dsh-connect-workbuddy 4.13.1 → 4.14.0

package/lib/{host-heartbeat-CwdR6teZ.js → host-heartbeat-B1I95fKS.js}

@@ -1096,6 +1096,198 @@ function withEffectiveOff(models, selection) {
 	});
 }
 //#endregion
+//#region src/promo.ts
+/** A record-ish value, or undefined for anything else. */
+function record(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+/** A trimmed non-empty string, or undefined. */
+function text(value) {
+	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+/**
+* `'HH:mm'` → minutes since midnight, or undefined for anything else.
+*
+* `24:00` is accepted and means exactly 1440 — the END of a day. The upstream
+* writes "all day" as `0:00`–`23:59` today, which leaves a one-minute hole
+* between 23:59 and midnight where a standing campaign reads as not running.
+* Accepting `24:00` lets such a window be expressed (and lets a future upstream
+* fix it) without that hole; as a START it is rejected, because a day that
+* begins at 24:00 is the next day and that is a different statement.
+*
+* Any other malformed value is left to the caller to drop — a wrong window
+* would hide a live promotion, and guessing is not this parser's job.
+*/
+function minutesOfClock(value) {
+	const match = /^(\d{1,2}):(\d{2})$/.exec(value.trim());
+	if (match === null) return void 0;
+	const hours = Number(match[1]);
+	const minutes = Number(match[2]);
+	if (!Number.isInteger(hours) || !Number.isInteger(minutes)) return void 0;
+	if (minutes > 59) return void 0;
+	if (hours > 24) return void 0;
+	if (hours === 24) return minutes === 0 ? 1440 : void 0;
+	return hours * 60 + minutes;
+}
+/** An ISO-8601 instant → epoch milliseconds. Numbers are refused on purpose. */
+function parseInstant(value) {
+	const raw = text(value);
+	if (raw === void 0) return void 0;
+	const ms = Date.parse(raw);
+	return Number.isNaN(ms) ? void 0 : ms;
+}
+/** The upstream's `modelIds` → the model's ids, de-duplicated. */
+function parseModelIds(value) {
+	if (!Array.isArray(value)) return void 0;
+	const ids = [];
+	for (const entry of value) {
+		const id = text(entry);
+		if (id !== void 0 && !ids.includes(id)) ids.push(id);
+	}
+	return ids.length === 0 ? void 0 : ids;
+}
+/** The upstream's `badge` → this plugin's badge shape. */
+function parseBadge(value) {
+	const raw = record(value);
+	if (raw === void 0) return void 0;
+	const label = text(raw["label"]) ?? text(raw["labelEn"]) ?? text(raw["shortLabel"]) ?? text(raw["shortLabelEn"]);
+	if (label === void 0) return void 0;
+	const labelEn = text(raw["labelEn"]);
+	const shortLabel = text(raw["shortLabel"]);
+	const shortLabelEn = text(raw["shortLabelEn"]);
+	const color = text(raw["color"]);
+	const display = raw["display"] === "activeOnly" ? "activeOnly" : void 0;
+	return {
+		label,
+		...labelEn === void 0 ? {} : { labelEn },
+		...shortLabel === void 0 ? {} : { shortLabel },
+		...shortLabelEn === void 0 ? {} : { shortLabelEn },
+		...color === void 0 ? {} : { color },
+		...display === void 0 ? {} : { display }
+	};
+}
+/** The upstream's `hover` → this plugin's copy shape. */
+function parseHover(value) {
+	const raw = record(value);
+	if (raw === void 0) return void 0;
+	const textZh = text(raw["textZh"]);
+	const textEn = text(raw["textEn"]);
+	if (textZh === void 0 && textEn === void 0) return void 0;
+	return {
+		...textZh === void 0 ? {} : { textZh },
+		...textEn === void 0 ? {} : { textEn }
+	};
+}
+/** The upstream's `schedule.daily` → the windows this plugin can evaluate. */
+function parseDaily(value) {
+	if (!Array.isArray(value)) return void 0;
+	const windows = [];
+	for (const entry of value) {
+		const raw = record(entry);
+		if (raw === void 0) continue;
+		const start = text(raw["start"]);
+		const end = text(raw["end"]);
+		if (start === void 0 || end === void 0) continue;
+		if (minutesOfClock(start) === void 0 || minutesOfClock(end) === void 0) continue;
+		windows.push({
+			start,
+			end
+		});
+	}
+	return windows.length === 0 ? void 0 : windows;
+}
+/** The upstream's `schedule` → this plugin's schedule shape. */
+function parseSchedule(value) {
+	const raw = record(value);
+	if (raw === void 0) return void 0;
+	const timezone = text(raw["timezone"]);
+	const validFrom = parseInstant(raw["validFrom"]);
+	const validUntil = parseInstant(raw["validUntil"]);
+	const daily = parseDaily(raw["daily"]);
+	const dailyUnusable = daily === void 0 && Array.isArray(raw["daily"]) && raw["daily"].length > 0;
+	if (timezone === void 0 && validFrom === void 0 && validUntil === void 0 && daily === void 0 && !dailyUnusable) return void 0;
+	return {
+		...timezone === void 0 ? {} : { timezone },
+		...validFrom === void 0 ? {} : { validFrom },
+		...validUntil === void 0 ? {} : { validUntil },
+		...daily === void 0 ? {} : { daily },
+		...dailyUnusable ? { dailyUnusable: true } : {}
+	};
+}
+/** One upstream entry → this plugin's promo shape, or undefined if it is not one. */
+function parsePromo(value, source) {
+	const raw = record(value);
+	if (raw === void 0) return void 0;
+	if (raw["enabled"] === false) return void 0;
+	const modelIds = parseModelIds(raw["modelIds"]);
+	if (modelIds === void 0) return void 0;
+	const badge = parseBadge(raw["badge"]);
+	if (badge === void 0) return void 0;
+	const hover = parseHover(raw["hover"]);
+	const schedule = parseSchedule(raw["schedule"]);
+	const priority = typeof raw["priority"] === "number" && Number.isFinite(raw["priority"]) ? raw["priority"] : 0;
+	return {
+		id: text(raw["id"]) ?? `${source}:${modelIds.join(",")}`,
+		source,
+		modelIds,
+		badge,
+		...hover === void 0 ? {} : { hover },
+		...schedule === void 0 ? {} : { schedule },
+		priority
+	};
+}
+/**
+* Parse the upstream's promotion and tier lists.
+*
+* Both lists are read from the SAME document the roster comes from, so this
+* never costs a request. Entries that are not promotions — no `modelIds`, no
+* `badge`, or `enabled: false` — are dropped here rather than downstream, so
+* that everything downstream can assume a promo is drawable.
+*
+* The promotions come first, so that a TIE on `priority` is broken in the
+* promotions' favour: a price badge ("Free now") is more actionable to a user
+* than an access-tier badge ("Pro Only"), and the upstream numbers them
+* equally (both 200 on the observed feed).
+*/
+function parseWorkBuddyPromos(rawPromotions, rawTiers) {
+	const promos = [];
+	for (const entry of Array.isArray(rawPromotions) ? rawPromotions : []) {
+		const promo = parsePromo(entry, "promotion");
+		if (promo !== void 0) promos.push(promo);
+	}
+	for (const entry of Array.isArray(rawTiers) ? rawTiers : []) {
+		const tier = parsePromo(entry, "tier");
+		if (tier !== void 0) promos.push(tier);
+	}
+	return promos;
+}
+/**
+* Attach the promotions that name each model.
+*
+* The result is UNRESOLVED on purpose: every candidate that names the model
+* rides along, so the badge can be chosen at render time against the clock
+* (see {@link selectPromoBadge}). Resolving here would freeze the answer at
+* fetch time — the defect that makes a "night discount" badge keep claiming
+* the night after the night is over.
+*/
+function attachPromos(models, promos) {
+	if (promos.length === 0) return [...models];
+	const byModel = /* @__PURE__ */ new Map();
+	for (const promo of promos) for (const modelId of promo.modelIds) {
+		const list = byModel.get(modelId);
+		if (list === void 0) byModel.set(modelId, [promo]);
+		else list.push(promo);
+	}
+	return models.map((model) => {
+		const list = byModel.get(model.id);
+		if (list === void 0) return model;
+		return {
+			...model,
+			promos: [...list].sort((a, b) => b.priority - a.priority)
+		};
+	});
+}
+//#endregion
 //#region src/upstream.ts
 /**
 * WorkBuddy (CodeBuddy / copilot.tencent.com) upstream client: chat streaming,
@@ -1145,55 +1337,80 @@ const GLOBAL_BASE = "https://www.workbuddy.ai";
 * Legacy model-catalog path, kept only as the CN region's FALLBACK.
 *
 * This is the document the WorkBuddy *plugin* used to read, and it is NOT the
-* document the WorkBuddy *app* reads. The gateway answers it with the CLI
-* channel's roster, whose second slot is the paid `hy4-preview`
-* (`credits: 'x0.29 credits'`), while the app's own config lists the free
-* `hy4-preview-f` (`credits: 'x0.00 credits'`) in that slot under the SAME
-* display name "Hy4 preview". Reading this path is therefore what makes the
-* plugin's card disagree with the app about a model's price — both are
-* correctly displaying a real record, just different ones.
+* document the WorkBuddy *app* reads: the gateway answers it with the CLI
+* channel's roster, which carries neither the app's `auto` slot nor any
+* promotion feed. The free Hy4 tier that used to live here as a separate
+* `hy4-preview-f` record is gone as a record — measured 2026-10-21, both
+* channels list the paid `hy4-preview` (`x0.29`) — and the free tier is now
+* expressed as a promotion badge (`夜间免费`) in the app-channel document only.
+* So this path is strictly poorer than {@link GLOBAL_CONFIG_PATH}; it stays
+* only so that a gateway which stops serving the modern document degrades
+* instead of emptying the region.
 */
 const MODELS_CATALOG_PATH = "/v2/enterprises/personal/models";
 /**
-* Remote product-config path; the CN region's PRIMARY catalog source and the
-* global region's only one.
+* Remote product-config path — the document the WorkBuddy app itself reads for
+* its model list, its prices AND its promotion badges.
 *
 * It is field-compatible with {@link MODELS_CATALOG_PATH} for every key
-* {@link parseUpstreamModel} reads, so one parser still serves both. On CN this
-* path is what the app itself consumes, so the plugin's roster and the app's
-* agree — that parity is the whole point of preferring it.
-*
-* The CLI user agent deliberately stays {@link CLIENT_UA} here. `/v3/config`
-* serves a DIFFERENT roster per client channel: the desktop token yields a
-* roster without the free `hy4-preview-f`, and the CLI token yields one with
-* it. Measured 2026-10-04 — CN + `/v3/config`: CLI token = 17 models incl.
-* `hy4-preview-f`(x0.00); desktop token = 29 models, no `hy4-preview-f` and no
-* cheap free tier. That is why the global branch below pairs this path with
-* {@link DESKTOP_UA} and the CN branch must NOT.
+* {@link parseUpstreamModel} reads, so one parser still serves both, and it
+* additionally carries `modelPromotions` / `modelTiers` — the promotion feed
+* no other path publishes (see {@link withPromos}).
+*
+* Which document this path answers depends on the CHANNEL the request claims
+* to be (see {@link PRODUCT_UA}); it does not depend on the host: `www.workbuddy.cn`,
+* `copilot.tencent.com`, `wb.tencentbuddy.com` and `www.codebuddy.cn` answer
+* byte-identically under the same header.
 */
 const GLOBAL_CONFIG_PATH = "/v3/config";
+/**
+* The chat channel's user agent — the identity the plugin's adapter speaks as.
+*
+* Chat is a different contract from configuration: the conversation-identity
+* triple (conversation id, session id, device id) is bound to this channel, and
+* the upstream bills and rate-limits it as the CLI agent. The plugin chats as
+* the CLI agent on purpose, so this stays {@link CLIENT_UA} everywhere the
+* request is a CHAT.
+*/
 const CLIENT_UA = "CLI/2.63.2 CodeBuddy/2.63.2";
 /**
-* User agent of the WorkBuddy desktop app.
+* The product-config channel's user agent: the WorkBuddy APP's own product
+* identity, byte-for-byte the header the app sends.
+*
+* The app builds it in `buildVlmGatewayHeaders` (WorkBuddy 5.8.3) as
+*
+*     `User-Agent: WorkBuddy/<app> WorkBuddy/<app> CLI/<cli>`
+*
+* — the app version twice, the CLI version once — and sends it to
+* `/v3/config`; the app's own log reads
+* `fetch cloud product from url:https://www.workbuddy.cn/v3/config success`
+* with `{"user-agent":"WorkBuddy/5.8.3 WorkBuddy/5.8.3 CLI/2.161.0", …}`.
+*
+* It matters, because `/v3/config` answers a DIFFERENT product configuration
+* per client channel. Measured 2026-10-21, same token, same URL, only this
+* header differing (CN gateway):
+*
+*   | User-Agent                                    | `/v3/config` answer                    |
+*   | ---                                           | ---                                    |
+*   | `CLI/2.63.2 CodeBuddy/2.63.2` (CLI channel)   | 5 keys, 35 models, NO promotion feed    |
+*   | `WorkBuddy/5.8.3` (app channel, no CLI part)  | 18 keys, 37 models, no promotion feed   |
+*   | `WorkBuddy/5.8.3 WorkBuddy/5.8.3 CLI/2.161.0` | 22 keys, 62 models, 8 promos + 1 tier   |
 *
-* The config service serves a DIFFERENT product configuration per client
-* channel, selected by this product token — the version suffix is ignored
-* (`WorkBuddy/5.5.2`, `WorkBuddy/1.0.0` and a bare `WorkBuddy` answer
-* identically). On the INTERNATIONAL gateway the split decides which models
-* exist at all:
+* The CLI channel's answer is a strict SUBSET of the app channel's: it
+* publishes neither `modelPromotions` nor `modelTiers`. That is precisely why
+* the CN card showed no promotion badge while the WorkBuddy app showed one on
+* the very same account — the plugin was reading a document the upstream
+* publishes WITHOUT the feed, not a feed that does not exist.
 *
-*   - CLI channel (`CLI/… CodeBuddy/…`) → 35 models that OMIT
-*     `deepseek-v4.1-flash` and `gpt-6-astra`, even though both are perfectly
-*     chat-usable (verified: `deepseek-v4.1-flash` streams HTTP 200 and is
-*     billed `x0.00`);
-*   - desktop channel → the account's real 20-model chat roster including both.
+* The version suffixes are inert — `WorkBuddy/1.0.0 CLI/2.63.2
+* CodeBuddy/2.63.2` answers identically — so what selects the document is the
+* CHANNEL the header claims, not the version in it.
 *
-* The plugin emulates the CLI channel for CHAT but reads the desktop channel's
-* configuration to learn the account's actual model list. The CN gateway needs
-* no such switch: its desktop config carries no `cli` agent roster at all, so
-* CN keeps reading the shared `/v2/enterprises/personal/models` path.
+* Global answers the same document under either app-shaped header (17 keys,
+* 28 models, 5 promotions + 1 tier, identical roster), so both regions read
+* `/v3/config` as {@link PRODUCT_UA}.
 */
-const DESKTOP_UA = "WorkBuddy/5.5.2";
+const PRODUCT_UA = "WorkBuddy/5.8.3 WorkBuddy/5.8.3 CLI/2.161.0";
 const JSON_TIMEOUT_MS = 3e4;
 const ERROR_BODY_LIMIT = 4096;
 /**
@@ -1281,6 +1498,44 @@ const POLICY_REJECT_MARKERS = ["request illegal", "\"code\":11140"];
 */
 const MODEL_BUSY_CODE = "\"code\":14003";
 /**
+* Business code of the gateway's CHANNEL gate (`11128`, "Illegal API invocation
+* from an unapproved channel").
+*
+* The quoted-key form for the same reason as the markers above: a request id is
+* hexadecimal and can contain the digits `11128` by coincidence.
+*
+* A DIFFERENT gate from the one {@link conversationHeaders} works around, which
+* also answers `11128` (`conversation id missing`). The code is the same
+* because the gateway reuses it for every rule in that family; the BODY is what
+* tells them apart, so {@link isChannelRejectBody} requires both halves.
+*/
+const CHANNEL_REJECT_CODE = "\"code\":11128";
+/**
+* Wording that identifies the CHANNEL half of `11128` (the other halves being
+* `conversation id missing` and `first message is not system prompt`).
+*
+* Matched against the upstream's `msg`, NEVER against `displayTips`. That is not
+* a style choice: the tips are the SAME misleading sentence for every member of
+* the `11128` family — "这次调用没通过渠道校验，可能不是官方客户端发出的" — which is
+* why matching them would claim the conversation-id gate too and blame the
+* prompt's opening for a header problem this plugin already fixes.
+*
+* Lower-cased before the search. Two spellings are listed because the observed
+* bodies name the code and the phrase together
+* (`{"code":11128,"msg":"Illegal API invocation from an unapproved channel"}`),
+* and either half is enough to identify it.
+*/
+const CHANNEL_REJECT_MARKERS = ["unapproved channel", "illegal api invocation"];
+/**
+* The other gates that answer the SAME business code.
+*
+* Excluded explicitly so a body that also carries the channel wording can never
+* be read as the prompt rule: a confidently wrong diagnosis is worse here than
+* the generic `client` reply, because it sends the user to rewrite a system
+* prompt that is not at fault.
+*/
+const OTHER_CHANNEL_CODE_GATES = ["conversation id missing", "first message is not system prompt"];
+/**
 * Whether a failure body is the MODEL-scoped throttle rather than an account
 * limit.
 *
@@ -1300,6 +1555,72 @@ const MODEL_BUSY_CODE = "\"code\":14003";
 function isModelBusyBody(body) {
 	return body.includes(MODEL_BUSY_CODE);
 }
+/**
+* Whether a failure body is the gateway's CHANNEL gate rather than the other
+* `11128` ({@link conversationHeaders}' `conversation id missing`).
+*
+* Both halves are required. The code alone would claim the conversation-id gate
+* too, and its reply would then blame the prompt's opening for a request-header
+* problem the plugin already fixed — a confidently wrong diagnosis is worse
+* here than the generic `client` reply, because it sends the user to rewrite a
+* system prompt that is not at fault.
+*/
+function isChannelRejectBody(body) {
+	if (!body.includes(CHANNEL_REJECT_CODE)) return false;
+	const lower = body.toLowerCase();
+	if (OTHER_CHANNEL_CODE_GATES.some((marker) => lower.includes(marker))) return false;
+	return CHANNEL_REJECT_MARKERS.some((marker) => lower.includes(marker));
+}
+/**
+* The OPENINGS of the `system` messages in a prepared request body.
+*
+* This is the evidence the channel gate actually reacts to, and echoing it is
+* what turns "the upstream refused" into "the upstream refused because of this
+* line" — the reader can then fix the prompt or report the new opening, instead
+* of cycling accounts that cannot change a byte of it.
+*
+* Each entry is the first non-empty line, clipped: a fingerprint lives at the
+* START of the content, so the rest of a 10 KB system prompt is noise that
+* would bury the one sentence worth reading. At most three entries are kept —
+* the gate scans every `system` message, but a body with more than three of them
+* is already worth showing compactly.
+*
+* Never throws: a malformed body is the upstream's to reject, and losing the
+* failure measurement is not an acceptable price for reading an excerpt.
+*/
+function systemOpeningsOfBody(bodyJson) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyJson);
+	} catch {
+		return [];
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return [];
+	const messages = parsed["messages"];
+	if (!Array.isArray(messages)) return [];
+	const openings = [];
+	for (const value of messages) {
+		if (openings.length >= 3) break;
+		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+		const message = value;
+		const role = message["role"];
+		if (typeof role !== "string" || role.trim().toLowerCase() !== "system") continue;
+		const content = message["content"];
+		if (typeof content !== "string") continue;
+		const opening = firstLineOf(content).replace(/\s+/gu, " ").trim();
+		if (opening !== "") openings.push(clip(opening, SYSTEM_OPENING_LIMIT));
+	}
+	return openings;
+}
+/** Longest system-prompt opening echoed back to the user, in characters. */
+const SYSTEM_OPENING_LIMIT = 120;
+function firstLineOf(content) {
+	const newline = content.indexOf("\n");
+	return newline === -1 ? content : content.slice(0, newline);
+}
+function clip(text, limit) {
+	return text.length <= limit ? text : `${text.slice(0, limit - 1)}…`;
+}
 /** Classify an upstream failure from its HTTP status and body excerpt. */
 function classifyUpstreamError(status, body) {
 	if (status === 402) return "hard_credit";
@@ -1308,6 +1629,7 @@ function classifyUpstreamError(status, body) {
 	if (body.includes(CREDITS_EXHAUSTED_CODE)) return "hard_credit";
 	for (const marker of SESSION_DEAD_MARKERS) if (body.includes(marker)) return "session_dead";
 	for (const marker of POLICY_REJECT_MARKERS) if (body.includes(marker)) return "policy_reject";
+	if (isChannelRejectBody(body)) return "channel_reject";
 	if (isModelBusyBody(body)) return "model_busy";
 	if (status === 429) return "soft_rate";
 	if (status === 404) return "not_found";
@@ -2005,8 +2327,16 @@ function parseUpstreamModel(value) {
 * selector serves them. Without a usable `cli` roster the whole parsed catalog
 * is exposed rather than nothing: the roster is an upstream detail that may
 * change, and an empty answer would silently disarm the provider.
+*
+* `keepIds` is the user's own selection riding along with the refresh. The
+* upstream roster may drop a model the user is actually running — the app
+* channel's `cli` roster dropped `minimax-m2.7` on 2026-10-21 while the SAME
+* document still publishes it (`x0.26`) and the chat endpoint still answers for
+* it (measured HTTP 200). A roster read is therefore the upstream's roster PLUS
+* the kept ids this document still lists: a refresh may add or withdraw
+* upstream models, but it never silently withdraws a model the user is on.
 */
-function selectCliModels(rawModels, agents) {
+function selectCliModels(rawModels, agents, keepIds = []) {
 	const byId = /* @__PURE__ */ new Map();
 	for (const model of Array.isArray(rawModels) ? rawModels : []) {
 		const parsed = parseUpstreamModel(model);
@@ -2020,9 +2350,32 @@ function selectCliModels(rawModels, agents) {
 			break;
 		}
 	}
-	const models = (cliIds !== void 0 && cliIds.length > 0 ? cliIds : [...byId.keys()]).map((id) => byId.get(id)).filter((model) => model !== void 0);
+	const ids = cliIds !== void 0 && cliIds.length > 0 ? cliIds : [...byId.keys()];
+	const models = ids.map((id) => byId.get(id)).filter((model) => model !== void 0);
 	if (models.length === 0) throw new Error("workbuddy model catalog resolved to an empty list");
-	return models;
+	const kept = keepIds.filter((id) => !ids.includes(id)).map((id) => byId.get(id)).filter((model) => model !== void 0);
+	return [...models, ...kept];
+}
+/**
+* The roster plus the promotion badges the SAME document carries.
+*
+* `data.modelPromotions` and `data.modelTiers` sit beside `data.models` in
+* the upstream's `/v3/config` document, so the badges cost no extra request:
+* they are read out of the response the roster was read from. Which models
+* they name is resolved here; WHICH badge holds at a given moment is not
+* (see `src/promo.ts` — a badge is a function of the clock).
+*
+* BOTH regions publish the feed, and they publish it in the app channel's
+* document: measured 2026-10-21 on the same accounts the app reads, CN
+* `/v3/config` carries 8 promotions + 1 tier badge (Chinese labels such as
+* `夜间折扣` / `限时免费` / `订阅优先`, with `schedule.daily` night windows),
+* and the global gateway carries 5 promotions + 1 tier badge. The feed is
+* absent only from the CLI channel's answer, which the plugin never reads a
+* product configuration as (see {@link PRODUCT_UA}).
+*/
+function withPromos(models, data) {
+	const promos = parseWorkBuddyPromos(data["modelPromotions"], data["modelTiers"]);
+	return promos.length === 0 ? models : attachPromos(models, promos);
 }
 /**
 * Upstream HTTP client. One instance serves the whole plugin; requests take
@@ -2164,13 +2517,14 @@ var WorkBuddyUpstreamClient = class {
 	/**
 	* Read the model directory for the credential's region.
 	*
-	* Both regions prefer `/v3/config`, the document the WorkBuddy app itself
-	* consumes, so the plugin's roster and the app's agree. They differ in the
-	* user agent that requests it, and that difference is load-bearing: `/v3`
-	* serves a different roster per client channel. Global asks as the desktop
-	* channel (see {@link DESKTOP_UA}); CN asks as the CLI channel
-	* ({@link CLIENT_UA}), which is the only CN channel whose `/v3` answer
-	* contains the free `hy4-preview-f` (see {@link GLOBAL_CONFIG_PATH}).
+	* Both regions read `/v3/config`, the document the WorkBuddy app itself
+	* consumes, and both read it as the APP's product identity
+	* ({@link PRODUCT_UA}) — the header the app sends, not the CLI channel's.
+	* That is load-bearing, not cosmetic: the CLI channel's answer is a strict
+	* subset of the app channel's and publishes neither `modelPromotions` nor
+	* `modelTiers`, so reading `/v3/config` as the CLI channel is what left the
+	* CN card without a single promotion badge while the app showed one on the
+	* same account (see {@link PRODUCT_UA}).
 	*
 	* CN falls back to the legacy {@link MODELS_CATALOG_PATH} when `/v3` fails,
 	* returns a non-zero envelope, or resolves to no usable model, so a gateway
@@ -2181,8 +2535,14 @@ var WorkBuddyUpstreamClient = class {
 	*
 	* No user-side toggle is involved: the region comes from the credential's
 	* `domain`.
+	*
+	* `keepModelIds` is the user's own selection, passed through to
+	* {@link selectCliModels}: a model the upstream roster dropped but the SAME
+	* document still publishes stays in the roster, so reading the directory
+	* never withdraws a model the user is running (issue #32's failure mode,
+	* one step upstream of it).
 	*/
-	async fetchModels(credential, signal) {
+	async fetchModels(credential, signal, keepModelIds = []) {
 		const timeout = signal ?? AbortSignal.timeout(JSON_TIMEOUT_MS);
 		if (regionOf(credential.domain) === "global") {
 			const response = await fetch(`${globalBase(credential.domain)}${GLOBAL_CONFIG_PATH}`, {
@@ -2194,14 +2554,14 @@ var WorkBuddyUpstreamClient = class {
 					"X-Product": "SaaS",
 					"X-Requested-With": "XMLHttpRequest",
 					"Connection": "close",
-					"User-Agent": DESKTOP_UA
+					"User-Agent": PRODUCT_UA
 				},
 				signal: timeout
 			});
 			const envelope = await readEnvelope(response);
 			if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
 			const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
-			return selectCliModels(data["models"], data["agents"]);
+			return withPromos(selectCliModels(data["models"], data["agents"], keepModelIds), data);
 		}
 		const readCatalog = async (path) => {
 			const response = await fetch(`${chatBase(credential)}${path}`, {
@@ -2210,14 +2570,14 @@ var WorkBuddyUpstreamClient = class {
 					"Accept": "application/json",
 					"Origin": originReferer(credential),
 					"Referer": `${originReferer(credential)}/`,
-					"User-Agent": CLIENT_UA
+					"User-Agent": PRODUCT_UA
 				},
 				signal: timeout
 			});
 			const envelope = await readEnvelope(response);
 			if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
 			const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
-			return selectCliModels(data["models"], data["agents"]);
+			return withPromos(selectCliModels(data["models"], data["agents"], keepModelIds), data);
 		};
 		try {
 			return await readCatalog(GLOBAL_CONFIG_PATH);
@@ -4410,7 +4770,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.13.1";
+const WORKBUDDY_CONNECT_VERSION = "4.14.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -4568,4 +4928,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { WORKBUDDY_APP_EXECUTABLE_ENV as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, lastRefusalFor as J, REFUSES_OFF_MODEL_IDS as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, withEffectiveOff as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, offRefused as X, offDefaultFor as Y, recordRefusal as Z, WORKBUDDY_AUTH_FILENAME as _, readHostHeartbeat as a, findWorkbuddyAppExecutableWithSource as at, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, macosBundleExecutable as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, readAtRestKey as dt, clearAtRestKeyCache as et, WorkBuddyCatalog as f, workbuddyAppExecutableCandidates as ft, ENCRYPTED_CREDENTIAL_CODE as g, writeFileAtomic as gt, fallbackModelsFor as h, withFileLock as ht, processStartTimeMs as i, findWorkbuddyAppExecutable as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, macosNestedAppBundles as lt, deriveCatalog as m, resolveDshHome as mt, clearHostHeartbeat as n, deriveAtRestKeyId as nt, workbuddyHostHeartbeatPath as o, isEncryptedFieldWrapper as ot, applyContextBudgets as p, hostPeersInfo as pt, defaultOffModelIds as q, isHeartbeatProcessAlive as r, fetchAtRestKeyPayload as rt, writeHostHeartbeat as s, isWorkbuddyBundle as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, deriveAtRestKey as tt, FALLBACK_WORKBUDDY_MODELS as u, openEncryptedField as ut, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, knownRegionOf as z };
+export { withEffectiveOff as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, defaultOffModelIds as J, systemOpeningsOfBody as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, recordRefusal as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, offDefaultFor as X, lastRefusalFor as Y, offRefused as Z, WORKBUDDY_AUTH_FILENAME as _, writeFileAtomic as _t, readHostHeartbeat as a, findWorkbuddyAppExecutable as at, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, isWorkbuddyBundle as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, openEncryptedField as dt, WORKBUDDY_APP_EXECUTABLE_ENV as et, WorkBuddyCatalog as f, readAtRestKey as ft, ENCRYPTED_CREDENTIAL_CODE as g, withFileLock as gt, fallbackModelsFor as h, resolveDshHome as ht, processStartTimeMs as i, fetchAtRestKeyPayload as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, macosBundleExecutable as lt, deriveCatalog as m, hostPeersInfo as mt, clearHostHeartbeat as n, deriveAtRestKey as nt, workbuddyHostHeartbeatPath as o, findWorkbuddyAppExecutableWithSource as ot, applyContextBudgets as p, workbuddyAppExecutableCandidates as pt, REFUSES_OFF_MODEL_IDS as q, isHeartbeatProcessAlive as r, deriveAtRestKeyId as rt, writeHostHeartbeat as s, isEncryptedFieldWrapper as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, clearAtRestKeyCache as tt, FALLBACK_WORKBUDDY_MODELS as u, macosNestedAppBundles as ut, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, knownRegionOf as z };