dsh-connect-workbuddy 3.4.3 → 3.4.5

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # Changelog
 
+## 3.4.5 (2026-10-04)
+
+### Fixes
+
+- **保存设置不再把「本该用实时目录」的模型槽写空，正在用的模型不会凭空消失（issue #32）。**
+  - **现象**：在 `regions` 从未成功写入过的 profile 上（如 issue #31 所述的环境），第一次保存（哪怕只改了一处偏好）之后，模型选择器里**正在使用的默认模型突然不见了**，其他只在上游目录里、不在内置静态名单里的模型也一起消失，且**没有任何报错**。
+  - **根因**（两半，缺一不可）：
+    1. **写半边**——`__save` 的 `merged` 以宿主解析值为种子。当 `regions` 还是空对象时，`{"cn":{"imageModelIds":[]}}` 这样的载荷会落下**一个没有 `lastCatalog` 的 cn 槽**。槽本身合法（schema 里 `lastCatalog` 默认就是 `[]`），但它缺了这份目录。
+    2. **读半边**——`configuredModels` / `displayModels` 把 roster 解析成两步：`state.lastCatalog?.length ? lastCatalog : 静态名单`。「槽存在但没有目录」和「从未配置过」于是被当成同一件事，都退回**内置的 12 条静态名单**；而 `applySelection` 又把这份静态名单 `catalog.set()` 进**实时目录**——实时发现注册的 17 条就此被覆盖。正在用的 `space-bunny` 只在实时目录里、不在静态名单里，当场消失。
+  - **修法**：
+    - 写半边：`__save` 在合并之后、落盘之前，对本次载荷**真正触及**的区域（只碰 `incoming` 里出现过的键，不动调用方没提到的兄弟区域），若该槽缺目录（`lastCatalog` 缺失或为空数组），就用 `displayModels` 取到的**实时名册**补上。用 `displayModels` 而非上游往返：保存不该依赖网络，也不该因为上游不可用而失败。调用方显式传来的数组（含非空数组）仍然优先，实时名册为空则维持原状、不写空数组。
+    - 读半边：roster 解析改成三步 `lastCatalog → 该区域当前已注册的实时目录 → 静态名单`。静态名单退回它本来该待的位置——上游离线、什么都发现不了时的最后兜底。`applySelection` 在 `set()` **之前**读一次当前目录，避免观察到自己正要写的值。
+  - 这样「槽存在但缺目录」会**降到实时目录**，永远不会越过它掉到静态名单。
+
+- **未显式设置预算的模型不再被强制压到 200K，1M 模型的真实窗口得以保留（issue #33）。**
+  - **现象**：上游目录里 17 个模型有 15 个被改报成 200000——`space-bunny`、`deepseek-v4.1-flash`、`deepseek-v4-pro`、`glm-5.3`、`glm-5.3-flash`、`glm-5.2`、`kimi-k3-1`、`kimi-k2.8-preview` 的 1000000、`hy4-preview` 的 960000、`minimax-m3` 的 512000、`auto`/`kimi-k2.6`/`kimi-k2.7` 的 256000 全部变成 200000。
+  - **根因**：`applyContextBudgets` 里 `budgets[model.id] ?? 200_000` 的默认值——**未设置预算被当成「设成 200K」**。这条默认值在 CHANGELOG 里给出的理由是「让 DSH 提前压缩以避开上游节流」，但同一份 CHANGELOG 又自述实测节流线是 **2 万～3 万 token 且单次请求即触顶**：200K 比那条线高一个数量级，压到 200K 并没有把压缩提前到安全区。200K 在静态目录里也无出处（`auto` 是 168000、`hy3` 是 192000、`default-model` 是 176000、`primary-model` 是 272000）；插件自己的静态目录还把 `glm-5.3` 等声明为 1000000，与钳制自相矛盾。
+  - **修法**：`applyContextBudgets` 不再有默认值——**只做上限**：未设置预算时保留模型的原生窗口，设置了就用 `Math.min(原生, 预算)`。`contextBudgets` 的语义恢复成「用户设的上限」，而不是一个隐式的全局改写。（`toWebModel` 里那份重复的 `?? 200_000` 也一并去掉，改为调用同一个函数，避免卡片与运行时目录各说各话。）
+  - 想继续压缩的用户仍然可以显式设置 `regions.<region>.contextBudgets`；卡片上原本只在原生窗口 > 200K 时才出现的「DSH 上下文预算」选择器，现在因为不再默认钳制而更有意义。
+
+## 3.4.4 (2026-10-03)
+
+### Features
+
+- **测试请求体积可选（1 万 / 2 万 / 3 万 / 5 万 / 10 万 token），不再固定 2.5 万。**
+  - **背景**：上游的频率限制（6004）按**请求体积**触发——实测阈值落在 2 万～3 万 token 之间，**单次请求就足以触顶**（不是累计）。而账号池的「测试」探针此前固定发 25,000 token，于是真实对话体积在 2.5 万～3 万之间时会出现「测试测出可用、一发聊天立刻被限」。
+  - **为什么不是把固定值调大**：探针只测一个点，而阈值是一个区间、真实对话体积是连续的——把 2.5 万改成 3 万只是把缝隙上移（3 万以上漏判），且成本线性上升（2.5 万 ≈ 0.72 积分，5 万 ≈ 1.4+）。**体积是用户流量的属性，因此交给用户选。**
+  - 新增池子设置「测试请求体积」，默认仍是实测标定的 25K（`0` = 默认）；改动立即生效，无需重载。
+  - 相应用户可见的说明写在设置项旁：解释 2 万～3 万阈值与「测出可用、一发就被限」的成因。
+
+- **换号时在回复正文里说明原因，不再只有日志。**
+  - **背景**：池子的 failover 会给同一个请求依次试多个账号，此前只写一行 `logger.warn`——用户完全看不到。于是一次切换过的回复，和「你选的那个账号正常回答」**在界面上完全一样**，而且事后无法从记录区分「刚才真有请求失败」和「状态莫名其妙退回了旧值」。
+  - 现在回答开头会附一行（仅当真的发生了切换、且确实有内容送达时）：
+
+    > [dsh-connect-workbuddy] 「13046625578」was rate limited — this answer came from another account
+
+  - 只报**第一个**被放弃的账号与原因（连续试 4 个账号时不刷屏），原因按用户能采取的行动措辞（`rate limited` / `signed out` / `rejected by policy` / …），而不是内部 kind 名。
+
+- **池子记录标注来源与时间，让「结果变了」可解释。**
+  - 每条测量现在记录它是**谁写的**：`测得`（用户点「测试」的批测）或 `聊天撞上`（实时聊天失败被记录），以及**多久前**更新。
+  - 卡片上分两行显示：主行是结果/恢复时间/原因，次行是来源胶囊 + 相对时间。此前只能靠时间戳分布**猜**来源（批测写同一时间戳、单账号写入时间戳各不同）。
+  - 「来源未知」用于本次升级之前写入、没有来源字段的旧记录——不猜，如实标注。
+
+### Fixes
+
+- **「来源未知」胶囊太淡看不清。** 旧样式同时做了四处削弱（`background:transparent`、`1px dashed`、`label-dimmed #9aa0a6`、`font-weight:400`）；实测对比度发现**字色不是主因**（`#9aa0a6` 5.28:1，反而比正常胶囊的 `#999` 4.89:1 更亮），主因是 10px 小字配 400 字重。已改为实底 + 实线边框 + `label-secondary`（8.41:1），并去掉字重覆盖以继承基类的 600。
+
 ## 3.4.3 (2026-10-03)
 
 ### Features

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { E as legacyWorkbuddyOwnAuthPath, H as WORKBUDDY_APP_EXECUTABLE_ENV, J as findWorkbuddyAppExecutableWithSource, N as WorkBuddyUpstreamClient, S as defaultDesktopAuthDirs, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, x as defaultDesktopAuthCandidates } from "./host-heartbeat-D5ArLcFf.js";
+import { A as workbuddyOwnAuthPath, C as defaultDesktopAuthDirs, D as legacyWorkbuddyOwnAuthPath, P as WorkBuddyUpstreamClient, S as defaultDesktopAuthCandidates, U as WORKBUDDY_APP_EXECUTABLE_ENV, Y as findWorkbuddyAppExecutableWithSource, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-CTigiLJK.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -513,11 +513,19 @@ window.__ModuleLoader__.load({
 		* @throws {WorkBuddySettingsWriteError} when neither writer persists the value.
 		*/
 		async function writePoolPreferences(scope, region, preferences) {
-			const next = nextRegionPool(scope.getSnapshot().value, region, preferences)[region];
+			const slot = {
+				enabled: preferences.enabled,
+				targetModelId: preferences.targetModelId,
+				memberAccountIds: preferences.memberAccountIds
+			};
+			if (preferences.probeInputTokens !== void 0) slot["probeInputTokens"] = preferences.probeInputTokens;
+			const next = nextRegionPool(scope.getSnapshot().value, region, slot)[region];
 			await writeField(scope, "regions", region, next, (readBack) => {
 				const pool = readBack?.pool;
 				if (pool === void 0 || pool === null) return false;
 				if (pool["enabled"] !== preferences.enabled || pool["targetModelId"] !== preferences.targetModelId) return false;
+				const wantedTokens = preferences.probeInputTokens ?? 0;
+				if ((pool["probeInputTokens"] ?? 0) !== wantedTokens) return false;
 				const stored = pool["memberAccountIds"];
 				if (!Array.isArray(stored) || stored.length !== preferences.memberAccountIds.length) return false;
 				const wanted = new Set(preferences.memberAccountIds);
@@ -619,6 +627,53 @@ window.__ModuleLoader__.load({
 			return message.replace(/^transport error:\s*/u, "");
 		}
 		//#endregion
+		//#region src/client/probe-age.ts
+		const MINUTE_MS$1 = 6e4;
+		const HOUR_MS$1 = 60 * MINUTE_MS$1;
+		const DAY_MS$1 = 24 * HOUR_MS$1;
+		/**
+		* How long ago a measurement was taken, coarsely: "刚刚", "N 分钟前",
+		* "N 小时前", "N 天前".
+		*
+		* Coarse on purpose, for the same reason `remainingText` rounds: a figure that
+		* changes every second reads as live telemetry rather than as "how stale is
+		* this", which is the only question being asked here.
+		*
+		* A clock skew that puts the measurement in the FUTURE (a stored `atMs` ahead
+		* of `nowMs`, from a machine whose clock moved backwards) is reported as
+		* "刚刚" rather than as a negative age: the record is real, and the card must
+		* not print "-3 分钟前".
+		*/
+		function probeAgeText(t, atMs, nowMs) {
+			const age = nowMs - atMs;
+			if (age < MINUTE_MS$1) return t("row.poolProbeJustNow");
+			if (age < HOUR_MS$1) return t("row.poolProbeMinutesAgo", { count: Math.round(age / MINUTE_MS$1) });
+			if (age < 2 * DAY_MS$1) return t("row.poolProbeHoursAgo", { count: Math.round(age / HOUR_MS$1) });
+			return t("row.poolProbeDaysAgo", { count: Math.round(age / DAY_MS$1) });
+		}
+		//#endregion
+		//#region src/probe.ts
+		/**
+		* The probe sizes the card offers, in tokens.
+		*
+		* A closed set, each step a meaningful position relative to the measured 20k~30k
+		* threshold: below it (10k/20k) proves an account can serve SHORT requests and
+		* is the cheap choice; at it (30k) is the size that finally covers the whole
+		* measured window; above it (50k/100k) is for conversations that routinely run
+		* long, where a smaller probe would report "usable" for an account that refuses
+		* the very next message.
+		*
+		* Exported so the schema's description, the card's dropdown, and the coercion
+		* below cannot drift apart into three different menus.
+		*/
+		const PROBE_INPUT_TOKEN_CHOICES = [
+			1e4,
+			2e4,
+			3e4,
+			5e4,
+			1e5
+		];
+		//#endregion
 		//#region src/client/remaining.ts
 		const MINUTE_MS = 6e4;
 		const HOUR_MS = 60 * MINUTE_MS;
@@ -989,10 +1044,11 @@ window.__ModuleLoader__.load({
 			const saved = {
 				enabled: pool?.enabled ?? false,
 				targetModelId: pool?.targetModelId || pool?.staleTargetModelId || "",
+				probeInputTokens: pool?.probeInputTokens ?? 0,
 				memberAccountIds: pool?.memberAccountIds ?? []
 			};
 			const active = draftRegion === region && draft !== null ? draft : saved;
-			const dirty = draftRegion === region && draft !== null && (draft.enabled !== saved.enabled || draft.targetModelId !== saved.targetModelId || !sameIds(draft.memberAccountIds, saved.memberAccountIds));
+			const dirty = draftRegion === region && draft !== null && (draft.enabled !== saved.enabled || draft.targetModelId !== saved.targetModelId || draft.probeInputTokens !== saved.probeInputTokens || !sameIds(draft.memberAccountIds, saved.memberAccountIds));
 			/**
 			* Membership that actually resolves to a local sign-in — what a batch runs on.
 			*
@@ -1376,10 +1432,24 @@ window.__ModuleLoader__.load({
 			const name = account.accountName === "" ? t("row.accountUnnamed") : account.accountName;
 			const excluded = exclusionText(t, account);
 			const probe = account.probe;
+			const outcomeLine = probe === void 0 ? t("row.poolNeverTested") : probe.retryAtMs !== void 0 ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryAt", { at: formatShort(probe.retryAtMs) })}` : probe.outcome === "rate-limited" || probe.outcome === "out-of-credit" ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryUnknown")}` : outcomeText(t, probe.outcome);
+			const remaining = probe?.retryAtMs === void 0 ? "" : remainingText(t, probe.retryAtMs, Date.now());
+			const reason = probe === void 0 ? void 0 : inlineProbeReason(probe.outcome, probe.message);
+			const age = probe === void 0 ? void 0 : probeAgeText(t, probe.atMs, Date.now());
+			const probeLabel = probe === void 0 ? void 0 : probe.source === void 0 ? {
+				text: t("row.poolProbeSourceUnknown"),
+				className: "dsm-workbuddy-pool-prov-tag dsm-workbuddy-pool-prov-unknown"
+			} : probe.source === "live-request" ? {
+				text: t("row.poolProbeSourceLive"),
+				className: "dsm-workbuddy-pool-prov-tag dsm-workbuddy-pool-prov-live"
+			} : {
+				text: t("row.poolProbeSourceTest"),
+				className: "dsm-workbuddy-pool-prov-tag"
+			};
 			const probeLine = [
-				probe === void 0 ? t("row.poolNeverTested") : probe.retryAtMs !== void 0 ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryAt", { at: formatShort(probe.retryAtMs) })}` : probe.outcome === "rate-limited" || probe.outcome === "out-of-credit" ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryUnknown")}` : outcomeText(t, probe.outcome),
-				probe?.retryAtMs === void 0 ? "" : remainingText(t, probe.retryAtMs, Date.now()),
-				probe === void 0 ? void 0 : inlineProbeReason(probe.outcome, probe.message)
+				outcomeLine,
+				remaining,
+				reason
 			].filter((part) => part !== void 0 && part !== "").join(" · ");
 			return (0, react.createElement)("div", {
 				className: `dsm-workbuddy-pool-row${account.current ? " dsm-workbuddy-pool-row-current" : ""}`,
@@ -1396,7 +1466,7 @@ window.__ModuleLoader__.load({
 			}), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-account-name" }, (0, react.createElement)("b", null, name), account.current ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-current-tag" }, t("row.poolCurrentBadge")) : null, (0, react.createElement)("span", { className: checked ? "dsm-workbuddy-pool-member" : "dsm-workbuddy-pool-not-member" }, checked ? t("row.poolMember") : t("row.poolNotMember")), excluded === void 0 ? probe === void 0 ? null : (0, react.createElement)("span", null, t("row.poolTestedAt", { at: formatShort(probe.atMs) })) : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-excluded" }, excluded))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-credits" }, account.credits === void 0 ? (0, react.createElement)("span", null, "—") : (0, react.createElement)("b", null, formatNumber$1(account.credits)), account.expiringSoon !== void 0 && account.expiringSoon > 0 ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-soon" }, t("row.poolCreditSoon", { count: formatNumber$1(account.expiringSoon) })) : account.nearestExpiryMs === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-soon-plain" }, t("row.poolCreditNearest", { at: formatShort(account.nearestExpiryMs) }))), (0, react.createElement)("span", {
 				className: "dsm-workbuddy-pool-probe",
 				...probe?.message === void 0 ? {} : { title: probe.message }
-			}, probeLine), checkinSupported ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checkin" }, account.checkedInToday === void 0 ? (0, react.createElement)("span", {
+			}, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-main" }, probeLine), probeLabel === void 0 && age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-prov" }, probeLabel === void 0 ? null : (0, react.createElement)("span", { className: probeLabel.className }, probeLabel.text), probeLabel === void 0 || age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-sep" }, "·"), age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-age" }, age))), checkinSupported ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checkin" }, account.checkedInToday === void 0 ? (0, react.createElement)("span", {
 				className: "dsm-workbuddy-pool-unknown",
 				title: t("row.poolNeverTested")
 			}, t("row.poolCheckinUnknown")) : account.checkedInToday ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checked" }, t("row.poolCheckedIn")) : t("row.poolNotCheckedIn")) : null);
@@ -1431,7 +1501,22 @@ window.__ModuleLoader__.load({
 			}, t("row.poolTargetStaleOption", { model: active.targetModelId })) : null, ...(pool.catalog ?? []).map((model) => (0, react.createElement)("option", {
 				value: model.id,
 				key: model.id
-			}, model.creditMultiplier === void 0 ? model.name : `${model.name} (x${model.creditMultiplier.toFixed(2)})`)))))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-save-bar" }, (0, react.createElement)("a", {
+			}, model.creditMultiplier === void 0 ? model.name : `${model.name} (x${model.creditMultiplier.toFixed(2)})`))))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, t("row.poolProbeSizeLabel")), (0, react.createElement)("span", null, t("row.poolProbeSizeHint"))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("select", {
+				className: "dsm-workbuddy-pool-select",
+				value: String(active.probeInputTokens),
+				disabled: !canEdit,
+				onChange: (event) => {
+					const parsed = Number.parseInt(event.currentTarget.value, 10);
+					const next = Number.isFinite(parsed) ? parsed : 0;
+					onEdit((current) => ({
+						...current,
+						probeInputTokens: next
+					}));
+				}
+			}, (0, react.createElement)("option", { value: "0" }, t("row.poolProbeSizeDefault")), ...PROBE_INPUT_TOKEN_CHOICES.map((tokens) => (0, react.createElement)("option", {
+				value: String(tokens),
+				key: String(tokens)
+			}, t("row.poolProbeSizeOption", { tokens: String(tokens / 1e3) }))))))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-save-bar" }, (0, react.createElement)("a", {
 				className: "dsm-workbuddy-usage-cheer",
 				href: WORKBUDDY_GITHUB_URL,
 				target: "_blank",
@@ -1705,6 +1790,14 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-pool-soon{font-size:11px;line-height:16px;color:var(--dsw-alias-state-warn-primary,#f59e0b)}
 .dsm-workbuddy-pool-soon-plain{font-size:11px;line-height:16px;color:var(--dsw-alias-label-tertiary,#999)}
 .dsm-workbuddy-pool-probe,.dsm-workbuddy-pool-checkin{font-size:12px;line-height:17px;color:var(--dsw-alias-label-tertiary,#999);min-width:0;overflow-wrap:anywhere}
+.dsm-workbuddy-pool-probe{display:flex;flex-direction:column;gap:4px}
+.dsm-workbuddy-pool-probe-main{color:var(--dsw-alias-label-secondary,#c6c9d0)}
+.dsm-workbuddy-pool-probe-prov{display:flex;align-items:center;gap:5px;font-size:11px;line-height:15px;color:var(--dsw-alias-label-tertiary,#999);min-width:0;flex-wrap:wrap}
+.dsm-workbuddy-pool-prov-tag{padding:1px 6px;border-radius:999px;background:var(--dsw-alias-bg-layer-3,#2a2c33);color:var(--dsw-alias-label-tertiary,#999);font-size:10px;font-weight:600;line-height:15px;white-space:nowrap}
+.dsm-workbuddy-pool-prov-live{background:rgba(245,158,11,.16);color:var(--dsw-alias-state-warn-primary,#f59e0b)}
+.dsm-workbuddy-pool-prov-unknown{background:var(--dsw-alias-bg-layer-3,#2a2c33);border:1px solid var(--dsw-alias-border-l1,#2c2d31);color:var(--dsw-alias-label-secondary,#c6c9d0)}
+.dsm-workbuddy-pool-prov-sep{color:var(--dsw-alias-label-dimmed,#9aa0a6);opacity:.7}
+.dsm-workbuddy-pool-prov-age{color:var(--dsw-alias-label-tertiary,#999);white-space:nowrap}
 .dsm-workbuddy-pool-members{display:flex;flex-direction:column;gap:10px}
 .dsm-workbuddy-pool-members-head{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;flex-wrap:wrap}
 .dsm-workbuddy-pool-members-title{margin:0 0 3px;font-size:13px;font-weight:600;color:var(--dsw-alias-label-primary,#e6e6e6)}
@@ -3077,6 +3170,13 @@ window.__ModuleLoader__.load({
 			"row.remainingMinutes": "in about {count} min",
 			"row.remainingHours": "in about {count} h",
 			"row.remainingDays": "in about {count} d",
+			"row.poolProbeJustNow": "just now",
+			"row.poolProbeMinutesAgo": "{count} min ago",
+			"row.poolProbeHoursAgo": "{count} h ago",
+			"row.poolProbeDaysAgo": "{count} d ago",
+			"row.poolProbeSourceTest": "tested",
+			"row.poolProbeSourceLive": "hit by a live request",
+			"row.poolProbeSourceUnknown": "source unknown",
 			"row.poolSettingsTitle": "Account pool settings",
 			"row.poolSettingsHint": "These are preferences: they take effect when you save (same as the model list). Test results are written automatically and are not affected by this button.",
 			"row.poolEnabled": "Enable the account pool",
@@ -3087,6 +3187,10 @@ window.__ModuleLoader__.load({
 			"row.poolTargetLabel": "Target test model",
 			"row.poolTargetHint": "Auto (default) picks a zero-multiplier model from this region's catalog, preferring the largest context window. The two regions can pick different models. A manual choice always wins.",
 			"row.poolTargetAutoOption": "Auto — pick a free model",
+			"row.poolProbeSizeLabel": "Test request size",
+			"row.poolProbeSizeHint": "How much text a test sends. The upstream refuses a request once it grows past roughly 20K–30K tokens, so a test smaller than your real conversations answers \"usable\" for an account that would refuse them. Bigger tests are more truthful but cost more credit each.",
+			"row.poolProbeSizeDefault": "Default (25K)",
+			"row.poolProbeSizeOption": "{tokens}K tokens",
 			"row.poolSaved": "Save",
 			"row.poolSaving": "Saving…",
 			"row.poolSaveFailed": "Could not save: {message}",
@@ -3254,6 +3358,13 @@ window.__ModuleLoader__.load({
 			"row.remainingMinutes": "约 {count} 分钟后",
 			"row.remainingHours": "约 {count} 小时后",
 			"row.remainingDays": "约 {count} 天后",
+			"row.poolProbeJustNow": "刚刚",
+			"row.poolProbeMinutesAgo": "{count} 分钟前",
+			"row.poolProbeHoursAgo": "{count} 小时前",
+			"row.poolProbeDaysAgo": "{count} 天前",
+			"row.poolProbeSourceTest": "测得",
+			"row.poolProbeSourceLive": "聊天撞上",
+			"row.poolProbeSourceUnknown": "来源未知",
 			"row.poolSettingsTitle": "账号池设置",
 			"row.poolSettingsHint": "下面是偏好设置：点保存才生效（与「模型管理」一致）。测试结果由插件自动写入，不受这个保存按钮影响。",
 			"row.poolEnabled": "启用账号池",
@@ -3264,6 +3375,10 @@ window.__ModuleLoader__.load({
 			"row.poolTargetLabel": "目标测试模型",
 			"row.poolTargetHint": "「自动」（默认）会从本区域目录里挑一个倍率为 0 的免费模型，多个候选取上下文窗口最大的。国内版与国际版可能挑到不同的模型。手动指定优先于自动。",
 			"row.poolTargetAutoOption": "自动 —— 挑一个免费模型",
+			"row.poolProbeSizeLabel": "测试请求体积",
+			"row.poolProbeSizeHint": "测试时发送多少文本。上游在请求大约超过 2 万～3 万 token 时会开始拒绝，所以测试体积若小于你真实对话的体积，就会出现「测出可用、实际一发就被限」。体积越大测得越准，但每次测试消耗的积分也越多。",
+			"row.poolProbeSizeDefault": "默认（2.5 万）",
+			"row.poolProbeSizeOption": "{tokens} 万 token",
 			"row.poolSaved": "保存",
 			"row.poolSaving": "保存中…",
 			"row.poolSaveFailed": "保存失败：{message}",

package/lib/{host-heartbeat-D5ArLcFf.js → host-heartbeat-CTigiLJK.js}

@@ -2556,11 +2556,26 @@ const FALLBACK_WORKBUDDY_MODELS_GLOBAL = [
 function fallbackModelsFor(region) {
 	return region === "global" ? FALLBACK_WORKBUDDY_MODELS_GLOBAL : FALLBACK_WORKBUDDY_MODELS;
 }
-/** Apply the saved local DSH budget; models above 200K default to 200K. */
+/**
+* Apply the saved local DSH budget. A budget is an UPPER LIMIT the user sets,
+* never a default: a model without an explicit budget keeps its own window, and
+* a budget can only ever LOWER a window (`Math.min`), so a value above the
+* native one is not an error, just a no-op.
+*
+* There used to be a `?? 200_000` default here (issue #33), on the rationale
+* that a lower advertised window makes DSH compact sooner and so keeps a long
+* session under the upstream throttle. That rationale does not hold: the
+* measured throttle fires on a SINGLE request past 20k-30k input tokens (the
+* CHANGELOG's own wording calls 200K "远超上游 ~20–30k 的节流线"), so clamping to
+* 200K bought none of the safety it claimed while costing every >200K model its
+* real window — and contradicting the static roster in this very file, which
+* declares those models as 1M. A user who wants the conservative behaviour sets
+* a budget explicitly; the card offers that per model.
+*/
 function applyContextBudgets(catalog, budgets = {}) {
 	return catalog.map((model) => ({
 		...model,
-		contextWindow: model.contextWindow > 2e5 ? Math.min(model.contextWindow, budgets[model.id] ?? 2e5) : model.contextWindow
+		contextWindow: budgets[model.id] === void 0 ? model.contextWindow : Math.min(model.contextWindow, budgets[model.id])
 	}));
 }
 function deriveCatalog(catalog, enabled, budgets = {}) {
@@ -2791,7 +2806,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "3.4.3";
+const WORKBUDDY_CONNECT_VERSION = "3.4.5";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -2949,4 +2964,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { openEncryptedField as $, CREDENTIAL_REJECTED_CODE as A, prepareChatBody as B, defaultDesktopAuthPath as C, parseWorkBuddyAuth as D, legacyWorkbuddyOwnAuthPath as E, declaredTools as F, deriveAtRestKeyId as G, WORKBUDDY_APP_EXECUTABLE_ENV as H, isCredentialRejectedError as I, findWorkbuddyAppExecutableWithSource as J, fetchAtRestKeyPayload as K, parseCreditMultiplier as L, WorkBuddyCredentialRejectedError as M, WorkBuddyUpstreamClient as N, workbuddyAccountId as O, classifyUpstreamError as P, macosNestedAppBundles as Q, parseReasoning as R, defaultDesktopAuthDirs as S, isEncryptedCredentialError as T, clearAtRestKeyCache as U, regionOf as V, deriveAtRestKey as W, isWorkbuddyBundle as X, isEncryptedFieldWrapper as Y, macosBundleExecutable as Z, WORKBUDDY_AUTH_FILE_ENV as _, readHostHeartbeat as a, authFileName as b, WORKBUDDY_CONNECT_VERSION as c, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, readAtRestKey as et, WorkBuddyCatalog as f, WORKBUDDY_AUTH_FILENAME as g, ENCRYPTED_CREDENTIAL_CODE as h, processStartTimeMs as i, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as j, workbuddyOwnAuthPath as k, piAiRuntimeInfo as l, fallbackModelsFor as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, deriveCatalog as p, findWorkbuddyAppExecutable as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, workbuddyAppExecutableCandidates as tt, FALLBACK_WORKBUDDY_MODELS as u, WorkBuddyCredentialStore as v, hasEncryptedCredentialFields as w, defaultDesktopAuthCandidates as x, WorkBuddyEncryptedCredentialError as y, parseUpstreamModel as z };
+export { macosNestedAppBundles as $, workbuddyOwnAuthPath as A, parseUpstreamModel as B, defaultDesktopAuthDirs as C, legacyWorkbuddyOwnAuthPath as D, isEncryptedCredentialError as E, classifyUpstreamError as F, deriveAtRestKey as G, regionOf as H, declaredTools as I, findWorkbuddyAppExecutable as J, deriveAtRestKeyId as K, isCredentialRejectedError as L, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as M, WorkBuddyCredentialRejectedError as N, parseWorkBuddyAuth as O, WorkBuddyUpstreamClient as P, macosBundleExecutable as Q, parseCreditMultiplier as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, WORKBUDDY_APP_EXECUTABLE_ENV as U, prepareChatBody as V, clearAtRestKeyCache as W, isEncryptedFieldWrapper as X, findWorkbuddyAppExecutableWithSource as Y, isWorkbuddyBundle as Z, WORKBUDDY_AUTH_FILENAME as _, readHostHeartbeat as a, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, openEncryptedField as et, WorkBuddyCatalog as f, ENCRYPTED_CREDENTIAL_CODE as g, fallbackModelsFor as h, processStartTimeMs as i, CREDENTIAL_REJECTED_CODE as j, workbuddyAccountId as k, piAiRuntimeInfo as l, deriveCatalog as m, clearHostHeartbeat as n, workbuddyAppExecutableCandidates as nt, workbuddyHostHeartbeatPath as o, applyContextBudgets as p, fetchAtRestKeyPayload as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, readAtRestKey as tt, FALLBACK_WORKBUDDY_MODELS as u, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, parseReasoning as z };

package/lib/index.d.ts

@@ -1351,7 +1351,7 @@ declare const PROBE_SYSTEM_PROMPT = "You are a connectivity check. Reply with a
  * Output cap for a probe. One token is enough to prove the model answers.
  *
  * The probe's cost comes from its INPUT, not its output (see
- * {@link PROBE_INPUT_TOKENS}), so paying for a long completion would add money
+ * {@link DEFAULT_PROBE_INPUT_TOKENS}), so paying for a long completion would add money
  * without adding signal.
  */
 declare const PROBE_MAX_TOKENS = 1;
@@ -1378,8 +1378,27 @@ declare const PROBE_MAX_TOKENS = 1;
  * A probe that sent a handful of tokens answered "usable" while every real
  * request in a long conversation was refused — the probe was asking too small a
  * question. 25k is sized to be a realistic long-conversation payload.
+ *
+ * Renamed from `PROBE_INPUT_TOKENS` to say what it now IS: the DEFAULT, not the
+ * only possible size. The size is a property of the user's own traffic (see
+ * {@link probeRequestBody}), so it became a setting; this constant is what an
+ * unset setting, an older profile, and every existing test mean by "a probe".
+ */
+declare const DEFAULT_PROBE_INPUT_TOKENS = 25000;
+/**
+ * The probe sizes the card offers, in tokens.
+ *
+ * A closed set, each step a meaningful position relative to the measured 20k~30k
+ * threshold: below it (10k/20k) proves an account can serve SHORT requests and
+ * is the cheap choice; at it (30k) is the size that finally covers the whole
+ * measured window; above it (50k/100k) is for conversations that routinely run
+ * long, where a smaller probe would report "usable" for an account that refuses
+ * the very next message.
+ *
+ * Exported so the schema's description, the card's dropdown, and the coercion
+ * below cannot drift apart into three different menus.
  */
-declare const PROBE_INPUT_TOKENS = 25000;
+declare const PROBE_INPUT_TOKEN_CHOICES: readonly number[];
 /**
  * Build the request body for one probe.
  *
@@ -1387,10 +1406,13 @@ declare const PROBE_INPUT_TOKENS = 25000;
  * `prepareChatBody` enforces that too, but sending it explicitly keeps this
  * function's output valid on its own.
  *
- * Measured on the built artifact: 112,713 bytes of body, and the upstream
- * counted `prompt_tokens: 25023` at a cost of `credit: 0.72`.
+ * Measured on the built artifact at the DEFAULT size: 112,713 bytes of body, and
+ * the upstream counted `prompt_tokens: 25023` at a cost of `credit: 0.72`. The
+ * body bytes and the credit both scale with the size asked for, which is why the
+ * size is a user setting: a larger probe answers more truthfully for someone
+ * whose conversations are long, and costs proportionally more to ask.
  */
-declare function probeRequestBody(modelId: string): string;
+declare function probeRequestBody(modelId: string, inputTokens?: number): string;
 /**
  * How one probe ended.
  *
@@ -1509,12 +1531,35 @@ declare function probeModel(input: {
   credential: WorkBuddyCredential;
   modelId: string;
   nowMs: number;
+  /**
+   * How much input this probe sends, in tokens.
+   *
+   * Omitted means {@link DEFAULT_PROBE_INPUT_TOKENS}, so every existing caller
+   * keeps the measured 25k and only the pool's user-facing "test" passes a
+   * chosen size through.
+   */
+  inputTokens?: number;
   /** The region's next monthly quota refresh, when known. */
   quotaRefreshAtMs?: number;
   signal?: AbortSignal;
 }): Promise<WorkBuddyProbeResult>;
 //#endregion
 //#region src/account-pool.d.ts
+/**
+ * Which of the pool's writers produced a measurement.
+ *
+ * `test-batch` — the user pressed "test" (or the check-in batch), so the
+ *   outcome is a deliberate measurement of the target model.
+ * `live-request` — a real chat request failed and its failure was recorded so
+ *   the NEXT request starts from a measurement instead of rediscovering the
+ *   same wall.
+ *
+ * The distinction is diagnostic, not behavioural: both feed the same routing
+ * and cooling logic. It exists so a user who watched an account measure `ok`
+ * and later saw it limited can tell whether that was a later live failure
+ * (expected) or an older value winning (a bug).
+ */
+type WorkBuddyPoolProbeSource = 'test-batch' | 'live-request';
 /** One account's pool entry: what the picker needs, plus its last measurement. */
 interface WorkBuddyPoolAccount {
   /** Stable account id (the same one `WorkBuddyAccountChoice` carries). */
@@ -1534,6 +1579,26 @@ interface WorkBuddyPoolProbe {
   outcome: WorkBuddyProbeOutcome;
   /** When this measurement was taken, in epoch ms. */
   atMs: number;
+  /**
+   * WHAT WROTE THIS MEASUREMENT.
+   *
+   * Two sites write probes for the same account, and before this field they
+   * were indistinguishable in the file — which made a real confusion
+   * unanswerable: the user presses "test", sees an account measured `ok`, and
+   * later finds it `rate-limited`. Nothing in the record said whether that was
+   * a NEWER measurement (a live request really did hit the limit) or an OLDER
+   * one somehow winning, and the file keeps no history to tell them apart.
+   *
+   * With the source recorded, that question has an answer on sight: a
+   * `live-request` entry that replaced a `test-batch` result is the pool
+   * working as designed (a live failure steers the next request away from the
+   * account); two entries of the SAME source with the OLDER one winning would
+   * be a genuine bug.
+   *
+   * ABSENT for any measurement written before this field existed, so old probe
+   * files stay readable — an absent source means "unknown", never a guess.
+   */
+  source?: WorkBuddyPoolProbeSource;
   /**
    * When this account may be usable again, when the upstream stated a time.
    *
@@ -1961,6 +2026,14 @@ interface WorkBuddyWebPoolAccount {
   probe?: {
     outcome: WorkBuddyWebProbeOutcome;
     atMs: number;
+    /**
+     * What wrote this measurement, so the card can explain a change the user
+     * watched happen: `test-batch` is a deliberate test, `live-request` is a
+     * real request that failed and overwrote it. ABSENT for records written
+     * before the field existed — the card must then say "unknown" rather than
+     * guess which of the two it was.
+     */
+    source?: 'test-batch' | 'live-request';
     /** Only when the upstream named a time; never invented locally. */
     retryAtMs?: number;
     /**
@@ -2030,6 +2103,14 @@ interface WorkBuddyWebPool {
   targetModelSource: 'preferred' | 'free' | 'none' | 'stale';
   /** The account ids the user has checked into this region's pool. */
   memberAccountIds?: readonly string[];
+  /**
+   * Tokens each test probe sends, as the user saved it; `0`/absent = default.
+   *
+   * The SAVED value, not the resolved one: the card needs to tell "the user
+   * never chose a size" apart from "the user chose 25000", because the first
+   * must keep showing the default option rather than a number they never picked.
+   */
+  probeInputTokens?: number;
   /**
    * The subset of {@link memberAccountIds} that resolves to a real local
    * sign-in — i.e. what a batch actually runs on.
@@ -2188,6 +2269,14 @@ interface WorkBuddyPoolDeps {
   preferences(region: WorkBuddyRegion): {
     enabled: boolean;
     targetModelId: string;
+    /**
+     * Tokens each test probe sends as saved; `0` when the user never chose.
+     *
+     * Optional so a caller that has not learnt about the setting still
+     * satisfies this interface, and so its absence reads as "default" — the
+     * same meaning the host gives an older profile.
+     */
+    probeInputTokens?: number;
     memberAccountIds: readonly string[];
   };
   /** One region's CHECKED accounts, plus their credits and last measurements. */
@@ -2344,6 +2433,23 @@ interface WorkBuddyPoolPreferences {
   enabled?: boolean;
   /** Model id to test; `''` means auto-pick a free model from this region. */
   targetModelId?: string;
+  /**
+   * How much input a probe sends, in tokens — the pool's biggest single knob.
+   *
+   * The upstream's rate limit (6004) fires on request SIZE, and the threshold
+   * was measured to sit between 20k and 30k tokens. The probe has to be sized
+   * near where the user's REAL conversations land: too small and it reports
+   * "usable" while every long conversation is refused (the exact false positive
+   * that made this knob necessary), too large and it costs real credit on every
+   * batch AND excludes accounts that would have served the shorter requests the
+   * user actually sends.
+   *
+   * A fixed value therefore cannot be right for everyone — the right size is a
+   * property of the user's own traffic, which only they know. `undefined` keeps
+   * the measured default ({@link DEFAULT_PROBE_INPUT_TOKENS}), so an existing
+   * profile is unaffected.
+   */
+  probeInputTokens?: number;
   /**
    * The account ids checked into this region's pool.
    *
@@ -2498,4 +2604,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKENS, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as openEncryptedField, A as CREDENTIAL_REJECTED_CODE, B as prepareChatBody, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as declaredTools, G as deriveAtRestKeyId, H as WORKBUDDY_APP_EXECUTABLE_ENV, I as isCredentialRejectedError, K as fetchAtRestKeyPayload, L as parseCreditMultiplier, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as macosNestedAppBundles, R as parseReasoning, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as clearAtRestKeyCache, V as regionOf, W as deriveAtRestKey, X as isWorkbuddyBundle, Y as isEncryptedFieldWrapper, Z as macosBundleExecutable, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as readAtRestKey, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as workbuddyAppExecutableCandidates, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as parseUpstreamModel } from "./host-heartbeat-D5ArLcFf.js";
+import { $ as macosNestedAppBundles, A as workbuddyOwnAuthPath, B as parseUpstreamModel, C as defaultDesktopAuthDirs, D as legacyWorkbuddyOwnAuthPath, E as isEncryptedCredentialError, F as classifyUpstreamError, G as deriveAtRestKey, H as regionOf, I as declaredTools, J as findWorkbuddyAppExecutable, K as deriveAtRestKeyId, L as isCredentialRejectedError, M as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, N as WorkBuddyCredentialRejectedError, O as parseWorkBuddyAuth, P as WorkBuddyUpstreamClient, Q as macosBundleExecutable, R as parseCreditMultiplier, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as WORKBUDDY_APP_EXECUTABLE_ENV, V as prepareChatBody, W as clearAtRestKeyCache, X as isEncryptedFieldWrapper, Z as isWorkbuddyBundle, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as openEncryptedField, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, j as CREDENTIAL_REJECTED_CODE, k as workbuddyAccountId, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as workbuddyAppExecutableCandidates, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as fetchAtRestKeyPayload, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as readAtRestKey, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as parseReasoning } from "./host-heartbeat-CTigiLJK.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1342,10 +1342,49 @@ var RecoveryStream = class {
 	*/
 	nativeCallsSeen = false;
 	buffer;
-	constructor(res, gate, logger) {
+	/**
+	* A notice to place at the head of the answer, once, before any prose.
+	*
+	* Set when the request reached this stream only after the pool failed over, so
+	* the user learns WHY the answer came from a different account. Without it a
+	* failover is invisible: the reply looks like it came from the account they
+	* picked, and the only trace is a `logger.warn` they never see. The notice is
+	* emitted ahead of the model's own text so it cannot be mistaken for part of
+	* the answer, and only once — a retry that never delivers text must not leave
+	* a stray line behind.
+	*/
+	notice;
+	constructor(res, gate, logger, notice) {
 		this.res = res;
 		this.logger = logger;
 		this.buffer = gate === void 0 ? void 0 : new DsmlStreamBuffer(gate);
+		this.notice = notice;
+	}
+	/**
+	* Emit the pending failover notice, if any, and forget it.
+	*
+	* Called immediately before the first content reaches the client. Placed
+	* here rather than in the constructor because a stream whose write fails, or
+	* whose attempt is discarded in favour of a retry, must not have already told
+	* the user about a switch it never completed.
+	*/
+	flushNotice() {
+		const notice = this.notice;
+		if (notice === void 0) return;
+		this.notice = void 0;
+		if (!this.res.writable) return;
+		const chunk = { choices: [{
+			index: 0,
+			delta: {},
+			finish_reason: ""
+		}] };
+		const choiceRecord = {
+			index: 0,
+			delta: {},
+			finish_reason: ""
+		};
+		this.windowOpened = true;
+		this.res.write(contentFrame(chunk, choiceRecord, notice));
 	}
 	/** True when a call or real prose has reached the client. */
 	get delivered() {
@@ -1444,6 +1483,7 @@ var RecoveryStream = class {
 		if (Array.isArray(nativeCalls) && nativeCalls.length > 0) {
 			this.nativeCallsSeen = true;
 			this.windowOpened = true;
+			this.flushNotice();
 			this.send(frame, false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1458,6 +1498,7 @@ var RecoveryStream = class {
 		}
 		if (this.buffer === void 0 || this.nativeCallsSeen) {
 			this.windowOpened = true;
+			this.flushNotice();
 			this.closeWindow();
 			this.res.write(frame);
 			this.wroteContent = true;
@@ -1466,6 +1507,7 @@ var RecoveryStream = class {
 		this.windowOpened = true;
 		const outcome = this.buffer.add(content);
 		if (outcome.calls !== void 0 && outcome.calls.length > 0) {
+			this.flushNotice();
 			this.send(callsFrame(chunk, choiceRecord, outcome.calls), false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1478,6 +1520,7 @@ var RecoveryStream = class {
 			return;
 		}
 		if (outcome.prose) {
+			this.flushNotice();
 			this.send(contentFrame(chunk, choiceRecord, outcome.text), false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1521,6 +1564,7 @@ var RecoveryStream = class {
 		this.windowOpened = true;
 		const frame = contentFrame(chunk, choiceRecord, text);
 		if (text.trim() !== "") {
+			this.flushNotice();
 			this.send(frame, false);
 			this.wroteContent = true;
 			this.closeWindow();
@@ -1598,6 +1642,55 @@ function callsFrame(chunk, choice, calls) {
 	};
 	return `data: ${JSON.stringify(next)}\n\n`;
 }
+/**
+* How to name a pool account in a sentence the USER reads.
+*
+* Prefers the phone number (`uin`) because that is what the pool table shows and
+* what a person recognises; the nickname and the opaque account id are fallbacks
+* so this can never render an empty name. Deliberately NOT the hashed account id
+* on its own: a 24-character hex digest identifies an account to the plugin, but
+* to the person reading the answer it identifies nothing.
+*/
+function describeAccount(credential) {
+	if (credential.uin !== void 0 && credential.uin !== "") return credential.uin;
+	if (credential.nickname !== void 0 && credential.nickname !== "") return credential.nickname;
+	return workbuddyAccountId(credential);
+}
+/**
+* One short phrase for why an account was abandoned, for the in-reply notice.
+*
+* Kept to the distinction the user can act on rather than the internal kind
+* name: "rate limited" says wait or add an account, "rejected" says the sign-in
+* is the problem. The numeric kind would only send them to the log.
+*/
+function failoverReasonText(failure) {
+	if (failure.ok) return "unusable";
+	switch (failure.kind) {
+		case "soft_rate":
+		case "hard_credit": return "rate limited";
+		case "session_dead": return "signed out";
+		case "policy_reject": return "rejected by policy";
+		case "not_found": return "model unavailable";
+		case "server": return "erroring upstream";
+		default: return `unusable (http ${failure.status})`;
+	}
+}
+/**
+* The line prepended to an answer that came from a failover account.
+*
+* Block-quoted and bracketed so it reads as machinery rather than as the model's
+* own words, and so a user skimming for the answer can skip it. It states the
+* reason AND the account left behind, because those are the two facts that make
+* an unexpected reply explicable.
+*
+* The wording avoids "switched TO <account>" on purpose: the account that took
+* over is the one the user is about to keep talking to, and naming it invites
+* the reading that they must now manage it. What they need is to know the one
+* they chose did not answer, and why.
+*/
+function failoverNoticeText(from, reason) {
+	return `\n\n> [dsh-connect-workbuddy] 「${from}」was ${reason} — this answer came from another account\n\n`;
+}
 /** One frame carrying replacement text for a frame whose content was consumed. */
 function contentFrame(chunk, choice, content) {
 	const delta = {
@@ -1726,6 +1819,15 @@ function createWorkBuddyShim(options) {
 		let result = await client.chatStream(credential, prepared, controller.signal);
 		const triedAccountIds = [];
 		/**
+		* The account the request STARTED on, and the reason it was abandoned.
+		*
+		* `??=` on the first switch only: if three accounts fail in a row the user
+		* cares that the answer did not come from the one they picked, not with a
+		* blow-by-blow list of every candidate that was also rate limited.
+		*/
+		let switchedFrom;
+		let switchedBecause;
+		/**
 		* Tell the plugin about a failed attempt so it can store the measurement.
 		*
 		* Every failed attempt is reported exactly once, INCLUDING the last one — an
@@ -1780,6 +1882,8 @@ function createWorkBuddyShim(options) {
 			});
 			if (controller.signal.aborted) break;
 			logger?.warn(`dsh-connect-workbuddy: retrying chat on another pool account after ${result.kind} (http ${result.status})`);
+			switchedFrom ??= describeAccount(credential);
+			switchedBecause ??= failoverReasonText(result);
 			credential = next;
 			result = await client.chatStream(credential, prepared, controller.signal);
 		}
@@ -1813,7 +1917,8 @@ function createWorkBuddyShim(options) {
 			requiredParameters: declared.requiredParameters,
 			...declared.pinnedToolName === void 0 ? {} : { pinnedToolName: declared.pinnedToolName }
 		};
-		const writer = new RecoveryStream(res, gate, logger);
+		const notice = switchedFrom === void 0 || switchedBecause === void 0 ? void 0 : failoverNoticeText(switchedFrom, switchedBecause);
+		const writer = new RecoveryStream(res, gate, logger, notice);
 		await writer.consume(result.response.body);
 		if (gate !== void 0 && !writer.delivered && writer.residueSeen && !controller.signal.aborted) {
 			logger?.warn("dsh-connect-workbuddy: the turn produced DSML markup only; retrying it once");
@@ -1868,7 +1973,7 @@ const PROBE_SYSTEM_PROMPT = "You are a connectivity check. Reply with a single w
 * Output cap for a probe. One token is enough to prove the model answers.
 *
 * The probe's cost comes from its INPUT, not its output (see
-* {@link PROBE_INPUT_TOKENS}), so paying for a long completion would add money
+* {@link DEFAULT_PROBE_INPUT_TOKENS}), so paying for a long completion would add money
 * without adding signal.
 */
 const PROBE_MAX_TOKENS = 1;
@@ -1895,8 +2000,44 @@ const PROBE_MAX_TOKENS = 1;
 * A probe that sent a handful of tokens answered "usable" while every real
 * request in a long conversation was refused — the probe was asking too small a
 * question. 25k is sized to be a realistic long-conversation payload.
+*
+* Renamed from `PROBE_INPUT_TOKENS` to say what it now IS: the DEFAULT, not the
+* only possible size. The size is a property of the user's own traffic (see
+* {@link probeRequestBody}), so it became a setting; this constant is what an
+* unset setting, an older profile, and every existing test mean by "a probe".
+*/
+const DEFAULT_PROBE_INPUT_TOKENS = 25e3;
+/**
+* The probe sizes the card offers, in tokens.
+*
+* A closed set, each step a meaningful position relative to the measured 20k~30k
+* threshold: below it (10k/20k) proves an account can serve SHORT requests and
+* is the cheap choice; at it (30k) is the size that finally covers the whole
+* measured window; above it (50k/100k) is for conversations that routinely run
+* long, where a smaller probe would report "usable" for an account that refuses
+* the very next message.
+*
+* Exported so the schema's description, the card's dropdown, and the coercion
+* below cannot drift apart into three different menus.
 */
-const PROBE_INPUT_TOKENS = 25e3;
+const PROBE_INPUT_TOKEN_CHOICES = [
+	1e4,
+	2e4,
+	3e4,
+	5e4,
+	1e5
+];
+/**
+* A requested probe size reduced to a size this build will actually send.
+*
+* Anything outside {@link PROBE_INPUT_TOKEN_CHOICES} — `undefined` from an older
+* profile, `0` from an unset field, a hand-edited odd number — becomes the
+* measured default. Coercing rather than rejecting keeps a hand-edited profile
+* working instead of turning one odd value into a failed test batch.
+*/
+function resolveProbeInputTokens(requested) {
+	return requested !== void 0 && PROBE_INPUT_TOKEN_CHOICES.includes(requested) ? requested : DEFAULT_PROBE_INPUT_TOKENS;
+}
 /**
 * Characters per token for the filler text, measured.
 *
@@ -1915,11 +2056,14 @@ const FILLER_LINE = "The quick brown fox jumps over the lazy dog. ";
 * `prepareChatBody` enforces that too, but sending it explicitly keeps this
 * function's output valid on its own.
 *
-* Measured on the built artifact: 112,713 bytes of body, and the upstream
-* counted `prompt_tokens: 25023` at a cost of `credit: 0.72`.
+* Measured on the built artifact at the DEFAULT size: 112,713 bytes of body, and
+* the upstream counted `prompt_tokens: 25023` at a cost of `credit: 0.72`. The
+* body bytes and the credit both scale with the size asked for, which is why the
+* size is a user setting: a larger probe answers more truthfully for someone
+* whose conversations are long, and costs proportionally more to ask.
 */
-function probeRequestBody(modelId) {
-	const targetChars = Math.ceil(PROBE_INPUT_TOKENS * CHARS_PER_TOKEN);
+function probeRequestBody(modelId, inputTokens = DEFAULT_PROBE_INPUT_TOKENS) {
+	const targetChars = Math.ceil(resolveProbeInputTokens(inputTokens) * CHARS_PER_TOKEN);
 	const filler = FILLER_LINE.repeat(Math.ceil(targetChars / 45));
 	return JSON.stringify({
 		model: modelId,
@@ -2117,7 +2261,7 @@ async function probeModel(input) {
 	let answer;
 	const startedAt = Date.now();
 	try {
-		answer = await input.client.probeChat(input.credential, probeRequestBody(input.modelId), input.signal);
+		answer = await input.client.probeChat(input.credential, probeRequestBody(input.modelId, input.inputTokens), input.signal);
 	} catch (error) {
 		return {
 			modelId: input.modelId,
@@ -2310,6 +2454,7 @@ function probeUpdatesOf(rows) {
 		updates[row.accountId] = {
 			outcome: row.result.outcome,
 			atMs,
+			source: "test-batch",
 			...row.result.retryAtMs === void 0 ? {} : { retryAtMs: row.result.retryAtMs },
 			...row.result.message === void 0 ? {} : { message: row.result.message }
 		};
@@ -2574,7 +2719,7 @@ const POOL_STORE_PREFIX = ".workbuddy-pool";
 function isProbe(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const candidate = value;
-	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string");
+	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string") && (candidate["source"] === void 0 || typeof candidate["source"] === "string");
 }
 /**
 * One region's path for measured pool facts.
@@ -2621,6 +2766,7 @@ async function readPoolProbes(region) {
 		probes[accountId] = {
 			outcome: probe.outcome,
 			atMs: probe.atMs,
+			...knownProbeSource(probe.source) === void 0 ? {} : { source: knownProbeSource(probe.source) },
 			...probe.retryAtMs === void 0 ? {} : { retryAtMs: probe.retryAtMs },
 			...probe.message === void 0 ? {} : { message: probe.message }
 		};
@@ -2628,6 +2774,17 @@ async function readPoolProbes(region) {
 	return probes;
 }
 /**
+* A stored source string reduced to a source this build understands.
+*
+* `isProbe` accepts any string so a newer build's label cannot destroy the
+* measurement it describes; this narrows it at the point of use. An unknown
+* value becomes `undefined`, which the card renders as "unknown" — the honest
+* answer, rather than mislabelling it as one of the two kinds we do know.
+*/
+function knownProbeSource(value) {
+	return value === "test-batch" || value === "live-request" ? value : void 0;
+}
+/**
 * Merge measurements into one region's store and write it atomically.
 *
 * A MERGE rather than a replace, because batches measure one account at a time
@@ -2936,10 +3093,11 @@ function toCredits(answer) {
 }
 /** Project a model into the card's row, dropping empty optional fields. */
 function toWebModel(model, budgets) {
+	const budgeted = applyContextBudgets([model], budgets)[0] ?? model;
 	return {
 		id: model.id,
 		name: model.name,
-		contextWindow: model.contextWindow > 2e5 ? Math.min(model.contextWindow, budgets[model.id] ?? 2e5) : model.contextWindow,
+		contextWindow: budgeted.contextWindow,
 		nativeContextWindow: model.contextWindow,
 		maxTokens: model.maxTokens,
 		...model.creditMultiplier === void 0 ? {} : { creditMultiplier: model.creditMultiplier },
@@ -3127,6 +3285,7 @@ async function workBuddyWebPool(deps, region) {
 			...measured?.probe === void 0 ? {} : { probe: {
 				outcome: measured.probe.outcome,
 				atMs: measured.probe.atMs,
+				...measured.probe.source === void 0 ? {} : { source: measured.probe.source },
 				...measured.probe.retryAtMs === void 0 ? {} : { retryAtMs: measured.probe.retryAtMs },
 				...measured.probe.message === void 0 ? {} : { message: measured.probe.message }
 			} },
@@ -3143,6 +3302,7 @@ async function workBuddyWebPool(deps, region) {
 		...target.staleModelId === void 0 ? {} : { staleTargetModelId: target.staleModelId },
 		targetModelSource: target.source,
 		memberAccountIds: preferences.memberAccountIds,
+		...preferences.probeInputTokens === void 0 ? {} : { probeInputTokens: preferences.probeInputTokens },
 		effectiveMemberAccountIds: effectiveMembersOf(accounts.map((account) => account.accountId), new Set(preferences.memberAccountIds)),
 		accounts,
 		catalog: deps.displayModels(region).map((model) => ({
@@ -3392,6 +3552,14 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 							...slot
 						} : slot;
 					}
+					if (field === "regions") for (const key of Object.keys(incoming)) {
+						const slot = merged[key];
+						if (!isPlainRecord(slot) || key !== "cn" && key !== "global") continue;
+						if (Array.isArray(slot.lastCatalog) && slot.lastCatalog.length > 0) continue;
+						const live = deps.displayModels(key);
+						if (live.length === 0) continue;
+						slot.lastCatalog = live;
+					}
 					await settings.mutate(row.ns, [{
 						op: "set",
 						path: [field],
@@ -3522,6 +3690,16 @@ const modelConfig = z.object({
 const poolConfig = z.object({
 	enabled: z.boolean().default(false).description("Whether this region's account pool is active (opt-in). While on, a failed chat request is retried against the other usable pool members before the error is reported."),
 	targetModelId: z.string().default("").description("Model id to test; empty means pick a zero-multiplier model from this region's catalog"),
+	/**
+	* Sizing of the test probe, as a token count the user picks from a fixed set.
+	*
+	* A closed set rather than a free number: each step is a meaningful position
+	* relative to the measured 20k~30k threshold, and an arbitrary value would
+	* invite a size that is neither safely under nor clearly over it. `0` (and any
+	* unknown value) falls back to the measured default, so a profile written by
+	* an older build — and one hand-edited to something odd — behaves identically.
+	*/
+	probeInputTokens: z.number().step(1).default(0).description("Input tokens each test probe sends: 10000 / 20000 / 30000 / 50000 / 100000. Bigger probes catch a rate limit real conversations would hit, but cost more credit per test and may mark an account unusable for large requests only. 0 uses the measured default (25000)"),
 	memberAccountIds: z.array(z.string()).default([]).description("Account ids checked into this pool (opt-in; empty means the pool covers nothing)")
 });
 const regionStateConfig = z.object({
@@ -3757,13 +3935,16 @@ function apply(ctx, config) {
 		...model,
 		...images.has(model.id) ? { multimodal: true } : { multimodal: false }
 	}));
-	const configuredModels = (value, region) => {
+	const configuredModels = (value, region, liveModels = []) => {
 		const state = regionStateOf(value, region);
-		return withImageSelection(deriveCatalog(state.lastCatalog?.length ? state.lastCatalog : fallbackModelsFor(region), new Set(state.enabledModelIds ?? []), state.contextBudgets ?? {}), new Set(state.imageModelIds ?? []));
+		const roster = state.lastCatalog?.length ? state.lastCatalog : liveModels.length ? liveModels : fallbackModelsFor(region);
+		return withImageSelection(deriveCatalog(roster, new Set(state.enabledModelIds ?? []), state.contextBudgets ?? {}), new Set(state.imageModelIds ?? []));
 	};
 	const displayModels = (value, region) => {
 		const state = regionStateOf(value, region);
-		return state.lastCatalog?.length ? state.lastCatalog : fallbackModelsFor(region);
+		if (state.lastCatalog?.length) return state.lastCatalog;
+		const live = stacks[region]?.catalog?.current();
+		return live?.length ? live : fallbackModelsFor(region);
 	};
 	let current = () => config;
 	let invalidateCatalog = () => {};
@@ -3786,7 +3967,7 @@ function apply(ctx, config) {
 		for (const region of REGION_KEYS) {
 			stacks[region].store.setDesktopPath(authFile);
 			stacks[region].store.selectAccount(effectiveAccountFor(region, value));
-			stacks[region].catalog.set(configuredModels(value, region));
+			stacks[region].catalog.set(configuredModels(value, region, stacks[region].catalog.current()));
 		}
 		invalidateCatalog();
 		syncRegionRegistration(value);
@@ -4138,6 +4319,7 @@ function apply(ctx, config) {
 		await writePoolProbes(region, { [accountId]: {
 			outcome,
 			atMs: Date.now(),
+			source: "live-request",
 			...retryAtMs === void 0 ? {} : { retryAtMs },
 			...message === "" ? {} : { message }
 		} });
@@ -4228,9 +4410,11 @@ function apply(ctx, config) {
 	/** One region's pool preferences, with the schema's defaults applied. */
 	const poolPreferencesOf = (config, region) => {
 		const pool = regionStateOf(config, region).pool;
+		const probeInputTokens = pool?.probeInputTokens;
 		return {
 			enabled: pool?.enabled === true,
 			targetModelId: pool?.targetModelId ?? "",
+			...probeInputTokens === void 0 ? {} : { probeInputTokens },
 			memberAccountIds: pool?.memberAccountIds ?? []
 		};
 	};
@@ -4276,11 +4460,13 @@ function apply(ctx, config) {
 			claimDailyCheckin: (credential) => client.claimDailyCheckin(credential),
 			probe: async (credential, modelId) => {
 				const quotaRefreshAtMs = await quotaRefreshOf(region, credential);
+				const inputTokens = resolveProbeInputTokens(poolPreferencesOf(current(), region).probeInputTokens);
 				return probeModel({
 					client,
 					credential,
 					modelId,
 					nowMs: Date.now(),
+					inputTokens,
 					...quotaRefreshAtMs === void 0 ? {} : { quotaRefreshAtMs }
 				});
 			}
@@ -4402,4 +4588,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKENS, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "3.4.3",
+  "version": "3.4.5",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",