dsh-connect-workbuddy 3.4.4 → 3.5.0

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## 3.5.0 (2026-10-04)
+
+### Features
+
+- **每个模型行新增「可关闭思考」勾选框：`off` 档位不再由上游声明单独决定（issue #34）。**
+  - **背景**：本版之前，某个模型是否提供「关闭思考」（`reasoning_effort: "off"`）完全由上游的 `canDisableThinking` 声明决定，而那个声明对部分模型是**错的**——它们声称可关闭思考，实际对 `off` 返回 HTTP 400，且报文里不说是哪个参数被拒。
+  - **做什么**：模型行上多一个「可关闭思考」勾选框，勾上 = 提供 `off`，取消 = 不提供。**每个模型都有这个勾选框**，最终由用户决定；上游声明与内置名单只决定**默认值**，不再是一道墙。
+  - **默认怎么来**：内置一份按精确 id 复核的名单（`src/off-thinking.ts` 的 `REFUSES_OFF_MODEL_IDS`，9 个模型），首次读取时用它填勾选状态，所以「不勾」的模型从一开始就不是这 9 个会失败的。这份名单**只是种子**，不是墙：
+    - 上游新增一个拒绝 `off` 的模型 → **取消勾选**即可，不必等我们发版；
+    - 名单误伤了一个其实可用的模型 → **勾上**即可恢复。
+  - **首次保存即生效**：保存的是勾选后的 id 列表（`offModelIds: string[]`）。`undefined`（从未保存）与 `[]`（用户全不勾）是可区分的，前者用内置名单填，后者保持空——`regionStateOf` 读原始槽位，所以这个区分在数据层天然存在。
+  - **刷新不覆盖**：与「图片」勾选刻意不同。图片的勾选在刷新时会被上游声明重新同步；`off` 的勾选**保持不动**，因为它存在的理由就是「上游声明不可信」，刷新重写等于抹掉用户的修正。
+
+### Fixes
+
+- **保存模型列表不再抹掉 `canDisableThinking`，`off` 不会在保存后从全部模型上消失（issue #34 同族缺陷，发布前发现）。**
+  - **现象**：在 3.4.5 及更早版本上，只要在卡片上按过一次「保存」，**所有模型**的「关闭思考」档位就会一起消失——连 `glm-5.3`、`kimi-k3` 这些确实接受 `off` 的也一起没了。
+  - **根因**：`toWebModel` 把 `canDisableThinking` 从卡片负载里丢掉了，而卡片保存时会把整行模型**原样写回** `lastCatalog`。于是这一次保存把上游的声明从每一行里删掉了；下次解析名册读到「没有声明」，而缺省一律视为**不提供 `off`**（这个保守缺省必须保留：`hy4-preview`、`hy3-x` 明确声明 `false`，把缺省翻成 `true` 会让它们重新开始报 400）。
+  - **修法**：`canDisableThinking` 现在随卡片负载往返，与旁边的 `supportsImages` 同一种处理——它是**上游的声明**，只负责持久化，不是运行时答案（运行时读的是勾选状态盖上去的值）。
+  - **已有配置**：曾经保存过的 profile 里那份声明已经丢了。按一次「从 WorkBuddy 刷新」再「保存」即可补回；在那之前也可以直接在勾选框上手动勾选。
+
+- **对上游声明为可关闭、实际返回 HTTP 400 的模型，不再提供 `off` 档位（issue #34）。**
+  - **现象**：选中 `off` 后**每一次**请求都硬失败，且报文里 `extError.param` 是空的——上游不说是哪个参数被拒。因为 `off` 属于按模型保存的选择，失败会一直持续到用户手动换档，看起来像「这个模型坏了」。
+  - **依据（报告者实测，3.4.4，两个网关）**：28 次观测中 18 次接受 `off`（HTTP 200）、10 次返回 400（去重后 9 个模型 id）；**除 `off` 之外**的每一档（`minimal`/`low`/`medium`/`high`/`xhigh`/`max`）以及完全不传该字段，在两个网关上都是 200——`off` 是唯一失败的档位。两个网关用**不同的错误码报同一个原因**：国际版 `11133`（`Invalid request parameters`，附 `extError.code: model_param_invalid`），国内版 `11150`（`the reasoning effort value is not supported by the current model`）。
+  - **不再信任声明**：`src/off-thinking.ts` 新增一份按**精确模型 id** 复核的名单（`deepseek-v4.1-flash` / `-sg` / `-pro`、`primary-model`、`gpt-6-astra`、`gpt-5.6-sol` / `-terra` / `-luna`、`gemini-3.5-flash`），与 `native-modality.ts` 的图片能力表同一种做法。没有任何**声明字段**能分开这两组：接受侧是 GLM/Kimi/MiniMax 加 `fast-model`/`balanced-model`/`auto`/`hy3`，拒绝侧是 DeepSeek-v4/GPT/Gemini 前沿模型加 `primary-model`，两组公布的是一模一样的能力。
+  - **按 id 而非按区域**：`deepseek-v4.1-flash` 在**两个网关上都拒绝**，分组跟着模型家族走而不是网关。代价是不对称的——提供一个必定失败的档位，代价是用户该模型的**每一次**请求；误藏一个本来可用的档位，代价只是一个选项——所以名单**宁可多藏**，并交给上面的勾选框兜底。
+  - **为什么是「与 200K 同样的取法」**：`null` 才是撤销档位的唯一正确手段，与档位的**值**是两个不同的位置——pi-ai 的 `getSupportedThinkingLevels` 只在 `map[level] === null` 时把该档位移出选择器，而线上取值走的是 `map[level] ?? level`，所以给个字符串仍会照发。
+
+### Docs
+
+- `docs/reasoning-investigation.md` 的实测表（`hy3-x`、`hy4-preview`、`hy4-preview-x` 声明 `canDisableThinking: false`）是「缺省不能翻成 `true`」这一判断的依据，本版沿用该结论而未改动该文档。
+- 两份 README 的「模型管理」一节补上「可关闭思考」勾选框，并修正 3.4.5 起已失效的「窗口最高 200K」表述（issue #33 已改为按原生窗口宣称）。
+
+## 3.4.5 (2026-10-04)
+
+### Fixes
+
+- **保存设置不再把「本该用实时目录」的模型槽写空，正在用的模型不会凭空消失（issue #32）。**
+  - **现象**：在 `regions` 从未成功写入过的 profile 上（如 issue #31 所述的环境），第一次保存（哪怕只改了一处偏好）之后，模型选择器里**正在使用的默认模型突然不见了**，其他只在上游目录里、不在内置静态名单里的模型也一起消失，且**没有任何报错**。
+  - **根因**（两半，缺一不可）：
+    1. **写半边**——`__save` 的 `merged` 以宿主解析值为种子。当 `regions` 还是空对象时，`{"cn":{"imageModelIds":[]}}` 这样的载荷会落下**一个没有 `lastCatalog` 的 cn 槽**。槽本身合法（schema 里 `lastCatalog` 默认就是 `[]`），但它缺了这份目录。
+    2. **读半边**——`configuredModels` / `displayModels` 把 roster 解析成两步：`state.lastCatalog?.length ? lastCatalog : 静态名单`。「槽存在但没有目录」和「从未配置过」于是被当成同一件事，都退回**内置的 12 条静态名单**；而 `applySelection` 又把这份静态名单 `catalog.set()` 进**实时目录**——实时发现注册的 17 条就此被覆盖。正在用的 `space-bunny` 只在实时目录里、不在静态名单里，当场消失。
+  - **修法**：
+    - 写半边：`__save` 在合并之后、落盘之前，对本次载荷**真正触及**的区域（只碰 `incoming` 里出现过的键，不动调用方没提到的兄弟区域），若该槽缺目录（`lastCatalog` 缺失或为空数组），就用 `displayModels` 取到的**实时名册**补上。用 `displayModels` 而非上游往返：保存不该依赖网络，也不该因为上游不可用而失败。调用方显式传来的数组（含非空数组）仍然优先，实时名册为空则维持原状、不写空数组。
+    - 读半边：roster 解析改成三步 `lastCatalog → 该区域当前已注册的实时目录 → 静态名单`。静态名单退回它本来该待的位置——上游离线、什么都发现不了时的最后兜底。`applySelection` 在 `set()` **之前**读一次当前目录，避免观察到自己正要写的值。
+  - 这样「槽存在但缺目录」会**降到实时目录**，永远不会越过它掉到静态名单。
+
+- **未显式设置预算的模型不再被强制压到 200K，1M 模型的真实窗口得以保留（issue #33）。**
+  - **现象**：上游目录里 17 个模型有 15 个被改报成 200000——`space-bunny`、`deepseek-v4.1-flash`、`deepseek-v4-pro`、`glm-5.3`、`glm-5.3-flash`、`glm-5.2`、`kimi-k3-1`、`kimi-k2.8-preview` 的 1000000、`hy4-preview` 的 960000、`minimax-m3` 的 512000、`auto`/`kimi-k2.6`/`kimi-k2.7` 的 256000 全部变成 200000。
+  - **根因**：`applyContextBudgets` 里 `budgets[model.id] ?? 200_000` 的默认值——**未设置预算被当成「设成 200K」**。这条默认值在 CHANGELOG 里给出的理由是「让 DSH 提前压缩以避开上游节流」，但同一份 CHANGELOG 又自述实测节流线是 **2 万～3 万 token 且单次请求即触顶**：200K 比那条线高一个数量级，压到 200K 并没有把压缩提前到安全区。200K 在静态目录里也无出处（`auto` 是 168000、`hy3` 是 192000、`default-model` 是 176000、`primary-model` 是 272000）；插件自己的静态目录还把 `glm-5.3` 等声明为 1000000，与钳制自相矛盾。
+  - **修法**：`applyContextBudgets` 不再有默认值——**只做上限**：未设置预算时保留模型的原生窗口，设置了就用 `Math.min(原生, 预算)`。`contextBudgets` 的语义恢复成「用户设的上限」，而不是一个隐式的全局改写。（`toWebModel` 里那份重复的 `?? 200_000` 也一并去掉，改为调用同一个函数，避免卡片与运行时目录各说各话。）
+  - 想继续压缩的用户仍然可以显式设置 `regions.<region>.contextBudgets`；卡片上原本只在原生窗口 > 200K 时才出现的「DSH 上下文预算」选择器，现在因为不再默认钳制而更有意义。
+
 ## 3.4.4 (2026-10-03)
 
 ### Features

package/README.en.md

@@ -24,10 +24,10 @@ A [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness) bund
 - **Dual parallel providers (CN + international)** — the CN side registers as the `workbuddy` provider (`GLM-5.3`, `DeepSeek-V4-Pro`, `Kimi-K3`, `MiniMax-M3`, `Hy3`, etc.), the international side as `workbuddy-global` (`GPT-5.6`, `Gemini-3.5-Flash`, `GLM-5.3`, `Kimi-K3`, etc.). **A region's models appear in the DSH model picker when that region has an account**: with accounts on both sides, both rosters are selectable at once, and different sessions can each pick a side without interfering. **A region with no local sign-in lists no models** — it cannot serve a single request, so listing them would offer nothing but failures. Sign in once for that region and its models come back on "detect accounts again" or after a restart; the provider itself stays registered either way, because its settings card is how you sign in (re-detection lives in the pool block). Model names carry the upstream credit multiplier (e.g. `GLM-5.3 · x0.79`), matching WorkBuddy's own model menu.
 - **Tabbed settings card** — the card's top carries a "Domestic / Global" tab bar; each tab holds its own account pool and model management. Account, directory, selection, and unsaved drafts are fully isolated per tab — switching accounts or refreshing models on one tab never touches the other side's runtime catalog or sessions.
 - **Switch either provider off on its own** — each tab carries an on/off checkbox (both checked by default). Unchecking one **withdraws that provider from DSH's model picker entirely** (it is not merely a hidden tab): its adapter route and its "Settings → Models" directory entry are both pulled, and startup no longer sends pointless requests for it. Account, credits, directory, and selection are all kept, and re-checking restores everything. The typical use is "I have no use for the international side" — switch it off and keep the picker clean. Note: a session that had already selected a model from the switched-off provider will report `NO_ADAPTER` on its next call; the card states this plainly on the switched-off tab instead of failing silently.
-- **Model management** — refresh the full catalog from upstream and enable or disable each model individually; refresh is a draft operation that only takes effect on save. Upstream also reports credit multiplier, context/output limits, and reasoning efforts; **image input is decided by a vendor-verified table**: a refresh pre-checks only models the vendor's own documentation calls natively multimodal, leaves documented text-only models unchecked, and treats anything without a vendor source as unverified and unchecked rather than guessing. Upstream's `supportsImages` is a *platform* declaration, not the model's capability, so it does not drive that decision at all. You can still tick any box by hand, and your selection is kept locally.
+- **Model management** — refresh the full catalog from upstream and enable or disable each model individually; refresh is a draft operation that only takes effect on save. Upstream also reports credit multiplier, context/output limits, and reasoning efforts; **image input is decided by a vendor-verified table**: a refresh pre-checks only models the vendor's own documentation calls natively multimodal, leaves documented text-only models unchecked, and treats anything without a vendor source as unverified and unchecked rather than guessing. Upstream's `supportsImages` is a *platform* declaration, not the model's capability, so it does not drive that decision at all. You can still tick any box by hand, and your selection is kept locally. **Every model row also carries a “Can disable” (`off`) checkbox**: it decides whether that model gets the “turn thinking off entirely” level. The default comes from a reviewed built-in table (the 9 models that claim the capability but answer HTTP 400 for it start unticked), and you can change it per model — **untick** for a newly refusing upstream model, **tick** for one the table wrongly hides or you have verified works; your ticks are saved on first save and recomputed no further.
 - **Model availability testing, including cooldown recovery times** — working out when a limited model frees up used to mean guessing through repeated failures. Now every model row has a **Test** button that gives you a direct answer for whether the model works right now and, if not, when it comes back. **It sends a real-volume request (about 25k input tokens)**, rather than "ping it and see if it answers" — because the upstream throttles on request **SIZE** (measured: about 20k tokens pass, about 30k are refused), so a small request looks fine while every request in a long conversation may be refused. That is exactly where "the test passes but I am limited" came from. **Where the recovery time comes from**: the upstream's 429 carries **no** `Retry-After` header (and no `X-RateLimit-*`), but it writes the reset time into the response **body** — `{"code":6004,"msg":"…将在 2026-09-30 02:30:30 UTC+8 重置…"}`. The plugin parses that time and converts it using the UTC offset the message states, so the result does not depend on your machine's timezone; the card then shows “✗ Rate limited · usable again after 2026/9/30 02:30:30”. When none of the sources states a time, the plugin **never invents a countdown** and says plainly that no time was given. A rate limit deliberately does **not** borrow the monthly refresh time, which would tell you to wait weeks for a limit that clears in seconds. Probes run in the Host, so **the credential never reaches the page**, and results are not written to settings — your saved selection is untouched.
 
-  **Two things to know.** ① **It really does spend credits** — one measured probe reported `credit` 0.02 (a refused one 429s and costs almost nothing). So testing is **manual and per-model only**: there is deliberately no “Test selected” batch button, because sweeping the whole list from one click is an uncontrolled spend — and the Host enforces the same rule, **accepting a single model only** and refusing multi-model requests. ② The upstream advertises a 1M context yet throttles far below it, and the plugin advertises up to 200K to DSH, so DSH compacts very late — hitting the throttle in a long session follows directly from that.
+  **Two things to know.** ① **It really does spend credits** — one measured probe reported `credit` 0.02 (a refused one 429s and costs almost nothing). So testing is **manual and per-model only**: there is deliberately no “Test selected” batch button, because sweeping the whole list from one click is an uncontrolled spend — and the Host enforces the same rule, **accepting a single model only** and refusing multi-model requests. ② The upstream advertises a 1M context yet throttles far below it, and the plugin advertises each model's **native** window to DSH (no longer clamped to 200K as of 3.5.0), so DSH compacts very late — hitting the throttle in a long session follows directly from that. To make DSH compact sooner, set a “DSH context budget” cap on the model's row.
 - **Local account switching** — discovers the multiple sign-in credentials WorkBuddy's desktop app leaves behind and lets you switch per region. Tokens are never written to DSH settings.
 - **Account pool: batch actions across several accounts, plus automatic failover** — tick the accounts you want into a pool and you get **one-click check-in for every account**, **one-click testing of every account against a model you choose** (defaulting to the region's zero-multiplier free model), and with **Enable the account pool** switched on, **automatic failover**: a request that fails upstream is retried against the pool's other usable accounts, in order, until one serves it or none is left. Membership starts **empty and is an explicit opt-in**: "signed in on this machine" is not the same as "spend this account's credits and claim its rewards". The pool's **ranking decides who serves every request** (usable first, then higher credits, soonest-expiring, freshest credential), and on a failure the next usable member is tried. It **never writes back your saved selection** — switch the pool off and your own account applies again immediately. **The switch only decides whether the PLUGIN chooses** — with it off, the plugin stops picking and switching accounts for you, but check-in and testing stay available (they are manual actions). Testing reuses the model rows' real-volume probe, so it **does cost real credits**; **automatic check-in is deliberately not offered** — a check-in claims real rewards, so it only ever runs when you press the button. See [Account pool](#account-pool).
 - **Actionable advice when a credential is refused** — when the upstream rejects the selected account's token, the plugin actually **probes** the other local sign-ins: if one still answers, it tells you to switch to it (with a one-click switch) instead of vaguely asking you to sign in again — re-authenticating fixes nothing while you are pinned to a revoked backup. Only when there is genuinely no other local account does it ask you to sign in again.

package/README.md

@@ -31,10 +31,10 @@
 - **双供应商并行接入（国内版 + 国际版）** —— 国内版注册为 `workbuddy` provider（`GLM-5.3`、`DeepSeek-V4-Pro`、`Kimi-K3`、`MiniMax-M3`、`Hy3` 等），国际版注册为 `workbuddy-global` provider（`GPT-5.6`、`Gemini-3.5-Flash`、`GLM-5.3`、`Kimi-K3` 等）。**有账号的区域其模型会出现在 DSH 模型选择器里**：两边都有账号时两组同时可选，不同会话可以各选一边，互不干扰。**本机没有账号的区域不列出任何模型**（该区域一个请求也发不出去，列出来只会点到就失败）；只要在该区域登录一次，「重新检测账号」或重启后模型就会自动出现——provider 本身始终注册着，因为它的设置卡片正是登录的入口（重新检测在账号池区块里）。模型名内嵌上游积分倍率（如 `GLM-5.3 · x0.79`），与 WorkBuddy 自身模型菜单一致。
 - **插件卡片 tab 切换** —— 设置卡片顶部为「国内版 / 国际版」两个 tab，各含独立的账号池与模型管理；每个 tab 的账号、目录、勾选与未保存草稿完全隔离——在一个 tab 里切账号或刷新模型，不会触碰另一边的运行时目录与会话。
 - **可单独关闭任一版本供应商** —— 每个 tab 右侧有一个勾选框（默认都勾选）。**取消勾选即把该供应商从 DSH 模型选择器里彻底撤掉**（不是只藏起 tab）：它的路由与「设置 → 模型」页的目录条目一并摘除，启动时也不再为它发无用请求。账号、积分、目录与勾选**全部保留**，重新勾选即完整恢复。典型用法是「我根本用不到国际版」——关掉它，让选择器干净。注意：若某会话此前选中的正是被关闭供应商的模型，该会话再调用会报 `NO_ADAPTER`，卡片会在关闭态的 tab 上明确提示这一点，不会静默失败。
-- **模型管理** —— 从上游刷新完整模型目录，逐项勾选启用或禁用；刷新是草稿操作，点保存才生效。上游同时给出积分倍率、上下文/输出上限与推理档位；**图片输入按厂商核验表判定**：刷新时只有厂商文档明确写为原生多模态的模型才自动勾选，文档写明纯文本的不勾，**没有厂商资料的一律按「未核实」不猜**（上游的 `supportsImages` 是平台侧声明，不等于模型能看图，不参与判定）。用户仍可随时手动勾选，勾选状态保存在本地。
+- **模型管理** —— 从上游刷新完整模型目录，逐项勾选启用或禁用；刷新是草稿操作，点保存才生效。上游同时给出积分倍率、上下文/输出上限与推理档位；**图片输入按厂商核验表判定**：刷新时只有厂商文档明确写为原生多模态的模型才自动勾选，文档写明纯文本的不勾，**没有厂商资料的一律按「未核实」不猜**（上游的 `supportsImages` 是平台侧声明，不等于模型能看图，不参与判定）。用户仍可随时手动勾选，勾选状态保存在本地。**每个模型行还有「可关闭思考」（`off`）勾选框**：决定要不要为该模型提供「完全关闭思考」这一档位。默认由内置复核名单给出（上游声称可关闭、实测却对它返回 HTTP 400 的 9 个模型默认不勾），你可以按模型改勾/取消——**取消**用于上游新出现的拒绝模型，**勾上**用于名单误伤、或你已确认可用的模型；首次保存即写入你的勾选，之后不再重算。
 - **模型可用性测试（含冷却恢复时间）** —— 限量模型的冷却时间过去只能靠反复试错去猜。现在每个模型行有一个「测试」按钮，直接告诉你它此刻能否使用、不能用时何时恢复。**它发的是一条真实体积的请求（约 25k 输入 token）**，而不是「发个 ping 看通不通」——因为上游的限流**按请求体积触发**（实测约 20k 能过、约 30k 被拒），小请求看着正常、长对话里却可能每次都被拒，那正是「测试通过、实际被限」的来源。**恢复时间的来源**：上游的 429 **不带** `Retry-After` 响应头（也没有 `X-RateLimit-*`），但它把重置时间写在**响应体**里——`{"code":6004,"msg":"…将在 2026-09-30 02:30:30 UTC+8 重置…"}`。插件从响应体解析该时间（并按其声明的 UTC 偏移换算，不受你本机时区影响），因此卡片能直接显示「✗ 被限流 · 2026/9/30 02:30:30 之后可再用」。三处来源都没说时，插件**不编造倒计时**，如实显示「上游未给出何时恢复」。限流**不会**去借月周期包的刷新时间（那会让人为几秒的限流去等几周）。探测在后台发起，**凭据不会传到页面**；结果不写入设置，也不改变你已保存的勾选。
 
-  **两点需要知道**：① **它真的花钱**——实测一次报 `credit` 0.02（被限流时直接 429，几乎不花）。因此**只能按单个模型手工点**，没有「测试已勾选」这类批量按钮：一次覆盖整个列表就是一次不可控支出（服务端也据此**只接受单个模型**，多模型请求会被拒）。② 上游虽宣称 1M 上下文，但节流线远低于此；插件向 DSH 宣称的窗口最高 200K，所以 DSH 很晚才压缩对话——长会话撞限流是这条机制的直接结果。
+  **两点需要知道**：① **它真的花钱**——实测一次报 `credit` 0.02（被限流时直接 429，几乎不花）。因此**只能按单个模型手工点**，没有「测试已勾选」这类批量按钮：一次覆盖整个列表就是一次不可控支出（服务端也据此**只接受单个模型**，多模型请求会被拒）。② 上游虽宣称 1M 上下文，但节流线远低于此；插件按模型的**原生窗口**向 DSH 宣称（3.5.0 起不再默认压到 200K），所以 DSH 很晚才压缩对话——长会话撞限流是这条机制的直接结果。想让 DSH 更早压缩，就在模型行上手动设一个「DSH 上下文预算」上限。
 - **本机账号切换** —— 自动发现 WorkBuddy 桌面端留下的多个登录凭据，可按区域切换账号；Token 不写入 DSH 设置。
 - **账号池：多账号批量操作与自动换号** —— 把要用的账号勾进池子，即可**一键签到所有账号**、**一键测试所有账号 × 你指定的模型**（默认挑该区域倍率为 0 的免费模型）；开启**启用账号池**即同时打开**自动换号**——某个请求在上游失败时，插件会依次用池内其他可用账号重试，直到有一个接手、或全部不可用为止，然后才把错误报给你。成员**默认一个都不含**、必须显式勾选（「本机有登录」不等于「要拿它去签到和花积分」）；**开启后由池子的排序决定每一次请求用谁**（可用优先，其次积分高、快过期的积分包、凭据更新的）；失败时依次用池内其他可用账号重试。排序**从不写回你保存的选择**——关掉开关，你选定的账号立刻完全生效。只有请求本身不合法（HTTP 400）不换号：同一个请求体换谁都是 400，重试只会白等。**这个开关只管「插件要不要自己决定」**：关掉它，插件不再替你选账号、也不再替你换号，但**签到与测试仍然可用**（它们是手动动作）。测试走的是与模型行同一套真实体积探测，因此**有真实成本**；**不提供自动签到**——签到会真实领取奖励，只在你点按钮时执行。详见[账号池](#账号池)。
 - **凭据失效时给出可执行的建议** —— 上游拒绝当前账号的 token 时，插件会**实际探测**本机其他账号：若有账号仍然可用，就直接告诉你「切换到它即可」（并附一键切换），而不是笼统地让你重新登录——被钉在一个作废的旧备份上时，重新登录并不能解决问题。只有本机确实没有别的账号可切换时，才会提示重新登录。

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { E as legacyWorkbuddyOwnAuthPath, H as WORKBUDDY_APP_EXECUTABLE_ENV, J as findWorkbuddyAppExecutableWithSource, N as WorkBuddyUpstreamClient, S as defaultDesktopAuthDirs, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, x as defaultDesktopAuthCandidates } from "./host-heartbeat-DTuwptkM.js";
+import { A as workbuddyOwnAuthPath, C as defaultDesktopAuthDirs, D as legacyWorkbuddyOwnAuthPath, P as WorkBuddyUpstreamClient, S as defaultDesktopAuthCandidates, U as WORKBUDDY_APP_EXECUTABLE_ENV, Y as findWorkbuddyAppExecutableWithSource, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-C6G_goTD.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -1715,6 +1715,8 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-model-enabled input{margin:0;accent-color:var(--dsw-alias-brand-primary,#5686fe);flex:none}
 .dsm-workbuddy-model-image{display:inline-flex;align-items:center;gap:5px;flex:none;cursor:pointer;color:var(--dsw-alias-label-secondary,#c6c9d0);font-size:11px;line-height:16px}
 .dsm-workbuddy-model-image input{margin:0;accent-color:var(--dsw-alias-brand-primary,#5686fe)}
+.dsm-workbuddy-model-off{display:inline-flex;align-items:center;gap:5px;flex:none;cursor:pointer;color:var(--dsw-alias-label-secondary,#c6c9d0);font-size:11px;line-height:16px}
+.dsm-workbuddy-model-off input{margin:0;accent-color:var(--dsw-alias-brand-primary,#5686fe)}
 .dsm-workbuddy-model-copy{display:flex;align-items:baseline;gap:8px;min-width:0}
 .dsm-workbuddy-model-name{display:inline-flex;align-items:baseline;gap:7px;color:var(--dsw-alias-label-primary,#e6e6e6);font-size:13px;font-weight:500;line-height:19px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
 .dsm-workbuddy-model-name-rate{color:var(--dsw-alias-label-tertiary,#999);font-size:11px;font-weight:400;line-height:16px;flex:none}
@@ -2473,6 +2475,7 @@ window.__ModuleLoader__.load({
 							models: fresh,
 							enabledIds: new Set(stillEnabled),
 							imageIds: new Set(upstreamImages),
+							offIds: new Set(activeOffIds),
 							contextBudgets: stillBudgets
 						}
 					}));
@@ -2495,6 +2498,8 @@ window.__ModuleLoader__.load({
 			const activeEnabledIds = draft?.enabledIds ?? savedEnabledIds;
 			const savedImageIds = status.status === "signed-in" ? new Set(status.imageModelIds) : /* @__PURE__ */ new Set();
 			const activeImageIds = draft?.imageIds ?? savedImageIds;
+			const savedOffIds = status.status === "signed-in" ? new Set(status.offModelIds) : /* @__PURE__ */ new Set();
+			const activeOffIds = draft?.offIds ?? savedOffIds;
 			settingsScope?.getSnapshot().value;
 			const savedContextBudgets = status.status === "signed-in" ? status.contextBudgets ?? {} : {};
 			const activeContextBudgets = draft?.contextBudgets ?? savedContextBudgets;
@@ -2518,6 +2523,7 @@ window.__ModuleLoader__.load({
 						models: [...visibleModels],
 						enabledIds: new Set(activeEnabledIds),
 						imageIds: new Set(activeImageIds),
+						offIds: new Set(activeOffIds),
 						contextBudgets: { ...activeContextBudgets }
 					})
 				}));
@@ -2542,6 +2548,24 @@ window.__ModuleLoader__.load({
 					};
 				});
 			};
+			/**
+			* Flip one row's `off` answer (issue #34).
+			*
+			* Writes an EXPLICIT answer in both directions, so the built-in rule is only
+			* consulted while the user has no opinion. That is also why there is no
+			* "reset" control: once an answer matches the rule, the two are
+			* indistinguishable in effect, and the tooltip already names the override.
+			*/
+			const toggleOff = (modelId) => {
+				editDraft((current) => {
+					const next = new Set(current.offIds);
+					if (!next.delete(modelId)) next.add(modelId);
+					return {
+						...current,
+						offIds: next
+					};
+				});
+			};
 			const setContextBudget = (modelId, budget) => {
 				editDraft((current) => ({
 					...current,
@@ -2622,6 +2646,7 @@ window.__ModuleLoader__.load({
 						lastCatalog: visibleModels.map(toPersistedWorkBuddyModel),
 						enabledModelIds: [...activeEnabledIds],
 						imageModelIds: [...activeImageIds],
+						offModelIds: [...activeOffIds],
 						contextBudgets: activeContextBudgets
 					});
 					discardModels();
@@ -2887,6 +2912,18 @@ window.__ModuleLoader__.load({
 																		}
 																	}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("row.modelImage") })]
 																}),
+																/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+																	className: "dsm-workbuddy-model-off",
+																	title: t("row.modelOffHint"),
+																	children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+																		type: "checkbox",
+																		checked: activeOffIds.has(model.id),
+																		disabled: !canWrite || saving,
+																		onChange: () => {
+																			toggleOff(model.id);
+																		}
+																	}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("row.modelOff") })]
+																}),
 																/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("fieldset", {
 																	className: "dsm-workbuddy-context-budget",
 																	"aria-label": t("row.contextBudget"),
@@ -3108,6 +3145,8 @@ window.__ModuleLoader__.load({
 			"row.modelImage": "Image",
 			"row.modelImageText": "Image input: the vendor documents this model as text-only, so a refresh leaves it unchecked. Tick it yourself only if you know it reads images.",
 			"row.modelImageUnverified": "Image input unverified: no vendor source confirms this model reads images, so a refresh leaves it unchecked rather than guessing. Tick it yourself if you have verified it works.",
+			"row.modelOff": "Can disable",
+			"row.modelOffHint": "Offer the “off” level for this model",
 			"row.modelReasoning": "Reasoning: {efforts}",
 			"row.modelUnknown": "Unknown",
 			"row.modelCapabilityPending": "Only capabilities advertised by WorkBuddy are shown.",
@@ -3296,6 +3335,8 @@ window.__ModuleLoader__.load({
 			"row.modelImage": "图片",
 			"row.modelImageText": "图片输入：厂商文档标明该模型仅支持文本，因此刷新时不会自动勾选。只有你确认它能读图，才建议手动勾上。",
 			"row.modelImageUnverified": "图片输入未核实：没有厂商资料确认该模型能读图，刷新时按「不猜」处理，不会自动勾选。如果你验证过确实可用，可以手动勾上。",
+			"row.modelOff": "可关闭思考",
+			"row.modelOffHint": "为这个模型提供「关闭思考」档位",
 			"row.modelReasoning": "推理强度：{efforts}",
 			"row.modelUnknown": "未知",
 			"row.modelCapabilityPending": "仅展示 WorkBuddy 接口明确公布的模型能力。",

package/lib/{host-heartbeat-DTuwptkM.js → host-heartbeat-C6G_goTD.js}

@@ -2556,11 +2556,26 @@ const FALLBACK_WORKBUDDY_MODELS_GLOBAL = [
 function fallbackModelsFor(region) {
 	return region === "global" ? FALLBACK_WORKBUDDY_MODELS_GLOBAL : FALLBACK_WORKBUDDY_MODELS;
 }
-/** Apply the saved local DSH budget; models above 200K default to 200K. */
+/**
+* Apply the saved local DSH budget. A budget is an UPPER LIMIT the user sets,
+* never a default: a model without an explicit budget keeps its own window, and
+* a budget can only ever LOWER a window (`Math.min`), so a value above the
+* native one is not an error, just a no-op.
+*
+* There used to be a `?? 200_000` default here (issue #33), on the rationale
+* that a lower advertised window makes DSH compact sooner and so keeps a long
+* session under the upstream throttle. That rationale does not hold: the
+* measured throttle fires on a SINGLE request past 20k-30k input tokens (the
+* CHANGELOG's own wording calls 200K "远超上游 ~20–30k 的节流线"), so clamping to
+* 200K bought none of the safety it claimed while costing every >200K model its
+* real window — and contradicting the static roster in this very file, which
+* declares those models as 1M. A user who wants the conservative behaviour sets
+* a budget explicitly; the card offers that per model.
+*/
 function applyContextBudgets(catalog, budgets = {}) {
 	return catalog.map((model) => ({
 		...model,
-		contextWindow: model.contextWindow > 2e5 ? Math.min(model.contextWindow, budgets[model.id] ?? 2e5) : model.contextWindow
+		contextWindow: budgets[model.id] === void 0 ? model.contextWindow : Math.min(model.contextWindow, budgets[model.id])
 	}));
 }
 function deriveCatalog(catalog, enabled, budgets = {}) {
@@ -2791,7 +2806,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "3.4.4";
+const WORKBUDDY_CONNECT_VERSION = "3.5.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -2949,4 +2964,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { openEncryptedField as $, CREDENTIAL_REJECTED_CODE as A, prepareChatBody as B, defaultDesktopAuthPath as C, parseWorkBuddyAuth as D, legacyWorkbuddyOwnAuthPath as E, declaredTools as F, deriveAtRestKeyId as G, WORKBUDDY_APP_EXECUTABLE_ENV as H, isCredentialRejectedError as I, findWorkbuddyAppExecutableWithSource as J, fetchAtRestKeyPayload as K, parseCreditMultiplier as L, WorkBuddyCredentialRejectedError as M, WorkBuddyUpstreamClient as N, workbuddyAccountId as O, classifyUpstreamError as P, macosNestedAppBundles as Q, parseReasoning as R, defaultDesktopAuthDirs as S, isEncryptedCredentialError as T, clearAtRestKeyCache as U, regionOf as V, deriveAtRestKey as W, isWorkbuddyBundle as X, isEncryptedFieldWrapper as Y, macosBundleExecutable as Z, WORKBUDDY_AUTH_FILE_ENV as _, readHostHeartbeat as a, authFileName as b, WORKBUDDY_CONNECT_VERSION as c, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, readAtRestKey as et, WorkBuddyCatalog as f, WORKBUDDY_AUTH_FILENAME as g, ENCRYPTED_CREDENTIAL_CODE as h, processStartTimeMs as i, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as j, workbuddyOwnAuthPath as k, piAiRuntimeInfo as l, fallbackModelsFor as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, deriveCatalog as p, findWorkbuddyAppExecutable as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, workbuddyAppExecutableCandidates as tt, FALLBACK_WORKBUDDY_MODELS as u, WorkBuddyCredentialStore as v, hasEncryptedCredentialFields as w, defaultDesktopAuthCandidates as x, WorkBuddyEncryptedCredentialError as y, parseUpstreamModel as z };
+export { macosNestedAppBundles as $, workbuddyOwnAuthPath as A, parseUpstreamModel as B, defaultDesktopAuthDirs as C, legacyWorkbuddyOwnAuthPath as D, isEncryptedCredentialError as E, classifyUpstreamError as F, deriveAtRestKey as G, regionOf as H, declaredTools as I, findWorkbuddyAppExecutable as J, deriveAtRestKeyId as K, isCredentialRejectedError as L, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as M, WorkBuddyCredentialRejectedError as N, parseWorkBuddyAuth as O, WorkBuddyUpstreamClient as P, macosBundleExecutable as Q, parseCreditMultiplier as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, WORKBUDDY_APP_EXECUTABLE_ENV as U, prepareChatBody as V, clearAtRestKeyCache as W, isEncryptedFieldWrapper as X, findWorkbuddyAppExecutableWithSource as Y, isWorkbuddyBundle as Z, WORKBUDDY_AUTH_FILENAME as _, readHostHeartbeat as a, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, openEncryptedField as et, WorkBuddyCatalog as f, ENCRYPTED_CREDENTIAL_CODE as g, fallbackModelsFor as h, processStartTimeMs as i, CREDENTIAL_REJECTED_CODE as j, workbuddyAccountId as k, piAiRuntimeInfo as l, deriveCatalog as m, clearHostHeartbeat as n, workbuddyAppExecutableCandidates as nt, workbuddyHostHeartbeatPath as o, applyContextBudgets as p, fetchAtRestKeyPayload as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, readAtRestKey as tt, FALLBACK_WORKBUDDY_MODELS as u, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, parseReasoning as z };

package/lib/index.d.ts

@@ -1050,6 +1050,68 @@ declare function imageDefaultFor(info: {
   supportsImages?: boolean;
 }): boolean;
 //#endregion
+//#region src/off-thinking.d.ts
+/**
+ * Ids observed to REFUSE `reasoning_effort: "off"` with HTTP 400 despite
+ * declaring `canDisableThinking: true` (issue #34).
+ *
+ * Keyed by exact model id and deliberately NOT by region: `deepseek-v4.1-flash`
+ * refuses on BOTH gateways, and the split tracks the model family rather than
+ * the gateway. The cost is asymmetric — offering a level that always fails
+ * costs the user every request for that model, while hiding one that would have
+ * worked costs a single option — so the table errs towards hiding. A user who
+ * knows better can override any entry (see {@link effectiveOff}).
+ *
+ * `deepseek-v4-pro` was measured on the CN gateway only; it is listed because
+ * its sibling does refuse on both, and the same asymmetry argues for hiding.
+ */
+declare const REFUSES_OFF_MODEL_IDS: ReadonlySet<string>;
+/** The two fields this rule needs; both are declared by the model itself. */
+interface WorkBuddyOffCapability {
+  id: string;
+  reasoning?: WorkBuddyReasoning;
+}
+/**
+ * Whether `off` should be offered for a model when the user has expressed no
+ * opinion: the upstream's declaration, minus the ids known to refuse it.
+ *
+ * Only an explicit `canDisableThinking: true` enables the level; absence is
+ * "unknown" and stays unoffered, matching how the rest of the plugin treats an
+ * undeclared capability.
+ */
+declare function offDefaultFor(info: WorkBuddyOffCapability): boolean;
+/**
+ * The model ids the `off` level should be offered for by default (issue #34).
+ *
+ * The user's checkbox is a plain set: ticked = offered, unticked = withdrawn.
+ * This is the seed — what the set is filled with the first time it is read —
+ * so a profile that has never saved shows the correct default immediately,
+ * without requiring a save.
+ *
+ * Only an explicit `canDisableThinking: true` enables the level; absence is
+ * "unknown" and stays unoffered, matching how the rest of the plugin treats an
+ * undeclared capability.
+ */
+declare function defaultOffModelIds(models: readonly WorkBuddyOffCapability[]): string[];
+/**
+ * Stamp the user's saved `off` selection onto a model list, for the RUNTIME
+ * catalog.
+ *
+ * The runtime model descriptor is built by `workBuddyThinkingLevelMap`, which
+ * reads only the model's own declaration — so the corrected answer has to be
+ * written onto the model before it reaches the adapter. Doing it here keeps the
+ * adapter a pure "declared capability in, level map out" function and keeps the
+ * table next to the rule it feeds.
+ *
+ * This OVERWRITES the declared field rather than adding a sibling, which is
+ * safe because the declared value has exactly one consumer (that same level
+ * map) and is never persisted where the card can see it: `toWebModel` drops
+ * `canDisableThinking`, and the card's `lastCatalog` is written from the raw
+ * upstream discovery, never from this stamped list. A model that declares no
+ * reasoning is returned untouched — there is no level to correct.
+ */
+declare function withEffectiveOff<T extends WorkBuddyOffCapability>(models: readonly T[], selection: ReadonlySet<string>): T[];
+//#endregion
 //#region src/at-rest.d.ts
 /**
  * WorkBuddy desktop "at-rest" credential decryption.
@@ -1804,6 +1866,21 @@ interface WorkBuddyWebModel {
   reasoning?: {
     supportedEfforts?: readonly string[];
     defaultEffort?: string;
+    /**
+     * Upstream's own "thinking can be turned off" declaration, carried through
+     * the card so it RIDES ALONG in the saved `lastCatalog` entry.
+     *
+     * It is a persistence detail, not the runtime answer: the adapter's level
+     * map is built from the effective value stamped in `index.ts` (declaration
+     * minus the models known to reject `off`, then the user's override). It has
+     * to travel because the card writes the whole row back on save — omitting
+     * it made one Save silently strip the declaration from every model, which
+     * withdrew `off` from the models that accept it (the default is
+     * conservative: an absent declaration never offers `off`, so `hy4-preview`
+     * and friends keep their intended `false` but the rest lose a working
+     * level). Same shape as `supportsImages` above.
+     */
+    canDisableThinking?: boolean;
   };
   description?: string;
 }
@@ -1915,6 +1992,11 @@ type WorkBuddyWebUsage =
   models: readonly WorkBuddyWebModel[];
   enabledModelIds: readonly string[];
   imageModelIds: readonly string[];
+  /**
+   * Model ids whose `off` thinking level is offered (issue #34): the saved
+   * selection, seeded from the built-in rule the first time it is read.
+   */
+  offModelIds: readonly string[];
   credits?: WorkBuddyWebCredits;
   creditsError?: string;
   /**
@@ -2196,6 +2278,8 @@ interface WorkBuddyStatusRouteOptions {
   enabledModelIds(region: WorkBuddyRegion): readonly string[];
   /** Model ids the user opted into image input, for the requested region. */
   imageModelIds(region: WorkBuddyRegion): readonly string[];
+  /** Model ids whose `off` thinking level is offered, for the requested region. */
+  offModelIds(region: WorkBuddyRegion): readonly string[];
   /** Saved local DSH context budgets by model id, for the requested region. */
   contextBudgets(region: WorkBuddyRegion): Readonly<Record<string, number | undefined>>;
   /** Re-read the live catalog of one region from the upstream. */
@@ -2403,6 +2487,12 @@ interface WorkBuddyRegionState {
   enabledModelIds?: string[];
   /** Model ids the user explicitly opted into image input. */
   imageModelIds?: string[];
+  /**
+   * Model ids whose `off` thinking level is offered (issue #34). Seeded from
+   * the built-in rule (upstream declaration minus the models known to reject
+   * `off`) when first read; the card's checkbox toggles membership.
+   */
+  offModelIds?: string[];
   /** Local DSH context budget per model in this region. */
   contextBudgets?: Record<string, WorkBuddyContextBudget>;
   /** This region's account-pool preferences (opt-in; see {@link WorkBuddyPoolPreferences}). */
@@ -2604,4 +2694,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as openEncryptedField, A as CREDENTIAL_REJECTED_CODE, B as prepareChatBody, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as declaredTools, G as deriveAtRestKeyId, H as WORKBUDDY_APP_EXECUTABLE_ENV, I as isCredentialRejectedError, K as fetchAtRestKeyPayload, L as parseCreditMultiplier, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as macosNestedAppBundles, R as parseReasoning, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as clearAtRestKeyCache, V as regionOf, W as deriveAtRestKey, X as isWorkbuddyBundle, Y as isEncryptedFieldWrapper, Z as macosBundleExecutable, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as readAtRestKey, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as workbuddyAppExecutableCandidates, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as parseUpstreamModel } from "./host-heartbeat-DTuwptkM.js";
+import { $ as macosNestedAppBundles, A as workbuddyOwnAuthPath, B as parseUpstreamModel, C as defaultDesktopAuthDirs, D as legacyWorkbuddyOwnAuthPath, E as isEncryptedCredentialError, F as classifyUpstreamError, G as deriveAtRestKey, H as regionOf, I as declaredTools, J as findWorkbuddyAppExecutable, K as deriveAtRestKeyId, L as isCredentialRejectedError, M as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, N as WorkBuddyCredentialRejectedError, O as parseWorkBuddyAuth, P as WorkBuddyUpstreamClient, Q as macosBundleExecutable, R as parseCreditMultiplier, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as WORKBUDDY_APP_EXECUTABLE_ENV, V as prepareChatBody, W as clearAtRestKeyCache, X as isEncryptedFieldWrapper, Z as isWorkbuddyBundle, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as openEncryptedField, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, j as CREDENTIAL_REJECTED_CODE, k as workbuddyAccountId, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as workbuddyAppExecutableCandidates, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as fetchAtRestKeyPayload, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as readAtRestKey, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as parseReasoning } from "./host-heartbeat-C6G_goTD.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -3093,10 +3093,11 @@ function toCredits(answer) {
 }
 /** Project a model into the card's row, dropping empty optional fields. */
 function toWebModel(model, budgets) {
+	const budgeted = applyContextBudgets([model], budgets)[0] ?? model;
 	return {
 		id: model.id,
 		name: model.name,
-		contextWindow: model.contextWindow > 2e5 ? Math.min(model.contextWindow, budgets[model.id] ?? 2e5) : model.contextWindow,
+		contextWindow: budgeted.contextWindow,
 		nativeContextWindow: model.contextWindow,
 		maxTokens: model.maxTokens,
 		...model.creditMultiplier === void 0 ? {} : { creditMultiplier: model.creditMultiplier },
@@ -3104,7 +3105,8 @@ function toWebModel(model, budgets) {
 		...model.multimodal === void 0 ? {} : { multimodal: model.multimodal },
 		...model.reasoning === void 0 ? {} : { reasoning: {
 			...model.reasoning.supportedEfforts === void 0 ? {} : { supportedEfforts: [...model.reasoning.supportedEfforts] },
-			...model.reasoning.defaultEffort === void 0 ? {} : { defaultEffort: model.reasoning.defaultEffort }
+			...model.reasoning.defaultEffort === void 0 ? {} : { defaultEffort: model.reasoning.defaultEffort },
+			...model.reasoning.canDisableThinking === void 0 ? {} : { canDisableThinking: model.reasoning.canDisableThinking }
 		} }
 	};
 }
@@ -3203,7 +3205,8 @@ async function workBuddyWebStatus(deps, region) {
 		accounts: accounts.map(toWebAccount),
 		models: deps.displayModels(region).map((model) => toWebModel(model, deps.contextBudgets(region))),
 		enabledModelIds: [...deps.enabledModelIds(region)],
-		imageModelIds: [...deps.imageModelIds(region)]
+		imageModelIds: [...deps.imageModelIds(region)],
+		offModelIds: [...deps.offModelIds(region)]
 	};
 	const [creditsResult, checkinResult] = await Promise.allSettled([deps.client.fetchCredits(credential), deps.client.fetchCheckinStatus(credential)]);
 	const rejected = [creditsResult, checkinResult].some((result) => result.status === "rejected" && isCredentialRejectedError(result.reason));
@@ -3551,6 +3554,14 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 							...slot
 						} : slot;
 					}
+					if (field === "regions") for (const key of Object.keys(incoming)) {
+						const slot = merged[key];
+						if (!isPlainRecord(slot) || key !== "cn" && key !== "global") continue;
+						if (Array.isArray(slot.lastCatalog) && slot.lastCatalog.length > 0) continue;
+						const live = deps.displayModels(key);
+						if (live.length === 0) continue;
+						slot.lastCatalog = live;
+					}
 					await settings.mutate(row.ns, [{
 						op: "set",
 						path: [field],
@@ -3631,6 +3642,85 @@ function imageDefaultFor(info) {
 	return NATIVE_MODALITY_BY_MODEL_ID[info.id] === "multimodal";
 }
 //#endregion
+//#region src/off-thinking.ts
+/**
+* Ids observed to REFUSE `reasoning_effort: "off"` with HTTP 400 despite
+* declaring `canDisableThinking: true` (issue #34).
+*
+* Keyed by exact model id and deliberately NOT by region: `deepseek-v4.1-flash`
+* refuses on BOTH gateways, and the split tracks the model family rather than
+* the gateway. The cost is asymmetric — offering a level that always fails
+* costs the user every request for that model, while hiding one that would have
+* worked costs a single option — so the table errs towards hiding. A user who
+* knows better can override any entry (see {@link effectiveOff}).
+*
+* `deepseek-v4-pro` was measured on the CN gateway only; it is listed because
+* its sibling does refuse on both, and the same asymmetry argues for hiding.
+*/
+const REFUSES_OFF_MODEL_IDS = /* @__PURE__ */ new Set([
+	"deepseek-v4.1-flash",
+	"deepseek-v4.1-flash-sg",
+	"deepseek-v4-pro",
+	"primary-model",
+	"gpt-6-astra",
+	"gpt-5.6-sol",
+	"gpt-5.6-terra",
+	"gpt-5.6-luna",
+	"gemini-3.5-flash"
+]);
+/**
+* Whether `off` should be offered for a model when the user has expressed no
+* opinion: the upstream's declaration, minus the ids known to refuse it.
+*
+* Only an explicit `canDisableThinking: true` enables the level; absence is
+* "unknown" and stays unoffered, matching how the rest of the plugin treats an
+* undeclared capability.
+*/
+function offDefaultFor(info) {
+	return info.reasoning?.canDisableThinking === true && !REFUSES_OFF_MODEL_IDS.has(info.id);
+}
+/**
+* The model ids the `off` level should be offered for by default (issue #34).
+*
+* The user's checkbox is a plain set: ticked = offered, unticked = withdrawn.
+* This is the seed — what the set is filled with the first time it is read —
+* so a profile that has never saved shows the correct default immediately,
+* without requiring a save.
+*
+* Only an explicit `canDisableThinking: true` enables the level; absence is
+* "unknown" and stays unoffered, matching how the rest of the plugin treats an
+* undeclared capability.
+*/
+function defaultOffModelIds(models) {
+	return models.filter(offDefaultFor).map((model) => model.id);
+}
+/**
+* Stamp the user's saved `off` selection onto a model list, for the RUNTIME
+* catalog.
+*
+* The runtime model descriptor is built by `workBuddyThinkingLevelMap`, which
+* reads only the model's own declaration — so the corrected answer has to be
+* written onto the model before it reaches the adapter. Doing it here keeps the
+* adapter a pure "declared capability in, level map out" function and keeps the
+* table next to the rule it feeds.
+*
+* This OVERWRITES the declared field rather than adding a sibling, which is
+* safe because the declared value has exactly one consumer (that same level
+* map) and is never persisted where the card can see it: `toWebModel` drops
+* `canDisableThinking`, and the card's `lastCatalog` is written from the raw
+* upstream discovery, never from this stamped list. A model that declares no
+* reasoning is returned untouched — there is no level to correct.
+*/
+function withEffectiveOff(models, selection) {
+	return models.map((model) => model.reasoning === void 0 ? model : {
+		...model,
+		reasoning: {
+			...model.reasoning,
+			canDisableThinking: selection.has(model.id)
+		}
+	});
+}
+//#endregion
 //#region src/index.ts
 /** Stable Cordis plugin name. */
 const name = "dsh-connect-workbuddy";
@@ -3698,6 +3788,16 @@ const regionStateConfig = z.object({
 	lastCatalog: z.array(modelConfig).default([]),
 	enabledModelIds: z.array(z.string()).default([]),
 	imageModelIds: z.array(z.string()).default([]),
+	/**
+	* Per-model override of whether thinking `off` is offered, keyed by model id
+	* (issue #34). An ABSENT key means "use the built-in rule" — the upstream's
+	* `canDisableThinking` declaration minus the ids known to refuse `off` (see
+	* `src/off-thinking.ts`).
+	*
+	* Seeded from {@link defaultOffModelIds} on first read so the checkbox is
+	* ticked correctly without the user having to save.
+	*/
+	offModelIds: z.array(z.string()).default([]).description("Model ids whose \"off\" thinking level is offered; seeded from the built-in rule when first read."),
 	contextBudgets: z.dict(z.number().step(1).min(1)).default({}),
 	pool: poolConfig.default({})
 });
@@ -3926,13 +4026,27 @@ function apply(ctx, config) {
 		...model,
 		...images.has(model.id) ? { multimodal: true } : { multimodal: false }
 	}));
-	const configuredModels = (value, region) => {
+	const configuredModels = (value, region, liveModels = []) => {
 		const state = regionStateOf(value, region);
-		return withImageSelection(deriveCatalog(state.lastCatalog?.length ? state.lastCatalog : fallbackModelsFor(region), new Set(state.enabledModelIds ?? []), state.contextBudgets ?? {}), new Set(state.imageModelIds ?? []));
+		const roster = state.lastCatalog?.length ? state.lastCatalog : liveModels.length ? liveModels : fallbackModelsFor(region);
+		const declared = withImageSelection(deriveCatalog(roster, new Set(state.enabledModelIds ?? []), state.contextBudgets ?? {}), new Set(state.imageModelIds ?? []));
+		return withEffectiveOff(declared, new Set(savedOffModelIds(state, declared)));
 	};
+	/**
+	* The region's `off` selection as a Set (issue #34).
+	*
+	* `undefined` means "the user has never saved" — seed from the built-in rule
+	* so the checkbox is ticked correctly on first read. An explicit `[]` means
+	* the user UNticked everything and must stay empty: `regionStateOf` reads the
+	* raw stored slot, so `undefined` and `[]` are distinguishable here, and
+	* collapsing them would silently re-enable every model on the next load.
+	*/
+	const savedOffModelIds = (state, roster) => state.offModelIds ?? defaultOffModelIds(roster);
 	const displayModels = (value, region) => {
 		const state = regionStateOf(value, region);
-		return state.lastCatalog?.length ? state.lastCatalog : fallbackModelsFor(region);
+		if (state.lastCatalog?.length) return state.lastCatalog;
+		const live = stacks[region]?.catalog?.current();
+		return live?.length ? live : fallbackModelsFor(region);
 	};
 	let current = () => config;
 	let invalidateCatalog = () => {};
@@ -3955,7 +4069,7 @@ function apply(ctx, config) {
 		for (const region of REGION_KEYS) {
 			stacks[region].store.setDesktopPath(authFile);
 			stacks[region].store.selectAccount(effectiveAccountFor(region, value));
-			stacks[region].catalog.set(configuredModels(value, region));
+			stacks[region].catalog.set(configuredModels(value, region, stacks[region].catalog.current()));
 		}
 		invalidateCatalog();
 		syncRegionRegistration(value);
@@ -4027,6 +4141,7 @@ function apply(ctx, config) {
 		displayModels: (region) => displayModels(current(), region),
 		enabledModelIds: (region) => regionStateOf(current(), region).enabledModelIds ?? [],
 		imageModelIds: (region) => regionStateOf(current(), region).imageModelIds ?? [],
+		offModelIds: (region) => savedOffModelIds(regionStateOf(current(), region), displayModels(current(), region)),
 		contextBudgets: (region) => regionStateOf(current(), region).contextBudgets ?? {},
 		discoverModels,
 		regionEnabled: (region) => regionEnabled(current(), region),
@@ -4564,7 +4679,7 @@ function apply(ctx, config) {
 					const models = await client.fetchModels(credential);
 					if (stopped) return;
 					const state = regionStateOf(current(), region);
-					stacks[region].catalog.set(withImageSelection(deriveCatalog(models, new Set(state.enabledModelIds ?? []), state.contextBudgets ?? {}), new Set(state.imageModelIds ?? [])));
+					stacks[region].catalog.set(withEffectiveOff(withImageSelection(deriveCatalog(models, new Set(state.enabledModelIds ?? []), state.contextBudgets ?? {}), new Set(state.imageModelIds ?? [])), new Set(savedOffModelIds(state, models))));
 					adapters[region].invalidate();
 				} catch (error) {
 					ctx.logger.warn(`dsh-connect-workbuddy: dynamic ${region} model catalog unavailable; serving the static fallback list`, error);
@@ -4576,4 +4691,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "3.4.4",
+  "version": "3.5.0",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",