[MYCF711]

What

Three changes to how a refused chat is handled, all driven by measurements against copilot.tencent.com (2026-10-30, real accounts, streamed, deepseek-v4.1-flash, reasoning_effort: max).

1. DeepSeek Harness's opener keeps the harness's name

DSH's system prompt opens with

You are an AI agent powered by DeepSeek Harness.

which WorkBuddy refuses as 11128 Illegal API invocation from an unapproved channel (plugins#279). The plugin already rewords it, but it reworded it into

You are an AI agent that helps the user with programming tasks.

which takes the harness's name out of the only line that says which agent is running. WorkBuddy matches a refused line whole and exactly — the plugin's own note on FLAGGED says one extra space lets it through — so a comma is enough:

system prompt	result
You are an AI agent powered by DeepSeek Harness.	400 {"code":11128,…}
You are an AI agent, powered by DeepSeek Harness.	200

2. A refusal of words not reworded yet is answered with a comma before the system prompt moves

The next thing tried used to be the destructive one: move the whole system prompt into the first user message and put You are a helpful assistant. in its place. That costs the agent the slot its instructions are read in. Now the same words are said with one more comma first (OPENERS), and only a chat still refused is moved.

Measured that a word added after the product name is not what passes:

tried	result
…powered by DeepSeek Harness Desktop.	400
…powered by DeepSeek Harness CLI.	400
…powered by Claude Code.	200
…powered by FooBar.	200

So the trigger is a shape plus a name; break either and it passes. Adding Desktop buys nothing, which is why the fix changes the shape, not the wording.

3. A refusal carries the address of its own fix

REFUSED.md (new) says what the check reads, the shapes measured to pass and to fail, the two errors that look like this one and are not (11101 non-stream; 11128 "first message is not system prompt"), and how to turn such a line off in the agent that emits it. The refusal's message now names that file — before the hint, never after it, because magpie's Routing page matches the hint by the message ending in it:

// Routing client.js
const hint = HINTS.find((h) => tr.error.endsWith(" — " + h));

So a user can paste the error at their own agent and the agent can go read the fix.

Tests

267 pass, 0 fail   (HOME=$(mktemp -d) bun test, 26 files)
✓ bun scripts/check.mjs workbuddy

New: comma.test.mjs (the comma goes in, the harness's name survives, a chat with nothing of the kind is not resent, commaPaused reaches a message's parts), plus a test in systemasuser.test.mjs that an opening FLAGGED doesn't know is said with a comma and the system message keeps its slot — the behaviour this changes — and assertions that a refusal still ends in the hint with the doc address before it.

Note for reviewers

The REFUSED.md URL points at main; it resolves once this is merged. Until then the link 404s for anyone reading a refusal from the branch build.

[yetone]

Thanks @MYCF711! Merged at 4830b16. 257/257 tests pass on main, and the unflag tests go red with the old wording. A real deepseek-v4.1-flash request through workbuddy-ai came back 200. workbuddy 0.2.2 is on npm, and magpie v0.1.2161 raises the WorkBuddy mover's min to it. Not tried on the China site (our account there answers 401), so that case rests on your 400→200 measurement.

[MYCF711]

Verified on my side.

• Merge: 79b02cc on main (2026-10-30T06:30:38Z), not 4830b16. 4830b16 was the branch commit; the merge squashed it, and GET /commits/4830b16/branches-where-head returns [] — it does not exist on main. Only matters if something references the SHA.
• npm: @magpie-community/opencode-workbuddy-auth@0.2.2 is latest, published 06:34:55Z (4 min after the merge). packages/workbuddy/package.json on main reads "version": "0.2.2".

China site: no account there either, so that half stays uncovered. I am not claiming it.

One signal worth watching: #feedback has a message at 07:02Z from wong — "workbuddy用不了了" — 27 minutes after 0.2.2 hit npm. No error text yet, so I am not calling it a regression. First report after the publish, that is all.

On the min raise: I could not verify it here. internal/provider/migrate_workbuddy*.go still reads min: "0.1.40" on origin/main 1bbaded6. If the raise lives elsewhere, point me at the file and I will re-check.