dsh-connect-workbuddy 3.4.2 → 3.4.4

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as readAtRestKey, A as CREDENTIAL_REJECTED_CODE, B as prepareChatBody, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as declaredTools, G as deriveAtRestKeyId, H as WORKBUDDY_APP_EXECUTABLE_ENV, I as isCredentialRejectedError, J as isEncryptedFieldWrapper, K as fetchAtRestKeyPayload, L as parseCreditMultiplier, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as openEncryptedField, R as parseReasoning, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as clearAtRestKeyCache, V as regionOf, W as deriveAtRestKey, X as macosBundleExecutable, Y as isWorkbuddyBundle, Z as macosNestedAppBundles, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as workbuddyAppExecutableCandidates, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as parseUpstreamModel } from "./host-heartbeat-Sq5JwluI.js";
+import { $ as openEncryptedField, A as CREDENTIAL_REJECTED_CODE, B as prepareChatBody, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as declaredTools, G as deriveAtRestKeyId, H as WORKBUDDY_APP_EXECUTABLE_ENV, I as isCredentialRejectedError, K as fetchAtRestKeyPayload, L as parseCreditMultiplier, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as macosNestedAppBundles, R as parseReasoning, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as clearAtRestKeyCache, V as regionOf, W as deriveAtRestKey, X as isWorkbuddyBundle, Y as isEncryptedFieldWrapper, Z as macosBundleExecutable, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as readAtRestKey, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as workbuddyAppExecutableCandidates, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as parseUpstreamModel } from "./host-heartbeat-DTuwptkM.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1180,6 +1180,7 @@ const KIND_STATUS = {
 	hard_credit: 402,
 	soft_rate: 429,
 	session_dead: 401,
+	policy_reject: 403,
 	not_found: 502,
 	server: 502,
 	client: 400
@@ -1212,6 +1213,16 @@ const KIND_STATUS = {
 * Every other kind already lands outside the retry set by its status alone
 * (`hard_credit` 402 → quota, `session_dead` 401 → auth, 502/400 → other), so
 * none of them is listed: a translation nobody needs is a lie waiting to drift.
+*
+* `policy_reject` is deliberately NOT listed either, for a sharper reason than
+* the others: the obvious candidate translation would be the upstream's own
+* numeric code (11140), but that is not a class the host knows, so it would take
+* the host's generic path and add nothing over `policy_reject`. It needs no
+* translation to stay outside the retry set (403), and it must NOT be translated
+* INTO the set — a content-policy refusal is deterministic, so retrying it in
+* place would spend the retry budget on a request the server will refuse again,
+* and cross-provider failover cannot help a policy decision either. The code the
+* host receives therefore names the class honestly.
 */
 const KIND_HOST_CODE = { soft_rate: "quota_exceeded" };
 /**
@@ -1331,10 +1342,49 @@ var RecoveryStream = class {
 	*/
 	nativeCallsSeen = false;
 	buffer;
-	constructor(res, gate, logger) {
+	/**
+	* A notice to place at the head of the answer, once, before any prose.
+	*
+	* Set when the request reached this stream only after the pool failed over, so
+	* the user learns WHY the answer came from a different account. Without it a
+	* failover is invisible: the reply looks like it came from the account they
+	* picked, and the only trace is a `logger.warn` they never see. The notice is
+	* emitted ahead of the model's own text so it cannot be mistaken for part of
+	* the answer, and only once — a retry that never delivers text must not leave
+	* a stray line behind.
+	*/
+	notice;
+	constructor(res, gate, logger, notice) {
 		this.res = res;
 		this.logger = logger;
 		this.buffer = gate === void 0 ? void 0 : new DsmlStreamBuffer(gate);
+		this.notice = notice;
+	}
+	/**
+	* Emit the pending failover notice, if any, and forget it.
+	*
+	* Called immediately before the first content reaches the client. Placed
+	* here rather than in the constructor because a stream whose write fails, or
+	* whose attempt is discarded in favour of a retry, must not have already told
+	* the user about a switch it never completed.
+	*/
+	flushNotice() {
+		const notice = this.notice;
+		if (notice === void 0) return;
+		this.notice = void 0;
+		if (!this.res.writable) return;
+		const chunk = { choices: [{
+			index: 0,
+			delta: {},
+			finish_reason: ""
+		}] };
+		const choiceRecord = {
+			index: 0,
+			delta: {},
+			finish_reason: ""
+		};
+		this.windowOpened = true;
+		this.res.write(contentFrame(chunk, choiceRecord, notice));
 	}
 	/** True when a call or real prose has reached the client. */
 	get delivered() {
@@ -1433,6 +1483,7 @@ var RecoveryStream = class {
 		if (Array.isArray(nativeCalls) && nativeCalls.length > 0) {
 			this.nativeCallsSeen = true;
 			this.windowOpened = true;
+			this.flushNotice();
 			this.send(frame, false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1447,6 +1498,7 @@ var RecoveryStream = class {
 		}
 		if (this.buffer === void 0 || this.nativeCallsSeen) {
 			this.windowOpened = true;
+			this.flushNotice();
 			this.closeWindow();
 			this.res.write(frame);
 			this.wroteContent = true;
@@ -1455,6 +1507,7 @@ var RecoveryStream = class {
 		this.windowOpened = true;
 		const outcome = this.buffer.add(content);
 		if (outcome.calls !== void 0 && outcome.calls.length > 0) {
+			this.flushNotice();
 			this.send(callsFrame(chunk, choiceRecord, outcome.calls), false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1467,6 +1520,7 @@ var RecoveryStream = class {
 			return;
 		}
 		if (outcome.prose) {
+			this.flushNotice();
 			this.send(contentFrame(chunk, choiceRecord, outcome.text), false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1510,6 +1564,7 @@ var RecoveryStream = class {
 		this.windowOpened = true;
 		const frame = contentFrame(chunk, choiceRecord, text);
 		if (text.trim() !== "") {
+			this.flushNotice();
 			this.send(frame, false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1587,6 +1642,55 @@ function callsFrame(chunk, choice, calls) {
 	};
 	return `data: ${JSON.stringify(next)}\n\n`;
 }
+/**
+* How to name a pool account in a sentence the USER reads.
+*
+* Prefers the phone number (`uin`) because that is what the pool table shows and
+* what a person recognises; the nickname and the opaque account id are fallbacks
+* so this can never render an empty name. Deliberately NOT the hashed account id
+* on its own: a 24-character hex digest identifies an account to the plugin, but
+* to the person reading the answer it identifies nothing.
+*/
+function describeAccount(credential) {
+	if (credential.uin !== void 0 && credential.uin !== "") return credential.uin;
+	if (credential.nickname !== void 0 && credential.nickname !== "") return credential.nickname;
+	return workbuddyAccountId(credential);
+}
+/**
+* One short phrase for why an account was abandoned, for the in-reply notice.
+*
+* Kept to the distinction the user can act on rather than the internal kind
+* name: "rate limited" says wait or add an account, "rejected" says the sign-in
+* is the problem. The numeric kind would only send them to the log.
+*/
+function failoverReasonText(failure) {
+	if (failure.ok) return "unusable";
+	switch (failure.kind) {
+		case "soft_rate":
+		case "hard_credit": return "rate limited";
+		case "session_dead": return "signed out";
+		case "policy_reject": return "rejected by policy";
+		case "not_found": return "model unavailable";
+		case "server": return "erroring upstream";
+		default: return `unusable (http ${failure.status})`;
+	}
+}
+/**
+* The line prepended to an answer that came from a failover account.
+*
+* Block-quoted and bracketed so it reads as machinery rather than as the model's
+* own words, and so a user skimming for the answer can skip it. It states the
+* reason AND the account left behind, because those are the two facts that make
+* an unexpected reply explicable.
+*
+* The wording avoids "switched TO <account>" on purpose: the account that took
+* over is the one the user is about to keep talking to, and naming it invites
+* the reading that they must now manage it. What they need is to know the one
+* they chose did not answer, and why.
+*/
+function failoverNoticeText(from, reason) {
+	return `\n\n> [dsh-connect-workbuddy] 「${from}」was ${reason} — this answer came from another account\n\n`;
+}
 /** One frame carrying replacement text for a frame whose content was consumed. */
 function contentFrame(chunk, choice, content) {
 	const delta = {
@@ -1715,6 +1819,15 @@ function createWorkBuddyShim(options) {
 		let result = await client.chatStream(credential, prepared, controller.signal);
 		const triedAccountIds = [];
 		/**
+		* The account the request STARTED on, and the reason it was abandoned.
+		*
+		* `??=` on the first switch only: if three accounts fail in a row the user
+		* cares that the answer did not come from the one they picked, not with a
+		* blow-by-blow list of every candidate that was also rate limited.
+		*/
+		let switchedFrom;
+		let switchedBecause;
+		/**
 		* Tell the plugin about a failed attempt so it can store the measurement.
 		*
 		* Every failed attempt is reported exactly once, INCLUDING the last one — an
@@ -1769,6 +1882,8 @@ function createWorkBuddyShim(options) {
 			});
 			if (controller.signal.aborted) break;
 			logger?.warn(`dsh-connect-workbuddy: retrying chat on another pool account after ${result.kind} (http ${result.status})`);
+			switchedFrom ??= describeAccount(credential);
+			switchedBecause ??= failoverReasonText(result);
 			credential = next;
 			result = await client.chatStream(credential, prepared, controller.signal);
 		}
@@ -1777,6 +1892,16 @@ function createWorkBuddyShim(options) {
 		if (!result.ok) {
 			const attempts = triedAccountIds.length;
 			const note = attempts > 1 ? ` (after trying ${attempts} accounts)` : "";
+			if (result.kind === "policy_reject") {
+				const detail = result.detail;
+				const lead = detail?.displayMsg ?? result.message.slice(0, 200);
+				const meta = ["服务端策略拒绝"];
+				if (detail?.upstreamCode !== void 0) meta.push(`code ${detail.upstreamCode}`);
+				if (detail?.requestId !== void 0) meta.push(`requestId ${detail.requestId}`);
+				const message = `${lead}（${meta.join("，")}）${note}。该请求被 WorkBuddy 服务端策略拒绝，重新登录不会解决；可在 WorkBuddy 桌面端用同一账号验证，或切换区域/账号后重试`;
+				writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, message, hostErrorCode(result.kind));
+				return;
+			}
 			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status})${note}: ${result.message.slice(0, 400)}`, hostErrorCode(result.kind));
 			return;
 		}
@@ -1792,7 +1917,8 @@ function createWorkBuddyShim(options) {
 			requiredParameters: declared.requiredParameters,
 			...declared.pinnedToolName === void 0 ? {} : { pinnedToolName: declared.pinnedToolName }
 		};
-		const writer = new RecoveryStream(res, gate, logger);
+		const notice = switchedFrom === void 0 || switchedBecause === void 0 ? void 0 : failoverNoticeText(switchedFrom, switchedBecause);
+		const writer = new RecoveryStream(res, gate, logger, notice);
 		await writer.consume(result.response.body);
 		if (gate !== void 0 && !writer.delivered && writer.residueSeen && !controller.signal.aborted) {
 			logger?.warn("dsh-connect-workbuddy: the turn produced DSML markup only; retrying it once");
@@ -1847,7 +1973,7 @@ const PROBE_SYSTEM_PROMPT = "You are a connectivity check. Reply with a single w
 * Output cap for a probe. One token is enough to prove the model answers.
 *
 * The probe's cost comes from its INPUT, not its output (see
-* {@link PROBE_INPUT_TOKENS}), so paying for a long completion would add money
+* {@link DEFAULT_PROBE_INPUT_TOKENS}), so paying for a long completion would add money
 * without adding signal.
 */
 const PROBE_MAX_TOKENS = 1;
@@ -1874,8 +2000,44 @@ const PROBE_MAX_TOKENS = 1;
 * A probe that sent a handful of tokens answered "usable" while every real
 * request in a long conversation was refused — the probe was asking too small a
 * question. 25k is sized to be a realistic long-conversation payload.
+*
+* Renamed from `PROBE_INPUT_TOKENS` to say what it now IS: the DEFAULT, not the
+* only possible size. The size is a property of the user's own traffic (see
+* {@link probeRequestBody}), so it became a setting; this constant is what an
+* unset setting, an older profile, and every existing test mean by "a probe".
+*/
+const DEFAULT_PROBE_INPUT_TOKENS = 25e3;
+/**
+* The probe sizes the card offers, in tokens.
+*
+* A closed set, each step a meaningful position relative to the measured 20k~30k
+* threshold: below it (10k/20k) proves an account can serve SHORT requests and
+* is the cheap choice; at it (30k) is the size that finally covers the whole
+* measured window; above it (50k/100k) is for conversations that routinely run
+* long, where a smaller probe would report "usable" for an account that refuses
+* the very next message.
+*
+* Exported so the schema's description, the card's dropdown, and the coercion
+* below cannot drift apart into three different menus.
 */
-const PROBE_INPUT_TOKENS = 25e3;
+const PROBE_INPUT_TOKEN_CHOICES = [
+	1e4,
+	2e4,
+	3e4,
+	5e4,
+	1e5
+];
+/**
+* A requested probe size reduced to a size this build will actually send.
+*
+* Anything outside {@link PROBE_INPUT_TOKEN_CHOICES} — `undefined` from an older
+* profile, `0` from an unset field, a hand-edited odd number — becomes the
+* measured default. Coercing rather than rejecting keeps a hand-edited profile
+* working instead of turning one odd value into a failed test batch.
+*/
+function resolveProbeInputTokens(requested) {
+	return requested !== void 0 && PROBE_INPUT_TOKEN_CHOICES.includes(requested) ? requested : DEFAULT_PROBE_INPUT_TOKENS;
+}
 /**
 * Characters per token for the filler text, measured.
 *
@@ -1894,11 +2056,14 @@ const FILLER_LINE = "The quick brown fox jumps over the lazy dog. ";
 * `prepareChatBody` enforces that too, but sending it explicitly keeps this
 * function's output valid on its own.
 *
-* Measured on the built artifact: 112,713 bytes of body, and the upstream
-* counted `prompt_tokens: 25023` at a cost of `credit: 0.72`.
+* Measured on the built artifact at the DEFAULT size: 112,713 bytes of body, and
+* the upstream counted `prompt_tokens: 25023` at a cost of `credit: 0.72`. The
+* body bytes and the credit both scale with the size asked for, which is why the
+* size is a user setting: a larger probe answers more truthfully for someone
+* whose conversations are long, and costs proportionally more to ask.
 */
-function probeRequestBody(modelId) {
-	const targetChars = Math.ceil(PROBE_INPUT_TOKENS * CHARS_PER_TOKEN);
+function probeRequestBody(modelId, inputTokens = DEFAULT_PROBE_INPUT_TOKENS) {
+	const targetChars = Math.ceil(resolveProbeInputTokens(inputTokens) * CHARS_PER_TOKEN);
 	const filler = FILLER_LINE.repeat(Math.ceil(targetChars / 45));
 	return JSON.stringify({
 		model: modelId,
@@ -2026,12 +2191,16 @@ function cooldownOf(input) {
 *
 * Built on `classifyUpstreamError` rather than re-testing status codes, so a
 * probe and a real chat request can never disagree about what the same upstream
-* answer means. The extra split here is `credential-rejected`, which the
+* answer means. The extra splits here are `credential-rejected`, which the
 * upstream signals with a non-JSON 401/403 edge page and which needs completely
-* different advice (re-auth, not "wait").
+* different advice (re-auth, not "wait"), and `policy-rejected`, a JSON 403
+* content-policy refusal where re-auth advice would be actively misleading.
 */
 function outcomeOfFailure(status, body) {
-	if (status === 401 || status === 403) return "credential-rejected";
+	if (status === 401 || status === 403) {
+		if (classifyUpstreamError(status, body) === "policy_reject") return "policy-rejected";
+		return "credential-rejected";
+	}
 	switch (classifyUpstreamError(status, body)) {
 		case "soft_rate": return "rate-limited";
 		case "hard_credit": return "out-of-credit";
@@ -2092,7 +2261,7 @@ async function probeModel(input) {
 	let answer;
 	const startedAt = Date.now();
 	try {
-		answer = await input.client.probeChat(input.credential, probeRequestBody(input.modelId), input.signal);
+		answer = await input.client.probeChat(input.credential, probeRequestBody(input.modelId, input.inputTokens), input.signal);
 	} catch (error) {
 		return {
 			modelId: input.modelId,
@@ -2285,6 +2454,7 @@ function probeUpdatesOf(rows) {
 		updates[row.accountId] = {
 			outcome: row.result.outcome,
 			atMs,
+			source: "test-batch",
 			...row.result.retryAtMs === void 0 ? {} : { retryAtMs: row.result.retryAtMs },
 			...row.result.message === void 0 ? {} : { message: row.result.message }
 		};
@@ -2362,6 +2532,7 @@ function exclusionOf(probe, nowMs) {
 		case "failed": return retryDue(probe, nowMs) ? void 0 : "failed";
 		case "rate-limited": return retryDue(probe, nowMs) ? void 0 : "rate-limited";
 		case "out-of-credit": return retryDue(probe, nowMs) ? void 0 : "out-of-credit";
+		case "policy-rejected": return;
 		default: return "unusable";
 	}
 }
@@ -2548,7 +2719,7 @@ const POOL_STORE_PREFIX = ".workbuddy-pool";
 function isProbe(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const candidate = value;
-	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string");
+	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string") && (candidate["source"] === void 0 || typeof candidate["source"] === "string");
 }
 /**
 * One region's path for measured pool facts.
@@ -2595,6 +2766,7 @@ async function readPoolProbes(region) {
 		probes[accountId] = {
 			outcome: probe.outcome,
 			atMs: probe.atMs,
+			...knownProbeSource(probe.source) === void 0 ? {} : { source: knownProbeSource(probe.source) },
 			...probe.retryAtMs === void 0 ? {} : { retryAtMs: probe.retryAtMs },
 			...probe.message === void 0 ? {} : { message: probe.message }
 		};
@@ -2602,6 +2774,17 @@ async function readPoolProbes(region) {
 	return probes;
 }
 /**
+* A stored source string reduced to a source this build understands.
+*
+* `isProbe` accepts any string so a newer build's label cannot destroy the
+* measurement it describes; this narrows it at the point of use. An unknown
+* value becomes `undefined`, which the card renders as "unknown" — the honest
+* answer, rather than mislabelling it as one of the two kinds we do know.
+*/
+function knownProbeSource(value) {
+	return value === "test-batch" || value === "live-request" ? value : void 0;
+}
+/**
 * Merge measurements into one region's store and write it atomically.
 *
 * A MERGE rather than a replace, because batches measure one account at a time
@@ -3101,6 +3284,7 @@ async function workBuddyWebPool(deps, region) {
 			...measured?.probe === void 0 ? {} : { probe: {
 				outcome: measured.probe.outcome,
 				atMs: measured.probe.atMs,
+				...measured.probe.source === void 0 ? {} : { source: measured.probe.source },
 				...measured.probe.retryAtMs === void 0 ? {} : { retryAtMs: measured.probe.retryAtMs },
 				...measured.probe.message === void 0 ? {} : { message: measured.probe.message }
 			} },
@@ -3117,6 +3301,7 @@ async function workBuddyWebPool(deps, region) {
 		...target.staleModelId === void 0 ? {} : { staleTargetModelId: target.staleModelId },
 		targetModelSource: target.source,
 		memberAccountIds: preferences.memberAccountIds,
+		...preferences.probeInputTokens === void 0 ? {} : { probeInputTokens: preferences.probeInputTokens },
 		effectiveMemberAccountIds: effectiveMembersOf(accounts.map((account) => account.accountId), new Set(preferences.memberAccountIds)),
 		accounts,
 		catalog: deps.displayModels(region).map((model) => ({
@@ -3496,6 +3681,16 @@ const modelConfig = z.object({
 const poolConfig = z.object({
 	enabled: z.boolean().default(false).description("Whether this region's account pool is active (opt-in). While on, a failed chat request is retried against the other usable pool members before the error is reported."),
 	targetModelId: z.string().default("").description("Model id to test; empty means pick a zero-multiplier model from this region's catalog"),
+	/**
+	* Sizing of the test probe, as a token count the user picks from a fixed set.
+	*
+	* A closed set rather than a free number: each step is a meaningful position
+	* relative to the measured 20k~30k threshold, and an arbitrary value would
+	* invite a size that is neither safely under nor clearly over it. `0` (and any
+	* unknown value) falls back to the measured default, so a profile written by
+	* an older build — and one hand-edited to something odd — behaves identically.
+	*/
+	probeInputTokens: z.number().step(1).default(0).description("Input tokens each test probe sends: 10000 / 20000 / 30000 / 50000 / 100000. Bigger probes catch a rate limit real conversations would hit, but cost more credit per test and may mark an account unusable for large requests only. 0 uses the measured default (25000)"),
 	memberAccountIds: z.array(z.string()).default([]).description("Account ids checked into this pool (opt-in; empty means the pool covers nothing)")
 });
 const regionStateConfig = z.object({
@@ -4112,6 +4307,7 @@ function apply(ctx, config) {
 		await writePoolProbes(region, { [accountId]: {
 			outcome,
 			atMs: Date.now(),
+			source: "live-request",
 			...retryAtMs === void 0 ? {} : { retryAtMs },
 			...message === "" ? {} : { message }
 		} });
@@ -4202,9 +4398,11 @@ function apply(ctx, config) {
 	/** One region's pool preferences, with the schema's defaults applied. */
 	const poolPreferencesOf = (config, region) => {
 		const pool = regionStateOf(config, region).pool;
+		const probeInputTokens = pool?.probeInputTokens;
 		return {
 			enabled: pool?.enabled === true,
 			targetModelId: pool?.targetModelId ?? "",
+			...probeInputTokens === void 0 ? {} : { probeInputTokens },
 			memberAccountIds: pool?.memberAccountIds ?? []
 		};
 	};
@@ -4250,11 +4448,13 @@ function apply(ctx, config) {
 			claimDailyCheckin: (credential) => client.claimDailyCheckin(credential),
 			probe: async (credential, modelId) => {
 				const quotaRefreshAtMs = await quotaRefreshOf(region, credential);
+				const inputTokens = resolveProbeInputTokens(poolPreferencesOf(current(), region).probeInputTokens);
 				return probeModel({
 					client,
 					credential,
 					modelId,
 					nowMs: Date.now(),
+					inputTokens,
 					...quotaRefreshAtMs === void 0 ? {} : { quotaRefreshAtMs }
 				});
 			}
@@ -4376,4 +4576,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKENS, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "3.4.2",
+  "version": "3.4.4",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",