dsh-connect-workbuddy 4.10.1 → 4.11.0

package/CHANGELOG.md

@@ -20,6 +20,38 @@
   - **变异验证**：把修复回退后这两条断言分别报 **15 ≠ 3** 与 **9 ≠ 3**；三个用例在修复后全绿。写入后再读的用例在前修复/后修复两种状态下都绿——它守的是「共享窗口不得变成 TTL」，是回归护栏而非修复证据。
   - 文件里的凭据夹具用**真实的加密字段形状** `{$wbEncrypted: 1, envelope: "<base64>"}`；写成嵌套对象会被 `isEncryptedFieldWrapper()` 判为「未加密」，让整条用例静默走错分支（写测试时踩到过，已在夹具注释里记下）。
 
+## 4.11.0 (2026-10-20)
+
+> 版本号是 **minor**：有行为变更（对实测拒绝 `off` 的那 9 个模型，卡片上的「可关闭思考」变为不可勾选）。发往上游的请求体、路由 id、模型 id、凭据、计费与换号规则一律未变。
+
+### Fixes
+
+- **issue #83：给「实测拒绝 off」的模型勾上「可关闭思考」后，该模型的每一次 `/compact` 必定 400 / 11133**
+  - **报告链路**：用户在卡片上给 `deepseek-v4.1-flash` 之类**实测拒绝 `off`** 的模型勾了「可关闭思考」→ `withEffectiveOff()` 用保存的勾选覆盖 `canDisableThinking` → `workBuddyThinkingLevelMap()` 把 `off` 映成 `"off"` → pi-ai 的 `openai-completions` 在**调用方没传 `reasoningEffort`** 时用 `model.thinkingLevelMap?.off` 兜底 → 压缩摘要请求（`summarizeWithLlm`）恰好**不传**档位 → 每次 `/compact` 都带 `reasoning_effort:"off"` → 两个网关都回 400 / 11133，界面只说 `Compaction could not produce a useful summary`。
+  - **多写出来的那一条**：`REFUSES_OFF_MODEL_IDS` 一直被当作「种子」而不是「墙」，3.5.0 的说明写着「用户勾选即生效」。但它与同一条 changelog 里写下的取舍原则相反：**提供一个必定失败的档位，代价是该模型每一次请求；误藏一个本来可用的档位，代价只是一个选项**。而且这次失败的不只是「某个请求」——pi-ai 会把这个档位当成**所有未指定档位请求的默认值**。
+  - **三道防线（独立失效点，各自有测试）**：
+    1. **层级映射墙**：`withEffectiveOff()` 对名单内 id 恒置 `canDisableThinking: false`（`offRefused()` 与 `offDefaultFor()` 同口径），`workBuddyThinkingLevelMap()` 再查一次名单，所以 `off` 根本不会被提供，也不依赖调用方先盖章。
+    2. **请求体兜底**：`prepareChatBody()` 新增 `dropRefusedReasoning()`——名单内模型的 `reasoning_effort: "off"` 在发往上游前被摘掉。这一层守的是**目录建好之后才变**的情形：账号池换号会把 body 指向另一个账号的模型，`primary-model` 还是个由网关解析的别名。
+    3. **显式默认档位**：`dsh-llm-pi-ai` 按 `options.reasoningEffort ?? profile.reasoning` 解析档位，此前 `profile.reasoning` 是 `undefined`，等于把默认值交给 pi-ai 的层级映射——也就是交给那个 `off`。现在 profile 显式声明 `reasoning: 'high'`（`WORKBUDDY_DEFAULT_EFFORT`），所有注册键一致。
+  - **只摘 `off`**：其他档位在 issue #34 的实测里全部 200；body 里**本来就没有**档位时不补任何值——插件不替模型决定该怎么思考。
+  - **列表外模型不受影响**：名单按**精确 id** 匹配，`grok-4.7` 这类未记录的模型仍然由用户勾选与自身声明决定，修复不会顺手拿走一个本来能用的档位。
+  - **错误信息可诊断**：`parseUpstreamErrorDetail()` 现在读 `extError.param` / `extError.value`；当被拒参数与推理档位有关时，回复直接点名「上游拒绝了推理档位「off」（reasoning_effort）」并给出「取消可关闭思考勾选」的处置建议，而不是只说「请求被上游拒绝」。`param` 为空时（issue #78 的那类 body）**不猜**，原有文案原样保留。
+  - **观测记录**：`reportRefusal` 回调把「某模型确实被拒了 off」记进一个有界环形缓冲（20 条，进程内、不落盘）。这是压缩路径唯一能把事实送到界面上的通路——它只把失败当布尔值，正文被丢掉。
+
+### Features
+
+- **卡片上如实标注拒绝 `off` 的行**：名单内模型（以及进程内实测被拒的模型）的「可关闭思考」显示为**勾选但禁用**，旁边多一枚 `拒绝 off` 标记，tooltip 说明「实测两个网关都回 400 / code 11133，勾选后所有未指定档位的请求（尤其压缩摘要）都会失败」。**不禁用、不隐藏**这个勾选框：旧版本可能已经把勾存下来了，藏起来等于把用户保存的状态和失败原因一起藏掉。判定值 `offRefused` / `refusesOff` 由宿主给出，卡片不自行推断。
+
+### Tests
+
+- **`tests/issue83-off-refusal.spec.ts`：钉请求体，而不是钉函数返回值**
+  - 用**真实 pi-ai `openai-completions`** 经**真实 adapter** 构建请求，注入 `fetch` 捕获 body，再断言 `reasoning_effort` 不在其中——「盖了章」不等于「没发出去」，只有 body 能证明。模型描述符取自 adapter 自己的目录（声明 `canDisableThinking: true`，与上游对这 9 个 id 的声明一致），所以手写描述符绕过的 profile 级修复在这里藏不住。
+  - 另外三条守 `prepareChatBody`：名单内摘除、名单外保留、其他档位一格不动、原本没有档位就不补。
+- **`tests/issue83-profile-default.spec.ts`**：profile 的默认档位是 `'high'` 而不是 `undefined`/`'off'`，且**每一个注册键**都一致（issue #75 的身份键也算）。
+- **`tests/off-thinking.spec.ts` / `off-thinking-runtime.spec.ts` / `off-thinking-card.spec.tsx` 改了三条断言**：此前它们断言「用户勾选优先于名单」，而那正是 issue #83 的成因。现在改为断言墙生效、名单外仍然尊重勾选、以及卡片对宿主标记的行渲染成「勾选但禁用 + 有标记」。
+- **`tests/upstream-error-copy.spec.ts` 加了 4 条**：11133 且 `param` 指向档位时点名档位与处置；`param` 为空时**不**归因到档位；拒绝被上报（含被请求命名的 `modelId`，不是账号别名）；非参数类失败不上报。
+- **变异验证**：单独回退「层级映射墙」→ 1 条红；单独回退「adapter 名单判断」→ 2 条红；单独回退「显式默认档位」→ profile 那 2 条红。撤回其中任一层都有测试当场报错。全量 1536 passed / 2 skipped，`pnpm run typecheck` 与 `pnpm run build` 均干净。
+
 ## 4.10.0 (2026-10-19)
 
 > 版本号是 **minor**：4.9.5 / 4.9.6 两个 patch 从未单独发布到 npm（npm 上仍是 4.9.4），本次一次性带上它们，并新增福利活动的完整链路。**发往上游的请求体、路由 id、模型 id、凭据、计费与换号规则一律未变。**

package/README.en.md

@@ -24,7 +24,7 @@ A [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness) bund
 - **Dual parallel providers (CN + international)** — the CN side registers as the `workbuddy` provider (`GLM-5.3`, `DeepSeek-V4-Pro`, `Kimi-K3`, `MiniMax-M3`, `Hy3`, etc.), the international side as `workbuddy-global` (`GPT-5.6`, `Gemini-3.5-Flash`, `GLM-5.3`, `Kimi-K3`, etc.). **A region's models appear in the DSH model picker when that region has an account**: with accounts on both sides, both rosters are selectable at once, and different sessions can each pick a side without interfering. **A region with no local sign-in lists no models** — it cannot serve a single request, so listing them would offer nothing but failures. Sign in once for that region and its models come back on "detect accounts again" or after a restart; the provider itself stays registered either way, because its settings card is how you sign in (re-detection lives in the pool block). Model names carry the upstream credit multiplier (e.g. `GLM-5.3 · x0.79`), matching WorkBuddy's own model menu.
 - **Tabbed settings card** — the card's top carries a "Domestic / Global" tab bar; each tab holds its own account pool and model management. Account, directory, selection, and unsaved drafts are fully isolated per tab — switching accounts or refreshing models on one tab never touches the other side's runtime catalog or sessions.
 - **Switch either provider off on its own** — each tab carries an on/off checkbox (both checked by default). Unchecking one **withdraws that provider from DSH's model picker entirely** (it is not merely a hidden tab): its adapter route and its "Settings → Models" directory entry are both pulled, and startup no longer sends pointless requests for it. Account, credits, directory, and selection are all kept, and re-checking restores everything. The typical use is "I have no use for the international side" — switch it off and keep the picker clean. Note: a session that had already selected a model from the switched-off provider will report `NO_ADAPTER` on its next call; the card states this plainly on the switched-off tab instead of failing silently.
-- **Model management** — refresh the full catalog from upstream and enable or disable each model individually; refresh is a draft operation that only takes effect on save. Upstream also reports credit multiplier, context/output limits, and reasoning efforts; **image input is decided by a vendor-verified table**: a refresh pre-checks only models the vendor's own documentation calls natively multimodal, leaves documented text-only models unchecked, and treats anything without a vendor source as unverified and unchecked rather than guessing. Upstream's `supportsImages` is a *platform* declaration, not the model's capability, so it does not drive that decision at all. You can still tick any box by hand, and your selection is kept locally. **Every model row also carries a “Can disable” (`off`) checkbox**: it decides whether that model gets the “turn thinking off entirely” level. The default comes from a reviewed built-in table (the 9 models that claim the capability but answer HTTP 400 for it start unticked), and you can change it per model — **untick** for a newly refusing upstream model, **tick** for one the table wrongly hides or you have verified works; your ticks are saved on first save and recomputed no further.
+- **Model management** — refresh the full catalog from upstream and enable or disable each model individually; refresh is a draft operation that only takes effect on save. Upstream also reports credit multiplier, context/output limits, and reasoning efforts; **image input is decided by a vendor-verified table**: a refresh pre-checks only models the vendor's own documentation calls natively multimodal, leaves documented text-only models unchecked, and treats anything without a vendor source as unverified and unchecked rather than guessing. Upstream's `supportsImages` is a *platform* declaration, not the model's capability, so it does not drive that decision at all. You can still tick any box by hand, and your selection is kept locally. **Every model row also carries a “Can disable” (`off`) checkbox**: it decides whether that model gets the “turn thinking off entirely” level. The default comes from a reviewed built-in table (the 9 models that claim the capability but answer HTTP 400 for it start unticked), and you can change it per model — **untick** for a model you do not need the level on. **The 9 tabled models cannot be ticked at all** (their row is marked "refuses off" with an explanatory tooltip): the level is not merely an extra option — pi-ai uses it as the DEFAULT for every request that names no tier, and a compaction summary is exactly such a request, so one tick made every `/compact` for that model fail with HTTP 400 / code 11133 (issue #83). Models outside the table are still decided entirely by your selection and their own declaration; your ticks are saved on first save and recomputed no further.
 - **Model availability testing, including cooldown recovery times** — working out when a limited model frees up used to mean guessing through repeated failures. Now every model row has a **Test** button that gives you a direct answer for whether the model works right now and, if not, when it comes back. **It sends a real-volume request (about 25k input tokens)**, rather than "ping it and see if it answers" — because the upstream throttles on request **SIZE** (measured: about 20k tokens pass, about 30k are refused), so a small request looks fine while every request in a long conversation may be refused. That is exactly where "the test passes but I am limited" came from. **Where the recovery time comes from**: the upstream's 429 carries **no** `Retry-After` header (and no `X-RateLimit-*`), but it writes the reset time into the response **body** — `{"code":6004,"msg":"…将在 2026-09-30 02:30:30 UTC+8 重置…"}`. The plugin parses that time and converts it using the UTC offset the message states, so the result does not depend on your machine's timezone; the card then shows “✗ Rate limited · usable again after 2026/9/30 02:30:30”. When none of the sources states a time, the plugin **never invents a countdown** and says plainly that no time was given. A rate limit deliberately does **not** borrow the monthly refresh time, which would tell you to wait weeks for a limit that clears in seconds. Probes run in the Host, so **the credential never reaches the page**, and results are not written to settings — your saved selection is untouched.
 
   **Two things to know.** ① **It really does spend credits** — one measured probe reported `credit` 0.02 (a refused one 429s and costs almost nothing). So testing is **manual and per-model only**: there is deliberately no “Test selected” batch button, because sweeping the whole list from one click is an uncontrolled spend — and the Host enforces the same rule, **accepting a single model only** and refusing multi-model requests. ② The upstream advertises a 1M context yet throttles far below it, and the plugin advertises each model's **native** window to DSH (no longer clamped to 200K as of 3.5.0), so DSH compacts very late — hitting the throttle in a long session follows directly from that. To make DSH compact sooner, set a “DSH context budget” cap on the model's row (200K / 500K / the model's native window).

package/README.md

@@ -31,7 +31,7 @@
 - **双供应商并行接入（国内版 + 国际版）** —— 国内版注册为 `workbuddy` provider（`GLM-5.3`、`DeepSeek-V4-Pro`、`Kimi-K3`、`MiniMax-M3`、`Hy3` 等），国际版注册为 `workbuddy-global` provider（`GPT-5.6`、`Gemini-3.5-Flash`、`GLM-5.3`、`Kimi-K3` 等）。**有账号的区域其模型会出现在 DSH 模型选择器里**：两边都有账号时两组同时可选，不同会话可以各选一边，互不干扰。**本机没有账号的区域不列出任何模型**（该区域一个请求也发不出去，列出来只会点到就失败）；只要在该区域登录一次，「重新检测账号」或重启后模型就会自动出现——provider 本身始终注册着，因为它的设置卡片正是登录的入口（重新检测在账号池区块里）。模型名内嵌上游积分倍率（如 `GLM-5.3 · x0.79`），与 WorkBuddy 自身模型菜单一致。
 - **插件卡片 tab 切换** —— 设置卡片顶部为「国内版 / 国际版」两个 tab，各含独立的账号池与模型管理；每个 tab 的账号、目录、勾选与未保存草稿完全隔离——在一个 tab 里切账号或刷新模型，不会触碰另一边的运行时目录与会话。
 - **可单独关闭任一版本供应商** —— 每个 tab 右侧有一个勾选框（默认都勾选）。**取消勾选即把该供应商从 DSH 模型选择器里彻底撤掉**（不是只藏起 tab）：它的路由与「设置 → 模型」页的目录条目一并摘除，启动时也不再为它发无用请求。账号、积分、目录与勾选**全部保留**，重新勾选即完整恢复。典型用法是「我根本用不到国际版」——关掉它，让选择器干净。注意：若某会话此前选中的正是被关闭供应商的模型，该会话再调用会报 `NO_ADAPTER`，卡片会在关闭态的 tab 上明确提示这一点，不会静默失败。
-- **模型管理** —— 从上游刷新完整模型目录，逐项勾选启用或禁用；刷新是草稿操作，点保存才生效。上游同时给出积分倍率、上下文/输出上限与推理档位；**图片输入按厂商核验表判定**：刷新时只有厂商文档明确写为原生多模态的模型才自动勾选，文档写明纯文本的不勾，**没有厂商资料的一律按「未核实」不猜**（上游的 `supportsImages` 是平台侧声明，不等于模型能看图，不参与判定）。用户仍可随时手动勾选，勾选状态保存在本地。**每个模型行还有「可关闭思考」（`off`）勾选框**：决定要不要为该模型提供「完全关闭思考」这一档位。默认由内置复核名单给出（上游声称可关闭、实测却对它返回 HTTP 400 的 9 个模型默认不勾），你可以按模型改勾/取消——**取消**用于上游新出现的拒绝模型，**勾上**用于名单误伤、或你已确认可用的模型；首次保存即写入你的勾选，之后不再重算。
+- **模型管理** —— 从上游刷新完整模型目录，逐项勾选启用或禁用；刷新是草稿操作，点保存才生效。上游同时给出积分倍率、上下文/输出上限与推理档位；**图片输入按厂商核验表判定**：刷新时只有厂商文档明确写为原生多模态的模型才自动勾选，文档写明纯文本的不勾，**没有厂商资料的一律按「未核实」不猜**（上游的 `supportsImages` 是平台侧声明，不等于模型能看图，不参与判定）。用户仍可随时手动勾选，勾选状态保存在本地。**每个模型行还有「可关闭思考」（`off`）勾选框**：决定要不要为该模型提供「完全关闭思考」这一档位。默认由内置复核名单给出（上游声称可关闭、实测却对它返回 HTTP 400 的 9 个模型默认不勾），你可以按模型改勾/取消——**取消**用于当前不需要该档位的模型；**名单内那 9 个模型不可勾选**（行上标「拒绝 off」，悬停有说明）：该档位被勾上后不只是多一个选项，pi-ai 会把它当作**所有未指定档位请求的默认值**，压缩摘要请求正属于这一类，勾一次等于让该模型的每一次 `/compact` 都 400 / 11133（issue #83）。名单外的模型仍完全由你的勾选与自身声明决定；首次保存即写入你的勾选，之后不再重算。
 - **模型可用性测试（含冷却恢复时间）** —— 限量模型的冷却时间过去只能靠反复试错去猜。现在每个模型行有一个「测试」按钮，直接告诉你它此刻能否使用、不能用时何时恢复。**它发的是一条真实体积的请求（约 25k 输入 token）**，而不是「发个 ping 看通不通」——因为上游的限流**按请求体积触发**（实测约 20k 能过、约 30k 被拒），小请求看着正常、长对话里却可能每次都被拒，那正是「测试通过、实际被限」的来源。**恢复时间的来源**：上游的 429 **不带** `Retry-After` 响应头（也没有 `X-RateLimit-*`），但它把重置时间写在**响应体**里——`{"code":6004,"msg":"…将在 2026-09-30 02:30:30 UTC+8 重置…"}`。插件从响应体解析该时间（并按其声明的 UTC 偏移换算，不受你本机时区影响），因此卡片能直接显示「✗ 被限流 · 2026/9/30 02:30:30 之后可再用」。三处来源都没说时，插件**不编造倒计时**，如实显示「上游未给出何时恢复」。限流**不会**去借月周期包的刷新时间（那会让人为几秒的限流去等几周）。探测在后台发起，**凭据不会传到页面**；结果不写入设置，也不改变你已保存的勾选。
 
   **两点需要知道**：① **它真的花钱**——实测一次报 `credit` 0.02（被限流时直接 429，几乎不花）。因此**只能按单个模型手工点**，没有「测试已勾选」这类批量按钮：一次覆盖整个列表就是一次不可控支出（服务端也据此**只接受单个模型**，多模型请求会被拒）。② 上游虽宣称 1M 上下文，但节流线远低于此；插件按模型的**原生窗口**向 DSH 宣称（3.5.0 起不再默认压到 200K），所以 DSH 很晚才压缩对话——长会话撞限流是这条机制的直接结果。想让 DSH 更早压缩，就在模型行上手动设一个「DSH 上下文预算」上限（可选 200K / 500K / 模型原生窗口）。

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, K as WORKBUDDY_APP_EXECUTABLE_ENV, O as legacyWorkbuddyOwnAuthPath, Q as findWorkbuddyAppExecutableWithSource, S as defaultDesktopAuthCandidates, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, ot as hostPeersInfo, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-Cq4_pJ_l.js";
+import { $ as WORKBUDDY_APP_EXECUTABLE_ENV, C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, a as readHostHeartbeat, at as findWorkbuddyAppExecutableWithSource, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, pt as hostPeersInfo, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-BrIEnor4.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -3901,6 +3901,8 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-model-image input{margin:0;accent-color:var(--dsw-alias-brand-primary,#5686fe)}
 .dsm-workbuddy-model-off{display:inline-flex;align-items:center;gap:5px;flex:none;cursor:pointer;color:var(--dsw-alias-label-secondary,#c6c9d0);font-size:11px;line-height:16px}
 .dsm-workbuddy-model-off input{margin:0;accent-color:var(--dsw-alias-brand-primary,#5686fe)}
+.dsm-workbuddy-model-off-blocked{cursor:not-allowed;opacity:.75}
+.dsm-workbuddy-model-off-flag{margin-left:2px;padding:0 4px;border-radius:4px;background:var(--dsw-alias-label-caution-background,#4a3a1f);color:var(--dsw-alias-label-caution,#e8b34b);font-size:10px;line-height:14px;white-space:nowrap}
 .dsm-workbuddy-model-copy{display:flex;align-items:baseline;gap:8px;min-width:0}
 .dsm-workbuddy-model-name{display:inline-flex;align-items:baseline;gap:7px;color:var(--dsw-alias-label-primary,#e6e6e6);font-size:13px;font-weight:500;line-height:19px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
 .dsm-workbuddy-model-name-rate{color:var(--dsw-alias-label-tertiary,#999);font-size:11px;font-weight:400;line-height:16px;flex:none}
@@ -5390,6 +5392,7 @@ window.__ModuleLoader__.load({
 			* "reset" control: once an answer matches the rule, the two are
 			* indistinguishable in effect, and the tooltip already names the override.
 			*/
+			const offBlocked = (model) => model.reasoning?.offRefused === true || model.reasoning?.refusesOff === true;
 			const toggleOff = (modelId) => {
 				editDraft((current) => {
 					const next = new Set(current.offIds);
@@ -5971,16 +5974,23 @@ window.__ModuleLoader__.load({
 																	}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("row.modelImage") })]
 																}),
 																/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-																	className: "dsm-workbuddy-model-off",
-																	title: t("row.modelOffHint"),
-																	children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-																		type: "checkbox",
-																		checked: activeOffIds.has(model.id),
-																		disabled: !canWrite || saving,
-																		onChange: () => {
-																			toggleOff(model.id);
-																		}
-																	}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("row.modelOff") })]
+																	className: `dsm-workbuddy-model-off${offBlocked(model) ? " dsm-workbuddy-model-off-blocked" : ""}`,
+																	title: offBlocked(model) ? t("row.modelOffRefusedHint") : t("row.modelOffHint"),
+																	children: [
+																		/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+																			type: "checkbox",
+																			checked: activeOffIds.has(model.id),
+																			disabled: !canWrite || saving || offBlocked(model),
+																			onChange: () => {
+																				toggleOff(model.id);
+																			}
+																		}),
+																		/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("row.modelOff") }),
+																		offBlocked(model) ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+																			className: "dsm-workbuddy-model-off-flag",
+																			children: t("row.modelOffRefused")
+																		}) : null
+																	]
 																}),
 																/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("fieldset", {
 																	className: "dsm-workbuddy-context-budget",
@@ -7190,6 +7200,8 @@ window.__ModuleLoader__.load({
 			"row.modelImageUnverified": "Image input unverified: no vendor source confirms this model reads images, so a refresh leaves it unchecked rather than guessing. Tick it yourself if you have verified it works.",
 			"row.modelOff": "Can disable",
 			"row.modelOffHint": "Offer the “off” level for this model",
+			"row.modelOffRefused": "refuses off",
+			"row.modelOffRefusedHint": "Measured to reject the “off” level with HTTP 400 (code 11133) on both gateways. With this ticked, every request that carries no reasoning tier — compaction summaries above all — would fail, so it cannot be enabled here.",
 			"row.modelReasoning": "Reasoning: {efforts}",
 			"row.modelUnknown": "Unknown",
 			"row.modelCapabilityPending": "Only capabilities advertised by WorkBuddy are shown.",
@@ -7512,6 +7524,8 @@ window.__ModuleLoader__.load({
 			"row.modelImageUnverified": "图片输入未核实：没有厂商资料确认该模型能读图，刷新时按「不猜」处理，不会自动勾选。如果你验证过确实可用，可以手动勾上。",
 			"row.modelOff": "可关闭思考",
 			"row.modelOffHint": "为这个模型提供「关闭思考」档位",
+			"row.modelOffRefused": "拒绝 off",
+			"row.modelOffRefusedHint": "实测在两个网关上都拒绝「关闭思考」档位（HTTP 400 / code 11133）。勾选后，所有未指定推理档位的请求（尤其是压缩摘要）都会失败，因此这里不能启用。",
 			"row.modelReasoning": "推理强度：{efforts}",
 			"row.modelUnknown": "未知",
 			"row.modelCapabilityPending": "仅展示 WorkBuddy 接口明确公布的模型能力。",

package/lib/{host-heartbeat-Cq4_pJ_l.js → host-heartbeat-BrIEnor4.js}

@@ -962,6 +962,140 @@ function clearAtRestKeyCache() {
 	cachedAppExecutable = void 0;
 }
 //#endregion
+//#region src/off-thinking.ts
+/**
+* Ids observed to REFUSE `reasoning_effort: "off"` with HTTP 400 despite
+* declaring `canDisableThinking: true` (issue #34).
+*
+* Keyed by exact model id and deliberately NOT by region: `deepseek-v4.1-flash`
+* refuses on BOTH gateways, and the split tracks the model family rather than
+* the gateway. The cost is asymmetric — offering a level that always fails
+* costs the user every request for that model, while hiding one that would have
+* worked costs a single option — so the table errs towards hiding, and
+* {@link withEffectiveOff} enforces it as a HARD wall rather than a seed
+* (issue #83: a tick used to reopen the failing level, and with no
+* `reasoningEffort` passed the level became the default for compaction too).
+* See {@link offRefused} for why the checkbox must not win.
+*
+* `deepseek-v4-pro` was measured on the CN gateway only; it is listed because
+* its sibling does refuse on both, and the same asymmetry argues for hiding.
+*/
+const REFUSES_OFF_MODEL_IDS = /* @__PURE__ */ new Set([
+	"deepseek-v4.1-flash",
+	"deepseek-v4.1-flash-sg",
+	"deepseek-v4-pro",
+	"primary-model",
+	"gpt-6-astra",
+	"gpt-5.6-sol",
+	"gpt-5.6-terra",
+	"gpt-5.6-luna",
+	"gemini-3.5-flash"
+]);
+/**
+* Whether `off` should be offered for a model when the user has expressed no
+* opinion: the upstream's declaration, minus the ids known to refuse it.
+*
+* Only an explicit `canDisableThinking: true` enables the level; absence is
+* "unknown" and stays unoffered, matching how the rest of the plugin treats an
+* undeclared capability.
+*/
+function offDefaultFor(info) {
+	return info.reasoning?.canDisableThinking === true && !REFUSES_OFF_MODEL_IDS.has(info.id);
+}
+/**
+* The model ids the `off` level should be offered for by default (issue #34).
+*
+* The user's checkbox is a plain set: ticked = offered, unticked = withdrawn.
+* This is the seed — what the set is filled with the first time it is read —
+* so a profile that has never saved shows the correct default immediately,
+* without requiring a save.
+*
+* Only an explicit `canDisableThinking: true` enables the level; absence is
+* "unknown" and stays unoffered, matching how the rest of the plugin treats an
+* undeclared capability.
+*/
+function defaultOffModelIds(models) {
+	return models.filter(offDefaultFor).map((model) => model.id);
+}
+/** How many observations are kept, newest first. Bounded so a refusal storm cannot grow memory. */
+const REFUSAL_RING = 20;
+/**
+* The refusals this process has observed, newest first.
+*
+* Process-scoped rather than persisted: it is EVIDENCE ("what did the upstream
+* actually say"), and a stale record from another install would promote a model
+* into the refusal table on the strength of a request the current build never
+* sent. The card reads it; nothing sends from it.
+*/
+const observedRefusals = [];
+/** Record one refusal, keeping the newest {@link REFUSAL_RING}. */
+function recordRefusal(report) {
+	observedRefusals.unshift(report);
+	if (observedRefusals.length > REFUSAL_RING) observedRefusals.length = REFUSAL_RING;
+}
+/** The most recent refusal naming `modelId`, or `undefined` when none did. */
+function lastRefusalFor(modelId) {
+	return observedRefusals.find((report) => report.modelId === modelId);
+}
+/**
+* Whether a model may offer `off` AT ALL, no matter what the user asked for.
+*
+* This is the hard wall in front of {@link REFUSES_OFF_MODEL_IDS} (issue #83).
+* The table above used to be a seed only: the checkbox wrote the selection
+* straight into `canDisableThinking`, so ticking a model known to refuse `off`
+* reopened exactly the failure the table exists to prevent — and not once per
+* "off" turn either. pi-ai's `openai-completions` reads
+* `model.thinkingLevelMap?.off` whenever the caller passes NO
+* `reasoningEffort` at all, and a compaction summary is such a caller: it never
+* carries an effort. So one tick made every `/compact` for that model answer
+* HTTP 400 / code 11133, with the surface showing only "could not produce a
+* useful summary".
+*
+* The asymmetry that writes the table also writes this test: a level that
+* always fails costs the user EVERY request for that model, while a level that
+* was hidden needlessly costs one option. So the refusal list wins over the
+* checkbox, not the other way round.
+*
+* The table is keyed by EXACT id, so anything that pins a different id at
+* request time (aliases such as `primary-model`) is out of its reach; those are
+* covered where the request is actually built — see
+* {@link normalizePreparedReasoning}.
+*/
+function offRefused(modelId) {
+	return REFUSES_OFF_MODEL_IDS.has(modelId);
+}
+/**
+* Stamp the user's saved `off` selection onto a model list, for the RUNTIME
+* catalog.
+*
+* The runtime model descriptor is built by `workBuddyThinkingLevelMap`, which
+* reads only the model's own declaration — so the corrected answer has to be
+* written onto the model before it reaches the adapter. Doing it here keeps the
+* adapter a pure "declared capability in, level map out" function and keeps the
+* table next to the rule it feeds.
+*
+* This OVERWRITES the declared field rather than adding a sibling, which is
+* safe because the declared value has exactly one consumer (that same level
+* map) and is never persisted where the card can see it: `toWebModel` drops
+* `canDisableThinking`, and the card's `lastCatalog` is written from the raw
+* upstream discovery, never from this stamped list. A model that declares no
+* reasoning is returned untouched — there is no level to correct.
+*
+* A refusal-table id is stamped `false` REGARDLESS of the selection
+* ({@link offRefused}): the tick stays in the saved set — the card shows it and
+* the hint explains it — but it can no longer be turned into a request that
+* fails.
+*/
+function withEffectiveOff(models, selection) {
+	return models.map((model) => model.reasoning === void 0 ? model : {
+		...model,
+		reasoning: {
+			...model.reasoning,
+			canDisableThinking: selection.has(model.id) && !offRefused(model.id)
+		}
+	});
+}
+//#endregion
 //#region src/upstream.ts
 /**
 * WorkBuddy (CodeBuddy / copilot.tencent.com) upstream client: chat streaming,
@@ -1218,6 +1352,14 @@ function parseUpstreamErrorDetail(body) {
 	if (typeof raw.requestId === "string") detail.requestId = raw.requestId;
 	if (displayMsg !== void 0) detail.displayMsg = displayMsg;
 	if (tips !== void 0) detail.tips = tips;
+	const ext = raw.extError;
+	if (typeof ext === "object" && ext !== null && !Array.isArray(ext)) {
+		const extRaw = ext;
+		const param = extRaw["param"];
+		if (typeof param === "string" && param !== "") detail.rejectedParam = param;
+		const value = extRaw["value"];
+		if (typeof value === "string" && value !== "") detail.rejectedTier = value;
+	}
 	return detail;
 }
 /**
@@ -1477,8 +1619,36 @@ function prepareChatBody(source) {
 	}
 	ensureSystemHead(obj);
 	normalizeToolChoice(obj);
+	dropRefusedReasoning(obj);
 	return JSON.stringify(obj);
 }
+/**
+* Remove `reasoning_effort: "off"` when it would only ever fail (issue #83).
+*
+* The refusal table is keyed by exact model id, but the model a request
+* actually names can change AFTER the catalog was built: account-pool failover
+* re-points the body at another account's model, and `primary-model` is an
+* alias whose concrete id the gateway resolves. A tick on such a row therefore
+* reaches this plugin's prepared body as a bare `"off"` — exactly the value the
+* table says the upstream answers with HTTP 400 / code 11133.
+*
+* Stripped HERE because this is the last thing the plugin controls before the
+* upstream counts the body, and because the test is {@link offRefused} — the
+* same single source of truth the catalog stamping uses, so the two cannot
+* drift apart.
+*
+* Only the literal `"off"` is touched. Every other effort value returned 200 on
+* every model measured for issue #34, and a body naming no effort is left
+* alone: deleting a field the caller never sent would be inventing an opinion
+* about how the model should think.
+*/
+function dropRefusedReasoning(obj) {
+	const effort = obj["reasoning_effort"];
+	if (typeof effort !== "string" || effort.trim().toLowerCase() !== "off") return;
+	const model = obj["model"];
+	if (typeof model !== "string" || !offRefused(model)) return;
+	delete obj["reasoning_effort"];
+}
 /** Rewrite OpenAI `tool_choice` spellings into the upstream's string form. */
 function normalizeToolChoice(obj) {
 	const suppress = () => {
@@ -4167,7 +4337,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.10.1";
+const WORKBUDDY_CONNECT_VERSION = "4.11.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -4325,4 +4495,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { isEncryptedFieldWrapper as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, deriveAtRestKey as J, WORKBUDDY_APP_EXECUTABLE_ENV as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, findWorkbuddyAppExecutableWithSource as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, fetchAtRestKeyPayload as X, deriveAtRestKeyId as Y, findWorkbuddyAppExecutable as Z, WORKBUDDY_AUTH_FILENAME as _, readHostHeartbeat as a, workbuddyAppExecutableCandidates as at, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, withFileLock as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, isWorkbuddyBundle as et, WorkBuddyCatalog as f, ENCRYPTED_CREDENTIAL_CODE as g, fallbackModelsFor as h, processStartTimeMs as i, readAtRestKey as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, writeFileAtomic as lt, deriveCatalog as m, clearHostHeartbeat as n, macosNestedAppBundles as nt, workbuddyHostHeartbeatPath as o, hostPeersInfo as ot, applyContextBudgets as p, clearAtRestKeyCache as q, isHeartbeatProcessAlive as r, openEncryptedField as rt, writeHostHeartbeat as s, resolveDshHome as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, macosBundleExecutable as tt, FALLBACK_WORKBUDDY_MODELS as u, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, knownRegionOf as z };
+export { WORKBUDDY_APP_EXECUTABLE_ENV as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, lastRefusalFor as J, REFUSES_OFF_MODEL_IDS as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, withEffectiveOff as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, offRefused as X, offDefaultFor as Y, recordRefusal as Z, WORKBUDDY_AUTH_FILENAME as _, readHostHeartbeat as a, findWorkbuddyAppExecutableWithSource as at, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, macosBundleExecutable as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, readAtRestKey as dt, clearAtRestKeyCache as et, WorkBuddyCatalog as f, workbuddyAppExecutableCandidates as ft, ENCRYPTED_CREDENTIAL_CODE as g, writeFileAtomic as gt, fallbackModelsFor as h, withFileLock as ht, processStartTimeMs as i, findWorkbuddyAppExecutable as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, macosNestedAppBundles as lt, deriveCatalog as m, resolveDshHome as mt, clearHostHeartbeat as n, deriveAtRestKeyId as nt, workbuddyHostHeartbeatPath as o, isEncryptedFieldWrapper as ot, applyContextBudgets as p, hostPeersInfo as pt, defaultOffModelIds as q, isHeartbeatProcessAlive as r, fetchAtRestKeyPayload as rt, writeHostHeartbeat as s, isWorkbuddyBundle as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, deriveAtRestKey as tt, FALLBACK_WORKBUDDY_MODELS as u, openEncryptedField as ut, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, knownRegionOf as z };

package/lib/index.d.ts

@@ -615,6 +615,15 @@ interface WorkBuddyReasoning {
   supportedEfforts?: readonly string[];
   defaultEffort?: string;
   canDisableThinking?: boolean;
+  /**
+   * An OBSERVED refusal of the `off` tier for this model (issue #83).
+   *
+   * Never declared by the upstream: it is stamped from this plugin's own
+   * refusal record, and it outlives the catalog that witnessed it so the card
+   * can keep showing the badge after a refresh. `undefined` means "never
+   * observed", which is not the same claim as "accepts".
+   */
+  refusesOff?: boolean;
 }
 /** One CLI-usable model, carrying everything the plugin card displays. */
 interface WorkBuddyUpstreamModel {
@@ -825,6 +834,17 @@ interface UpstreamErrorDetail {
    * clause losing its own meaning.
    */
   tips?: string;
+  /**
+   * The request parameter the upstream named as rejected, from
+   * `extError.param` (issue #83).
+   *
+   * Kept because the generic sentences cannot say WHICH parameter was at fault:
+   * a 11133 caused by `reasoning_effort` reads exactly like a model that is
+   * unavailable, and the fix (untick one checkbox) lives nowhere in the reply.
+   */
+  rejectedParam?: string;
+  /** The offending value of {@link rejectedParam}, when the body carries one. */
+  rejectedTier?: string;
 }
 /**
  * Region for a login domain; an empty domain means CN (matching upstream tooling).
@@ -1145,6 +1165,95 @@ declare class WorkBuddyCatalog {
   set(models: readonly WorkBuddyModelInfo[]): void;
 }
 //#endregion
+//#region src/off-thinking.d.ts
+/**
+ * Ids observed to REFUSE `reasoning_effort: "off"` with HTTP 400 despite
+ * declaring `canDisableThinking: true` (issue #34).
+ *
+ * Keyed by exact model id and deliberately NOT by region: `deepseek-v4.1-flash`
+ * refuses on BOTH gateways, and the split tracks the model family rather than
+ * the gateway. The cost is asymmetric — offering a level that always fails
+ * costs the user every request for that model, while hiding one that would have
+ * worked costs a single option — so the table errs towards hiding, and
+ * {@link withEffectiveOff} enforces it as a HARD wall rather than a seed
+ * (issue #83: a tick used to reopen the failing level, and with no
+ * `reasoningEffort` passed the level became the default for compaction too).
+ * See {@link offRefused} for why the checkbox must not win.
+ *
+ * `deepseek-v4-pro` was measured on the CN gateway only; it is listed because
+ * its sibling does refuse on both, and the same asymmetry argues for hiding.
+ */
+declare const REFUSES_OFF_MODEL_IDS: ReadonlySet<string>;
+/** The two fields this rule needs; both are declared by the model itself. */
+interface WorkBuddyOffCapability {
+  id: string;
+  reasoning?: WorkBuddyReasoning;
+}
+/**
+ * Whether `off` should be offered for a model when the user has expressed no
+ * opinion: the upstream's declaration, minus the ids known to refuse it.
+ *
+ * Only an explicit `canDisableThinking: true` enables the level; absence is
+ * "unknown" and stays unoffered, matching how the rest of the plugin treats an
+ * undeclared capability.
+ */
+declare function offDefaultFor(info: WorkBuddyOffCapability): boolean;
+/**
+ * The model ids the `off` level should be offered for by default (issue #34).
+ *
+ * The user's checkbox is a plain set: ticked = offered, unticked = withdrawn.
+ * This is the seed — what the set is filled with the first time it is read —
+ * so a profile that has never saved shows the correct default immediately,
+ * without requiring a save.
+ *
+ * Only an explicit `canDisableThinking: true` enables the level; absence is
+ * "unknown" and stays unoffered, matching how the rest of the plugin treats an
+ * undeclared capability.
+ */
+declare function defaultOffModelIds(models: readonly WorkBuddyOffCapability[]): string[];
+/** One OBSERVED refusal of a reasoning tier, as the upstream reported it. */
+interface WorkBuddyRefusalReport {
+  /** The rejected parameter (`extError.param`), e.g. `reasoning_effort`. */
+  param: string;
+  /** The rejected value (`extError.value`), when the body carried one. */
+  tier?: string;
+  /** Upstream business code, e.g. 11133. */
+  code?: number;
+  /** Epoch milliseconds of the observation. */
+  at: number;
+  /**
+   * The model the refused REQUEST named — not the account's route alias.
+   *
+   * Taken from the body (`modelIdOfBody`), so it is the concrete id the card
+   * lists; the badge would otherwise never attach, since failover re-points the
+   * body at whatever the serving account routes.
+   */
+  modelId?: string;
+}
+/**
+ * Stamp the user's saved `off` selection onto a model list, for the RUNTIME
+ * catalog.
+ *
+ * The runtime model descriptor is built by `workBuddyThinkingLevelMap`, which
+ * reads only the model's own declaration — so the corrected answer has to be
+ * written onto the model before it reaches the adapter. Doing it here keeps the
+ * adapter a pure "declared capability in, level map out" function and keeps the
+ * table next to the rule it feeds.
+ *
+ * This OVERWRITES the declared field rather than adding a sibling, which is
+ * safe because the declared value has exactly one consumer (that same level
+ * map) and is never persisted where the card can see it: `toWebModel` drops
+ * `canDisableThinking`, and the card's `lastCatalog` is written from the raw
+ * upstream discovery, never from this stamped list. A model that declares no
+ * reasoning is returned untouched — there is no level to correct.
+ *
+ * A refusal-table id is stamped `false` REGARDLESS of the selection
+ * ({@link offRefused}): the tick stays in the saved set — the card shows it and
+ * the hint explains it — but it can no longer be turned into a request that
+ * fails.
+ */
+declare function withEffectiveOff<T extends WorkBuddyOffCapability>(models: readonly T[], selection: ReadonlySet<string>): T[];
+//#endregion
 //#region src/shim.d.ts
 /** Minimal logger surface the plugin context already provides. */
 interface ShimLogger {
@@ -1219,6 +1328,18 @@ interface WorkBuddyShimOptions {
    * it produces the same reply as before this option existed.
    */
   failoverShortfall?: WorkBuddyFailoverShortfall;
+  /**
+   * Told about every refused request the plugin can attribute to a MODEL, right
+   * before the failure is rendered (issue #83).
+   *
+   * Separate from the rendered reply because the caller that hit the refusal is
+   * not always the user: compaction reads the failure as a boolean and shows
+   * "could not produce a useful summary", so the one fact that explains it (this
+   * model refuses `off`) never reaches any surface. This callback is how the
+   * card learns it happened. Must not throw: a bookkeeping failure must never
+   * replace the upstream's own failure.
+   */
+  reportRefusal?: (refusal: WorkBuddyRefusalReport) => void;
   /**
    * Called before the FIRST attempt of every chat request, so the plugin can
    * point the store at the account the pool's ranking says should serve.
@@ -1365,7 +1486,6 @@ interface ContextRescue {
 }
 //#endregion
 //#region src/adapter.d.ts
-/** Provider route this bundle owns for the domestic (CN) gateway. */
 declare const WORKBUDDY_PROVIDER = "workbuddy";
 /** Provider route this bundle owns for the international gateway. */
 declare const WORKBUDDY_GLOBAL_PROVIDER = "workbuddy-global";
@@ -1450,10 +1570,15 @@ declare function workBuddyDisplayName(info: WorkBuddyModelInfo): string;
  *
  * The value read here is already the EFFECTIVE one: the runtime catalog is
  * stamped by `withEffectiveOff()` before it reaches the adapter, so this is the
- * user's `off` selection when they made one (and the upstream declaration,
- * minus `REFUSES_OFF_MODEL_IDS`, when they never did). Absence is "unknown" and
- * stays unoffered, matching how the rest of the plugin treats undeclared
- * capability.
+ * user's `off` selection when they made one — except for the ids on
+ * `REFUSES_OFF_MODEL_IDS`, which the stamp forces to `false` no matter what the
+ * user asked for (issue #83: this level, once ticked, also became the IMPLICIT
+ * default for every request that carries no effort at all, which is how
+ * compaction went to 100% failure). The table is re-checked here as well so the
+ * wall does not depend on every caller remembering to stamp first.
+ *
+ * Absence is "unknown" and stays unoffered, matching how the rest of the plugin
+ * treats undeclared capability.
  */
 declare function workBuddyThinkingLevelMap(info: WorkBuddyModelInfo): WorkBuddyThinkingLevelMap | undefined;
 /**
@@ -1520,68 +1645,6 @@ declare function imageDefaultFor(info: {
   supportsImages?: boolean;
 }): boolean;
 //#endregion
-//#region src/off-thinking.d.ts
-/**
- * Ids observed to REFUSE `reasoning_effort: "off"` with HTTP 400 despite
- * declaring `canDisableThinking: true` (issue #34).
- *
- * Keyed by exact model id and deliberately NOT by region: `deepseek-v4.1-flash`
- * refuses on BOTH gateways, and the split tracks the model family rather than
- * the gateway. The cost is asymmetric — offering a level that always fails
- * costs the user every request for that model, while hiding one that would have
- * worked costs a single option — so the table errs towards hiding. A user who
- * knows better can override any entry (see {@link effectiveOff}).
- *
- * `deepseek-v4-pro` was measured on the CN gateway only; it is listed because
- * its sibling does refuse on both, and the same asymmetry argues for hiding.
- */
-declare const REFUSES_OFF_MODEL_IDS: ReadonlySet<string>;
-/** The two fields this rule needs; both are declared by the model itself. */
-interface WorkBuddyOffCapability {
-  id: string;
-  reasoning?: WorkBuddyReasoning;
-}
-/**
- * Whether `off` should be offered for a model when the user has expressed no
- * opinion: the upstream's declaration, minus the ids known to refuse it.
- *
- * Only an explicit `canDisableThinking: true` enables the level; absence is
- * "unknown" and stays unoffered, matching how the rest of the plugin treats an
- * undeclared capability.
- */
-declare function offDefaultFor(info: WorkBuddyOffCapability): boolean;
-/**
- * The model ids the `off` level should be offered for by default (issue #34).
- *
- * The user's checkbox is a plain set: ticked = offered, unticked = withdrawn.
- * This is the seed — what the set is filled with the first time it is read —
- * so a profile that has never saved shows the correct default immediately,
- * without requiring a save.
- *
- * Only an explicit `canDisableThinking: true` enables the level; absence is
- * "unknown" and stays unoffered, matching how the rest of the plugin treats an
- * undeclared capability.
- */
-declare function defaultOffModelIds(models: readonly WorkBuddyOffCapability[]): string[];
-/**
- * Stamp the user's saved `off` selection onto a model list, for the RUNTIME
- * catalog.
- *
- * The runtime model descriptor is built by `workBuddyThinkingLevelMap`, which
- * reads only the model's own declaration — so the corrected answer has to be
- * written onto the model before it reaches the adapter. Doing it here keeps the
- * adapter a pure "declared capability in, level map out" function and keeps the
- * table next to the rule it feeds.
- *
- * This OVERWRITES the declared field rather than adding a sibling, which is
- * safe because the declared value has exactly one consumer (that same level
- * map) and is never persisted where the card can see it: `toWebModel` drops
- * `canDisableThinking`, and the card's `lastCatalog` is written from the raw
- * upstream discovery, never from this stamped list. A model that declares no
- * reasoning is returned untouched — there is no level to correct.
- */
-declare function withEffectiveOff<T extends WorkBuddyOffCapability>(models: readonly T[], selection: ReadonlySet<string>): T[];
-//#endregion
 //#region src/at-rest.d.ts
 /**
  * WorkBuddy desktop "at-rest" credential decryption.
@@ -2514,6 +2577,28 @@ interface WorkBuddyWebModel {
      * level). Same shape as `supportsImages` above.
      */
     canDisableThinking?: boolean;
+    /**
+     * This model is on the reviewed `off`-refusal table (`src/off-thinking.ts`),
+     * so ticking its checkbox cannot take effect (issue #83).
+     *
+     * The verdict, derived on the host — not a stored preference, and not
+     * something the card has to recompute. It exists so the card can explain a
+     * tick that did not stick instead of leaving the user staring at a checkbox
+     * that looks saved. Like every other `reasoning` field it rides along in
+     * the saved `lastCatalog` entry, where it is ignored on load: the verdict is
+     * always recomputed from `id`.
+     */
+    offRefused?: boolean;
+    /**
+     * A REQUEST really carried `reasoning_effort: "off"` for this model and the
+     * upstream answered HTTP 400 / code 11133 (issue #83).
+     *
+     * Row-level, DERIVED on write from the last refusal's `modelIdOfBody` —
+     * never typed in by hand. Merged rather than replaced when the saved
+     * catalog is refreshed, so the badge survives the full-table overwrite a
+     * model refresh performs.
+     */
+    refusesOff?: boolean;
   };
   description?: string;
 }

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as isEncryptedFieldWrapper, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as deriveAtRestKey, K as WORKBUDDY_APP_EXECUTABLE_ENV, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as fetchAtRestKeyPayload, Y as deriveAtRestKeyId, Z as findWorkbuddyAppExecutable, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as workbuddyAppExecutableCandidates, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as withFileLock, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as isWorkbuddyBundle, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as readAtRestKey, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as writeFileAtomic, m as deriveCatalog, n as clearHostHeartbeat, nt as macosNestedAppBundles, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as clearAtRestKeyCache, r as isHeartbeatProcessAlive, rt as openEncryptedField, s as writeHostHeartbeat, st as resolveDshHome, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosBundleExecutable, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-Cq4_pJ_l.js";
+import { $ as WORKBUDDY_APP_EXECUTABLE_ENV, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as lastRefusalFor, K as REFUSES_OFF_MODEL_IDS, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as withEffectiveOff, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as offRefused, Y as offDefaultFor, Z as recordRefusal, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as macosBundleExecutable, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as readAtRestKey, et as clearAtRestKeyCache, f as WorkBuddyCatalog, ft as workbuddyAppExecutableCandidates, g as ENCRYPTED_CREDENTIAL_CODE, gt as writeFileAtomic, h as fallbackModelsFor, ht as withFileLock, i as processStartTimeMs, it as findWorkbuddyAppExecutable, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as macosNestedAppBundles, m as deriveCatalog, mt as resolveDshHome, n as clearHostHeartbeat, nt as deriveAtRestKeyId, o as workbuddyHostHeartbeatPath, ot as isEncryptedFieldWrapper, p as applyContextBudgets, q as defaultOffModelIds, r as isHeartbeatProcessAlive, rt as fetchAtRestKeyPayload, s as writeHostHeartbeat, st as isWorkbuddyBundle, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as deriveAtRestKey, u as FALLBACK_WORKBUDDY_MODELS, ut as openEncryptedField, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-BrIEnor4.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -138,6 +138,13 @@ function claimableBenefits(benefits, nowMs) {
 * @module dsh-connect-workbuddy/adapter
 */
 /** Provider route this bundle owns for the domestic (CN) gateway. */
+/**
+* The tier a request gets when it names none — compaction summaries, above all
+* (issue #83). See the `reasoning` field in `profileFor` for why an absent
+* default is not "no opinion" but "whatever pi-ai's level map says", which is
+* how `off` became the silent default for `/compact`.
+*/
+const WORKBUDDY_DEFAULT_EFFORT = "high";
 const WORKBUDDY_PROVIDER = "workbuddy";
 /** Provider route this bundle owns for the international gateway. */
 const WORKBUDDY_GLOBAL_PROVIDER = "workbuddy-global";
@@ -307,16 +314,21 @@ function workBuddyDisplayName(info) {
 *
 * The value read here is already the EFFECTIVE one: the runtime catalog is
 * stamped by `withEffectiveOff()` before it reaches the adapter, so this is the
-* user's `off` selection when they made one (and the upstream declaration,
-* minus `REFUSES_OFF_MODEL_IDS`, when they never did). Absence is "unknown" and
-* stays unoffered, matching how the rest of the plugin treats undeclared
-* capability.
+* user's `off` selection when they made one — except for the ids on
+* `REFUSES_OFF_MODEL_IDS`, which the stamp forces to `false` no matter what the
+* user asked for (issue #83: this level, once ticked, also became the IMPLICIT
+* default for every request that carries no effort at all, which is how
+* compaction went to 100% failure). The table is re-checked here as well so the
+* wall does not depend on every caller remembering to stamp first.
+*
+* Absence is "unknown" and stays unoffered, matching how the rest of the plugin
+* treats undeclared capability.
 */
 function workBuddyThinkingLevelMap(info) {
 	const supported = info.reasoning?.supportedEfforts?.filter((effort) => THINKING_LEVELS.includes(effort));
 	if (supported === void 0 || supported.length === 0) return void 0;
 	const map = Object.fromEntries(THINKING_LEVELS.map((level) => [level, supported.includes(level) ? level : null]));
-	if (info.reasoning?.canDisableThinking === true) map.off = "off";
+	if (info.reasoning?.canDisableThinking === true && !offRefused(info.id)) map.off = "off";
 	else map.off = null;
 	return map;
 }
@@ -673,6 +685,20 @@ function createWorkBuddyAdapter(options) {
 		retryPolicy: resolveRetryPolicy(void 0, "dsh-connect-workbuddy retryPolicy"),
 		configuredMaxTokens: /* @__PURE__ */ new Map(),
 		modelErrors: /* @__PURE__ */ new Map(),
+		/**
+		* The default tier, pinned to the SAME value pi-ai's level map would fill in
+		* for an absent one (issue #83).
+		*
+		* `dsh-llm-pi-ai` resolves every request's tier as
+		* `options.reasoningEffort ?? profile.reasoning`, so an absent default here
+		* means "whatever pi-ai fills in" — and for a model whose map carried
+		* `off → "off"`, that was `"off"`, i.e. every compaction summary asked a
+		* model like `deepseek-v4.1-flash` to disable thinking, which it answers with
+		* 400 / 11133. Nothing structurally prevents a level or a catalog snapshot
+		* from disagreeing with the adapter's own map, so the default must never be
+		* that. This is the same value the host asks for explicitly on normal turns.
+		*/
+		reasoning: WORKBUDDY_DEFAULT_EFFORT,
 		...REQUEST_IMAGE_BUDGETS,
 		piProvider: key === providerId ? provider : {
 			...provider,
@@ -2721,6 +2747,46 @@ function describeAccount(credential) {
 * turn in this product reads Chinese, and an English clause inside Chinese prose
 * was the previous build's most visible rough edge.
 */
+/**
+* Name the rejected PARAMETER when the upstream refused a reasoning tier, or
+* `undefined` when it is any other failure (issue #83).
+*
+* The compaction path used to surface "Compaction could not produce a useful
+* summary" and nothing else, so a 11133 caused by `reasoning_effort: "off"` was
+* indistinguishable from a model that was simply unavailable — the reporter had
+* to read the raw body to learn that one parameter was at fault. When the body
+* names the offending parameter (`extError.param`) the reply says so; this is a
+* refusal the plugin can explain without guessing, because it is the union of
+* two facts the upstream stated in the response.
+*/
+/**
+* Turn a failure into a refusal report for {@link WorkBuddyShimOptions.reportRefusal},
+* or `undefined` when it is not a tier refusal worth recording.
+*
+* Only refusals the upstream attributed to a PARAMETER are reported: a plain
+* 500 or a quota error says nothing about `off`, and recording it would pin a
+* "refuses off" badge on a model that never refused anything.
+*/
+function refusedTierReport(failure, modelId) {
+	if (failure.ok || failure.kind !== "client") return void 0;
+	const param = failure.detail?.rejectedParam;
+	if (param === void 0 || !param.includes("reasoning")) return void 0;
+	const tier = failure.detail?.rejectedTier;
+	return {
+		param,
+		...tier === void 0 ? {} : { tier },
+		...failure.detail?.upstreamCode === void 0 ? {} : { code: failure.detail.upstreamCode },
+		...modelId === void 0 ? {} : { modelId },
+		at: Date.now()
+	};
+}
+function reasoningTierRefusal(failure) {
+	if (failure.ok || failure.kind !== "client") return void 0;
+	const param = failure.detail?.rejectedParam;
+	if (param === void 0 || !param.includes("reasoning")) return void 0;
+	const tier = failure.detail?.rejectedTier;
+	return tier === void 0 ? `上游拒绝了推理档位参数（${param}）` : `上游拒绝了推理档位「${tier}」（${param}）`;
+}
 function failoverReasonText(failure) {
 	if (failure.ok) return "不可用";
 	switch (failure.kind) {
@@ -2948,6 +3014,7 @@ function createWorkBuddyShim(options) {
 	const logger = options.logger;
 	const failoverAccount = options.failoverAccount;
 	const failoverShortfall = options.failoverShortfall;
+	const reportRefusedTier = options.reportRefusal ?? (() => {});
 	const prepareAccount = options.prepareAccount;
 	const onAccountFailure = options.onAccountFailure;
 	const onRequestBody = options.onRequestBody;
@@ -3165,6 +3232,8 @@ function createWorkBuddyShim(options) {
 			const note = attempts > 1 ? `（已尝试 ${attempts} 个账号）` : "";
 			const shortfall = failoverShortfall !== void 0 && failoverAccount !== void 0 && isFailoverWorthy(result.kind) ? await failoverShortfall().catch(() => void 0) : void 0;
 			const why = shortfall === void 0 ? "" : `：${shortfall}`;
+			const refusedReport = refusedTierReport(result, requestModelId);
+			if (refusedReport !== void 0) reportRefusedTier(refusedReport);
 			if (result.kind === "policy_reject") {
 				const detail = result.detail;
 				const lead = detail?.displayMsg ?? clippedUpstreamText(result.message, 200);
@@ -3190,8 +3259,9 @@ function createWorkBuddyShim(options) {
 			if (detail?.upstreamCode !== void 0) meta.push(`code ${detail.upstreamCode}`);
 			if (detail?.requestId !== void 0) meta.push(`requestId ${detail.requestId}`);
 			const stamp = meta.length === 0 ? "" : `（${meta.join("，")}）`;
-			const receipt = detail?.tips ?? detail?.displayMsg ?? clippedUpstreamText(result.message, 400);
-			const advice = result.kind === "client" ? "该请求被上游按参数拒绝：与网络、账号、额度都无关，换账号也不会改变结果，请按上面的提示调整后重试" : shortfall === void 0 ? "" : "建议换一个模型继续，或稍后等待该账号的额度恢复";
+			const refusedTier = reasoningTierRefusal(result);
+			const receipt = refusedTier ?? detail?.tips ?? detail?.displayMsg ?? clippedUpstreamText(result.message, 400);
+			const advice = refusedTier !== void 0 ? "这不是账号或网络问题：该模型实测拒绝「off」推理档位，请到模型卡片里取消该行的「可关闭思考」勾选后重试" : result.kind === "client" ? "该请求被上游按参数拒绝：与网络、账号、额度都无关，换账号也不会改变结果，请按上面的提示调整后重试" : shortfall === void 0 ? "" : "建议换一个模型继续，或稍后等待该账号的额度恢复";
 			const body = advice === "" ? receipt : `${receipt.replace(/[。.]$/u, "")}。${advice}`;
 			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy 上游失败：${failoverReasonText(result)}（http ${result.status}）${note}${why}${stamp}。${body}`, hostErrorCode(result.kind));
 			return;
@@ -5185,7 +5255,9 @@ function toWebModel(model, budgets) {
 		...model.reasoning === void 0 ? {} : { reasoning: {
 			...model.reasoning.supportedEfforts === void 0 ? {} : { supportedEfforts: [...model.reasoning.supportedEfforts] },
 			...model.reasoning.defaultEffort === void 0 ? {} : { defaultEffort: model.reasoning.defaultEffort },
-			...model.reasoning.canDisableThinking === void 0 ? {} : { canDisableThinking: model.reasoning.canDisableThinking }
+			...model.reasoning.canDisableThinking === void 0 ? {} : { canDisableThinking: model.reasoning.canDisableThinking },
+			...offRefused(model.id) ? { offRefused: true } : {},
+			...model.reasoning.refusesOff === true ? { refusesOff: true } : {}
 		} }
 	};
 }
@@ -5352,7 +5424,13 @@ async function workBuddyWebStatus(deps, region, options = {}) {
 		showCreditsInMainUi,
 		creditPosition,
 		accounts: accounts.map(toWebAccount),
-		models: deps.displayModels(region).map((model) => toWebModel(model, deps.contextBudgets(region))),
+		models: deps.displayModels(region).map((model) => toWebModel(model, deps.contextBudgets(region))).map((model) => model.reasoning === void 0 || lastRefusalFor(model.id) === void 0 ? model : {
+			...model,
+			reasoning: {
+				...model.reasoning,
+				refusesOff: true
+			}
+		}),
 		enabledModelIds: [...deps.enabledModelIds(region)],
 		imageModelIds: [...deps.imageModelIds(region)],
 		offModelIds: [...deps.offModelIds(region)]
@@ -6011,85 +6089,6 @@ function imageDefaultFor(info) {
 	return NATIVE_MODALITY_BY_MODEL_ID[info.id] === "multimodal";
 }
 //#endregion
-//#region src/off-thinking.ts
-/**
-* Ids observed to REFUSE `reasoning_effort: "off"` with HTTP 400 despite
-* declaring `canDisableThinking: true` (issue #34).
-*
-* Keyed by exact model id and deliberately NOT by region: `deepseek-v4.1-flash`
-* refuses on BOTH gateways, and the split tracks the model family rather than
-* the gateway. The cost is asymmetric — offering a level that always fails
-* costs the user every request for that model, while hiding one that would have
-* worked costs a single option — so the table errs towards hiding. A user who
-* knows better can override any entry (see {@link effectiveOff}).
-*
-* `deepseek-v4-pro` was measured on the CN gateway only; it is listed because
-* its sibling does refuse on both, and the same asymmetry argues for hiding.
-*/
-const REFUSES_OFF_MODEL_IDS = /* @__PURE__ */ new Set([
-	"deepseek-v4.1-flash",
-	"deepseek-v4.1-flash-sg",
-	"deepseek-v4-pro",
-	"primary-model",
-	"gpt-6-astra",
-	"gpt-5.6-sol",
-	"gpt-5.6-terra",
-	"gpt-5.6-luna",
-	"gemini-3.5-flash"
-]);
-/**
-* Whether `off` should be offered for a model when the user has expressed no
-* opinion: the upstream's declaration, minus the ids known to refuse it.
-*
-* Only an explicit `canDisableThinking: true` enables the level; absence is
-* "unknown" and stays unoffered, matching how the rest of the plugin treats an
-* undeclared capability.
-*/
-function offDefaultFor(info) {
-	return info.reasoning?.canDisableThinking === true && !REFUSES_OFF_MODEL_IDS.has(info.id);
-}
-/**
-* The model ids the `off` level should be offered for by default (issue #34).
-*
-* The user's checkbox is a plain set: ticked = offered, unticked = withdrawn.
-* This is the seed — what the set is filled with the first time it is read —
-* so a profile that has never saved shows the correct default immediately,
-* without requiring a save.
-*
-* Only an explicit `canDisableThinking: true` enables the level; absence is
-* "unknown" and stays unoffered, matching how the rest of the plugin treats an
-* undeclared capability.
-*/
-function defaultOffModelIds(models) {
-	return models.filter(offDefaultFor).map((model) => model.id);
-}
-/**
-* Stamp the user's saved `off` selection onto a model list, for the RUNTIME
-* catalog.
-*
-* The runtime model descriptor is built by `workBuddyThinkingLevelMap`, which
-* reads only the model's own declaration — so the corrected answer has to be
-* written onto the model before it reaches the adapter. Doing it here keeps the
-* adapter a pure "declared capability in, level map out" function and keeps the
-* table next to the rule it feeds.
-*
-* This OVERWRITES the declared field rather than adding a sibling, which is
-* safe because the declared value has exactly one consumer (that same level
-* map) and is never persisted where the card can see it: `toWebModel` drops
-* `canDisableThinking`, and the card's `lastCatalog` is written from the raw
-* upstream discovery, never from this stamped list. A model that declares no
-* reasoning is returned untouched — there is no level to correct.
-*/
-function withEffectiveOff(models, selection) {
-	return models.map((model) => model.reasoning === void 0 ? model : {
-		...model,
-		reasoning: {
-			...model.reasoning,
-			canDisableThinking: selection.has(model.id)
-		}
-	});
-}
-//#endregion
 //#region src/index.ts
 /** Stable Cordis plugin name. */
 const name = "dsh-connect-workbuddy";
@@ -6428,6 +6427,9 @@ function apply(ctx, config) {
 				onUpstreamUsage: (usage) => {
 					pendingUsage?.(usage);
 				},
+				reportRefusal: (report) => {
+					recordRefusal(report);
+				},
 				prepareAccount: () => applyPoolSelection(region),
 				failoverAccount: (triedAccountIds) => failoverAccountFor(region, triedAccountIds),
 				failoverShortfall: () => explainPoolShortfall(region),
@@ -6449,7 +6451,13 @@ function apply(ctx, config) {
 		const state = regionStateOf(value, region);
 		const roster = state.lastCatalog?.length ? state.lastCatalog : liveModels.length ? liveModels : fallbackModelsFor(region);
 		const declared = withImageSelection(deriveCatalog(roster, new Set(state.enabledModelIds ?? []), state.contextBudgets ?? {}), new Set(state.imageModelIds ?? []));
-		return withEffectiveOff(declared, new Set(savedOffModelIds(state, declared)));
+		return withEffectiveOff(declared, new Set(savedOffModelIds(state, declared))).map((model) => model.reasoning === void 0 || lastRefusalFor(model.id) === void 0 ? model : {
+			...model,
+			reasoning: {
+				...model.reasoning,
+				refusesOff: true
+			}
+		});
 	};
 	/**
 	* The region's `off` selection as a Set (issue #34).

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型（国内版与国际版）接入 DeepSeek Harness：每次刷新按上游目录自动读取每个模型的积分倍率，支持逐模型图片输入开关、多账号切换与账号池自动换号，并提供每日签到、卡片与输入框里的胶囊积分读数等只读积分概览。",
-  "version": "4.10.1",
+  "version": "4.11.0",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",