dsh-connect-workbuddy 3.4.2 → 3.4.4

package/lib/{host-heartbeat-Sq5JwluI.js → host-heartbeat-DTuwptkM.js}

@@ -1,7 +1,7 @@
 import { readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { createDecipheriv, createHash } from "node:crypto";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, win32 } from "node:path";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { execFile, execFileSync } from "node:child_process";
@@ -202,6 +202,167 @@ function macosBundleExecutable(bundle) {
 	return join(bundle, "Contents", "MacOS", name);
 }
 /**
+* The executable path WorkBuddy's own uninstall registration points at, or
+* undefined when the app was never registered.
+*
+* Why this exists: the four directory candidates in
+* {@link workbuddyAppExecutableCandidates} encode the DEFAULT install layout.
+* An app installed anywhere else — a second drive (the observed case was
+* `E:\workbuddy\WorkBuddy.exe`) — is installed and signed in, yet every
+* candidate misses, so the encrypted credential file cannot be opened and a
+* user who IS signed in is reported as signed out. The README's answer was to
+* set `WORKBUDDY_APP_EXECUTABLE` by hand; the installer already recorded the
+* answer, so this reads it instead.
+*
+* The registration is the app's own claim about itself, which is what makes it
+* safe to hand the path to the credential probe: a display name alone would be
+* a guess, whereas the path here was written by the installer that placed the
+* binary. The value is still checked against {@link APP_EXECUTABLE_NAME} and for
+* existence before use, and the callers fall through to the documented hint when
+* it is absent.
+*
+* The read is done through ALL THREE uninstall views, because the hive a
+* registration lands in depends on how the app was installed: per-user
+* (`/currentuser`, the layout WorkBuddy uses) registers under `HKCU`, a
+* machine-wide install under `HKLM`, and a 32-bit machine-wide one under
+* `HKLM\...\WOW6432Node`. A hive that does not exist or is unreadable is the
+* normal case on a machine without the app, not an error: every failure path
+* returns undefined so the caller can try the next candidate.
+*/
+function windowsRegistryAppExecutable(query = queryRegistry) {
+	for (const root of [
+		"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+		"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+		"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
+	]) {
+		const listing = query([
+			"query",
+			root,
+			"/s",
+			"/f",
+			"WorkBuddy",
+			"/t",
+			"REG_SZ"
+		]);
+		if (listing === void 0) continue;
+		const executable = registryExecutableFromQuery(listing);
+		if (executable !== void 0) return executable;
+		const fromDirectory = registryInstallLocationFromQuery(listing);
+		if (fromDirectory !== void 0) return fromDirectory;
+	}
+}
+/**
+* Parse `reg query` output for the value that names the installed executable.
+*
+* `reg query` prints keys as `HKEY_CURRENT_USER\...\Uninstall\<id>` followed by
+* indented `    ValueName    REG_SZ    Data` lines. Only `DisplayIcon` is
+* trusted here: it is the one value the installer writes pointing AT the
+* binary. The value is normalised by {@link normalizeRegistryExecutable}, which
+* strips the quotes and the icon index and rejects anything that is not the
+* desktop executable.
+*/
+function registryExecutableFromQuery(output) {
+	for (const rawLine of output.split(/\r?\n/u)) {
+		const match = /^\s*DisplayIcon\s+REG_SZ\s+(.*?)\s*$/u.exec(rawLine);
+		if (match === null) continue;
+		const executable = normalizeRegistryExecutable(match[1]);
+		if (executable !== void 0) return executable;
+	}
+}
+/**
+* The `WorkBuddy.exe` under an `InstallLocation`-style registry directory.
+*
+* Kept separate from {@link registryExecutableFromQuery} because the two values
+* mean different things: `DisplayIcon` NAMES a file, whereas the directory has
+* to have {@link APP_EXECUTABLE_NAME} joined onto it, and the result must still
+* be checked for existence by the caller's probe.
+*
+* `win32.join` rather than the host's `join`: the input is a Windows registry
+* value on EVERY machine this function can be called on. `path.join` is the
+* running platform's, so a suite on Linux/macOS would mangle `E:\workbuddy`
+* into `E:\workbuddy/WorkBuddy.exe` and the caller's `existsSync` could never
+* match it. The separator here is fixed by the DATA, not by the host.
+*/
+function registryInstallLocationFromQuery(output) {
+	for (const rawLine of output.split(/\r?\n/u)) {
+		const match = /^\s*InstallLocation\s+REG_SZ\s+(.*?)\s*$/u.exec(rawLine);
+		if (match === null) continue;
+		const directory = stripRegistryQuotes(match[1]);
+		if (directory === void 0 || directory === "") continue;
+		return win32.join(directory, APP_EXECUTABLE_NAME);
+	}
+}
+/**
+* A registry executable value reduced to a usable path, or undefined when it
+* cannot be one.
+*
+* `DisplayIcon` is stored as `"E:\workbuddy\WorkBuddy.exe",0`. The quotes and
+* the icon index are stripped, and a value that names something other than the
+* desktop executable — an `.ico`, an uninstaller, another product's binary — is
+* rejected rather than launched. A bare path without quotes is accepted too,
+* because not every installer writes the indexed form.
+*
+* The basename test uses `win32.basename` for the reason given on
+* {@link registryInstallLocationFromQuery}: the separator belongs to the
+* registry value (always Windows), so the host's `basename` — which does not
+* treat `\` as a separator — would return the whole string and reject every
+* legitimate path.
+*/
+function normalizeRegistryExecutable(value) {
+	const unquoted = stripRegistryQuotes(value);
+	if (unquoted === void 0 || unquoted === "") return void 0;
+	const withoutIndex = unquoted.replace(/,\s*-?\d+\s*$/u, "");
+	if (withoutIndex === "") return void 0;
+	if (win32.basename(withoutIndex).toLowerCase() !== APP_EXECUTABLE_NAME.toLowerCase()) return void 0;
+	return withoutIndex;
+}
+/**
+* The path inside a `DisplayIcon`/`InstallLocation` value, unquoted.
+*
+* Registry data may be written either quoted (`"E:\workbuddy\WorkBuddy.exe",0`)
+* or bare. Only a leading quote is treated as quoting: a bare `C:\dir\a"b.exe`
+* is a real (if unusual) filename and must not be truncated at the quote.
+*/
+function stripRegistryQuotes(value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return void 0;
+	if (!trimmed.startsWith("\"")) return trimmed;
+	const closing = trimmed.indexOf("\"", 1);
+	if (closing === -1) return void 0;
+	return trimmed.slice(1, closing).trim();
+}
+/**
+* Run `reg query` and return its stdout, or undefined when it cannot be run.
+*
+* `windowsHide` is REQUIRED, not cosmetic: the DSH Desktop host is an Electron
+* GUI process with no console, so spawning a console program without it flashes
+* a visible black window on every probe. The same reason is recorded for the
+* heartbeat probe in `host-heartbeat.ts` and in `docs/WINDOWS.md` §1-3.
+*
+* `execFileSync` (not `execFile`) keeps this synchronous so the candidates list
+* stays a pure function of its inputs: it is called during `findWorkbuddyApp`
+* `Executable`, which `readAtRestKey()` and the `doctor` command both treat as
+* a plain lookup. The read is bounded by the registry query's own output and
+* happens at most once per discovery.
+*/
+function queryRegistry(args) {
+	try {
+		return execFileSync("reg", [...args], REGISTRY_PROBE_OPTIONS);
+	} catch {
+		return;
+	}
+}
+/**
+* Options for the registry probe; `windowsHide` is mandatory (see above), and
+* the timeout matches `fetchAtRestKeyPayload()`'s: a hung `reg` must not wedge
+* the synchronous discovery path forever.
+*/
+const REGISTRY_PROBE_OPTIONS = {
+	encoding: "utf8",
+	windowsHide: true,
+	timeout: 1e4
+};
+/**
 * Candidate paths of the WorkBuddy desktop executable, in probe order.
 *
 * The Windows build is the one that encrypts credentials, so Windows leads;
@@ -224,7 +385,7 @@ function workbuddyAppExecutableCandidates(platform = process.platform, home = ho
 		const local = env["LOCALAPPDATA"]?.trim();
 		const programFiles = env["ProgramFiles"]?.trim();
 		const programFilesX86 = env["ProgramFiles(x86)"]?.trim();
-		candidates.push(local === void 0 || local === "" ? void 0 : join(local, "Programs", "WorkBuddy", APP_EXECUTABLE_NAME), local === void 0 || local === "" ? void 0 : join(local, "WorkBuddy", APP_EXECUTABLE_NAME), programFiles === void 0 || programFiles === "" ? void 0 : join(programFiles, "WorkBuddy", APP_EXECUTABLE_NAME), programFilesX86 === void 0 || programFilesX86 === "" ? void 0 : join(programFilesX86, "WorkBuddy", APP_EXECUTABLE_NAME));
+		candidates.push(local === void 0 || local === "" ? void 0 : win32.join(local, "Programs", "WorkBuddy", APP_EXECUTABLE_NAME), local === void 0 || local === "" ? void 0 : win32.join(local, "WorkBuddy", APP_EXECUTABLE_NAME), programFiles === void 0 || programFiles === "" ? void 0 : win32.join(programFiles, "WorkBuddy", APP_EXECUTABLE_NAME), programFilesX86 === void 0 || programFilesX86 === "" ? void 0 : win32.join(programFilesX86, "WorkBuddy", APP_EXECUTABLE_NAME));
 	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
 	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
 }
@@ -298,13 +459,55 @@ function macosNestedAppBundles(parent) {
 	return bundles;
 }
 /**
+* Locate the desktop executable AND say how it was found.
+*
+* Kept beside {@link findWorkbuddyAppExecutable} rather than folded into it
+* because the two answer different questions: callers on the credential path
+* only want the path, whereas `doctor` must explain the discovery. Sharing the
+* candidate list keeps them from drifting.
+*/
+function findWorkbuddyAppExecutableWithSource(platform = process.platform, home = homedir(), env = process.env, readRegistryAppPath = windowsRegistryAppExecutable) {
+	const fromEnv = env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim();
+	for (const candidate of workbuddyAppExecutableCandidates(platform, home, env)) {
+		try {
+			if (!existsSync(candidate)) continue;
+		} catch {
+			continue;
+		}
+		return {
+			executable: candidate,
+			source: fromEnv !== void 0 && fromEnv !== "" && candidate === fromEnv ? "env" : "default-layout"
+		};
+	}
+	if (platform === "win32") {
+		const fromRegistry = readRegistryAppPath();
+		if (fromRegistry !== void 0) try {
+			if (existsSync(fromRegistry)) return {
+				executable: fromRegistry,
+				source: "registry"
+			};
+		} catch {}
+	}
+	const executable = findWorkbuddyAppExecutable(platform, home, env, readRegistryAppPath);
+	return executable === void 0 ? void 0 : {
+		executable,
+		source: "nested-bundle"
+	};
+}
+/**
 * The first candidate that exists as a file, or undefined when the desktop app
 * is not installed where this platform expects it.
 */
-function findWorkbuddyAppExecutable(platform = process.platform, home = homedir(), env = process.env) {
+function findWorkbuddyAppExecutable(platform = process.platform, home = homedir(), env = process.env, readRegistryAppPath = windowsRegistryAppExecutable) {
 	for (const candidate of workbuddyAppExecutableCandidates(platform, home, env)) try {
 		if (existsSync(candidate)) return candidate;
 	} catch {}
+	if (platform === "win32") {
+		const fromRegistry = readRegistryAppPath();
+		if (fromRegistry !== void 0) try {
+			if (existsSync(fromRegistry)) return fromRegistry;
+		} catch {}
+	}
 	if (platform === "darwin") for (const parent of ["/Applications", join(home, "Applications")]) for (const bundle of macosNestedAppBundles(parent)) {
 		const executable = macosBundleExecutable(bundle);
 		if (executable === void 0) continue;
@@ -449,12 +652,19 @@ const HARD_CREDIT_MARKERS = [
 ];
 /** Session-invalidation markers that mean "sign in again in the WorkBuddy app". */
 const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
+/**
+* Content-policy refusal markers from the chat gateway. The quoted-key form
+* avoids substring hits inside unrelated values (request ids are hex and can
+* contain `11140` by coincidence).
+*/
+const POLICY_REJECT_MARKERS = ["request illegal", "\"code\":11140"];
 /** Classify an upstream failure from its HTTP status and body excerpt. */
 function classifyUpstreamError(status, body) {
 	if (status === 402) return "hard_credit";
 	const lower = body.toLowerCase();
 	for (const marker of HARD_CREDIT_MARKERS) if (lower.includes(marker.toLowerCase()) || body.includes(marker)) return "hard_credit";
 	for (const marker of SESSION_DEAD_MARKERS) if (body.includes(marker)) return "session_dead";
+	for (const marker of POLICY_REJECT_MARKERS) if (body.includes(marker)) return "policy_reject";
 	if (status === 429) return "soft_rate";
 	if (status === 404) return "not_found";
 	if (status >= 500) return "server";
@@ -462,6 +672,34 @@ function classifyUpstreamError(status, body) {
 	return "client";
 }
 /**
+* Parse the known-good fields out of an upstream failure body. Non-JSON
+* bodies (HTML error pages, empty strings) yield undefined rather than a guess.
+*/
+function parseUpstreamErrorDetail(body) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null) return void 0;
+	const raw = parsed;
+	let displayMsg;
+	const display = raw.displayMsg;
+	if (typeof display === "string") displayMsg = display;
+	else if (typeof display === "object" && display !== null) {
+		const localized = display;
+		const pick = localized.zh ?? localized.en;
+		if (typeof pick === "string") displayMsg = pick;
+	}
+	if (displayMsg === void 0 && typeof raw.msg === "string") displayMsg = raw.msg;
+	const detail = {};
+	if (typeof raw.code === "number") detail.upstreamCode = raw.code;
+	if (typeof raw.requestId === "string") detail.requestId = raw.requestId;
+	if (displayMsg !== void 0) detail.displayMsg = displayMsg;
+	return detail;
+}
+/**
 * Region for a login domain; an empty domain means CN (matching upstream tooling).
 *
 * The international product is reachable under TWO brand domains: the WorkBuddy
@@ -944,7 +1182,8 @@ var WorkBuddyUpstreamClient = class {
 			ok: false,
 			status: response.status,
 			kind: classifyUpstreamError(response.status, text),
-			message: text
+			message: text,
+			detail: parseUpstreamErrorDetail(text)
 		};
 	}
 	/**
@@ -2552,7 +2791,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "3.4.2";
+const WORKBUDDY_CONNECT_VERSION = "3.4.4";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -2710,4 +2949,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { readAtRestKey as $, CREDENTIAL_REJECTED_CODE as A, prepareChatBody as B, defaultDesktopAuthPath as C, parseWorkBuddyAuth as D, legacyWorkbuddyOwnAuthPath as E, declaredTools as F, deriveAtRestKeyId as G, WORKBUDDY_APP_EXECUTABLE_ENV as H, isCredentialRejectedError as I, isEncryptedFieldWrapper as J, fetchAtRestKeyPayload as K, parseCreditMultiplier as L, WorkBuddyCredentialRejectedError as M, WorkBuddyUpstreamClient as N, workbuddyAccountId as O, classifyUpstreamError as P, openEncryptedField as Q, parseReasoning as R, defaultDesktopAuthDirs as S, isEncryptedCredentialError as T, clearAtRestKeyCache as U, regionOf as V, deriveAtRestKey as W, macosBundleExecutable as X, isWorkbuddyBundle as Y, macosNestedAppBundles as Z, WORKBUDDY_AUTH_FILE_ENV as _, readHostHeartbeat as a, authFileName as b, WORKBUDDY_CONNECT_VERSION as c, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, workbuddyAppExecutableCandidates as et, WorkBuddyCatalog as f, WORKBUDDY_AUTH_FILENAME as g, ENCRYPTED_CREDENTIAL_CODE as h, processStartTimeMs as i, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as j, workbuddyOwnAuthPath as k, piAiRuntimeInfo as l, fallbackModelsFor as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, deriveCatalog as p, findWorkbuddyAppExecutable as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, FALLBACK_WORKBUDDY_MODELS as u, WorkBuddyCredentialStore as v, hasEncryptedCredentialFields as w, defaultDesktopAuthCandidates as x, WorkBuddyEncryptedCredentialError as y, parseUpstreamModel as z };
+export { openEncryptedField as $, CREDENTIAL_REJECTED_CODE as A, prepareChatBody as B, defaultDesktopAuthPath as C, parseWorkBuddyAuth as D, legacyWorkbuddyOwnAuthPath as E, declaredTools as F, deriveAtRestKeyId as G, WORKBUDDY_APP_EXECUTABLE_ENV as H, isCredentialRejectedError as I, findWorkbuddyAppExecutableWithSource as J, fetchAtRestKeyPayload as K, parseCreditMultiplier as L, WorkBuddyCredentialRejectedError as M, WorkBuddyUpstreamClient as N, workbuddyAccountId as O, classifyUpstreamError as P, macosNestedAppBundles as Q, parseReasoning as R, defaultDesktopAuthDirs as S, isEncryptedCredentialError as T, clearAtRestKeyCache as U, regionOf as V, deriveAtRestKey as W, isWorkbuddyBundle as X, isEncryptedFieldWrapper as Y, macosBundleExecutable as Z, WORKBUDDY_AUTH_FILE_ENV as _, readHostHeartbeat as a, authFileName as b, WORKBUDDY_CONNECT_VERSION as c, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, readAtRestKey as et, WorkBuddyCatalog as f, WORKBUDDY_AUTH_FILENAME as g, ENCRYPTED_CREDENTIAL_CODE as h, processStartTimeMs as i, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as j, workbuddyOwnAuthPath as k, piAiRuntimeInfo as l, fallbackModelsFor as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, deriveCatalog as p, findWorkbuddyAppExecutable as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, workbuddyAppExecutableCandidates as tt, FALLBACK_WORKBUDDY_MODELS as u, WorkBuddyCredentialStore as v, hasEncryptedCredentialFields as w, defaultDesktopAuthCandidates as x, WorkBuddyEncryptedCredentialError as y, parseUpstreamModel as z };

package/lib/index.d.ts

@@ -435,7 +435,7 @@ declare class WorkBuddyCredentialStore {
 /** WorkBuddy region selected by the credential's login domain. */
 type WorkBuddyRegion = 'cn' | 'global';
 /** Upstream failure classes the shim maps onto distinct HTTP answers. */
-type UpstreamErrorKind = 'hard_credit' | 'soft_rate' | 'session_dead' | 'not_found' | 'server' | 'client';
+type UpstreamErrorKind = 'hard_credit' | 'soft_rate' | 'session_dead' | 'policy_reject' | 'not_found' | 'server' | 'client';
 /** Reasoning capability as the upstream catalog declares it. */
 interface WorkBuddyReasoning {
   supportedEfforts?: readonly string[];
@@ -532,6 +532,8 @@ type WorkBuddyChatResult = {
   status: number;
   kind: UpstreamErrorKind;
   message: string;
+  /** Structured fields lifted from a JSON failure body, when there were any. */
+  detail?: UpstreamErrorDetail | undefined;
 };
 /**
  * Chat answer that also carries the response headers.
@@ -554,6 +556,15 @@ interface WorkBuddyProbeAnswer {
 }
 /** Classify an upstream failure from its HTTP status and body excerpt. */
 declare function classifyUpstreamError(status: number, body: string): UpstreamErrorKind;
+/** Structured fields lifted out of a JSON upstream failure body. */
+interface UpstreamErrorDetail {
+  /** Numeric upstream error code, e.g. 11140 for a content-policy refusal. */
+  upstreamCode?: number;
+  /** Upstream request id — the handle support asks for. */
+  requestId?: string;
+  /** Best human-facing message: `displayMsg.zh`, falling back to `.en`, then `msg`. */
+  displayMsg?: string;
+}
 /**
  * Region for a login domain; an empty domain means CN (matching upstream tooling).
  *
@@ -1170,7 +1181,7 @@ declare function macosNestedAppBundles(parent: string): string[];
  * The first candidate that exists as a file, or undefined when the desktop app
  * is not installed where this platform expects it.
  */
-declare function findWorkbuddyAppExecutable(platform?: NodeJS.Platform, home?: string, env?: NodeJS.ProcessEnv): string | undefined;
+declare function findWorkbuddyAppExecutable(platform?: NodeJS.Platform, home?: string, env?: NodeJS.ProcessEnv, readRegistryAppPath?: () => string | undefined): string | undefined;
 /**
  * Ask the installed desktop app for its key payload by running its own binary
  * as plain Node (`ELECTRON_RUN_AS_NODE`) and calling the native binding.
@@ -1340,7 +1351,7 @@ declare const PROBE_SYSTEM_PROMPT = "You are a connectivity check. Reply with a
  * Output cap for a probe. One token is enough to prove the model answers.
  *
  * The probe's cost comes from its INPUT, not its output (see
- * {@link PROBE_INPUT_TOKENS}), so paying for a long completion would add money
+ * {@link DEFAULT_PROBE_INPUT_TOKENS}), so paying for a long completion would add money
  * without adding signal.
  */
 declare const PROBE_MAX_TOKENS = 1;
@@ -1367,8 +1378,27 @@ declare const PROBE_MAX_TOKENS = 1;
  * A probe that sent a handful of tokens answered "usable" while every real
  * request in a long conversation was refused — the probe was asking too small a
  * question. 25k is sized to be a realistic long-conversation payload.
+ *
+ * Renamed from `PROBE_INPUT_TOKENS` to say what it now IS: the DEFAULT, not the
+ * only possible size. The size is a property of the user's own traffic (see
+ * {@link probeRequestBody}), so it became a setting; this constant is what an
+ * unset setting, an older profile, and every existing test mean by "a probe".
+ */
+declare const DEFAULT_PROBE_INPUT_TOKENS = 25000;
+/**
+ * The probe sizes the card offers, in tokens.
+ *
+ * A closed set, each step a meaningful position relative to the measured 20k~30k
+ * threshold: below it (10k/20k) proves an account can serve SHORT requests and
+ * is the cheap choice; at it (30k) is the size that finally covers the whole
+ * measured window; above it (50k/100k) is for conversations that routinely run
+ * long, where a smaller probe would report "usable" for an account that refuses
+ * the very next message.
+ *
+ * Exported so the schema's description, the card's dropdown, and the coercion
+ * below cannot drift apart into three different menus.
  */
-declare const PROBE_INPUT_TOKENS = 25000;
+declare const PROBE_INPUT_TOKEN_CHOICES: readonly number[];
 /**
  * Build the request body for one probe.
  *
@@ -1376,10 +1406,13 @@ declare const PROBE_INPUT_TOKENS = 25000;
  * `prepareChatBody` enforces that too, but sending it explicitly keeps this
  * function's output valid on its own.
  *
- * Measured on the built artifact: 112,713 bytes of body, and the upstream
- * counted `prompt_tokens: 25023` at a cost of `credit: 0.72`.
+ * Measured on the built artifact at the DEFAULT size: 112,713 bytes of body, and
+ * the upstream counted `prompt_tokens: 25023` at a cost of `credit: 0.72`. The
+ * body bytes and the credit both scale with the size asked for, which is why the
+ * size is a user setting: a larger probe answers more truthfully for someone
+ * whose conversations are long, and costs proportionally more to ask.
  */
-declare function probeRequestBody(modelId: string): string;
+declare function probeRequestBody(modelId: string, inputTokens?: number): string;
 /**
  * How one probe ended.
  *
@@ -1387,7 +1420,7 @@ declare function probeRequestBody(modelId: string): string;
  * outcome the feature exists for: it means "this model works, but not right
  * now". Everything else is a real, actionable failure or a success.
  */
-type WorkBuddyProbeOutcome = 'ok' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'unavailable' | 'not-found' | 'failed';
+type WorkBuddyProbeOutcome = 'ok' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'unavailable' | 'not-found' | 'failed';
 /**
  * One probe result, as the card renders it.
  *
@@ -1455,9 +1488,10 @@ declare function cooldownOf(input: {
  *
  * Built on `classifyUpstreamError` rather than re-testing status codes, so a
  * probe and a real chat request can never disagree about what the same upstream
- * answer means. The extra split here is `credential-rejected`, which the
+ * answer means. The extra splits here are `credential-rejected`, which the
  * upstream signals with a non-JSON 401/403 edge page and which needs completely
- * different advice (re-auth, not "wait").
+ * different advice (re-auth, not "wait"), and `policy-rejected`, a JSON 403
+ * content-policy refusal where re-auth advice would be actively misleading.
  */
 declare function outcomeOfFailure(status: number, body: string): WorkBuddyProbeOutcome;
 /**
@@ -1497,12 +1531,35 @@ declare function probeModel(input: {
   credential: WorkBuddyCredential;
   modelId: string;
   nowMs: number;
+  /**
+   * How much input this probe sends, in tokens.
+   *
+   * Omitted means {@link DEFAULT_PROBE_INPUT_TOKENS}, so every existing caller
+   * keeps the measured 25k and only the pool's user-facing "test" passes a
+   * chosen size through.
+   */
+  inputTokens?: number;
   /** The region's next monthly quota refresh, when known. */
   quotaRefreshAtMs?: number;
   signal?: AbortSignal;
 }): Promise<WorkBuddyProbeResult>;
 //#endregion
 //#region src/account-pool.d.ts
+/**
+ * Which of the pool's writers produced a measurement.
+ *
+ * `test-batch` — the user pressed "test" (or the check-in batch), so the
+ *   outcome is a deliberate measurement of the target model.
+ * `live-request` — a real chat request failed and its failure was recorded so
+ *   the NEXT request starts from a measurement instead of rediscovering the
+ *   same wall.
+ *
+ * The distinction is diagnostic, not behavioural: both feed the same routing
+ * and cooling logic. It exists so a user who watched an account measure `ok`
+ * and later saw it limited can tell whether that was a later live failure
+ * (expected) or an older value winning (a bug).
+ */
+type WorkBuddyPoolProbeSource = 'test-batch' | 'live-request';
 /** One account's pool entry: what the picker needs, plus its last measurement. */
 interface WorkBuddyPoolAccount {
   /** Stable account id (the same one `WorkBuddyAccountChoice` carries). */
@@ -1522,6 +1579,26 @@ interface WorkBuddyPoolProbe {
   outcome: WorkBuddyProbeOutcome;
   /** When this measurement was taken, in epoch ms. */
   atMs: number;
+  /**
+   * WHAT WROTE THIS MEASUREMENT.
+   *
+   * Two sites write probes for the same account, and before this field they
+   * were indistinguishable in the file — which made a real confusion
+   * unanswerable: the user presses "test", sees an account measured `ok`, and
+   * later finds it `rate-limited`. Nothing in the record said whether that was
+   * a NEWER measurement (a live request really did hit the limit) or an OLDER
+   * one somehow winning, and the file keeps no history to tell them apart.
+   *
+   * With the source recorded, that question has an answer on sight: a
+   * `live-request` entry that replaced a `test-batch` result is the pool
+   * working as designed (a live failure steers the next request away from the
+   * account); two entries of the SAME source with the OLDER one winning would
+   * be a genuine bug.
+   *
+   * ABSENT for any measurement written before this field existed, so old probe
+   * files stay readable — an absent source means "unknown", never a guess.
+   */
+  source?: WorkBuddyPoolProbeSource;
   /**
    * When this account may be usable again, when the upstream stated a time.
    *
@@ -1902,7 +1979,7 @@ type WorkBuddyWebUsage =
  * here because this module is the node-free bridge and must not import the
  * Host-side probe module (which pulls in the credential type).
  */
-type WorkBuddyWebProbeOutcome = 'ok' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'unavailable' | 'not-found' | 'failed';
+type WorkBuddyWebProbeOutcome = 'ok' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'unavailable' | 'not-found' | 'failed';
 /** One model's probe result, as the card renders it. */
 interface WorkBuddyWebProbeResult {
   modelId: string;
@@ -1949,6 +2026,14 @@ interface WorkBuddyWebPoolAccount {
   probe?: {
     outcome: WorkBuddyWebProbeOutcome;
     atMs: number;
+    /**
+     * What wrote this measurement, so the card can explain a change the user
+     * watched happen: `test-batch` is a deliberate test, `live-request` is a
+     * real request that failed and overwrote it. ABSENT for records written
+     * before the field existed — the card must then say "unknown" rather than
+     * guess which of the two it was.
+     */
+    source?: 'test-batch' | 'live-request';
     /** Only when the upstream named a time; never invented locally. */
     retryAtMs?: number;
     /**
@@ -2018,6 +2103,14 @@ interface WorkBuddyWebPool {
   targetModelSource: 'preferred' | 'free' | 'none' | 'stale';
   /** The account ids the user has checked into this region's pool. */
   memberAccountIds?: readonly string[];
+  /**
+   * Tokens each test probe sends, as the user saved it; `0`/absent = default.
+   *
+   * The SAVED value, not the resolved one: the card needs to tell "the user
+   * never chose a size" apart from "the user chose 25000", because the first
+   * must keep showing the default option rather than a number they never picked.
+   */
+  probeInputTokens?: number;
   /**
    * The subset of {@link memberAccountIds} that resolves to a real local
    * sign-in — i.e. what a batch actually runs on.
@@ -2176,6 +2269,14 @@ interface WorkBuddyPoolDeps {
   preferences(region: WorkBuddyRegion): {
     enabled: boolean;
     targetModelId: string;
+    /**
+     * Tokens each test probe sends as saved; `0` when the user never chose.
+     *
+     * Optional so a caller that has not learnt about the setting still
+     * satisfies this interface, and so its absence reads as "default" — the
+     * same meaning the host gives an older profile.
+     */
+    probeInputTokens?: number;
     memberAccountIds: readonly string[];
   };
   /** One region's CHECKED accounts, plus their credits and last measurements. */
@@ -2332,6 +2433,23 @@ interface WorkBuddyPoolPreferences {
   enabled?: boolean;
   /** Model id to test; `''` means auto-pick a free model from this region. */
   targetModelId?: string;
+  /**
+   * How much input a probe sends, in tokens — the pool's biggest single knob.
+   *
+   * The upstream's rate limit (6004) fires on request SIZE, and the threshold
+   * was measured to sit between 20k and 30k tokens. The probe has to be sized
+   * near where the user's REAL conversations land: too small and it reports
+   * "usable" while every long conversation is refused (the exact false positive
+   * that made this knob necessary), too large and it costs real credit on every
+   * batch AND excludes accounts that would have served the shorter requests the
+   * user actually sends.
+   *
+   * A fixed value therefore cannot be right for everyone — the right size is a
+   * property of the user's own traffic, which only they know. `undefined` keeps
+   * the measured default ({@link DEFAULT_PROBE_INPUT_TOKENS}), so an existing
+   * profile is unaffected.
+   */
+  probeInputTokens?: number;
   /**
    * The account ids checked into this region's pool.
    *
@@ -2486,4 +2604,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKENS, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };