dsh-connect-workbuddy 3.5.0 → 3.6.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 3.6.0 (2026-10-04)
+
+### Features
+
+- **「DSH 上下文预算」增加 500K 挡位。**
+  - 该选择器原本只有「200K」与「模型原生窗口」两档。上游官方的挡位阶梯是 300K／600K／960K（或 1M），没有 500K，所以 500K 是一个**便利挡位**而非上游限制，按需求直接加。
+  - **门槛取 `原生窗口 > 500_000`**，而不是复用 200K 那档的 `> 200_000`：否则 192K 的 `hy3`、300K 的模型都会得到一个写着 500K、实际却高于自身原生窗口的按钮——`catalog.ts` 用 `Math.min(原生, 预算)` 兜底，点它等于什么都没发生，却看起来像用户主动做了降级。
+  - 未存过预算时该挡位**不选中**（`activeContextBudgets[id] === 500_000` 对 `undefined` 为假），默认仍是 200K 那档；`?? 200_000` 只属于 200K 挡位。
+
+### Fixes
+
+- **国内版模型目录改读 App 自己那份 `/v3/config`，卡片显示的模型与价格不再和 App 对不上。**
+  - **现象**：同一个模型槽，App 里显示 `Hy4 preview (x0.00)`，插件卡片里显示 `Hy4 preview (x0.29)`。两边都没错，只是**读的不是同一份文档**——插件读 `/v2/enterprises/personal/models`（CLI 渠道名册，该槽位是付费的 `hy4-preview`），App 读 `/v3/config`（该槽位是免费的 `hy4-preview-f`）。两者显示名同为 "Hy4 preview"，价格却不同，于是看起来像插件显示错了。
+  - **根因**：`fetchModels` 的国内分支固定读 `/v2`，国际分支读 `/v3`。国内版从来没有读过 App 的那份文档，因此名册与价格天然可能与 App 不一致；而 `/v2` 里还有一个上游目录里不存在的 `auto` 槽，`/v3` 里则有 `auto` 没有的 `hy4-preview-f` 与 `minimax-m2.7`。
+  - **修法**：国内分支改为读 `/v3/config`，**沿用 CLI 的 User-Agent**——这一步是关键：`/v3` 按客户端渠道返回不同名册，桌面端渠道的国内名册（29 条）里**没有** `hy4-preview-f`，只有 CLI 渠道的 17 条名册有。实测确认 `/v3` 接受国内分支原有的整套请求头（`X-Domain` / `X-Product` / `X-Requested-With` 一个都不需要加），所以这是一处常量改动，没有协议风险。另加回退：`/v3` 请求失败或返回非 0 时退回旧的 `/v2` 并记一条 `ctx.logger.warn`，避免网关不再提供新文档时整个区域拿不到模型。回退覆盖三种失败：传输错误、信封 code 非 0、以及**解析出的名册为空**（`selectCliModels` 对空名册抛错）——三者都会退回旧源，不会让区域变空。
+  - **升级后需要手动做的两件事**（名册换源，不是可选项）：
+    1. 旧源独有的 `auto` 与 `hy4-preview` 不再出现在名册里；新源独有的是 `hy4-preview-f` 与 `minimax-m2.7`（两者并集 19 条，交集 17 条，实测）。
+    2. 若你此前勾选的正是 `hy4-preview`，刷新后这个勾会消失（`refreshModels` 用 `freshIds.has(id)` 过滤），而 `hy4-preview-f` **不会**被自动勾上——这是既有设计：插件从不替你勾选你没选过的模型（`stillEnabled` 的注释即此意）。勾一下新出现的 `Hy4 preview` 即可，它是免费的那只；其余已勾选的模型不受影响，模型列表也不会变空。
+
+- **`regions.<区域>` 为 `null` 时不再让读取路径崩溃（防御性加固，当前不可达）。**
+  - **背景**：为排查 issue #31 实测时发现，schemastery 的 `simplify()` 会把**空槽**序列化成 `null`（`{ cn: {} }` → `{ cn: null }`）。而 `regionStateOf` 的守卫只拒绝 `undefined`，所以 `null` 槽会被原样返回，`regionEnabled` 随即在 `.enabled` 上抛 `Cannot read properties of null`。
+  - **可达性**：**当前不可达**。宿主解析配置时会把存下来的 `null` 槽重新展开成完整的默认 regionState，实测 `Config({ regions: { cn: null } })` 得到的是一整份默认值而非 `null`。因此这是纯防御，不是某个已知崩溃的修复。
+  - **改动**：守卫补上 `&& stored !== null`，并新增 3 个回归用例（返回对象而非 null、`null` 槽与「缺失」槽行为一致地回落到遗留扁平字段、`regionEnabled` 不抛）。
+  - **顺带**：排查过程中的结论已贴在 issue #31——该 issue 里最后一条指向本插件的线索（`accountId` 是「存在且为 undefined」的自有键）**被实测证伪**：`accountId` 在解析后是**缺失**，且遍历 7 种真实输入的解析结果都没有任何「值为 undefined 的自有键」，`simplify()` 之后与 JSON 往返完全相等。
+
 ## 3.5.0 (2026-10-04)
 
 ### Features

package/README.en.md

@@ -27,7 +27,7 @@ A [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness) bund
 - **Model management** — refresh the full catalog from upstream and enable or disable each model individually; refresh is a draft operation that only takes effect on save. Upstream also reports credit multiplier, context/output limits, and reasoning efforts; **image input is decided by a vendor-verified table**: a refresh pre-checks only models the vendor's own documentation calls natively multimodal, leaves documented text-only models unchecked, and treats anything without a vendor source as unverified and unchecked rather than guessing. Upstream's `supportsImages` is a *platform* declaration, not the model's capability, so it does not drive that decision at all. You can still tick any box by hand, and your selection is kept locally. **Every model row also carries a “Can disable” (`off`) checkbox**: it decides whether that model gets the “turn thinking off entirely” level. The default comes from a reviewed built-in table (the 9 models that claim the capability but answer HTTP 400 for it start unticked), and you can change it per model — **untick** for a newly refusing upstream model, **tick** for one the table wrongly hides or you have verified works; your ticks are saved on first save and recomputed no further.
 - **Model availability testing, including cooldown recovery times** — working out when a limited model frees up used to mean guessing through repeated failures. Now every model row has a **Test** button that gives you a direct answer for whether the model works right now and, if not, when it comes back. **It sends a real-volume request (about 25k input tokens)**, rather than "ping it and see if it answers" — because the upstream throttles on request **SIZE** (measured: about 20k tokens pass, about 30k are refused), so a small request looks fine while every request in a long conversation may be refused. That is exactly where "the test passes but I am limited" came from. **Where the recovery time comes from**: the upstream's 429 carries **no** `Retry-After` header (and no `X-RateLimit-*`), but it writes the reset time into the response **body** — `{"code":6004,"msg":"…将在 2026-09-30 02:30:30 UTC+8 重置…"}`. The plugin parses that time and converts it using the UTC offset the message states, so the result does not depend on your machine's timezone; the card then shows “✗ Rate limited · usable again after 2026/9/30 02:30:30”. When none of the sources states a time, the plugin **never invents a countdown** and says plainly that no time was given. A rate limit deliberately does **not** borrow the monthly refresh time, which would tell you to wait weeks for a limit that clears in seconds. Probes run in the Host, so **the credential never reaches the page**, and results are not written to settings — your saved selection is untouched.
 
-  **Two things to know.** ① **It really does spend credits** — one measured probe reported `credit` 0.02 (a refused one 429s and costs almost nothing). So testing is **manual and per-model only**: there is deliberately no “Test selected” batch button, because sweeping the whole list from one click is an uncontrolled spend — and the Host enforces the same rule, **accepting a single model only** and refusing multi-model requests. ② The upstream advertises a 1M context yet throttles far below it, and the plugin advertises each model's **native** window to DSH (no longer clamped to 200K as of 3.5.0), so DSH compacts very late — hitting the throttle in a long session follows directly from that. To make DSH compact sooner, set a “DSH context budget” cap on the model's row.
+  **Two things to know.** ① **It really does spend credits** — one measured probe reported `credit` 0.02 (a refused one 429s and costs almost nothing). So testing is **manual and per-model only**: there is deliberately no “Test selected” batch button, because sweeping the whole list from one click is an uncontrolled spend — and the Host enforces the same rule, **accepting a single model only** and refusing multi-model requests. ② The upstream advertises a 1M context yet throttles far below it, and the plugin advertises each model's **native** window to DSH (no longer clamped to 200K as of 3.5.0), so DSH compacts very late — hitting the throttle in a long session follows directly from that. To make DSH compact sooner, set a “DSH context budget” cap on the model's row (200K / 500K / the model's native window).
 - **Local account switching** — discovers the multiple sign-in credentials WorkBuddy's desktop app leaves behind and lets you switch per region. Tokens are never written to DSH settings.
 - **Account pool: batch actions across several accounts, plus automatic failover** — tick the accounts you want into a pool and you get **one-click check-in for every account**, **one-click testing of every account against a model you choose** (defaulting to the region's zero-multiplier free model), and with **Enable the account pool** switched on, **automatic failover**: a request that fails upstream is retried against the pool's other usable accounts, in order, until one serves it or none is left. Membership starts **empty and is an explicit opt-in**: "signed in on this machine" is not the same as "spend this account's credits and claim its rewards". The pool's **ranking decides who serves every request** (usable first, then higher credits, soonest-expiring, freshest credential), and on a failure the next usable member is tried. It **never writes back your saved selection** — switch the pool off and your own account applies again immediately. **The switch only decides whether the PLUGIN chooses** — with it off, the plugin stops picking and switching accounts for you, but check-in and testing stay available (they are manual actions). Testing reuses the model rows' real-volume probe, so it **does cost real credits**; **automatic check-in is deliberately not offered** — a check-in claims real rewards, so it only ever runs when you press the button. See [Account pool](#account-pool).
 - **Actionable advice when a credential is refused** — when the upstream rejects the selected account's token, the plugin actually **probes** the other local sign-ins: if one still answers, it tells you to switch to it (with a one-click switch) instead of vaguely asking you to sign in again — re-authenticating fixes nothing while you are pinned to a revoked backup. Only when there is genuinely no other local account does it ask you to sign in again.
@@ -50,7 +50,7 @@ DSH PiAiAdapter (one stack per provider)
 
 The CN and international sides each own a complete runtime stack — credential store, model catalog, loopback shim, adapter — with visibility filtered by credential domain (`workbuddy.ai` / `codebuddy.ai` → international, anything else → CN), so **both regions' accounts can be signed in and used by different sessions at the same time**. The international product has two brand domains: the desktop app signs in at `workbuddy.ai`, while the CodeBuddy CLI signs in at `codebuddy.ai` — both are international.
 
-The model catalog comes from each region's correct source: CN reads `/v2/enterprises/personal/models`, while international reads `<global gateway>/v3/config` — the config service serves a different roster per client channel, and only the desktop user agent yields the account's real 20-model list (including the free `deepseek-v4.1-flash`). The credits overview comes from `https://www.codebuddy.cn/v2/billing/meter/get-user-resource` (international accounts auto-route to the global gateway their credential belongs to, `workbuddy.ai` or `codebuddy.ai` — tokens are not interchangeable across the two brand domains); all are read-only.
+The model catalog comes from each region's correct source, and both read the **same** `/v3/config` document the WorkBuddy app itself consumes; they differ only in which client identity requests it: CN uses the CodeBuddy CLI user agent, international uses the desktop user agent (the config service serves a different roster per client channel — only the CN CLI channel's roster carries the free `hy4-preview-f`, while the international side needs the desktop agent to get the account's real 20-model list, including the free `deepseek-v4.1-flash`). If CN cannot read `/v3/config`, it falls back to the legacy `/v2/enterprises/personal/models` and logs a line — that legacy roster is the CLI channel's, where the same slot carries the paid `hy4-preview` (`x0.29`) rather than the free `hy4-preview-f` (`x0.00`) the app shows, so it is used only while degraded. The credits overview comes from `https://www.codebuddy.cn/v2/billing/meter/get-user-resource` (international accounts auto-route to the global gateway their credential belongs to, `workbuddy.ai` or `codebuddy.ai` — tokens are not interchangeable across the two brand domains); all are read-only.
 
 Credentials are read (read-only) from the WorkBuddy desktop app's own auth file. Refreshed tokens are kept per region in `$DSH_HOME/.workbuddy-auth.cn.json` and `$DSH_HOME/.workbuddy-auth.global.json` (two simultaneously signed-in accounts never overwrite each other; the legacy single file `.workbuddy-auth.json` is still read as a migration source); the desktop app's file is never written.
 

package/README.md

@@ -34,7 +34,7 @@
 - **模型管理** —— 从上游刷新完整模型目录，逐项勾选启用或禁用；刷新是草稿操作，点保存才生效。上游同时给出积分倍率、上下文/输出上限与推理档位；**图片输入按厂商核验表判定**：刷新时只有厂商文档明确写为原生多模态的模型才自动勾选，文档写明纯文本的不勾，**没有厂商资料的一律按「未核实」不猜**（上游的 `supportsImages` 是平台侧声明，不等于模型能看图，不参与判定）。用户仍可随时手动勾选，勾选状态保存在本地。**每个模型行还有「可关闭思考」（`off`）勾选框**：决定要不要为该模型提供「完全关闭思考」这一档位。默认由内置复核名单给出（上游声称可关闭、实测却对它返回 HTTP 400 的 9 个模型默认不勾），你可以按模型改勾/取消——**取消**用于上游新出现的拒绝模型，**勾上**用于名单误伤、或你已确认可用的模型；首次保存即写入你的勾选，之后不再重算。
 - **模型可用性测试（含冷却恢复时间）** —— 限量模型的冷却时间过去只能靠反复试错去猜。现在每个模型行有一个「测试」按钮，直接告诉你它此刻能否使用、不能用时何时恢复。**它发的是一条真实体积的请求（约 25k 输入 token）**，而不是「发个 ping 看通不通」——因为上游的限流**按请求体积触发**（实测约 20k 能过、约 30k 被拒），小请求看着正常、长对话里却可能每次都被拒，那正是「测试通过、实际被限」的来源。**恢复时间的来源**：上游的 429 **不带** `Retry-After` 响应头（也没有 `X-RateLimit-*`），但它把重置时间写在**响应体**里——`{"code":6004,"msg":"…将在 2026-09-30 02:30:30 UTC+8 重置…"}`。插件从响应体解析该时间（并按其声明的 UTC 偏移换算，不受你本机时区影响），因此卡片能直接显示「✗ 被限流 · 2026/9/30 02:30:30 之后可再用」。三处来源都没说时，插件**不编造倒计时**，如实显示「上游未给出何时恢复」。限流**不会**去借月周期包的刷新时间（那会让人为几秒的限流去等几周）。探测在后台发起，**凭据不会传到页面**；结果不写入设置，也不改变你已保存的勾选。
 
-  **两点需要知道**：① **它真的花钱**——实测一次报 `credit` 0.02（被限流时直接 429，几乎不花）。因此**只能按单个模型手工点**，没有「测试已勾选」这类批量按钮：一次覆盖整个列表就是一次不可控支出（服务端也据此**只接受单个模型**，多模型请求会被拒）。② 上游虽宣称 1M 上下文，但节流线远低于此；插件按模型的**原生窗口**向 DSH 宣称（3.5.0 起不再默认压到 200K），所以 DSH 很晚才压缩对话——长会话撞限流是这条机制的直接结果。想让 DSH 更早压缩，就在模型行上手动设一个「DSH 上下文预算」上限。
+  **两点需要知道**：① **它真的花钱**——实测一次报 `credit` 0.02（被限流时直接 429，几乎不花）。因此**只能按单个模型手工点**，没有「测试已勾选」这类批量按钮：一次覆盖整个列表就是一次不可控支出（服务端也据此**只接受单个模型**，多模型请求会被拒）。② 上游虽宣称 1M 上下文，但节流线远低于此；插件按模型的**原生窗口**向 DSH 宣称（3.5.0 起不再默认压到 200K），所以 DSH 很晚才压缩对话——长会话撞限流是这条机制的直接结果。想让 DSH 更早压缩，就在模型行上手动设一个「DSH 上下文预算」上限（可选 200K / 500K / 模型原生窗口）。
 - **本机账号切换** —— 自动发现 WorkBuddy 桌面端留下的多个登录凭据，可按区域切换账号；Token 不写入 DSH 设置。
 - **账号池：多账号批量操作与自动换号** —— 把要用的账号勾进池子，即可**一键签到所有账号**、**一键测试所有账号 × 你指定的模型**（默认挑该区域倍率为 0 的免费模型）；开启**启用账号池**即同时打开**自动换号**——某个请求在上游失败时，插件会依次用池内其他可用账号重试，直到有一个接手、或全部不可用为止，然后才把错误报给你。成员**默认一个都不含**、必须显式勾选（「本机有登录」不等于「要拿它去签到和花积分」）；**开启后由池子的排序决定每一次请求用谁**（可用优先，其次积分高、快过期的积分包、凭据更新的）；失败时依次用池内其他可用账号重试。排序**从不写回你保存的选择**——关掉开关，你选定的账号立刻完全生效。只有请求本身不合法（HTTP 400）不换号：同一个请求体换谁都是 400，重试只会白等。**这个开关只管「插件要不要自己决定」**：关掉它，插件不再替你选账号、也不再替你换号，但**签到与测试仍然可用**（它们是手动动作）。测试走的是与模型行同一套真实体积探测，因此**有真实成本**；**不提供自动签到**——签到会真实领取奖励，只在你点按钮时执行。详见[账号池](#账号池)。
 - **凭据失效时给出可执行的建议** —— 上游拒绝当前账号的 token 时，插件会**实际探测**本机其他账号：若有账号仍然可用，就直接告诉你「切换到它即可」（并附一键切换），而不是笼统地让你重新登录——被钉在一个作废的旧备份上时，重新登录并不能解决问题。只有本机确实没有别的账号可切换时，才会提示重新登录。
@@ -57,7 +57,7 @@ DSH PiAiAdapter（每个 provider 一套）
 
 国内版与国际版各持一套完整的运行时栈——凭据 store、模型 catalog、回环 shim、adapter——按凭据域名（`workbuddy.ai` / `codebuddy.ai` → 国际版，其余 → 国内版）隔离可见账号，所以**两个区域的账号可以同时在线、同时被不同会话使用**。国际版有两个品牌域名：桌面端登录在 `workbuddy.ai`，CodeBuddy CLI 登录在 `codebuddy.ai`，两者都是国际版。
 
-模型目录按区域取自各自的正确来源：国内版走 `/v2/enterprises/personal/models`，国际版走 `<国际网关>/v3/config`（配置服务按客户端渠道返回不同清单，国际版必须用桌面端 User-Agent 才能取到账号真实的 20 个模型，含免费的 `deepseek-v4.1-flash`）。积分概览走 `https://www.codebuddy.cn/v2/billing/meter/get-user-resource`（国际版账号自动路由到其凭据所属的国际网关，`workbuddy.ai` 或 `codebuddy.ai`——两个品牌域名的凭据互不通用），均为只读接口。
+模型目录按区域取自各自的正确来源，两者都是 **App 自己读的那份** `/v3/config`，区别只在用哪个客户端身份去取：国内版用 CodeBuddy CLI 的 User-Agent，国际版用桌面端 User-Agent（配置服务按客户端渠道返回不同清单；国内版只有 CLI 渠道的清单里带免费的 `hy4-preview-f`，国际版则必须用桌面端才能取到账号真实的 20 个模型，含免费的 `deepseek-v4.1-flash`）。国内版若 `/v3/config` 取不到，会退回旧的 `/v2/enterprises/personal/models` 并记一条日志——那份旧名册是 CLI 渠道的，同名槽位挂着付费的 `hy4-preview`（`x0.29`）而不是 App 显示的免费 `hy4-preview-f`（`x0.00`），所以只在降级时使用。积分概览走 `https://www.codebuddy.cn/v2/billing/meter/get-user-resource`（国际版账号自动路由到其凭据所属的国际网关，`workbuddy.ai` 或 `codebuddy.ai`——两个品牌域名的凭据互不通用），均为只读接口。
 
 凭据读取自 WorkBuddy 桌面 App 自身的 auth 文件（只读）；刷新得到的 token 按区域存放在 `$DSH_HOME/.workbuddy-auth.cn.json` 与 `$DSH_HOME/.workbuddy-auth.global.json`（双账号同时在线互不覆盖；旧的单文件 `.workbuddy-auth.json` 作为迁移来源保留读取），桌面端文件永不被写入。
 

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { A as workbuddyOwnAuthPath, C as defaultDesktopAuthDirs, D as legacyWorkbuddyOwnAuthPath, P as WorkBuddyUpstreamClient, S as defaultDesktopAuthCandidates, U as WORKBUDDY_APP_EXECUTABLE_ENV, Y as findWorkbuddyAppExecutableWithSource, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-C6G_goTD.js";
+import { A as workbuddyOwnAuthPath, C as defaultDesktopAuthDirs, D as legacyWorkbuddyOwnAuthPath, P as WorkBuddyUpstreamClient, S as defaultDesktopAuthCandidates, U as WORKBUDDY_APP_EXECUTABLE_ENV, Y as findWorkbuddyAppExecutableWithSource, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-Cg2ahl1n.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -2927,23 +2927,35 @@ window.__ModuleLoader__.load({
 																/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("fieldset", {
 																	className: "dsm-workbuddy-context-budget",
 																	"aria-label": t("row.contextBudget"),
-																	children: [model.nativeContextWindow > 2e5 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-																		type: "radio",
-																		name: `context-${model.id}`,
-																		checked: (activeContextBudgets[model.id] ?? 2e5) === 2e5,
-																		disabled: !canWrite || saving,
-																		onChange: () => {
-																			setContextBudget(model.id, 2e5);
-																		}
-																	}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "200K" })] }) : null, /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-																		type: "radio",
-																		name: `context-${model.id}`,
-																		checked: model.nativeContextWindow <= 2e5 || activeContextBudgets[model.id] === model.nativeContextWindow,
-																		disabled: model.nativeContextWindow <= 2e5 || !canWrite || saving,
-																		onChange: () => {
-																			setContextBudget(model.id, model.nativeContextWindow);
-																		}
-																	}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: formatCapacity(model.nativeContextWindow, t("row.modelUnknown")) })] })]
+																	children: [
+																		model.nativeContextWindow > 2e5 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+																			type: "radio",
+																			name: `context-${model.id}`,
+																			checked: (activeContextBudgets[model.id] ?? 2e5) === 2e5,
+																			disabled: !canWrite || saving,
+																			onChange: () => {
+																				setContextBudget(model.id, 2e5);
+																			}
+																		}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "200K" })] }) : null,
+																		model.nativeContextWindow > 5e5 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+																			type: "radio",
+																			name: `context-${model.id}`,
+																			checked: activeContextBudgets[model.id] === 5e5,
+																			disabled: !canWrite || saving,
+																			onChange: () => {
+																				setContextBudget(model.id, 5e5);
+																			}
+																		}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "500K" })] }) : null,
+																		/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+																			type: "radio",
+																			name: `context-${model.id}`,
+																			checked: model.nativeContextWindow <= 2e5 || activeContextBudgets[model.id] === model.nativeContextWindow,
+																			disabled: model.nativeContextWindow <= 2e5 || !canWrite || saving,
+																			onChange: () => {
+																				setContextBudget(model.id, model.nativeContextWindow);
+																			}
+																		}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: formatCapacity(model.nativeContextWindow, t("row.modelUnknown")) })] })
+																	]
 																}),
 																/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 																	className: "dsm-workbuddy-model-actions-buttons",

package/lib/{host-heartbeat-C6G_goTD.js → host-heartbeat-Cg2ahl1n.js}

@@ -583,16 +583,34 @@ const CN_CHAT_BASE = "https://copilot.tencent.com";
 const CN_BILLING_BASE = "https://www.codebuddy.cn";
 const GLOBAL_BASE = "https://www.workbuddy.ai";
 /**
-* Model-catalog path used by the CN region (and the global fallback). The CN
-* gateway answers it with the same bytes as its legacy
-* `/console/enterprises/personal/models` alias. See {@link GLOBAL_CONFIG_PATH}
-* for why the international region reads a different document.
+* Legacy model-catalog path, kept only as the CN region's FALLBACK.
+*
+* This is the document the WorkBuddy *plugin* used to read, and it is NOT the
+* document the WorkBuddy *app* reads. The gateway answers it with the CLI
+* channel's roster, whose second slot is the paid `hy4-preview`
+* (`credits: 'x0.29 credits'`), while the app's own config lists the free
+* `hy4-preview-f` (`credits: 'x0.00 credits'`) in that slot under the SAME
+* display name "Hy4 preview". Reading this path is therefore what makes the
+* plugin's card disagree with the app about a model's price — both are
+* correctly displaying a real record, just different ones.
 */
 const MODELS_CATALOG_PATH = "/v2/enterprises/personal/models";
 /**
-* Remote product-config path on the global gateway. This is the document the
-* desktop channel receives; it is the only source that lists the account's
-* full international chat roster (see {@link DESKTOP_UA}).
+* Remote product-config path; the CN region's PRIMARY catalog source and the
+* global region's only one.
+*
+* It is field-compatible with {@link MODELS_CATALOG_PATH} for every key
+* {@link parseUpstreamModel} reads, so one parser still serves both. On CN this
+* path is what the app itself consumes, so the plugin's roster and the app's
+* agree — that parity is the whole point of preferring it.
+*
+* The CLI user agent deliberately stays {@link CLIENT_UA} here. `/v3/config`
+* serves a DIFFERENT roster per client channel: the desktop token yields a
+* roster without the free `hy4-preview-f`, and the CLI token yields one with
+* it. Measured 2026-10-04 — CN + `/v3/config`: CLI token = 17 models incl.
+* `hy4-preview-f`(x0.00); desktop token = 29 models, no `hy4-preview-f` and no
+* cheap free tier. That is why the global branch below pairs this path with
+* {@link DESKTOP_UA} and the CN branch must NOT.
 */
 const GLOBAL_CONFIG_PATH = "/v3/config";
 const CLIENT_UA = "CLI/2.63.2 CodeBuddy/2.63.2";
@@ -1152,6 +1170,19 @@ function selectCliModels(rawModels, agents) {
 * the credential explicitly so token refreshes apply on the next call.
 */
 var WorkBuddyUpstreamClient = class {
+	onFallback;
+	/**
+	* Reports a fallback the catalog reader had to take.
+	*
+	* Injected rather than logged here because this module holds no logger on
+	* purpose — it is pure transport + parsing, so it stays importable from
+	* tests and the CLI without a cordis context. The host wires its
+	* `ctx.logger.warn` in; without a host the event is dropped, which is the
+	* same silence the previous single-source reader had.
+	*/
+	constructor(onFallback) {
+		this.onFallback = onFallback;
+	}
 	/** POST the chat endpoint; a successful answer is the raw SSE response. */
 	async chatStream(credential, bodyJson, signal) {
 		let response;
@@ -1274,13 +1305,23 @@ var WorkBuddyUpstreamClient = class {
 	/**
 	* Read the model directory for the credential's region.
 	*
-	* The two regions expose their chat roster through different documents:
-	* CN answers `/v2/enterprises/personal/models`, while the global gateway's
-	* personal-models path returns HTTP 500 and the CLI channel's `/v3/config`
-	* omits chat-usable models — so global reads `/v3/config` as the desktop
-	* channel (see {@link DESKTOP_UA}). Both documents share the entry shape, so
-	* one parser serves them. No user-side toggle is involved: the region comes
-	* from the credential's `domain`.
+	* Both regions prefer `/v3/config`, the document the WorkBuddy app itself
+	* consumes, so the plugin's roster and the app's agree. They differ in the
+	* user agent that requests it, and that difference is load-bearing: `/v3`
+	* serves a different roster per client channel. Global asks as the desktop
+	* channel (see {@link DESKTOP_UA}); CN asks as the CLI channel
+	* ({@link CLIENT_UA}), which is the only CN channel whose `/v3` answer
+	* contains the free `hy4-preview-f` (see {@link GLOBAL_CONFIG_PATH}).
+	*
+	* CN falls back to the legacy {@link MODELS_CATALOG_PATH} when `/v3` fails,
+	* returns a non-zero envelope, or resolves to no usable model, so a gateway
+	* that stops serving the modern document degrades to the previous roster
+	* instead of leaving the region empty. The fallback is silent when unused and
+	* reported when it fires, because a roster that silently differs from the
+	* app's is exactly the bug this ordering exists to fix.
+	*
+	* No user-side toggle is involved: the region comes from the credential's
+	* `domain`.
 	*/
 	async fetchModels(credential, signal) {
 		const timeout = signal ?? AbortSignal.timeout(JSON_TIMEOUT_MS);
@@ -1303,20 +1344,28 @@ var WorkBuddyUpstreamClient = class {
 			const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
 			return selectCliModels(data["models"], data["agents"]);
 		}
-		const response = await fetch(`${chatBase(credential)}${MODELS_CATALOG_PATH}`, {
-			headers: {
-				"Authorization": `Bearer ${credential.accessToken}`,
-				"Accept": "application/json",
-				"Origin": originReferer(credential),
-				"Referer": `${originReferer(credential)}/`,
-				"User-Agent": CLIENT_UA
-			},
-			signal: timeout
-		});
-		const envelope = await readEnvelope(response);
-		if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
-		const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
-		return selectCliModels(data["models"], data["agents"]);
+		const readCatalog = async (path) => {
+			const response = await fetch(`${chatBase(credential)}${path}`, {
+				headers: {
+					"Authorization": `Bearer ${credential.accessToken}`,
+					"Accept": "application/json",
+					"Origin": originReferer(credential),
+					"Referer": `${originReferer(credential)}/`,
+					"User-Agent": CLIENT_UA
+				},
+				signal: timeout
+			});
+			const envelope = await readEnvelope(response);
+			if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
+			const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
+			return selectCliModels(data["models"], data["agents"]);
+		};
+		try {
+			return await readCatalog(GLOBAL_CONFIG_PATH);
+		} catch (error) {
+			this.onFallback?.(`CN model catalog ${GLOBAL_CONFIG_PATH} failed; falling back to ${MODELS_CATALOG_PATH}: ` + (error instanceof Error ? error.message : String(error)));
+			return await readCatalog(MODELS_CATALOG_PATH);
+		}
 	}
 	/** Query today's check-in status without changing account state. */
 	async fetchCheckinStatus(credential) {
@@ -2806,7 +2855,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "3.5.0";
+const WORKBUDDY_CONNECT_VERSION = "3.6.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -628,6 +628,17 @@ declare function parseUpstreamModel(value: unknown): WorkBuddyUpstreamModel | un
  * the credential explicitly so token refreshes apply on the next call.
  */
 declare class WorkBuddyUpstreamClient {
+  private readonly onFallback?;
+  /**
+   * Reports a fallback the catalog reader had to take.
+   *
+   * Injected rather than logged here because this module holds no logger on
+   * purpose — it is pure transport + parsing, so it stays importable from
+   * tests and the CLI without a cordis context. The host wires its
+   * `ctx.logger.warn` in; without a host the event is dropped, which is the
+   * same silence the previous single-source reader had.
+   */
+  constructor(onFallback?: ((message: string) => void) | undefined);
   /** POST the chat endpoint; a successful answer is the raw SSE response. */
   chatStream(credential: WorkBuddyCredential, bodyJson: string, signal?: AbortSignal): Promise<WorkBuddyChatResult>;
   /**
@@ -662,13 +673,23 @@ declare class WorkBuddyUpstreamClient {
   /**
    * Read the model directory for the credential's region.
    *
-   * The two regions expose their chat roster through different documents:
-   * CN answers `/v2/enterprises/personal/models`, while the global gateway's
-   * personal-models path returns HTTP 500 and the CLI channel's `/v3/config`
-   * omits chat-usable models — so global reads `/v3/config` as the desktop
-   * channel (see {@link DESKTOP_UA}). Both documents share the entry shape, so
-   * one parser serves them. No user-side toggle is involved: the region comes
-   * from the credential's `domain`.
+   * Both regions prefer `/v3/config`, the document the WorkBuddy app itself
+   * consumes, so the plugin's roster and the app's agree. They differ in the
+   * user agent that requests it, and that difference is load-bearing: `/v3`
+   * serves a different roster per client channel. Global asks as the desktop
+   * channel (see {@link DESKTOP_UA}); CN asks as the CLI channel
+   * ({@link CLIENT_UA}), which is the only CN channel whose `/v3` answer
+   * contains the free `hy4-preview-f` (see {@link GLOBAL_CONFIG_PATH}).
+   *
+   * CN falls back to the legacy {@link MODELS_CATALOG_PATH} when `/v3` fails,
+   * returns a non-zero envelope, or resolves to no usable model, so a gateway
+   * that stops serving the modern document degrades to the previous roster
+   * instead of leaving the region empty. The fallback is silent when unused and
+   * reported when it fires, because a roster that silently differs from the
+   * app's is exactly the bug this ordering exists to fix.
+   *
+   * No user-side toggle is involved: the region comes from the credential's
+   * `domain`.
    */
   fetchModels(credential: WorkBuddyCredential, signal?: AbortSignal): Promise<readonly WorkBuddyUpstreamModel[]>;
   /** Query today's check-in status without changing account state. */
@@ -1850,7 +1871,13 @@ interface WorkBuddyWebModel {
   name: string;
   /** Effective DSH context after applying the saved local budget. */
   contextWindow: number;
-  /** Native maximum advertised by WorkBuddy; models above 200K expose 200K/max. */
+  /**
+   * Native maximum advertised by WorkBuddy, never clamped by a default.
+   *
+   * Models above 200K expose the tier selector (200K / 500K / max); whether the
+   * window is actually reduced is the user's stored `contextBudgets` decision
+   * and nothing else — see issue #33.
+   */
   nativeContextWindow: number;
   maxTokens: number;
   creditMultiplier?: number;

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as macosNestedAppBundles, A as workbuddyOwnAuthPath, B as parseUpstreamModel, C as defaultDesktopAuthDirs, D as legacyWorkbuddyOwnAuthPath, E as isEncryptedCredentialError, F as classifyUpstreamError, G as deriveAtRestKey, H as regionOf, I as declaredTools, J as findWorkbuddyAppExecutable, K as deriveAtRestKeyId, L as isCredentialRejectedError, M as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, N as WorkBuddyCredentialRejectedError, O as parseWorkBuddyAuth, P as WorkBuddyUpstreamClient, Q as macosBundleExecutable, R as parseCreditMultiplier, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as WORKBUDDY_APP_EXECUTABLE_ENV, V as prepareChatBody, W as clearAtRestKeyCache, X as isEncryptedFieldWrapper, Z as isWorkbuddyBundle, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as openEncryptedField, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, j as CREDENTIAL_REJECTED_CODE, k as workbuddyAccountId, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as workbuddyAppExecutableCandidates, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as fetchAtRestKeyPayload, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as readAtRestKey, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as parseReasoning } from "./host-heartbeat-C6G_goTD.js";
+import { $ as macosNestedAppBundles, A as workbuddyOwnAuthPath, B as parseUpstreamModel, C as defaultDesktopAuthDirs, D as legacyWorkbuddyOwnAuthPath, E as isEncryptedCredentialError, F as classifyUpstreamError, G as deriveAtRestKey, H as regionOf, I as declaredTools, J as findWorkbuddyAppExecutable, K as deriveAtRestKeyId, L as isCredentialRejectedError, M as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, N as WorkBuddyCredentialRejectedError, O as parseWorkBuddyAuth, P as WorkBuddyUpstreamClient, Q as macosBundleExecutable, R as parseCreditMultiplier, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as WORKBUDDY_APP_EXECUTABLE_ENV, V as prepareChatBody, W as clearAtRestKeyCache, X as isEncryptedFieldWrapper, Z as isWorkbuddyBundle, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as openEncryptedField, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, j as CREDENTIAL_REJECTED_CODE, k as workbuddyAccountId, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as workbuddyAppExecutableCandidates, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as fetchAtRestKeyPayload, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as readAtRestKey, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as parseReasoning } from "./host-heartbeat-Cg2ahl1n.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -3871,7 +3871,7 @@ const Config = z.object({
 */
 function regionStateOf(config, region) {
 	const stored = unwrapVolatile(config.regions)?.[region];
-	if (stored !== void 0) return stored;
+	if (stored !== void 0 && stored !== null) return stored;
 	if (region !== "cn") return {};
 	const lastCatalog = unwrapVolatile(config.lastCatalog);
 	const enabledModelIds = unwrapVolatile(config.enabledModelIds);
@@ -3959,7 +3959,9 @@ async function legacyAttributionRegion(value, accountsFor) {
 * upstream never leaves a provider empty.
 */
 function apply(ctx, config) {
-	const client = new WorkBuddyUpstreamClient();
+	const client = new WorkBuddyUpstreamClient((message) => {
+		ctx.logger.warn(`dsh-connect-workbuddy: ${message}`);
+	});
 	/**
 	* How long a check-in reading is reused before asking the upstream again.
 	*

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "3.5.0",
+  "version": "3.6.0",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",