dsh-connect-workbuddy 3.5.0 → 4.0.0

package/lib/{host-heartbeat-C6G_goTD.js → host-heartbeat-vvVjdY_q.js}

@@ -583,16 +583,34 @@ const CN_CHAT_BASE = "https://copilot.tencent.com";
 const CN_BILLING_BASE = "https://www.codebuddy.cn";
 const GLOBAL_BASE = "https://www.workbuddy.ai";
 /**
-* Model-catalog path used by the CN region (and the global fallback). The CN
-* gateway answers it with the same bytes as its legacy
-* `/console/enterprises/personal/models` alias. See {@link GLOBAL_CONFIG_PATH}
-* for why the international region reads a different document.
+* Legacy model-catalog path, kept only as the CN region's FALLBACK.
+*
+* This is the document the WorkBuddy *plugin* used to read, and it is NOT the
+* document the WorkBuddy *app* reads. The gateway answers it with the CLI
+* channel's roster, whose second slot is the paid `hy4-preview`
+* (`credits: 'x0.29 credits'`), while the app's own config lists the free
+* `hy4-preview-f` (`credits: 'x0.00 credits'`) in that slot under the SAME
+* display name "Hy4 preview". Reading this path is therefore what makes the
+* plugin's card disagree with the app about a model's price — both are
+* correctly displaying a real record, just different ones.
 */
 const MODELS_CATALOG_PATH = "/v2/enterprises/personal/models";
 /**
-* Remote product-config path on the global gateway. This is the document the
-* desktop channel receives; it is the only source that lists the account's
-* full international chat roster (see {@link DESKTOP_UA}).
+* Remote product-config path; the CN region's PRIMARY catalog source and the
+* global region's only one.
+*
+* It is field-compatible with {@link MODELS_CATALOG_PATH} for every key
+* {@link parseUpstreamModel} reads, so one parser still serves both. On CN this
+* path is what the app itself consumes, so the plugin's roster and the app's
+* agree — that parity is the whole point of preferring it.
+*
+* The CLI user agent deliberately stays {@link CLIENT_UA} here. `/v3/config`
+* serves a DIFFERENT roster per client channel: the desktop token yields a
+* roster without the free `hy4-preview-f`, and the CLI token yields one with
+* it. Measured 2026-10-04 — CN + `/v3/config`: CLI token = 17 models incl.
+* `hy4-preview-f`(x0.00); desktop token = 29 models, no `hy4-preview-f` and no
+* cheap free tier. That is why the global branch below pairs this path with
+* {@link DESKTOP_UA} and the CN branch must NOT.
 */
 const GLOBAL_CONFIG_PATH = "/v3/config";
 const CLIENT_UA = "CLI/2.63.2 CodeBuddy/2.63.2";
@@ -1152,6 +1170,19 @@ function selectCliModels(rawModels, agents) {
 * the credential explicitly so token refreshes apply on the next call.
 */
 var WorkBuddyUpstreamClient = class {
+	onFallback;
+	/**
+	* Reports a fallback the catalog reader had to take.
+	*
+	* Injected rather than logged here because this module holds no logger on
+	* purpose — it is pure transport + parsing, so it stays importable from
+	* tests and the CLI without a cordis context. The host wires its
+	* `ctx.logger.warn` in; without a host the event is dropped, which is the
+	* same silence the previous single-source reader had.
+	*/
+	constructor(onFallback) {
+		this.onFallback = onFallback;
+	}
 	/** POST the chat endpoint; a successful answer is the raw SSE response. */
 	async chatStream(credential, bodyJson, signal) {
 		let response;
@@ -1274,13 +1305,23 @@ var WorkBuddyUpstreamClient = class {
 	/**
 	* Read the model directory for the credential's region.
 	*
-	* The two regions expose their chat roster through different documents:
-	* CN answers `/v2/enterprises/personal/models`, while the global gateway's
-	* personal-models path returns HTTP 500 and the CLI channel's `/v3/config`
-	* omits chat-usable models — so global reads `/v3/config` as the desktop
-	* channel (see {@link DESKTOP_UA}). Both documents share the entry shape, so
-	* one parser serves them. No user-side toggle is involved: the region comes
-	* from the credential's `domain`.
+	* Both regions prefer `/v3/config`, the document the WorkBuddy app itself
+	* consumes, so the plugin's roster and the app's agree. They differ in the
+	* user agent that requests it, and that difference is load-bearing: `/v3`
+	* serves a different roster per client channel. Global asks as the desktop
+	* channel (see {@link DESKTOP_UA}); CN asks as the CLI channel
+	* ({@link CLIENT_UA}), which is the only CN channel whose `/v3` answer
+	* contains the free `hy4-preview-f` (see {@link GLOBAL_CONFIG_PATH}).
+	*
+	* CN falls back to the legacy {@link MODELS_CATALOG_PATH} when `/v3` fails,
+	* returns a non-zero envelope, or resolves to no usable model, so a gateway
+	* that stops serving the modern document degrades to the previous roster
+	* instead of leaving the region empty. The fallback is silent when unused and
+	* reported when it fires, because a roster that silently differs from the
+	* app's is exactly the bug this ordering exists to fix.
+	*
+	* No user-side toggle is involved: the region comes from the credential's
+	* `domain`.
 	*/
 	async fetchModels(credential, signal) {
 		const timeout = signal ?? AbortSignal.timeout(JSON_TIMEOUT_MS);
@@ -1303,20 +1344,28 @@ var WorkBuddyUpstreamClient = class {
 			const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
 			return selectCliModels(data["models"], data["agents"]);
 		}
-		const response = await fetch(`${chatBase(credential)}${MODELS_CATALOG_PATH}`, {
-			headers: {
-				"Authorization": `Bearer ${credential.accessToken}`,
-				"Accept": "application/json",
-				"Origin": originReferer(credential),
-				"Referer": `${originReferer(credential)}/`,
-				"User-Agent": CLIENT_UA
-			},
-			signal: timeout
-		});
-		const envelope = await readEnvelope(response);
-		if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
-		const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
-		return selectCliModels(data["models"], data["agents"]);
+		const readCatalog = async (path) => {
+			const response = await fetch(`${chatBase(credential)}${path}`, {
+				headers: {
+					"Authorization": `Bearer ${credential.accessToken}`,
+					"Accept": "application/json",
+					"Origin": originReferer(credential),
+					"Referer": `${originReferer(credential)}/`,
+					"User-Agent": CLIENT_UA
+				},
+				signal: timeout
+			});
+			const envelope = await readEnvelope(response);
+			if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
+			const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
+			return selectCliModels(data["models"], data["agents"]);
+		};
+		try {
+			return await readCatalog(GLOBAL_CONFIG_PATH);
+		} catch (error) {
+			this.onFallback?.(`CN model catalog ${GLOBAL_CONFIG_PATH} failed; falling back to ${MODELS_CATALOG_PATH}: ` + (error instanceof Error ? error.message : String(error)));
+			return await readCatalog(MODELS_CATALOG_PATH);
+		}
 	}
 	/** Query today's check-in status without changing account state. */
 	async fetchCheckinStatus(credential) {
@@ -2806,7 +2855,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "3.5.0";
+const WORKBUDDY_CONNECT_VERSION = "4.0.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -628,6 +628,17 @@ declare function parseUpstreamModel(value: unknown): WorkBuddyUpstreamModel | un
  * the credential explicitly so token refreshes apply on the next call.
  */
 declare class WorkBuddyUpstreamClient {
+  private readonly onFallback?;
+  /**
+   * Reports a fallback the catalog reader had to take.
+   *
+   * Injected rather than logged here because this module holds no logger on
+   * purpose — it is pure transport + parsing, so it stays importable from
+   * tests and the CLI without a cordis context. The host wires its
+   * `ctx.logger.warn` in; without a host the event is dropped, which is the
+   * same silence the previous single-source reader had.
+   */
+  constructor(onFallback?: ((message: string) => void) | undefined);
   /** POST the chat endpoint; a successful answer is the raw SSE response. */
   chatStream(credential: WorkBuddyCredential, bodyJson: string, signal?: AbortSignal): Promise<WorkBuddyChatResult>;
   /**
@@ -662,13 +673,23 @@ declare class WorkBuddyUpstreamClient {
   /**
    * Read the model directory for the credential's region.
    *
-   * The two regions expose their chat roster through different documents:
-   * CN answers `/v2/enterprises/personal/models`, while the global gateway's
-   * personal-models path returns HTTP 500 and the CLI channel's `/v3/config`
-   * omits chat-usable models — so global reads `/v3/config` as the desktop
-   * channel (see {@link DESKTOP_UA}). Both documents share the entry shape, so
-   * one parser serves them. No user-side toggle is involved: the region comes
-   * from the credential's `domain`.
+   * Both regions prefer `/v3/config`, the document the WorkBuddy app itself
+   * consumes, so the plugin's roster and the app's agree. They differ in the
+   * user agent that requests it, and that difference is load-bearing: `/v3`
+   * serves a different roster per client channel. Global asks as the desktop
+   * channel (see {@link DESKTOP_UA}); CN asks as the CLI channel
+   * ({@link CLIENT_UA}), which is the only CN channel whose `/v3` answer
+   * contains the free `hy4-preview-f` (see {@link GLOBAL_CONFIG_PATH}).
+   *
+   * CN falls back to the legacy {@link MODELS_CATALOG_PATH} when `/v3` fails,
+   * returns a non-zero envelope, or resolves to no usable model, so a gateway
+   * that stops serving the modern document degrades to the previous roster
+   * instead of leaving the region empty. The fallback is silent when unused and
+   * reported when it fires, because a roster that silently differs from the
+   * app's is exactly the bug this ordering exists to fix.
+   *
+   * No user-side toggle is involved: the region comes from the credential's
+   * `domain`.
    */
   fetchModels(credential: WorkBuddyCredential, signal?: AbortSignal): Promise<readonly WorkBuddyUpstreamModel[]>;
   /** Query today's check-in status without changing account state. */
@@ -1850,7 +1871,13 @@ interface WorkBuddyWebModel {
   name: string;
   /** Effective DSH context after applying the saved local budget. */
   contextWindow: number;
-  /** Native maximum advertised by WorkBuddy; models above 200K expose 200K/max. */
+  /**
+   * Native maximum advertised by WorkBuddy, never clamped by a default.
+   *
+   * Models above 200K expose the tier selector (200K / 500K / max); whether the
+   * window is actually reduced is the user's stored `contextBudgets` decision
+   * and nothing else — see issue #33.
+   */
   nativeContextWindow: number;
   maxTokens: number;
   creditMultiplier?: number;
@@ -1956,6 +1983,17 @@ type WorkBuddyWebUsage =
   accounts: readonly WorkBuddyWebAccount[];
   /** Whether this region's provider is currently offered to DSH. */
   enabled?: boolean;
+  /**
+   * Whether this region's sidebar credit line is shown.
+   *
+   * Carried on the Host's answer rather than read from the browser settings
+   * mirror, for the same measured reason as `contextBudgets`: on the affected
+   * 0.1.7 deployment the mirror never picks up this plugin's writes (a save
+   * through the Host endpoint leaves it stale), so a control reading it kept
+   * showing the old value and looked like it could not be turned off — the
+   * "关闭不了" report.
+   */
+  showCreditsInMainUi?: boolean;
   message?: string;
   /** The persisted account id matches no local account. */
   selectionLost?: boolean;
@@ -1984,6 +2022,12 @@ type WorkBuddyWebUsage =
   region: WorkBuddyWebRegion;
   /** Whether this region's provider is currently offered to DSH. */
   enabled?: boolean;
+  /**
+   * Whether this region's sidebar credit line is shown. See the signed-out
+   * variant for why this travels on the Host's answer instead of the browser
+   * settings mirror.
+   */
+  showCreditsInMainUi?: boolean;
   source?: 'desktop' | 'dsh';
   tokenExpiresAtMs: number;
   /** A saved per-region choice is in effect (false = following the app). */
@@ -2290,6 +2334,19 @@ interface WorkBuddyStatusRouteOptions {
    * committed settings value rather than a local guess.
    */
   regionEnabled(region: WorkBuddyRegion): boolean;
+  /**
+   * Whether the region's sidebar credit line is shown.
+   *
+   * Read from the COMMITTED settings value here rather than in the browser, for
+   * the same reason as `regionEnabled` — and additionally because the browser's
+   * settings mirror is documented as stale for this namespace on the affected
+   * 0.1.7 deployments, which made the checkbox appear unable to turn the line
+   * off ("关闭不了"). The card reads this field off the Host's answer.
+   *
+   * Optional so a Host that predates the setting still satisfies the interface;
+   * absent reads as ON, matching the schema's `default(true)`.
+   */
+  showCreditsInMainUi?(region: WorkBuddyRegion): boolean;
   /**
    * Send one real-volume request to each named model of a region and report what
    * came back.
@@ -2332,6 +2389,18 @@ interface WorkBuddyStatusRouteOptions {
    * probe.
    */
   accountUsable?(region: WorkBuddyRegion, account: WorkBuddyRecoveryCandidate): Promise<boolean>;
+  /**
+   * Why each of the region's accounts cannot serve right now, keyed by account
+   * id. Absent key (or an absent dep) means "no reason known" — the composer
+   * panel then marks nothing, which is the honest answer for an account that has
+   * never been measured.
+   *
+   * The rule is the SAME one the pool ranks by (`exclusionOf`), including its
+   * cooldown-expiry handling, so an account the pool calls usable and one the
+   * panel calls rate-limited can never be the same account at the same moment.
+   * Reimplementing the expiry check here would let the two drift.
+   */
+  accountExclusions?(region: WorkBuddyRegion): Promise<Readonly<Record<string, WorkBuddyWebPoolExclusion>>>;
   /**
    * The region's account pool, assembled on the Host.
    *
@@ -2481,6 +2550,15 @@ interface WorkBuddyRegionState {
    * row (see `syncRegionRegistration`).
    */
   enabled?: boolean;
+  /**
+   * Whether this region's credit balance shows at the DSH sidebar foot.
+   *
+   * Per-region, independently switched: WB CN and WB AI are separate accounts
+   * on separate gateways, so a user holding only one of them must be able to
+   * show exactly that one. Opt-out — an absent value reads as ON, so a config
+   * written before this switch existed keeps whatever the default was.
+   */
+  showCreditsInMainUi?: boolean;
   /** The last-refreshed directory for this region; what the card displays. */
   lastCatalog?: WorkBuddyModelInfo[];
   /** The user's selection in this region, as model ids. */

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as macosNestedAppBundles, A as workbuddyOwnAuthPath, B as parseUpstreamModel, C as defaultDesktopAuthDirs, D as legacyWorkbuddyOwnAuthPath, E as isEncryptedCredentialError, F as classifyUpstreamError, G as deriveAtRestKey, H as regionOf, I as declaredTools, J as findWorkbuddyAppExecutable, K as deriveAtRestKeyId, L as isCredentialRejectedError, M as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, N as WorkBuddyCredentialRejectedError, O as parseWorkBuddyAuth, P as WorkBuddyUpstreamClient, Q as macosBundleExecutable, R as parseCreditMultiplier, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as WORKBUDDY_APP_EXECUTABLE_ENV, V as prepareChatBody, W as clearAtRestKeyCache, X as isEncryptedFieldWrapper, Z as isWorkbuddyBundle, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as openEncryptedField, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, j as CREDENTIAL_REJECTED_CODE, k as workbuddyAccountId, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as workbuddyAppExecutableCandidates, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as fetchAtRestKeyPayload, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as readAtRestKey, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as parseReasoning } from "./host-heartbeat-C6G_goTD.js";
+import { $ as macosNestedAppBundles, A as workbuddyOwnAuthPath, B as parseUpstreamModel, C as defaultDesktopAuthDirs, D as legacyWorkbuddyOwnAuthPath, E as isEncryptedCredentialError, F as classifyUpstreamError, G as deriveAtRestKey, H as regionOf, I as declaredTools, J as findWorkbuddyAppExecutable, K as deriveAtRestKeyId, L as isCredentialRejectedError, M as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, N as WorkBuddyCredentialRejectedError, O as parseWorkBuddyAuth, P as WorkBuddyUpstreamClient, Q as macosBundleExecutable, R as parseCreditMultiplier, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as WORKBUDDY_APP_EXECUTABLE_ENV, V as prepareChatBody, W as clearAtRestKeyCache, X as isEncryptedFieldWrapper, Z as isWorkbuddyBundle, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as openEncryptedField, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, j as CREDENTIAL_REJECTED_CODE, k as workbuddyAccountId, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as workbuddyAppExecutableCandidates, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as fetchAtRestKeyPayload, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as readAtRestKey, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as parseReasoning } from "./host-heartbeat-vvVjdY_q.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -2832,6 +2832,18 @@ async function writePoolProbes(region, updates) {
 */
 /** Plugin-owned usage endpoint consumed by its browser half. */
 const WORKBUDDY_USAGE_PATH = "/plugins/dsh-connect-workbuddy/usage";
+/**
+* Per-account credit balances for one region, read ONLY while the composer
+* panel is open.
+*
+* Separate from {@link WORKBUDDY_USAGE_PATH} because its cost is different in
+* kind: the usage document is one upstream read for the selected account, while
+* this is one read PER account in the region. Folding it into the usage route
+* would make every 5-minute refresh pay for a table nobody is looking at, so it
+* is fetched on demand instead — the same principle the pool applies to its
+* per-account figures.
+*/
+const WORKBUDDY_ACCOUNT_CREDITS_PATH = "/plugins/dsh-connect-workbuddy/account-credits";
 /** Plugin-owned live model refresh endpoint. */
 const WORKBUDDY_MODELS_REFRESH_PATH = "/plugins/dsh-connect-workbuddy/models/refresh";
 /** Plugin-owned local account rescan endpoint. */
@@ -3158,6 +3170,39 @@ function volatileFlagOf(field) {
 	return Config.dict?.[field]?.meta?.volatile === true;
 }
 /**
+* Per-account credit balances for one region, for the composer panel's table.
+*
+* ONE upstream read per account, which is exactly why this is its own route:
+* the panel calls it only while it is open, so the 5-minute readout never
+* multiplies its cost by the account count.
+*
+* Every account is listed even when its balance cannot be read — a credential
+* that no longer resolves, or an upstream that refused — because the panel's
+* job is to show which accounts exist and let the user switch. Such a row
+* carries NO `credits` field rather than `0`, so the panel renders "—" instead
+* of telling the user they are out of credits.
+*
+* Failures are contained per account: one dead credential must not blank the
+* table for the accounts that are fine.
+*/
+async function workBuddyAccountCredits(deps, region) {
+	const store = deps.store(region);
+	const accounts = await store.accounts();
+	const exclusions = await deps.accountExclusions?.(region).catch(() => void 0) ?? {};
+	return Promise.all(accounts.map(async (account) => {
+		const credential = await store.credentialFor(account.id).catch(() => void 0);
+		const credits = credential === void 0 ? void 0 : await deps.client.fetchCredits(credential).then((answer) => answer.total).catch(() => void 0);
+		const excludedBy = exclusions[account.id];
+		return {
+			id: account.id,
+			accountName: account.accountName,
+			selected: account.selected,
+			...credits === void 0 ? {} : { credits },
+			...excludedBy === void 0 ? {} : { excludedBy }
+		};
+	}));
+}
+/**
 * Assemble one region's card document. `region` is the tab the card is on;
 * the region-scoped store already answers with only that region's accounts,
 * so the document's model slots and account list are that region's by
@@ -3169,13 +3214,15 @@ async function workBuddyWebStatus(deps, region) {
 	const accounts = await store.accounts();
 	deps.regionUsable?.(region, accounts.length > 0);
 	const enabled = deps.regionEnabled(region);
+	const showCreditsInMainUi = deps.showCreditsInMainUi?.(region) ?? true;
 	const authStatus = await store.status();
 	const selectionExplicit = store.hasExplicitSelection();
 	if (authStatus.state !== "signed-out" && accounts.length === 0) return {
 		status: "signed-out",
 		accounts: [],
 		selectionExplicit,
-		enabled
+		enabled,
+		showCreditsInMainUi
 	};
 	let credential;
 	try {
@@ -3188,6 +3235,7 @@ async function workBuddyWebStatus(deps, region) {
 			message: safeMessage(error),
 			selectionExplicit,
 			enabled,
+			showCreditsInMainUi,
 			...await store.selectionLost() ? { selectionLost: true } : {},
 			...webAccounts.length === 0 ? await searchedPaths(store) : {}
 		};
@@ -3202,6 +3250,7 @@ async function workBuddyWebStatus(deps, region) {
 		tokenExpiresAtMs: credential.expiresAtMs,
 		selectionExplicit,
 		enabled,
+		showCreditsInMainUi,
 		accounts: accounts.map(toWebAccount),
 		models: deps.displayModels(region).map((model) => toWebModel(model, deps.contextBudgets(region))),
 		enabledModelIds: [...deps.enabledModelIds(region)],
@@ -3354,6 +3403,21 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 				}
 			}
 		});
+		const disposeAccountCredits = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_ACCOUNT_CREDITS_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				const region = requestRegion(req, res);
+				if (region === void 0) return;
+				try {
+					json(res, 200, { accounts: await workBuddyAccountCredits(deps, region) });
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
 		const disposeAccounts = ctx.webServer.register({
 			kind: "exact",
 			path: WORKBUDDY_ACCOUNTS_REFRESH_PATH,
@@ -3586,6 +3650,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			disposeCheckin();
 			disposeAccounts();
 			disposeUsage();
+			disposeAccountCredits();
 			disposeProbe();
 			disposePool();
 			disposeDiagWrite();
@@ -3785,6 +3850,22 @@ const poolConfig = z.object({
 });
 const regionStateConfig = z.object({
 	enabled: z.boolean().default(true).description("Whether this region's provider is offered to DSH (opt-out; false withdraws it entirely)"),
+	/**
+	* Whether this region's credit line shows at the DSH sidebar foot.
+	*
+	* Per-REGION rather than one global switch, because the two sides are
+	* independent providers the user may hold only one account on: a CN-only user
+	* has nothing to read from the international line and vice versa, and a
+	* single shared switch would force them to either show a permanently empty
+	* row or lose the one that works.
+	*
+	* ON by default (opt-out). The plugin card is not reachable in every host —
+	* a market plugin can own the Plugins tab and never render
+	* `plugins.bundle.config` — so a feature that is off until discovered would be
+	* off forever for those users. The line carries its own `×` in the sidebar,
+	* which is reachable exactly where the feature renders.
+	*/
+	showCreditsInMainUi: z.boolean().default(true).description("Show this region's remaining credits at the DSH sidebar foot (opt-out; the line carries its own hide button)"),
 	lastCatalog: z.array(modelConfig).default([]),
 	enabledModelIds: z.array(z.string()).default([]),
 	imageModelIds: z.array(z.string()).default([]),
@@ -3871,7 +3952,7 @@ const Config = z.object({
 */
 function regionStateOf(config, region) {
 	const stored = unwrapVolatile(config.regions)?.[region];
-	if (stored !== void 0) return stored;
+	if (stored !== void 0 && stored !== null) return stored;
 	if (region !== "cn") return {};
 	const lastCatalog = unwrapVolatile(config.lastCatalog);
 	const enabledModelIds = unwrapVolatile(config.enabledModelIds);
@@ -3959,7 +4040,9 @@ async function legacyAttributionRegion(value, accountsFor) {
 * upstream never leaves a provider empty.
 */
 function apply(ctx, config) {
-	const client = new WorkBuddyUpstreamClient();
+	const client = new WorkBuddyUpstreamClient((message) => {
+		ctx.logger.warn(`dsh-connect-workbuddy: ${message}`);
+	});
 	/**
 	* How long a check-in reading is reused before asking the upstream again.
 	*
@@ -4138,6 +4221,25 @@ function apply(ctx, config) {
 		store: (region) => stacks[region].store,
 		client,
 		accountUsable: accountUsabilityProbe,
+		/**
+		* Why each of the region's accounts cannot serve right now, for the composer
+		* panel's table.
+		*
+		* Runs the SAME `exclusionOf` the pool ranks by, against every account the
+		* region knows — not only pool members. Deriving it any other way (a second
+		* expiry comparison, or `probe.outcome` read raw) would let the panel call an
+		* account rate-limited while the pool has already moved past its cooldown.
+		*/
+		accountExclusions: async (region) => {
+			const probes = await readPoolProbes(region);
+			const nowMs = Date.now();
+			const out = {};
+			for (const [accountId, probe] of Object.entries(probes)) {
+				const excludedBy = exclusionOf(probe, nowMs);
+				if (excludedBy !== void 0) out[accountId] = excludedBy;
+			}
+			return out;
+		},
 		displayModels: (region) => displayModels(current(), region),
 		enabledModelIds: (region) => regionStateOf(current(), region).enabledModelIds ?? [],
 		imageModelIds: (region) => regionStateOf(current(), region).imageModelIds ?? [],
@@ -4146,6 +4248,13 @@ function apply(ctx, config) {
 		discoverModels,
 		regionEnabled: (region) => regionEnabled(current(), region),
 		/**
+		* The region's committed sidebar-credit flag, read from the same config the
+		* card writes. Exposed on the Host's answer because the browser settings
+		* mirror goes stale for this namespace on the affected 0.1.7 deployments,
+		* which made the switch look unable to turn the line off ("关闭不了").
+		*/
+		showCreditsInMainUi: (region) => regionStateOf(current(), region).showCreditsInMainUi !== false,
+		/**
 		* One minimal request per named model, through the region's own credential.
 		*
 		* Resolved here rather than in the route so the browser half never touches a

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "3.5.0",
+  "version": "4.0.0",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",

package/screenshots.json

@@ -1,4 +1,5 @@
 [
   "docs/assets/dsh-connect-workbuddy-usage-card.png",
-  "docs/assets/dsh-connect-workbuddy-account-pool.png"
+  "docs/assets/dsh-connect-workbuddy-account-pool.png",
+  "docs/assets/dsh-connect-workbuddy-composer-credits.png"
 ]