(chunk);
+		if (event !== void 0) yield event;
+	}
+}
+//#endregion
 //#region src/shim.ts
 /**
 * Loopback OpenAI-compatible endpoint with multi-account failover.
@@ -18023,7 +18366,74 @@ function paidAlternativeFor(model, models) {
 *
 * @module dsh-xdpool/shim
 */
+/**
+* The namespace the gateway lists POOL rows under.
+*
+* The listing already speaks three prefixes — `combo:<slug>` for a chain,
+* `free:<model>` for the keyless lane, and a composite `providerId/modelId` for
+* every aggregate row — and only the pool's own models were listed bare. A
+* client reading `/v1/models` therefore could tell three lanes apart and could
+* not tell the fourth from anything else, which is the opposite of what a
+* listing is for.
+*
+* A prefix rather than a slash, because the slash IS the aggregate
+* discriminator: `parseProviderModelId` splits on the first `/`, so a prefixed
+* id spelled with a slash would be read as an aggregate row and sent to the
+* wrong lane.
+*
+* `buddy:` because that is what this lane is. `REGISTERED_CHANNELS` in
+* `channels.ts` gives `buddy` to WorkBuddy 国内版 (`copilot.tencent.com`) and
+* `workbuddy` to 国际版, and the relay is wired to `shims.cn` — the domestic
+* pool. Naming the lane after the vendor rather than after the mechanism keeps it
+* consistent with every channel row the gateway lists, and it leaves `workbuddy:`
+* free for the international pool whenever `shims.global` is exposed too.
+*
+* Bare pool ids keep being accepted. Clients configured before this existed are
+* not broken by it; they are just no longer the only way to say it.
+*/
+const POOL_MODEL_PREFIX = "buddy:";
+/**
+* The lane this shim's pool rows belong to, spelled the way the channel registry
+* spells it. Exported so the card and the channel listing can agree on which
+* channel ids the pool already covers instead of each keeping its own list.
+*/
+const POOL_LANE_CHANNEL_ID = "buddy";
+/**
+* Prefixes reserved for lane routing. A channel must not be listed under one of
+* these, because its rows would then be indistinguishable from the lane that
+* owns the prefix.
+*/
+const RESERVED_MODEL_PREFIXES = [
+	POOL_MODEL_PREFIX,
+	FREE_MODEL_PREFIX,
+	`${COMBO_CHANNEL}:`
+];
+/**
+* Whether one channel id is already spoken for by a lane.
+*
+* The pool-owned ids are the interesting case rather than an accident: `buddy`
+* and `workbuddy` ARE account pools this plugin serves itself, so listing them
+* again as channels would offer the same models twice under two routes.
+*/
+function channelListableAsRows(channelId, poolOwned = /* @__PURE__ */ new Set([POOL_LANE_CHANNEL_ID])) {
+	if (poolOwned.has(channelId)) return false;
+	return !RESERVED_MODEL_PREFIXES.includes(`${channelId}:`);
+}
 const REQUEST_BODY_LIMIT = 67108864;
+/**
+* Marked by the LAN relay on every request it forwards.
+*
+* Defined here rather than in `relay.ts` because the shim has to READ it, and
+* `relay.ts` already depends on this module — importing back would be a cycle.
+*
+* It is also the only safe way to scope the gateway allowlist. This one process
+* serves two very different callers: the host's own adapter (so every model
+* DSH's picker offers, and every turn the user has in chat) and, through the
+* relay, whatever device on the LAN holds the key. Gating the shim outright
+* would gate the user's own chat with it; gating on this header restricts the
+* LAN surface and leaves the host untouched.
+*/
+const RELAY_HOP_HEADER = "x-xdpool-relay-hop";
 const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
 	"127.0.0.1",
 	"localhost",
@@ -18179,6 +18589,8 @@ function createWorkBuddyShim(options) {
 	const logger = options.logger;
 	const aggregate = options.aggregate;
 	const extra = options.extra;
+	const channels = options.channels;
+	const lanModels = options.lanModels;
 	const maxAttempts = options.maxAttempts ?? 8;
 	const SHARED_SECRET = randomBytes(32).toString("base64url");
 	function bearerOk(req) {
@@ -18314,6 +18726,153 @@ function createWorkBuddyShim(options) {
 		res.end();
 	}
 	/**
+	* Serve one login-channel turn.
+	*
+	* The lane yields already-translated events; this function owns the wire. It
+	* writes each delta as it arrives rather than collecting first, because
+	* time-to-first-token is the entire reason a client points at a gateway, and
+	* buffering would make a channel feel slower than using it through the picker.
+	*
+	* `stream: false` is honoured here — one `chat.completion`, no SSE. The pool
+	* lane forces streaming (`prepareChatBody`), so the two lanes differ on
+	* purpose; making the channel lane copy that deviation would mean a client's
+	* parse strategy depended on which lane a model happened to sit in.
+	*/
+	async function serveChannelCompletion(res, raw, modelId, target, signal) {
+		if (channels === void 0) return;
+		let body;
+		try {
+			body = JSON.parse(raw);
+		} catch {
+			body = {};
+		}
+		const nonStreaming = body.stream === false;
+		const created = Math.floor(Date.now() / 1e3);
+		const completionId = `chatcmpl-xdpool-${randomBytes(6).toString("base64url")}`;
+		let text = "";
+		let reasoning = "";
+		let toolCalls = [];
+		let usage;
+		let finish = "stop";
+		let started = false;
+		/** Open the SSE body on the first delta, so an early failure is a status. */
+		const begin = () => {
+			if (started || nonStreaming) return;
+			started = true;
+			res.writeHead(200, {
+				"Content-Type": "text/event-stream",
+				"Cache-Control": "no-cache",
+				"Connection": "keep-alive",
+				"X-Accel-Buffering": "no"
+			});
+		};
+		const writeFrame = (payload) => {
+			begin();
+			if (started) res.write(`data: ${JSON.stringify(payload)}\n\n`);
+		};
+		const chunk = (delta, reason) => ({
+			id: completionId,
+			object: "chat.completion.chunk",
+			created,
+			model: target.modelId,
+			choices: [{
+				index: 0,
+				delta,
+				finish_reason: reason
+			}],
+			usage: null
+		});
+		try {
+			for await (const event of channels.turn({
+				channel: target.channel,
+				modelId: target.modelId,
+				body,
+				signal
+			})) {
+				if (event.kind === "usage") {
+					usage = event.usage;
+					continue;
+				}
+				if (event.kind === "done") {
+					finish = event.finishReason;
+					continue;
+				}
+				const delta = event.delta;
+				if (typeof delta.content === "string") text += delta.content;
+				if (typeof delta.reasoning_content === "string") reasoning += delta.reasoning_content;
+				if (Array.isArray(delta.tool_calls)) for (const call of delta.tool_calls) {
+					const index = Number(call.index ?? toolCalls.length);
+					toolCalls[index] = mergeToolCallFragment(toolCalls[index] ?? {}, call);
+				}
+				if (!nonStreaming) writeFrame(chunk(delta, ""));
+			}
+		} catch (error) {
+			if (started) {
+				res.write("data: [DONE]\n\n");
+				res.end();
+				return;
+			}
+			const message = error instanceof Error ? error.message : String(error);
+			if (error instanceof ChannelRequestError) {
+				writeOpenAIError(res, 400, "invalid_request", message);
+				return;
+			}
+			writeOpenAIError(res, 502, "channel_upstream_error", `channel ${target.channel}: ${message}`);
+			return;
+		}
+		if (nonStreaming) {
+			writeJson$1(res, 200, {
+				id: completionId,
+				object: "chat.completion",
+				created,
+				model: target.modelId,
+				choices: [{
+					index: 0,
+					message: {
+						role: "assistant",
+						content: text === "" && toolCalls.length > 0 ? null : text,
+						...reasoning === "" ? {} : { reasoning_content: reasoning },
+						...toolCalls.length === 0 ? {} : { tool_calls: toolCalls }
+					},
+					finish_reason: finish
+				}],
+				...usage === void 0 ? {} : { usage }
+			});
+			return;
+		}
+		begin();
+		res.write(`data: ${JSON.stringify(chunk({}, finish))}\n\n`);
+		if (usage !== void 0) res.write(`data: ${JSON.stringify({
+			...chunk({}, finish),
+			usage
+		})}\n\n`);
+		res.write("data: [DONE]\n\n");
+		res.end();
+	}
+	/**
+	* Fold one tool-call fragment into its slot.
+	*
+	* The host streams a call as an opening fragment carrying `name` then argument
+	* deltas that do not, so the name must survive the merge while the argument
+	* strings concatenate in arrival order.
+	*/
+	function mergeToolCallFragment(existing, fragment) {
+		const before = existing.function ?? {};
+		const next = fragment.function ?? {};
+		const merged = {
+			...existing,
+			...fragment,
+			function: {
+				...before,
+				...next,
+				arguments: `${String(before.arguments ?? "")}${String(next.arguments ?? "")}`
+			}
+		};
+		if (typeof fragment.id === "string" && fragment.id !== "") merged.id = fragment.id;
+		else if (typeof existing.id === "string") merged.id = existing.id;
+		return merged;
+	}
+	/**
 	* Serve one aggregate turn: forward to the provider, stream back verbatim.
 	*
 	* No account rotation and no compaction retry. The first is honest — the key
@@ -18398,6 +18957,74 @@ function createWorkBuddyShim(options) {
 			pool.noteCredits(account.id, credits.total, credits.nearestExpiryMs);
 		} catch {}
 	}
+	/**
+	* Whether this request came in through the LAN relay.
+	*
+	* The relay stamps the header on what it forwards and strips any client-supplied
+	* copy, so this is a fact about the path the request took rather than something
+	* a caller can claim.
+	*/
+	const fromLan = (req) => req.headers[RELAY_HOP_HEADER] !== void 0;
+	/**
+	* The allowlist LAN clients are held to, or undefined when there is none.
+	*
+	* `undefined` covers both "the build has no allowlist wired" and "the user has
+	* never chosen one", and both mean serve everything — a gateway that answered
+	* 403 to every model before the user had seen the picker would look like the
+	* feature is broken rather than unset. A throwing reader is treated the same
+	* way: refusing a whole gateway over an unreadable file is worse than serving
+	* it, because the user cannot fix what they cannot reach.
+	*/
+	const lanAllowlist = () => {
+		if (lanModels === void 0) return void 0;
+		try {
+			const list = lanModels();
+			return list === void 0 ? void 0 : new Set(list);
+		} catch {
+			return;
+		}
+	};
+	/**
+	* Everything this shim could serve, with the name a human would recognise.
+	*
+	* One function for two consumers on purpose. `/v1/models` needs the ids, and
+	* the card's Gateway picker needs the ids AND the display name — a channel
+	* model is `qfmodel` on the wire but reads `Qwen3.8-Flash · 免费` everywhere the
+	* user has seen it so far. If the picker assembled its own list, the two would
+	* drift, and the failure would be invisible: the card offers a model the
+	* gateway then refuses, or hides one it serves.
+	*
+	* `source` is the value `/v1/models` reports as `owned_by`, and also what the
+	* picker groups rows under.
+	*/
+	async function roster() {
+		const entries = [];
+		for (const model of catalog.visible()) entries.push({
+			id: `${POOL_MODEL_PREFIX}${model.id}`,
+			name: model.name ?? model.id,
+			source: "workbuddy"
+		});
+		if (aggregate !== void 0) for (const row of aggregate.catalog.current()) entries.push({
+			id: row.id,
+			name: row.name ?? row.id,
+			source: isComboRow(row) ? COMBO_CHANNEL : row.providerId
+		});
+		if (extra !== void 0) for (const row of extra.free.current()) entries.push({
+			id: row.modelId,
+			name: row.name ?? row.modelId,
+			source: FREE_CHANNEL
+		});
+		if (channels !== void 0) try {
+			for (const row of await channels.rows()) entries.push({
+				id: row.id,
+				name: row.name,
+				source: row.channel
+			});
+		} catch (error) {
+			logger?.warn?.(`dsh-xdpool: channel listing failed: ${String(error)}`);
+		}
+		return entries;
+	}
 	async function handle(req, res) {
 		try {
 			if (!hostIsLoopback(req.headers.host)) {
@@ -18421,30 +19048,16 @@ function createWorkBuddyShim(options) {
 				return;
 			}
 			if (req.method === "GET" && (url === "/v1/models" || url === "/v1/models/")) {
-				const rows = catalog.current().map((model) => ({
-					id: model.id,
+				const rows = (await roster()).map((entry) => ({
+					id: entry.id,
 					object: "model",
 					created: 0,
-					owned_by: "workbuddy"
+					owned_by: entry.source
 				}));
-				if (aggregate !== void 0) for (const row of aggregate.catalog.current()) {
-					const ownedBy = isComboRow(row) ? COMBO_CHANNEL : row.providerId;
-					rows.push({
-						id: row.id,
-						object: "model",
-						created: 0,
-						owned_by: ownedBy
-					});
-				}
-				if (extra !== void 0) for (const row of extra.free.current()) rows.push({
-					id: row.modelId,
-					object: "model",
-					created: 0,
-					owned_by: FREE_CHANNEL
-				});
+				const allowed = fromLan(req) ? lanAllowlist() : void 0;
 				writeJson$1(res, 200, {
 					object: "list",
-					data: rows
+					data: allowed === void 0 ? rows : rows.filter((row) => allowed.has(row.id))
 				});
 				return;
 			}
@@ -18603,6 +19216,13 @@ function createWorkBuddyShim(options) {
 		} catch {
 			modelId = void 0;
 		}
+		if (fromLan(req)) {
+			const allowed = lanAllowlist();
+			if (allowed !== void 0 && (modelId === void 0 || !allowed.has(modelId))) {
+				writeOpenAIError(res, 403, "model_not_shared", modelId === void 0 ? "no model was named, and this gateway only serves the models shared on its XD Pool card" : `${modelId} is not shared on this gateway; enable it in XD Pool → Gateway`);
+				return;
+			}
+		}
 		const comboRow = aggregate === void 0 || modelId === void 0 ? void 0 : aggregate.catalog.findCombo(modelId);
 		if (comboRow !== void 0) {
 			await serveComboCompletion(res, raw, comboRow, controller.signal);
@@ -18627,8 +19247,28 @@ function createWorkBuddyShim(options) {
 			writeOpenAIError(res, 503, `${lane}_unavailable`, lane === "free" ? `${modelId} is not available right now; the free lane's model listing is refreshed on the XD Pool card` : `${modelId} is not available right now; sign in to the co-paid lane on the XD Pool card`);
 			return;
 		}
-		const prepared = client.prepareChatBodyFor(raw, region ?? "cn");
-		const conversationKey = conversationKeyOf(raw);
+		if (channels !== void 0 && modelId !== void 0) {
+			const target = channels.resolve(modelId);
+			if (target !== void 0) {
+				await serveChannelCompletion(res, raw, modelId, target, controller.signal);
+				return;
+			}
+		}
+		let poolRaw = raw;
+		if (modelId !== void 0 && modelId.startsWith("buddy:")) {
+			const bare = modelId.slice(6);
+			if (bare === "" || bare.startsWith("free:") || isComboId(bare) || bare.includes("/")) {
+				writeOpenAIError(res, 404, "model_not_found", `${modelId} is not a pool model`);
+				return;
+			}
+			modelId = bare;
+			poolRaw = JSON.stringify({
+				...JSON.parse(raw),
+				model: bare
+			});
+		}
+		const prepared = client.prepareChatBodyFor(poolRaw, region ?? "cn");
+		const conversationKey = conversationKeyOf(poolRaw);
 		const tried = [];
 		let last;
 		const turnId = randomBytes(8).toString("hex");
@@ -18732,6 +19372,7 @@ function createWorkBuddyShim(options) {
 	return {
 		ready,
 		baseUrl,
+		roster,
 		token: () => SHARED_SECRET,
 		close: () => new Promise((resolve, reject) => {
 			server.close(() => resolve());
@@ -19026,12 +19667,6 @@ async function recoverFromContextOverrun(options) {
 * @module dsh-xdpool/relay
 */
 /**
-* Marked on every forwarded request so a relay pointed at its own address
-* refuses instead of looping. A client has no reason to send it, and refusing
-* is cheaper than debugging a request storm you caused by accident.
-*/
-const RELAY_HOP_HEADER = "x-xdpool-relay-hop";
-/**
 * The only paths this relay forwards.
 *
 * Deliberately exactly the routes the shim serves. Anything else is refused
@@ -19292,6 +19927,37 @@ function createPoolRelay(options) {
 function newRelayKey() {
 	return randomBytes(32).toString("base64url");
 }
+/**
+* Compose the relay document the Gateway card renders.
+*
+* Extracted, and awaited HERE, because the bug this shape exists to prevent is
+* invisible at the call site: `status()` is async, and
+* `{ ...relay.status(), candidates }` spreads a PENDING PROMISE, which yields no
+* own properties at all. The document then carries the new fields and silently
+* drops `enabled`, `listening`, `host`, `port`, `key` and `error` — a card with no
+* switch, no key and no endpoint, served over HTTP 200 with nothing to indicate it
+* broke. This happened when the picker was added; the assertions below are the
+* reason it cannot happen quietly again.
+*
+* Every input is a function so a test can hand it a rejecting roster and still
+* require the rest of the document to arrive.
+*/
+async function relayDocumentOf(input) {
+	const status = await input.status();
+	let candidates;
+	try {
+		candidates = await input.roster();
+	} catch (error) {
+		input.warn?.(error);
+		candidates = [];
+	}
+	const shared = input.shared();
+	return {
+		...status,
+		candidates,
+		...shared === void 0 ? {} : { shared }
+	};
+}
 //#endregion
 //#region src/status.ts
 /** Build the status document. Never throws. */
@@ -20034,7 +20700,8 @@ function createCore(logger) {
 	const pool = new WorkBuddyAccountPool({
 		...logger === void 0 ? {} : { logger },
 		client,
-		persistent: true
+		persistent: true,
+		affinityPath: join(pluginDataDir(), "sticky-affinity.json")
 	});
 	return {
 		pool,
@@ -20271,6 +20938,35 @@ function apply(ctx, config = {}) {
 	aggregateCatalog.refresh();
 	const freeCatalog = new FreeCatalog();
 	const freeLane = createFreeLaneSource(freeCatalog, ctx.logger, usageRecorder);
+	/**
+	* The login channels, for the LAN gateway.
+	*
+	* Reached through `ctx.llm` rather than a socket: the pack registers each
+	* channel as a host adapter, so the host is the only thing that knows the
+	* credential, the endpoint and the wire dialect.
+	*
+	* The two pool-owned ids are left out on purpose. `buddy` and `workbuddy` ARE
+	* account pools this plugin already serves, so listing them again as channels
+	* would offer the same models twice under two routes — and `buddy:` is already
+	* the prefix the pool lane's own rows carry.
+	*/
+	const channelLane = createChannelLane({
+		llm: ctx.llm,
+		providers: () => REGISTERED_CHANNELS.map((channel) => channel.id).filter((id) => channelListableAsRows(id, POOL_OWNED_CHANNELS)),
+		toId: (channel, modelId) => `${channel}:${modelId}`,
+		attachments: () => ctx.get("attachments"),
+		logger: ctx.logger
+	});
+	/**
+	* The gateway allowlist, re-read per request.
+	*
+	* `undefined` and `[]` are deliberately NOT collapsed: the first means the
+	* user has never opened the picker, and the second means they unticked
+	* everything. Reading the stored field directly rather than through
+	* `relaySettingsOf` is what preserves that, since the relay's own settings
+	* object has no reason to carry a list it never consults.
+	*/
+	const lanModelsOf = () => readAggregateSettingsSync().relay?.models;
 	const shims = {
 		cn: createWorkBuddyShim({
 			pool: core.pool,
@@ -20283,7 +20979,9 @@ function apply(ctx, config = {}) {
 				catalog: aggregateCatalog,
 				readStore: () => readAggregateSettingsSync()
 			},
-			extra: { free: freeLane }
+			extra: { free: freeLane },
+			channels: channelLane,
+			lanModels: lanModelsOf
 		}),
 		global: createWorkBuddyShim({
 			pool: core.pool,
@@ -20330,6 +21028,19 @@ function apply(ctx, config = {}) {
 	relay.ready.catch((error) => {
 		ctx.logger.warn(`xdpool relay: startup failed — ${String(error)}`);
 	});
+	/**
+	* The relay document the Gateway card reads.
+	*
+	* One loader for BOTH routes rather than a per-route assembly: the card takes
+	* the write response as the new state, so a save that answered with only the
+	* listener status dropped the picker's roster off the card until the next poll.
+	*/
+	const relayDocument = () => relayDocumentOf({
+		status: () => relay.status(),
+		shared: () => readAggregateSettingsSync().relay?.models,
+		roster: () => shim.roster(),
+		warn: (error) => ctx.logger.warn("dsh-xdpool: gateway roster failed", error)
+	});
 	ctx.inject(["webServer"], (webCtx) => registerPoolStatusRoute(webCtx, {
 		pool: core.pool,
 		catalogs: core.catalogs,
@@ -20530,7 +21241,15 @@ function apply(ctx, config = {}) {
 		},
 		billionDocument: readBillionStatus,
 		/**
-		* Relay state and patches.
+		* Relay state plus the gateway's model picker.
+		*
+		* The candidates come from the shim's own roster rather than a parallel
+		* assembly here, so the card cannot offer a model the gateway would then
+		* refuse — the exact drift the picker exists to prevent.
+		*/
+		relayDocument,
+		/**
+		* Apply one patch from the card and answer with the fresh document.
 		*
 		* The write path mints a key when the card asks for a rotation and the user
 		* has never had one: an enabled relay with no key would have to either refuse
@@ -20538,7 +21257,6 @@ function apply(ctx, config = {}) {
 		* one keeps "enabled" honest, and the card shows it so it can be pasted into
 		* the other device.
 		*/
-		relayDocument: async () => relay.status(),
 		saveRelay: async (patch) => {
 			const before = readAggregateSettingsSync().relay ?? {};
 			const key = patch.key === "" ? newRelayKey() : patch.key;
@@ -20546,10 +21264,11 @@ function apply(ctx, config = {}) {
 				...patch.enabled === void 0 ? {} : { enabled: patch.enabled },
 				...patch.host === void 0 ? {} : { host: patch.host },
 				...patch.port === void 0 ? {} : { port: patch.port },
-				key: key ?? before.key ?? newRelayKey()
+				key: key ?? before.key ?? newRelayKey(),
+				...patch.models === void 0 ? {} : { models: patch.models }
 			});
 			await relay.sync();
-			return relay.status();
+			return relayDocument();
 		}
 	}));
 	api = {