dsh-connect-workbuddy 3.4.3 → 3.4.4

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 3.4.4 (2026-10-03)
+
+### Features
+
+- **测试请求体积可选（1 万 / 2 万 / 3 万 / 5 万 / 10 万 token），不再固定 2.5 万。**
+  - **背景**：上游的频率限制（6004）按**请求体积**触发——实测阈值落在 2 万～3 万 token 之间，**单次请求就足以触顶**（不是累计）。而账号池的「测试」探针此前固定发 25,000 token，于是真实对话体积在 2.5 万～3 万之间时会出现「测试测出可用、一发聊天立刻被限」。
+  - **为什么不是把固定值调大**：探针只测一个点，而阈值是一个区间、真实对话体积是连续的——把 2.5 万改成 3 万只是把缝隙上移（3 万以上漏判），且成本线性上升（2.5 万 ≈ 0.72 积分，5 万 ≈ 1.4+）。**体积是用户流量的属性，因此交给用户选。**
+  - 新增池子设置「测试请求体积」，默认仍是实测标定的 25K（`0` = 默认）；改动立即生效，无需重载。
+  - 相应用户可见的说明写在设置项旁：解释 2 万～3 万阈值与「测出可用、一发就被限」的成因。
+
+- **换号时在回复正文里说明原因，不再只有日志。**
+  - **背景**：池子的 failover 会给同一个请求依次试多个账号，此前只写一行 `logger.warn`——用户完全看不到。于是一次切换过的回复，和「你选的那个账号正常回答」**在界面上完全一样**，而且事后无法从记录区分「刚才真有请求失败」和「状态莫名其妙退回了旧值」。
+  - 现在回答开头会附一行（仅当真的发生了切换、且确实有内容送达时）：
+
+    > [dsh-connect-workbuddy] 「13046625578」was rate limited — this answer came from another account
+
+  - 只报**第一个**被放弃的账号与原因（连续试 4 个账号时不刷屏），原因按用户能采取的行动措辞（`rate limited` / `signed out` / `rejected by policy` / …），而不是内部 kind 名。
+
+- **池子记录标注来源与时间，让「结果变了」可解释。**
+  - 每条测量现在记录它是**谁写的**：`测得`（用户点「测试」的批测）或 `聊天撞上`（实时聊天失败被记录），以及**多久前**更新。
+  - 卡片上分两行显示：主行是结果/恢复时间/原因，次行是来源胶囊 + 相对时间。此前只能靠时间戳分布**猜**来源（批测写同一时间戳、单账号写入时间戳各不同）。
+  - 「来源未知」用于本次升级之前写入、没有来源字段的旧记录——不猜，如实标注。
+
+### Fixes
+
+- **「来源未知」胶囊太淡看不清。** 旧样式同时做了四处削弱（`background:transparent`、`1px dashed`、`label-dimmed #9aa0a6`、`font-weight:400`）；实测对比度发现**字色不是主因**（`#9aa0a6` 5.28:1，反而比正常胶囊的 `#999` 4.89:1 更亮），主因是 10px 小字配 400 字重。已改为实底 + 实线边框 + `label-secondary`（8.41:1），并去掉字重覆盖以继承基类的 600。
+
 ## 3.4.3 (2026-10-03)
 
 ### Features

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { E as legacyWorkbuddyOwnAuthPath, H as WORKBUDDY_APP_EXECUTABLE_ENV, J as findWorkbuddyAppExecutableWithSource, N as WorkBuddyUpstreamClient, S as defaultDesktopAuthDirs, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, x as defaultDesktopAuthCandidates } from "./host-heartbeat-D5ArLcFf.js";
+import { E as legacyWorkbuddyOwnAuthPath, H as WORKBUDDY_APP_EXECUTABLE_ENV, J as findWorkbuddyAppExecutableWithSource, N as WorkBuddyUpstreamClient, S as defaultDesktopAuthDirs, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, x as defaultDesktopAuthCandidates } from "./host-heartbeat-DTuwptkM.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -513,11 +513,19 @@ window.__ModuleLoader__.load({
 		* @throws {WorkBuddySettingsWriteError} when neither writer persists the value.
 		*/
 		async function writePoolPreferences(scope, region, preferences) {
-			const next = nextRegionPool(scope.getSnapshot().value, region, preferences)[region];
+			const slot = {
+				enabled: preferences.enabled,
+				targetModelId: preferences.targetModelId,
+				memberAccountIds: preferences.memberAccountIds
+			};
+			if (preferences.probeInputTokens !== void 0) slot["probeInputTokens"] = preferences.probeInputTokens;
+			const next = nextRegionPool(scope.getSnapshot().value, region, slot)[region];
 			await writeField(scope, "regions", region, next, (readBack) => {
 				const pool = readBack?.pool;
 				if (pool === void 0 || pool === null) return false;
 				if (pool["enabled"] !== preferences.enabled || pool["targetModelId"] !== preferences.targetModelId) return false;
+				const wantedTokens = preferences.probeInputTokens ?? 0;
+				if ((pool["probeInputTokens"] ?? 0) !== wantedTokens) return false;
 				const stored = pool["memberAccountIds"];
 				if (!Array.isArray(stored) || stored.length !== preferences.memberAccountIds.length) return false;
 				const wanted = new Set(preferences.memberAccountIds);
@@ -619,6 +627,53 @@ window.__ModuleLoader__.load({
 			return message.replace(/^transport error:\s*/u, "");
 		}
 		//#endregion
+		//#region src/client/probe-age.ts
+		const MINUTE_MS$1 = 6e4;
+		const HOUR_MS$1 = 60 * MINUTE_MS$1;
+		const DAY_MS$1 = 24 * HOUR_MS$1;
+		/**
+		* How long ago a measurement was taken, coarsely: "刚刚", "N 分钟前",
+		* "N 小时前", "N 天前".
+		*
+		* Coarse on purpose, for the same reason `remainingText` rounds: a figure that
+		* changes every second reads as live telemetry rather than as "how stale is
+		* this", which is the only question being asked here.
+		*
+		* A clock skew that puts the measurement in the FUTURE (a stored `atMs` ahead
+		* of `nowMs`, from a machine whose clock moved backwards) is reported as
+		* "刚刚" rather than as a negative age: the record is real, and the card must
+		* not print "-3 分钟前".
+		*/
+		function probeAgeText(t, atMs, nowMs) {
+			const age = nowMs - atMs;
+			if (age < MINUTE_MS$1) return t("row.poolProbeJustNow");
+			if (age < HOUR_MS$1) return t("row.poolProbeMinutesAgo", { count: Math.round(age / MINUTE_MS$1) });
+			if (age < 2 * DAY_MS$1) return t("row.poolProbeHoursAgo", { count: Math.round(age / HOUR_MS$1) });
+			return t("row.poolProbeDaysAgo", { count: Math.round(age / DAY_MS$1) });
+		}
+		//#endregion
+		//#region src/probe.ts
+		/**
+		* The probe sizes the card offers, in tokens.
+		*
+		* A closed set, each step a meaningful position relative to the measured 20k~30k
+		* threshold: below it (10k/20k) proves an account can serve SHORT requests and
+		* is the cheap choice; at it (30k) is the size that finally covers the whole
+		* measured window; above it (50k/100k) is for conversations that routinely run
+		* long, where a smaller probe would report "usable" for an account that refuses
+		* the very next message.
+		*
+		* Exported so the schema's description, the card's dropdown, and the coercion
+		* below cannot drift apart into three different menus.
+		*/
+		const PROBE_INPUT_TOKEN_CHOICES = [
+			1e4,
+			2e4,
+			3e4,
+			5e4,
+			1e5
+		];
+		//#endregion
 		//#region src/client/remaining.ts
 		const MINUTE_MS = 6e4;
 		const HOUR_MS = 60 * MINUTE_MS;
@@ -989,10 +1044,11 @@ window.__ModuleLoader__.load({
 			const saved = {
 				enabled: pool?.enabled ?? false,
 				targetModelId: pool?.targetModelId || pool?.staleTargetModelId || "",
+				probeInputTokens: pool?.probeInputTokens ?? 0,
 				memberAccountIds: pool?.memberAccountIds ?? []
 			};
 			const active = draftRegion === region && draft !== null ? draft : saved;
-			const dirty = draftRegion === region && draft !== null && (draft.enabled !== saved.enabled || draft.targetModelId !== saved.targetModelId || !sameIds(draft.memberAccountIds, saved.memberAccountIds));
+			const dirty = draftRegion === region && draft !== null && (draft.enabled !== saved.enabled || draft.targetModelId !== saved.targetModelId || draft.probeInputTokens !== saved.probeInputTokens || !sameIds(draft.memberAccountIds, saved.memberAccountIds));
 			/**
 			* Membership that actually resolves to a local sign-in — what a batch runs on.
 			*
@@ -1376,10 +1432,24 @@ window.__ModuleLoader__.load({
 			const name = account.accountName === "" ? t("row.accountUnnamed") : account.accountName;
 			const excluded = exclusionText(t, account);
 			const probe = account.probe;
+			const outcomeLine = probe === void 0 ? t("row.poolNeverTested") : probe.retryAtMs !== void 0 ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryAt", { at: formatShort(probe.retryAtMs) })}` : probe.outcome === "rate-limited" || probe.outcome === "out-of-credit" ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryUnknown")}` : outcomeText(t, probe.outcome);
+			const remaining = probe?.retryAtMs === void 0 ? "" : remainingText(t, probe.retryAtMs, Date.now());
+			const reason = probe === void 0 ? void 0 : inlineProbeReason(probe.outcome, probe.message);
+			const age = probe === void 0 ? void 0 : probeAgeText(t, probe.atMs, Date.now());
+			const probeLabel = probe === void 0 ? void 0 : probe.source === void 0 ? {
+				text: t("row.poolProbeSourceUnknown"),
+				className: "dsm-workbuddy-pool-prov-tag dsm-workbuddy-pool-prov-unknown"
+			} : probe.source === "live-request" ? {
+				text: t("row.poolProbeSourceLive"),
+				className: "dsm-workbuddy-pool-prov-tag dsm-workbuddy-pool-prov-live"
+			} : {
+				text: t("row.poolProbeSourceTest"),
+				className: "dsm-workbuddy-pool-prov-tag"
+			};
 			const probeLine = [
-				probe === void 0 ? t("row.poolNeverTested") : probe.retryAtMs !== void 0 ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryAt", { at: formatShort(probe.retryAtMs) })}` : probe.outcome === "rate-limited" || probe.outcome === "out-of-credit" ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryUnknown")}` : outcomeText(t, probe.outcome),
-				probe?.retryAtMs === void 0 ? "" : remainingText(t, probe.retryAtMs, Date.now()),
-				probe === void 0 ? void 0 : inlineProbeReason(probe.outcome, probe.message)
+				outcomeLine,
+				remaining,
+				reason
 			].filter((part) => part !== void 0 && part !== "").join(" · ");
 			return (0, react.createElement)("div", {
 				className: `dsm-workbuddy-pool-row${account.current ? " dsm-workbuddy-pool-row-current" : ""}`,
@@ -1396,7 +1466,7 @@ window.__ModuleLoader__.load({
 			}), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-account-name" }, (0, react.createElement)("b", null, name), account.current ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-current-tag" }, t("row.poolCurrentBadge")) : null, (0, react.createElement)("span", { className: checked ? "dsm-workbuddy-pool-member" : "dsm-workbuddy-pool-not-member" }, checked ? t("row.poolMember") : t("row.poolNotMember")), excluded === void 0 ? probe === void 0 ? null : (0, react.createElement)("span", null, t("row.poolTestedAt", { at: formatShort(probe.atMs) })) : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-excluded" }, excluded))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-credits" }, account.credits === void 0 ? (0, react.createElement)("span", null, "—") : (0, react.createElement)("b", null, formatNumber$1(account.credits)), account.expiringSoon !== void 0 && account.expiringSoon > 0 ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-soon" }, t("row.poolCreditSoon", { count: formatNumber$1(account.expiringSoon) })) : account.nearestExpiryMs === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-soon-plain" }, t("row.poolCreditNearest", { at: formatShort(account.nearestExpiryMs) }))), (0, react.createElement)("span", {
 				className: "dsm-workbuddy-pool-probe",
 				...probe?.message === void 0 ? {} : { title: probe.message }
-			}, probeLine), checkinSupported ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checkin" }, account.checkedInToday === void 0 ? (0, react.createElement)("span", {
+			}, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-main" }, probeLine), probeLabel === void 0 && age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-prov" }, probeLabel === void 0 ? null : (0, react.createElement)("span", { className: probeLabel.className }, probeLabel.text), probeLabel === void 0 || age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-sep" }, "·"), age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-age" }, age))), checkinSupported ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checkin" }, account.checkedInToday === void 0 ? (0, react.createElement)("span", {
 				className: "dsm-workbuddy-pool-unknown",
 				title: t("row.poolNeverTested")
 			}, t("row.poolCheckinUnknown")) : account.checkedInToday ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checked" }, t("row.poolCheckedIn")) : t("row.poolNotCheckedIn")) : null);
@@ -1431,7 +1501,22 @@ window.__ModuleLoader__.load({
 			}, t("row.poolTargetStaleOption", { model: active.targetModelId })) : null, ...(pool.catalog ?? []).map((model) => (0, react.createElement)("option", {
 				value: model.id,
 				key: model.id
-			}, model.creditMultiplier === void 0 ? model.name : `${model.name} (x${model.creditMultiplier.toFixed(2)})`)))))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-save-bar" }, (0, react.createElement)("a", {
+			}, model.creditMultiplier === void 0 ? model.name : `${model.name} (x${model.creditMultiplier.toFixed(2)})`))))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, t("row.poolProbeSizeLabel")), (0, react.createElement)("span", null, t("row.poolProbeSizeHint"))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("select", {
+				className: "dsm-workbuddy-pool-select",
+				value: String(active.probeInputTokens),
+				disabled: !canEdit,
+				onChange: (event) => {
+					const parsed = Number.parseInt(event.currentTarget.value, 10);
+					const next = Number.isFinite(parsed) ? parsed : 0;
+					onEdit((current) => ({
+						...current,
+						probeInputTokens: next
+					}));
+				}
+			}, (0, react.createElement)("option", { value: "0" }, t("row.poolProbeSizeDefault")), ...PROBE_INPUT_TOKEN_CHOICES.map((tokens) => (0, react.createElement)("option", {
+				value: String(tokens),
+				key: String(tokens)
+			}, t("row.poolProbeSizeOption", { tokens: String(tokens / 1e3) }))))))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-save-bar" }, (0, react.createElement)("a", {
 				className: "dsm-workbuddy-usage-cheer",
 				href: WORKBUDDY_GITHUB_URL,
 				target: "_blank",
@@ -1705,6 +1790,14 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-pool-soon{font-size:11px;line-height:16px;color:var(--dsw-alias-state-warn-primary,#f59e0b)}
 .dsm-workbuddy-pool-soon-plain{font-size:11px;line-height:16px;color:var(--dsw-alias-label-tertiary,#999)}
 .dsm-workbuddy-pool-probe,.dsm-workbuddy-pool-checkin{font-size:12px;line-height:17px;color:var(--dsw-alias-label-tertiary,#999);min-width:0;overflow-wrap:anywhere}
+.dsm-workbuddy-pool-probe{display:flex;flex-direction:column;gap:4px}
+.dsm-workbuddy-pool-probe-main{color:var(--dsw-alias-label-secondary,#c6c9d0)}
+.dsm-workbuddy-pool-probe-prov{display:flex;align-items:center;gap:5px;font-size:11px;line-height:15px;color:var(--dsw-alias-label-tertiary,#999);min-width:0;flex-wrap:wrap}
+.dsm-workbuddy-pool-prov-tag{padding:1px 6px;border-radius:999px;background:var(--dsw-alias-bg-layer-3,#2a2c33);color:var(--dsw-alias-label-tertiary,#999);font-size:10px;font-weight:600;line-height:15px;white-space:nowrap}
+.dsm-workbuddy-pool-prov-live{background:rgba(245,158,11,.16);color:var(--dsw-alias-state-warn-primary,#f59e0b)}
+.dsm-workbuddy-pool-prov-unknown{background:var(--dsw-alias-bg-layer-3,#2a2c33);border:1px solid var(--dsw-alias-border-l1,#2c2d31);color:var(--dsw-alias-label-secondary,#c6c9d0)}
+.dsm-workbuddy-pool-prov-sep{color:var(--dsw-alias-label-dimmed,#9aa0a6);opacity:.7}
+.dsm-workbuddy-pool-prov-age{color:var(--dsw-alias-label-tertiary,#999);white-space:nowrap}
 .dsm-workbuddy-pool-members{display:flex;flex-direction:column;gap:10px}
 .dsm-workbuddy-pool-members-head{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;flex-wrap:wrap}
 .dsm-workbuddy-pool-members-title{margin:0 0 3px;font-size:13px;font-weight:600;color:var(--dsw-alias-label-primary,#e6e6e6)}
@@ -3077,6 +3170,13 @@ window.__ModuleLoader__.load({
 			"row.remainingMinutes": "in about {count} min",
 			"row.remainingHours": "in about {count} h",
 			"row.remainingDays": "in about {count} d",
+			"row.poolProbeJustNow": "just now",
+			"row.poolProbeMinutesAgo": "{count} min ago",
+			"row.poolProbeHoursAgo": "{count} h ago",
+			"row.poolProbeDaysAgo": "{count} d ago",
+			"row.poolProbeSourceTest": "tested",
+			"row.poolProbeSourceLive": "hit by a live request",
+			"row.poolProbeSourceUnknown": "source unknown",
 			"row.poolSettingsTitle": "Account pool settings",
 			"row.poolSettingsHint": "These are preferences: they take effect when you save (same as the model list). Test results are written automatically and are not affected by this button.",
 			"row.poolEnabled": "Enable the account pool",
@@ -3087,6 +3187,10 @@ window.__ModuleLoader__.load({
 			"row.poolTargetLabel": "Target test model",
 			"row.poolTargetHint": "Auto (default) picks a zero-multiplier model from this region's catalog, preferring the largest context window. The two regions can pick different models. A manual choice always wins.",
 			"row.poolTargetAutoOption": "Auto — pick a free model",
+			"row.poolProbeSizeLabel": "Test request size",
+			"row.poolProbeSizeHint": "How much text a test sends. The upstream refuses a request once it grows past roughly 20K–30K tokens, so a test smaller than your real conversations answers \"usable\" for an account that would refuse them. Bigger tests are more truthful but cost more credit each.",
+			"row.poolProbeSizeDefault": "Default (25K)",
+			"row.poolProbeSizeOption": "{tokens}K tokens",
 			"row.poolSaved": "Save",
 			"row.poolSaving": "Saving…",
 			"row.poolSaveFailed": "Could not save: {message}",
@@ -3254,6 +3358,13 @@ window.__ModuleLoader__.load({
 			"row.remainingMinutes": "约 {count} 分钟后",
 			"row.remainingHours": "约 {count} 小时后",
 			"row.remainingDays": "约 {count} 天后",
+			"row.poolProbeJustNow": "刚刚",
+			"row.poolProbeMinutesAgo": "{count} 分钟前",
+			"row.poolProbeHoursAgo": "{count} 小时前",
+			"row.poolProbeDaysAgo": "{count} 天前",
+			"row.poolProbeSourceTest": "测得",
+			"row.poolProbeSourceLive": "聊天撞上",
+			"row.poolProbeSourceUnknown": "来源未知",
 			"row.poolSettingsTitle": "账号池设置",
 			"row.poolSettingsHint": "下面是偏好设置：点保存才生效（与「模型管理」一致）。测试结果由插件自动写入，不受这个保存按钮影响。",
 			"row.poolEnabled": "启用账号池",
@@ -3264,6 +3375,10 @@ window.__ModuleLoader__.load({
 			"row.poolTargetLabel": "目标测试模型",
 			"row.poolTargetHint": "「自动」（默认）会从本区域目录里挑一个倍率为 0 的免费模型，多个候选取上下文窗口最大的。国内版与国际版可能挑到不同的模型。手动指定优先于自动。",
 			"row.poolTargetAutoOption": "自动 —— 挑一个免费模型",
+			"row.poolProbeSizeLabel": "测试请求体积",
+			"row.poolProbeSizeHint": "测试时发送多少文本。上游在请求大约超过 2 万～3 万 token 时会开始拒绝，所以测试体积若小于你真实对话的体积，就会出现「测出可用、实际一发就被限」。体积越大测得越准，但每次测试消耗的积分也越多。",
+			"row.poolProbeSizeDefault": "默认（2.5 万）",
+			"row.poolProbeSizeOption": "{tokens} 万 token",
 			"row.poolSaved": "保存",
 			"row.poolSaving": "保存中…",
 			"row.poolSaveFailed": "保存失败：{message}",

package/lib/{host-heartbeat-D5ArLcFf.js → host-heartbeat-DTuwptkM.js}

@@ -2791,7 +2791,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "3.4.3";
+const WORKBUDDY_CONNECT_VERSION = "3.4.4";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -1351,7 +1351,7 @@ declare const PROBE_SYSTEM_PROMPT = "You are a connectivity check. Reply with a
  * Output cap for a probe. One token is enough to prove the model answers.
  *
  * The probe's cost comes from its INPUT, not its output (see
- * {@link PROBE_INPUT_TOKENS}), so paying for a long completion would add money
+ * {@link DEFAULT_PROBE_INPUT_TOKENS}), so paying for a long completion would add money
  * without adding signal.
  */
 declare const PROBE_MAX_TOKENS = 1;
@@ -1378,8 +1378,27 @@ declare const PROBE_MAX_TOKENS = 1;
  * A probe that sent a handful of tokens answered "usable" while every real
  * request in a long conversation was refused — the probe was asking too small a
  * question. 25k is sized to be a realistic long-conversation payload.
+ *
+ * Renamed from `PROBE_INPUT_TOKENS` to say what it now IS: the DEFAULT, not the
+ * only possible size. The size is a property of the user's own traffic (see
+ * {@link probeRequestBody}), so it became a setting; this constant is what an
+ * unset setting, an older profile, and every existing test mean by "a probe".
+ */
+declare const DEFAULT_PROBE_INPUT_TOKENS = 25000;
+/**
+ * The probe sizes the card offers, in tokens.
+ *
+ * A closed set, each step a meaningful position relative to the measured 20k~30k
+ * threshold: below it (10k/20k) proves an account can serve SHORT requests and
+ * is the cheap choice; at it (30k) is the size that finally covers the whole
+ * measured window; above it (50k/100k) is for conversations that routinely run
+ * long, where a smaller probe would report "usable" for an account that refuses
+ * the very next message.
+ *
+ * Exported so the schema's description, the card's dropdown, and the coercion
+ * below cannot drift apart into three different menus.
  */
-declare const PROBE_INPUT_TOKENS = 25000;
+declare const PROBE_INPUT_TOKEN_CHOICES: readonly number[];
 /**
  * Build the request body for one probe.
  *
@@ -1387,10 +1406,13 @@ declare const PROBE_INPUT_TOKENS = 25000;
  * `prepareChatBody` enforces that too, but sending it explicitly keeps this
  * function's output valid on its own.
  *
- * Measured on the built artifact: 112,713 bytes of body, and the upstream
- * counted `prompt_tokens: 25023` at a cost of `credit: 0.72`.
+ * Measured on the built artifact at the DEFAULT size: 112,713 bytes of body, and
+ * the upstream counted `prompt_tokens: 25023` at a cost of `credit: 0.72`. The
+ * body bytes and the credit both scale with the size asked for, which is why the
+ * size is a user setting: a larger probe answers more truthfully for someone
+ * whose conversations are long, and costs proportionally more to ask.
  */
-declare function probeRequestBody(modelId: string): string;
+declare function probeRequestBody(modelId: string, inputTokens?: number): string;
 /**
  * How one probe ended.
  *
@@ -1509,12 +1531,35 @@ declare function probeModel(input: {
   credential: WorkBuddyCredential;
   modelId: string;
   nowMs: number;
+  /**
+   * How much input this probe sends, in tokens.
+   *
+   * Omitted means {@link DEFAULT_PROBE_INPUT_TOKENS}, so every existing caller
+   * keeps the measured 25k and only the pool's user-facing "test" passes a
+   * chosen size through.
+   */
+  inputTokens?: number;
   /** The region's next monthly quota refresh, when known. */
   quotaRefreshAtMs?: number;
   signal?: AbortSignal;
 }): Promise<WorkBuddyProbeResult>;
 //#endregion
 //#region src/account-pool.d.ts
+/**
+ * Which of the pool's writers produced a measurement.
+ *
+ * `test-batch` — the user pressed "test" (or the check-in batch), so the
+ *   outcome is a deliberate measurement of the target model.
+ * `live-request` — a real chat request failed and its failure was recorded so
+ *   the NEXT request starts from a measurement instead of rediscovering the
+ *   same wall.
+ *
+ * The distinction is diagnostic, not behavioural: both feed the same routing
+ * and cooling logic. It exists so a user who watched an account measure `ok`
+ * and later saw it limited can tell whether that was a later live failure
+ * (expected) or an older value winning (a bug).
+ */
+type WorkBuddyPoolProbeSource = 'test-batch' | 'live-request';
 /** One account's pool entry: what the picker needs, plus its last measurement. */
 interface WorkBuddyPoolAccount {
   /** Stable account id (the same one `WorkBuddyAccountChoice` carries). */
@@ -1534,6 +1579,26 @@ interface WorkBuddyPoolProbe {
   outcome: WorkBuddyProbeOutcome;
   /** When this measurement was taken, in epoch ms. */
   atMs: number;
+  /**
+   * WHAT WROTE THIS MEASUREMENT.
+   *
+   * Two sites write probes for the same account, and before this field they
+   * were indistinguishable in the file — which made a real confusion
+   * unanswerable: the user presses "test", sees an account measured `ok`, and
+   * later finds it `rate-limited`. Nothing in the record said whether that was
+   * a NEWER measurement (a live request really did hit the limit) or an OLDER
+   * one somehow winning, and the file keeps no history to tell them apart.
+   *
+   * With the source recorded, that question has an answer on sight: a
+   * `live-request` entry that replaced a `test-batch` result is the pool
+   * working as designed (a live failure steers the next request away from the
+   * account); two entries of the SAME source with the OLDER one winning would
+   * be a genuine bug.
+   *
+   * ABSENT for any measurement written before this field existed, so old probe
+   * files stay readable — an absent source means "unknown", never a guess.
+   */
+  source?: WorkBuddyPoolProbeSource;
   /**
    * When this account may be usable again, when the upstream stated a time.
    *
@@ -1961,6 +2026,14 @@ interface WorkBuddyWebPoolAccount {
   probe?: {
     outcome: WorkBuddyWebProbeOutcome;
     atMs: number;
+    /**
+     * What wrote this measurement, so the card can explain a change the user
+     * watched happen: `test-batch` is a deliberate test, `live-request` is a
+     * real request that failed and overwrote it. ABSENT for records written
+     * before the field existed — the card must then say "unknown" rather than
+     * guess which of the two it was.
+     */
+    source?: 'test-batch' | 'live-request';
     /** Only when the upstream named a time; never invented locally. */
     retryAtMs?: number;
     /**
@@ -2030,6 +2103,14 @@ interface WorkBuddyWebPool {
   targetModelSource: 'preferred' | 'free' | 'none' | 'stale';
   /** The account ids the user has checked into this region's pool. */
   memberAccountIds?: readonly string[];
+  /**
+   * Tokens each test probe sends, as the user saved it; `0`/absent = default.
+   *
+   * The SAVED value, not the resolved one: the card needs to tell "the user
+   * never chose a size" apart from "the user chose 25000", because the first
+   * must keep showing the default option rather than a number they never picked.
+   */
+  probeInputTokens?: number;
   /**
    * The subset of {@link memberAccountIds} that resolves to a real local
    * sign-in — i.e. what a batch actually runs on.
@@ -2188,6 +2269,14 @@ interface WorkBuddyPoolDeps {
   preferences(region: WorkBuddyRegion): {
     enabled: boolean;
     targetModelId: string;
+    /**
+     * Tokens each test probe sends as saved; `0` when the user never chose.
+     *
+     * Optional so a caller that has not learnt about the setting still
+     * satisfies this interface, and so its absence reads as "default" — the
+     * same meaning the host gives an older profile.
+     */
+    probeInputTokens?: number;
     memberAccountIds: readonly string[];
   };
   /** One region's CHECKED accounts, plus their credits and last measurements. */
@@ -2344,6 +2433,23 @@ interface WorkBuddyPoolPreferences {
   enabled?: boolean;
   /** Model id to test; `''` means auto-pick a free model from this region. */
   targetModelId?: string;
+  /**
+   * How much input a probe sends, in tokens — the pool's biggest single knob.
+   *
+   * The upstream's rate limit (6004) fires on request SIZE, and the threshold
+   * was measured to sit between 20k and 30k tokens. The probe has to be sized
+   * near where the user's REAL conversations land: too small and it reports
+   * "usable" while every long conversation is refused (the exact false positive
+   * that made this knob necessary), too large and it costs real credit on every
+   * batch AND excludes accounts that would have served the shorter requests the
+   * user actually sends.
+   *
+   * A fixed value therefore cannot be right for everyone — the right size is a
+   * property of the user's own traffic, which only they know. `undefined` keeps
+   * the measured default ({@link DEFAULT_PROBE_INPUT_TOKENS}), so an existing
+   * profile is unaffected.
+   */
+  probeInputTokens?: number;
   /**
    * The account ids checked into this region's pool.
    *
@@ -2498,4 +2604,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKENS, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as openEncryptedField, A as CREDENTIAL_REJECTED_CODE, B as prepareChatBody, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as declaredTools, G as deriveAtRestKeyId, H as WORKBUDDY_APP_EXECUTABLE_ENV, I as isCredentialRejectedError, K as fetchAtRestKeyPayload, L as parseCreditMultiplier, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as macosNestedAppBundles, R as parseReasoning, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as clearAtRestKeyCache, V as regionOf, W as deriveAtRestKey, X as isWorkbuddyBundle, Y as isEncryptedFieldWrapper, Z as macosBundleExecutable, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as readAtRestKey, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as workbuddyAppExecutableCandidates, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as parseUpstreamModel } from "./host-heartbeat-D5ArLcFf.js";
+import { $ as openEncryptedField, A as CREDENTIAL_REJECTED_CODE, B as prepareChatBody, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as declaredTools, G as deriveAtRestKeyId, H as WORKBUDDY_APP_EXECUTABLE_ENV, I as isCredentialRejectedError, K as fetchAtRestKeyPayload, L as parseCreditMultiplier, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as macosNestedAppBundles, R as parseReasoning, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as clearAtRestKeyCache, V as regionOf, W as deriveAtRestKey, X as isWorkbuddyBundle, Y as isEncryptedFieldWrapper, Z as macosBundleExecutable, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as readAtRestKey, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as workbuddyAppExecutableCandidates, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as parseUpstreamModel } from "./host-heartbeat-DTuwptkM.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1342,10 +1342,49 @@ var RecoveryStream = class {
 	*/
 	nativeCallsSeen = false;
 	buffer;
-	constructor(res, gate, logger) {
+	/**
+	* A notice to place at the head of the answer, once, before any prose.
+	*
+	* Set when the request reached this stream only after the pool failed over, so
+	* the user learns WHY the answer came from a different account. Without it a
+	* failover is invisible: the reply looks like it came from the account they
+	* picked, and the only trace is a `logger.warn` they never see. The notice is
+	* emitted ahead of the model's own text so it cannot be mistaken for part of
+	* the answer, and only once — a retry that never delivers text must not leave
+	* a stray line behind.
+	*/
+	notice;
+	constructor(res, gate, logger, notice) {
 		this.res = res;
 		this.logger = logger;
 		this.buffer = gate === void 0 ? void 0 : new DsmlStreamBuffer(gate);
+		this.notice = notice;
+	}
+	/**
+	* Emit the pending failover notice, if any, and forget it.
+	*
+	* Called immediately before the first content reaches the client. Placed
+	* here rather than in the constructor because a stream whose write fails, or
+	* whose attempt is discarded in favour of a retry, must not have already told
+	* the user about a switch it never completed.
+	*/
+	flushNotice() {
+		const notice = this.notice;
+		if (notice === void 0) return;
+		this.notice = void 0;
+		if (!this.res.writable) return;
+		const chunk = { choices: [{
+			index: 0,
+			delta: {},
+			finish_reason: ""
+		}] };
+		const choiceRecord = {
+			index: 0,
+			delta: {},
+			finish_reason: ""
+		};
+		this.windowOpened = true;
+		this.res.write(contentFrame(chunk, choiceRecord, notice));
 	}
 	/** True when a call or real prose has reached the client. */
 	get delivered() {
@@ -1444,6 +1483,7 @@ var RecoveryStream = class {
 		if (Array.isArray(nativeCalls) && nativeCalls.length > 0) {
 			this.nativeCallsSeen = true;
 			this.windowOpened = true;
+			this.flushNotice();
 			this.send(frame, false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1458,6 +1498,7 @@ var RecoveryStream = class {
 		}
 		if (this.buffer === void 0 || this.nativeCallsSeen) {
 			this.windowOpened = true;
+			this.flushNotice();
 			this.closeWindow();
 			this.res.write(frame);
 			this.wroteContent = true;
@@ -1466,6 +1507,7 @@ var RecoveryStream = class {
 		this.windowOpened = true;
 		const outcome = this.buffer.add(content);
 		if (outcome.calls !== void 0 && outcome.calls.length > 0) {
+			this.flushNotice();
 			this.send(callsFrame(chunk, choiceRecord, outcome.calls), false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1478,6 +1520,7 @@ var RecoveryStream = class {
 			return;
 		}
 		if (outcome.prose) {
+			this.flushNotice();
 			this.send(contentFrame(chunk, choiceRecord, outcome.text), false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1521,6 +1564,7 @@ var RecoveryStream = class {
 		this.windowOpened = true;
 		const frame = contentFrame(chunk, choiceRecord, text);
 		if (text.trim() !== "") {
+			this.flushNotice();
 			this.send(frame, false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1598,6 +1642,55 @@ function callsFrame(chunk, choice, calls) {
 	};
 	return `data: ${JSON.stringify(next)}\n\n`;
 }
+/**
+* How to name a pool account in a sentence the USER reads.
+*
+* Prefers the phone number (`uin`) because that is what the pool table shows and
+* what a person recognises; the nickname and the opaque account id are fallbacks
+* so this can never render an empty name. Deliberately NOT the hashed account id
+* on its own: a 24-character hex digest identifies an account to the plugin, but
+* to the person reading the answer it identifies nothing.
+*/
+function describeAccount(credential) {
+	if (credential.uin !== void 0 && credential.uin !== "") return credential.uin;
+	if (credential.nickname !== void 0 && credential.nickname !== "") return credential.nickname;
+	return workbuddyAccountId(credential);
+}
+/**
+* One short phrase for why an account was abandoned, for the in-reply notice.
+*
+* Kept to the distinction the user can act on rather than the internal kind
+* name: "rate limited" says wait or add an account, "rejected" says the sign-in
+* is the problem. The numeric kind would only send them to the log.
+*/
+function failoverReasonText(failure) {
+	if (failure.ok) return "unusable";
+	switch (failure.kind) {
+		case "soft_rate":
+		case "hard_credit": return "rate limited";
+		case "session_dead": return "signed out";
+		case "policy_reject": return "rejected by policy";
+		case "not_found": return "model unavailable";
+		case "server": return "erroring upstream";
+		default: return `unusable (http ${failure.status})`;
+	}
+}
+/**
+* The line prepended to an answer that came from a failover account.
+*
+* Block-quoted and bracketed so it reads as machinery rather than as the model's
+* own words, and so a user skimming for the answer can skip it. It states the
+* reason AND the account left behind, because those are the two facts that make
+* an unexpected reply explicable.
+*
+* The wording avoids "switched TO <account>" on purpose: the account that took
+* over is the one the user is about to keep talking to, and naming it invites
+* the reading that they must now manage it. What they need is to know the one
+* they chose did not answer, and why.
+*/
+function failoverNoticeText(from, reason) {
+	return `\n\n> [dsh-connect-workbuddy] 「${from}」was ${reason} — this answer came from another account\n\n`;
+}
 /** One frame carrying replacement text for a frame whose content was consumed. */
 function contentFrame(chunk, choice, content) {
 	const delta = {
@@ -1726,6 +1819,15 @@ function createWorkBuddyShim(options) {
 		let result = await client.chatStream(credential, prepared, controller.signal);
 		const triedAccountIds = [];
 		/**
+		* The account the request STARTED on, and the reason it was abandoned.
+		*
+		* `??=` on the first switch only: if three accounts fail in a row the user
+		* cares that the answer did not come from the one they picked, not with a
+		* blow-by-blow list of every candidate that was also rate limited.
+		*/
+		let switchedFrom;
+		let switchedBecause;
+		/**
 		* Tell the plugin about a failed attempt so it can store the measurement.
 		*
 		* Every failed attempt is reported exactly once, INCLUDING the last one — an
@@ -1780,6 +1882,8 @@ function createWorkBuddyShim(options) {
 			});
 			if (controller.signal.aborted) break;
 			logger?.warn(`dsh-connect-workbuddy: retrying chat on another pool account after ${result.kind} (http ${result.status})`);
+			switchedFrom ??= describeAccount(credential);
+			switchedBecause ??= failoverReasonText(result);
 			credential = next;
 			result = await client.chatStream(credential, prepared, controller.signal);
 		}
@@ -1813,7 +1917,8 @@ function createWorkBuddyShim(options) {
 			requiredParameters: declared.requiredParameters,
 			...declared.pinnedToolName === void 0 ? {} : { pinnedToolName: declared.pinnedToolName }
 		};
-		const writer = new RecoveryStream(res, gate, logger);
+		const notice = switchedFrom === void 0 || switchedBecause === void 0 ? void 0 : failoverNoticeText(switchedFrom, switchedBecause);
+		const writer = new RecoveryStream(res, gate, logger, notice);
 		await writer.consume(result.response.body);
 		if (gate !== void 0 && !writer.delivered && writer.residueSeen && !controller.signal.aborted) {
 			logger?.warn("dsh-connect-workbuddy: the turn produced DSML markup only; retrying it once");
@@ -1868,7 +1973,7 @@ const PROBE_SYSTEM_PROMPT = "You are a connectivity check. Reply with a single w
 * Output cap for a probe. One token is enough to prove the model answers.
 *
 * The probe's cost comes from its INPUT, not its output (see
-* {@link PROBE_INPUT_TOKENS}), so paying for a long completion would add money
+* {@link DEFAULT_PROBE_INPUT_TOKENS}), so paying for a long completion would add money
 * without adding signal.
 */
 const PROBE_MAX_TOKENS = 1;
@@ -1895,8 +2000,44 @@ const PROBE_MAX_TOKENS = 1;
 * A probe that sent a handful of tokens answered "usable" while every real
 * request in a long conversation was refused — the probe was asking too small a
 * question. 25k is sized to be a realistic long-conversation payload.
+*
+* Renamed from `PROBE_INPUT_TOKENS` to say what it now IS: the DEFAULT, not the
+* only possible size. The size is a property of the user's own traffic (see
+* {@link probeRequestBody}), so it became a setting; this constant is what an
+* unset setting, an older profile, and every existing test mean by "a probe".
+*/
+const DEFAULT_PROBE_INPUT_TOKENS = 25e3;
+/**
+* The probe sizes the card offers, in tokens.
+*
+* A closed set, each step a meaningful position relative to the measured 20k~30k
+* threshold: below it (10k/20k) proves an account can serve SHORT requests and
+* is the cheap choice; at it (30k) is the size that finally covers the whole
+* measured window; above it (50k/100k) is for conversations that routinely run
+* long, where a smaller probe would report "usable" for an account that refuses
+* the very next message.
+*
+* Exported so the schema's description, the card's dropdown, and the coercion
+* below cannot drift apart into three different menus.
 */
-const PROBE_INPUT_TOKENS = 25e3;
+const PROBE_INPUT_TOKEN_CHOICES = [
+	1e4,
+	2e4,
+	3e4,
+	5e4,
+	1e5
+];
+/**
+* A requested probe size reduced to a size this build will actually send.
+*
+* Anything outside {@link PROBE_INPUT_TOKEN_CHOICES} — `undefined` from an older
+* profile, `0` from an unset field, a hand-edited odd number — becomes the
+* measured default. Coercing rather than rejecting keeps a hand-edited profile
+* working instead of turning one odd value into a failed test batch.
+*/
+function resolveProbeInputTokens(requested) {
+	return requested !== void 0 && PROBE_INPUT_TOKEN_CHOICES.includes(requested) ? requested : DEFAULT_PROBE_INPUT_TOKENS;
+}
 /**
 * Characters per token for the filler text, measured.
 *
@@ -1915,11 +2056,14 @@ const FILLER_LINE = "The quick brown fox jumps over the lazy dog. ";
 * `prepareChatBody` enforces that too, but sending it explicitly keeps this
 * function's output valid on its own.
 *
-* Measured on the built artifact: 112,713 bytes of body, and the upstream
-* counted `prompt_tokens: 25023` at a cost of `credit: 0.72`.
+* Measured on the built artifact at the DEFAULT size: 112,713 bytes of body, and
+* the upstream counted `prompt_tokens: 25023` at a cost of `credit: 0.72`. The
+* body bytes and the credit both scale with the size asked for, which is why the
+* size is a user setting: a larger probe answers more truthfully for someone
+* whose conversations are long, and costs proportionally more to ask.
 */
-function probeRequestBody(modelId) {
-	const targetChars = Math.ceil(PROBE_INPUT_TOKENS * CHARS_PER_TOKEN);
+function probeRequestBody(modelId, inputTokens = DEFAULT_PROBE_INPUT_TOKENS) {
+	const targetChars = Math.ceil(resolveProbeInputTokens(inputTokens) * CHARS_PER_TOKEN);
 	const filler = FILLER_LINE.repeat(Math.ceil(targetChars / 45));
 	return JSON.stringify({
 		model: modelId,
@@ -2117,7 +2261,7 @@ async function probeModel(input) {
 	let answer;
 	const startedAt = Date.now();
 	try {
-		answer = await input.client.probeChat(input.credential, probeRequestBody(input.modelId), input.signal);
+		answer = await input.client.probeChat(input.credential, probeRequestBody(input.modelId, input.inputTokens), input.signal);
 	} catch (error) {
 		return {
 			modelId: input.modelId,
@@ -2310,6 +2454,7 @@ function probeUpdatesOf(rows) {
 		updates[row.accountId] = {
 			outcome: row.result.outcome,
 			atMs,
+			source: "test-batch",
 			...row.result.retryAtMs === void 0 ? {} : { retryAtMs: row.result.retryAtMs },
 			...row.result.message === void 0 ? {} : { message: row.result.message }
 		};
@@ -2574,7 +2719,7 @@ const POOL_STORE_PREFIX = ".workbuddy-pool";
 function isProbe(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const candidate = value;
-	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string");
+	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string") && (candidate["source"] === void 0 || typeof candidate["source"] === "string");
 }
 /**
 * One region's path for measured pool facts.
@@ -2621,6 +2766,7 @@ async function readPoolProbes(region) {
 		probes[accountId] = {
 			outcome: probe.outcome,
 			atMs: probe.atMs,
+			...knownProbeSource(probe.source) === void 0 ? {} : { source: knownProbeSource(probe.source) },
 			...probe.retryAtMs === void 0 ? {} : { retryAtMs: probe.retryAtMs },
 			...probe.message === void 0 ? {} : { message: probe.message }
 		};
@@ -2628,6 +2774,17 @@ async function readPoolProbes(region) {
 	return probes;
 }
 /**
+* A stored source string reduced to a source this build understands.
+*
+* `isProbe` accepts any string so a newer build's label cannot destroy the
+* measurement it describes; this narrows it at the point of use. An unknown
+* value becomes `undefined`, which the card renders as "unknown" — the honest
+* answer, rather than mislabelling it as one of the two kinds we do know.
+*/
+function knownProbeSource(value) {
+	return value === "test-batch" || value === "live-request" ? value : void 0;
+}
+/**
 * Merge measurements into one region's store and write it atomically.
 *
 * A MERGE rather than a replace, because batches measure one account at a time
@@ -3127,6 +3284,7 @@ async function workBuddyWebPool(deps, region) {
 			...measured?.probe === void 0 ? {} : { probe: {
 				outcome: measured.probe.outcome,
 				atMs: measured.probe.atMs,
+				...measured.probe.source === void 0 ? {} : { source: measured.probe.source },
 				...measured.probe.retryAtMs === void 0 ? {} : { retryAtMs: measured.probe.retryAtMs },
 				...measured.probe.message === void 0 ? {} : { message: measured.probe.message }
 			} },
@@ -3143,6 +3301,7 @@ async function workBuddyWebPool(deps, region) {
 		...target.staleModelId === void 0 ? {} : { staleTargetModelId: target.staleModelId },
 		targetModelSource: target.source,
 		memberAccountIds: preferences.memberAccountIds,
+		...preferences.probeInputTokens === void 0 ? {} : { probeInputTokens: preferences.probeInputTokens },
 		effectiveMemberAccountIds: effectiveMembersOf(accounts.map((account) => account.accountId), new Set(preferences.memberAccountIds)),
 		accounts,
 		catalog: deps.displayModels(region).map((model) => ({
@@ -3522,6 +3681,16 @@ const modelConfig = z.object({
 const poolConfig = z.object({
 	enabled: z.boolean().default(false).description("Whether this region's account pool is active (opt-in). While on, a failed chat request is retried against the other usable pool members before the error is reported."),
 	targetModelId: z.string().default("").description("Model id to test; empty means pick a zero-multiplier model from this region's catalog"),
+	/**
+	* Sizing of the test probe, as a token count the user picks from a fixed set.
+	*
+	* A closed set rather than a free number: each step is a meaningful position
+	* relative to the measured 20k~30k threshold, and an arbitrary value would
+	* invite a size that is neither safely under nor clearly over it. `0` (and any
+	* unknown value) falls back to the measured default, so a profile written by
+	* an older build — and one hand-edited to something odd — behaves identically.
+	*/
+	probeInputTokens: z.number().step(1).default(0).description("Input tokens each test probe sends: 10000 / 20000 / 30000 / 50000 / 100000. Bigger probes catch a rate limit real conversations would hit, but cost more credit per test and may mark an account unusable for large requests only. 0 uses the measured default (25000)"),
 	memberAccountIds: z.array(z.string()).default([]).description("Account ids checked into this pool (opt-in; empty means the pool covers nothing)")
 });
 const regionStateConfig = z.object({
@@ -4138,6 +4307,7 @@ function apply(ctx, config) {
 		await writePoolProbes(region, { [accountId]: {
 			outcome,
 			atMs: Date.now(),
+			source: "live-request",
 			...retryAtMs === void 0 ? {} : { retryAtMs },
 			...message === "" ? {} : { message }
 		} });
@@ -4228,9 +4398,11 @@ function apply(ctx, config) {
 	/** One region's pool preferences, with the schema's defaults applied. */
 	const poolPreferencesOf = (config, region) => {
 		const pool = regionStateOf(config, region).pool;
+		const probeInputTokens = pool?.probeInputTokens;
 		return {
 			enabled: pool?.enabled === true,
 			targetModelId: pool?.targetModelId ?? "",
+			...probeInputTokens === void 0 ? {} : { probeInputTokens },
 			memberAccountIds: pool?.memberAccountIds ?? []
 		};
 	};
@@ -4276,11 +4448,13 @@ function apply(ctx, config) {
 			claimDailyCheckin: (credential) => client.claimDailyCheckin(credential),
 			probe: async (credential, modelId) => {
 				const quotaRefreshAtMs = await quotaRefreshOf(region, credential);
+				const inputTokens = resolveProbeInputTokens(poolPreferencesOf(current(), region).probeInputTokens);
 				return probeModel({
 					client,
 					credential,
 					modelId,
 					nowMs: Date.now(),
+					inputTokens,
 					...quotaRefreshAtMs === void 0 ? {} : { quotaRefreshAtMs }
 				});
 			}
@@ -4402,4 +4576,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKENS, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "3.4.3",
+  "version": "3.4.4",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",