dsh-connect-workbuddy 4.13.2 → 4.14.1

package/lib/{host-heartbeat-BJAL9pEe.js → host-heartbeat-D1WnqQY2.js}

@@ -962,6 +962,71 @@ function clearAtRestKeyCache() {
 	cachedAppExecutable = void 0;
 }
 //#endregion
+//#region src/native-modality.ts
+/**
+* Reviewed vendor classifications, keyed by EXACT model id (never a prefix).
+* Ids absent from this record are `unknown` — see {@link nativeModalityOf}.
+*/
+const NATIVE_MODALITY_BY_MODEL_ID = {
+	"deepseek-v4-pro": "text",
+	"glm-5.1": "text",
+	"glm-5.2": "text",
+	"glm-5.3": "text",
+	"hy3": "text",
+	"hy4-preview": "text",
+	"deepseek-v4.1-flash": "multimodal",
+	"glm-5.3-flash": "multimodal",
+	"glm-5v-turbo": "multimodal",
+	"kimi-k2.6": "multimodal",
+	"kimi-k2.7": "multimodal",
+	"kimi-k3-1": "multimodal",
+	"minimax-m3": "multimodal"
+};
+/**
+* Ids the upstream lists in the model roster that are ROUTERS, not models.
+*
+* `auto` (CN) is the one observed today: the gateway resolves it to whichever
+* model it considers the best fit (measured: CN `auto` → `hy4-preview`), so its
+* price, context window and behaviour are decided at request time by something
+* else. Offering it as a row advertises a model whose terms the plugin cannot
+* state, and it duplicates a real row already in the same roster.
+*
+* Kept as an explicit table rather than a heuristic: a router is an upstream
+* concept with no declared flag, and guessing from the name would eventually
+* hide a real model. Add an id here only after the same kind of evidence.
+*/
+const ROUTER_MODEL_IDS = /* @__PURE__ */ new Set(["auto"]);
+/** Whether this id is an upstream router rather than a model. */
+function isRouterModelId(modelId) {
+	return ROUTER_MODEL_IDS.has(modelId);
+}
+/**
+* Native modality of one model id. Exact match only: a new model never
+* inherits a classification from its family, its display name, or the
+* platform's image flag.
+*/
+function nativeModalityOf(modelId) {
+	if (isRouterModelId(modelId)) return "router";
+	return NATIVE_MODALITY_BY_MODEL_ID[modelId] ?? "unknown";
+}
+/**
+* Whether a model refresh should PRE-CHECK this model's image box.
+*
+* Only a documented `multimodal` is pre-checked. `text` is documented as
+* unable to read images, and `unknown` is deliberately left unchecked rather
+* than guessed — the whole reason this table exists is that the platform flag
+* guessed wrong. A platform `supportsImages: false` still vetoes, so a
+* documented-multimodal id can never be pre-checked against the platform's
+* explicit "no".
+*
+* The user can always tick a box by hand; this decides a DEFAULT only, and the
+* effective runtime flag remains the saved `imageModelIds`.
+*/
+function imageDefaultFor(info) {
+	if (info.supportsImages === false) return false;
+	return NATIVE_MODALITY_BY_MODEL_ID[info.id] === "multimodal";
+}
+//#endregion
 //#region src/off-thinking.ts
 /**
 * Ids observed to REFUSE `reasoning_effort: "off"` with HTTP 400 despite
@@ -1096,6 +1161,198 @@ function withEffectiveOff(models, selection) {
 	});
 }
 //#endregion
+//#region src/promo.ts
+/** A record-ish value, or undefined for anything else. */
+function record(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+/** A trimmed non-empty string, or undefined. */
+function text(value) {
+	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+/**
+* `'HH:mm'` → minutes since midnight, or undefined for anything else.
+*
+* `24:00` is accepted and means exactly 1440 — the END of a day. The upstream
+* writes "all day" as `0:00`–`23:59` today, which leaves a one-minute hole
+* between 23:59 and midnight where a standing campaign reads as not running.
+* Accepting `24:00` lets such a window be expressed (and lets a future upstream
+* fix it) without that hole; as a START it is rejected, because a day that
+* begins at 24:00 is the next day and that is a different statement.
+*
+* Any other malformed value is left to the caller to drop — a wrong window
+* would hide a live promotion, and guessing is not this parser's job.
+*/
+function minutesOfClock(value) {
+	const match = /^(\d{1,2}):(\d{2})$/.exec(value.trim());
+	if (match === null) return void 0;
+	const hours = Number(match[1]);
+	const minutes = Number(match[2]);
+	if (!Number.isInteger(hours) || !Number.isInteger(minutes)) return void 0;
+	if (minutes > 59) return void 0;
+	if (hours > 24) return void 0;
+	if (hours === 24) return minutes === 0 ? 1440 : void 0;
+	return hours * 60 + minutes;
+}
+/** An ISO-8601 instant → epoch milliseconds. Numbers are refused on purpose. */
+function parseInstant(value) {
+	const raw = text(value);
+	if (raw === void 0) return void 0;
+	const ms = Date.parse(raw);
+	return Number.isNaN(ms) ? void 0 : ms;
+}
+/** The upstream's `modelIds` → the model's ids, de-duplicated. */
+function parseModelIds(value) {
+	if (!Array.isArray(value)) return void 0;
+	const ids = [];
+	for (const entry of value) {
+		const id = text(entry);
+		if (id !== void 0 && !ids.includes(id)) ids.push(id);
+	}
+	return ids.length === 0 ? void 0 : ids;
+}
+/** The upstream's `badge` → this plugin's badge shape. */
+function parseBadge(value) {
+	const raw = record(value);
+	if (raw === void 0) return void 0;
+	const label = text(raw["label"]) ?? text(raw["labelEn"]) ?? text(raw["shortLabel"]) ?? text(raw["shortLabelEn"]);
+	if (label === void 0) return void 0;
+	const labelEn = text(raw["labelEn"]);
+	const shortLabel = text(raw["shortLabel"]);
+	const shortLabelEn = text(raw["shortLabelEn"]);
+	const color = text(raw["color"]);
+	const display = raw["display"] === "activeOnly" ? "activeOnly" : void 0;
+	return {
+		label,
+		...labelEn === void 0 ? {} : { labelEn },
+		...shortLabel === void 0 ? {} : { shortLabel },
+		...shortLabelEn === void 0 ? {} : { shortLabelEn },
+		...color === void 0 ? {} : { color },
+		...display === void 0 ? {} : { display }
+	};
+}
+/** The upstream's `hover` → this plugin's copy shape. */
+function parseHover(value) {
+	const raw = record(value);
+	if (raw === void 0) return void 0;
+	const textZh = text(raw["textZh"]);
+	const textEn = text(raw["textEn"]);
+	if (textZh === void 0 && textEn === void 0) return void 0;
+	return {
+		...textZh === void 0 ? {} : { textZh },
+		...textEn === void 0 ? {} : { textEn }
+	};
+}
+/** The upstream's `schedule.daily` → the windows this plugin can evaluate. */
+function parseDaily(value) {
+	if (!Array.isArray(value)) return void 0;
+	const windows = [];
+	for (const entry of value) {
+		const raw = record(entry);
+		if (raw === void 0) continue;
+		const start = text(raw["start"]);
+		const end = text(raw["end"]);
+		if (start === void 0 || end === void 0) continue;
+		if (minutesOfClock(start) === void 0 || minutesOfClock(end) === void 0) continue;
+		windows.push({
+			start,
+			end
+		});
+	}
+	return windows.length === 0 ? void 0 : windows;
+}
+/** The upstream's `schedule` → this plugin's schedule shape. */
+function parseSchedule(value) {
+	const raw = record(value);
+	if (raw === void 0) return void 0;
+	const timezone = text(raw["timezone"]);
+	const validFrom = parseInstant(raw["validFrom"]);
+	const validUntil = parseInstant(raw["validUntil"]);
+	const daily = parseDaily(raw["daily"]);
+	const dailyUnusable = daily === void 0 && Array.isArray(raw["daily"]) && raw["daily"].length > 0;
+	if (timezone === void 0 && validFrom === void 0 && validUntil === void 0 && daily === void 0 && !dailyUnusable) return void 0;
+	return {
+		...timezone === void 0 ? {} : { timezone },
+		...validFrom === void 0 ? {} : { validFrom },
+		...validUntil === void 0 ? {} : { validUntil },
+		...daily === void 0 ? {} : { daily },
+		...dailyUnusable ? { dailyUnusable: true } : {}
+	};
+}
+/** One upstream entry → this plugin's promo shape, or undefined if it is not one. */
+function parsePromo(value, source) {
+	const raw = record(value);
+	if (raw === void 0) return void 0;
+	if (raw["enabled"] === false) return void 0;
+	const modelIds = parseModelIds(raw["modelIds"]);
+	if (modelIds === void 0) return void 0;
+	const badge = parseBadge(raw["badge"]);
+	if (badge === void 0) return void 0;
+	const hover = parseHover(raw["hover"]);
+	const schedule = parseSchedule(raw["schedule"]);
+	const priority = typeof raw["priority"] === "number" && Number.isFinite(raw["priority"]) ? raw["priority"] : 0;
+	return {
+		id: text(raw["id"]) ?? `${source}:${modelIds.join(",")}`,
+		source,
+		modelIds,
+		badge,
+		...hover === void 0 ? {} : { hover },
+		...schedule === void 0 ? {} : { schedule },
+		priority
+	};
+}
+/**
+* Parse the upstream's promotion and tier lists.
+*
+* Both lists are read from the SAME document the roster comes from, so this
+* never costs a request. Entries that are not promotions — no `modelIds`, no
+* `badge`, or `enabled: false` — are dropped here rather than downstream, so
+* that everything downstream can assume a promo is drawable.
+*
+* The promotions come first, so that a TIE on `priority` is broken in the
+* promotions' favour: a price badge ("Free now") is more actionable to a user
+* than an access-tier badge ("Pro Only"), and the upstream numbers them
+* equally (both 200 on the observed feed).
+*/
+function parseWorkBuddyPromos(rawPromotions, rawTiers) {
+	const promos = [];
+	for (const entry of Array.isArray(rawPromotions) ? rawPromotions : []) {
+		const promo = parsePromo(entry, "promotion");
+		if (promo !== void 0) promos.push(promo);
+	}
+	for (const entry of Array.isArray(rawTiers) ? rawTiers : []) {
+		const tier = parsePromo(entry, "tier");
+		if (tier !== void 0) promos.push(tier);
+	}
+	return promos;
+}
+/**
+* Attach the promotions that name each model.
+*
+* The result is UNRESOLVED on purpose: every candidate that names the model
+* rides along, so the badge can be chosen at render time against the clock
+* (see {@link selectPromoBadge}). Resolving here would freeze the answer at
+* fetch time — the defect that makes a "night discount" badge keep claiming
+* the night after the night is over.
+*/
+function attachPromos(models, promos) {
+	if (promos.length === 0) return [...models];
+	const byModel = /* @__PURE__ */ new Map();
+	for (const promo of promos) for (const modelId of promo.modelIds) {
+		const list = byModel.get(modelId);
+		if (list === void 0) byModel.set(modelId, [promo]);
+		else list.push(promo);
+	}
+	return models.map((model) => {
+		const list = byModel.get(model.id);
+		if (list === void 0) return model;
+		return {
+			...model,
+			promos: [...list].sort((a, b) => b.priority - a.priority)
+		};
+	});
+}
+//#endregion
 //#region src/upstream.ts
 /**
 * WorkBuddy (CodeBuddy / copilot.tencent.com) upstream client: chat streaming,
@@ -1145,55 +1402,80 @@ const GLOBAL_BASE = "https://www.workbuddy.ai";
 * Legacy model-catalog path, kept only as the CN region's FALLBACK.
 *
 * This is the document the WorkBuddy *plugin* used to read, and it is NOT the
-* document the WorkBuddy *app* reads. The gateway answers it with the CLI
-* channel's roster, whose second slot is the paid `hy4-preview`
-* (`credits: 'x0.29 credits'`), while the app's own config lists the free
-* `hy4-preview-f` (`credits: 'x0.00 credits'`) in that slot under the SAME
-* display name "Hy4 preview". Reading this path is therefore what makes the
-* plugin's card disagree with the app about a model's price — both are
-* correctly displaying a real record, just different ones.
+* document the WorkBuddy *app* reads: the gateway answers it with the CLI
+* channel's roster, which carries neither the app's `auto` slot nor any
+* promotion feed. The free Hy4 tier that used to live here as a separate
+* `hy4-preview-f` record is gone as a record — measured 2026-10-21, both
+* channels list the paid `hy4-preview` (`x0.29`) — and the free tier is now
+* expressed as a promotion badge (`夜间免费`) in the app-channel document only.
+* So this path is strictly poorer than {@link GLOBAL_CONFIG_PATH}; it stays
+* only so that a gateway which stops serving the modern document degrades
+* instead of emptying the region.
 */
 const MODELS_CATALOG_PATH = "/v2/enterprises/personal/models";
 /**
-* Remote product-config path; the CN region's PRIMARY catalog source and the
-* global region's only one.
+* Remote product-config path — the document the WorkBuddy app itself reads for
+* its model list, its prices AND its promotion badges.
 *
 * It is field-compatible with {@link MODELS_CATALOG_PATH} for every key
-* {@link parseUpstreamModel} reads, so one parser still serves both. On CN this
-* path is what the app itself consumes, so the plugin's roster and the app's
-* agree — that parity is the whole point of preferring it.
-*
-* The CLI user agent deliberately stays {@link CLIENT_UA} here. `/v3/config`
-* serves a DIFFERENT roster per client channel: the desktop token yields a
-* roster without the free `hy4-preview-f`, and the CLI token yields one with
-* it. Measured 2026-10-04 — CN + `/v3/config`: CLI token = 17 models incl.
-* `hy4-preview-f`(x0.00); desktop token = 29 models, no `hy4-preview-f` and no
-* cheap free tier. That is why the global branch below pairs this path with
-* {@link DESKTOP_UA} and the CN branch must NOT.
+* {@link parseUpstreamModel} reads, so one parser still serves both, and it
+* additionally carries `modelPromotions` / `modelTiers` — the promotion feed
+* no other path publishes (see {@link withPromos}).
+*
+* Which document this path answers depends on the CHANNEL the request claims
+* to be (see {@link PRODUCT_UA}); it does not depend on the host: `www.workbuddy.cn`,
+* `copilot.tencent.com`, `wb.tencentbuddy.com` and `www.codebuddy.cn` answer
+* byte-identically under the same header.
 */
 const GLOBAL_CONFIG_PATH = "/v3/config";
+/**
+* The chat channel's user agent — the identity the plugin's adapter speaks as.
+*
+* Chat is a different contract from configuration: the conversation-identity
+* triple (conversation id, session id, device id) is bound to this channel, and
+* the upstream bills and rate-limits it as the CLI agent. The plugin chats as
+* the CLI agent on purpose, so this stays {@link CLIENT_UA} everywhere the
+* request is a CHAT.
+*/
 const CLIENT_UA = "CLI/2.63.2 CodeBuddy/2.63.2";
 /**
-* User agent of the WorkBuddy desktop app.
+* The product-config channel's user agent: the WorkBuddy APP's own product
+* identity, byte-for-byte the header the app sends.
+*
+* The app builds it in `buildVlmGatewayHeaders` (WorkBuddy 5.8.3) as
+*
+*     `User-Agent: WorkBuddy/<app> WorkBuddy/<app> CLI/<cli>`
 *
-* The config service serves a DIFFERENT product configuration per client
-* channel, selected by this product token — the version suffix is ignored
-* (`WorkBuddy/5.5.2`, `WorkBuddy/1.0.0` and a bare `WorkBuddy` answer
-* identically). On the INTERNATIONAL gateway the split decides which models
-* exist at all:
+* — the app version twice, the CLI version once — and sends it to
+* `/v3/config`; the app's own log reads
+* `fetch cloud product from url:https://www.workbuddy.cn/v3/config success`
+* with `{"user-agent":"WorkBuddy/5.8.3 WorkBuddy/5.8.3 CLI/2.161.0", …}`.
 *
-*   - CLI channel (`CLI/… CodeBuddy/…`) → 35 models that OMIT
-*     `deepseek-v4.1-flash` and `gpt-6-astra`, even though both are perfectly
-*     chat-usable (verified: `deepseek-v4.1-flash` streams HTTP 200 and is
-*     billed `x0.00`);
-*   - desktop channel → the account's real 20-model chat roster including both.
+* It matters, because `/v3/config` answers a DIFFERENT product configuration
+* per client channel. Measured 2026-10-21, same token, same URL, only this
+* header differing (CN gateway):
 *
-* The plugin emulates the CLI channel for CHAT but reads the desktop channel's
-* configuration to learn the account's actual model list. The CN gateway needs
-* no such switch: its desktop config carries no `cli` agent roster at all, so
-* CN keeps reading the shared `/v2/enterprises/personal/models` path.
+*   | User-Agent                                    | `/v3/config` answer                    |
+*   | ---                                           | ---                                    |
+*   | `CLI/2.63.2 CodeBuddy/2.63.2` (CLI channel)   | 5 keys, 35 models, NO promotion feed    |
+*   | `WorkBuddy/5.8.3` (app channel, no CLI part)  | 18 keys, 37 models, no promotion feed   |
+*   | `WorkBuddy/5.8.3 WorkBuddy/5.8.3 CLI/2.161.0` | 22 keys, 62 models, 8 promos + 1 tier   |
+*
+* The CLI channel's answer is a strict SUBSET of the app channel's: it
+* publishes neither `modelPromotions` nor `modelTiers`. That is precisely why
+* the CN card showed no promotion badge while the WorkBuddy app showed one on
+* the very same account — the plugin was reading a document the upstream
+* publishes WITHOUT the feed, not a feed that does not exist.
+*
+* The version suffixes are inert — `WorkBuddy/1.0.0 CLI/2.63.2
+* CodeBuddy/2.63.2` answers identically — so what selects the document is the
+* CHANNEL the header claims, not the version in it.
+*
+* Global answers the same document under either app-shaped header (17 keys,
+* 28 models, 5 promotions + 1 tier, identical roster), so both regions read
+* `/v3/config` as {@link PRODUCT_UA}.
 */
-const DESKTOP_UA = "WorkBuddy/5.5.2";
+const PRODUCT_UA = "WorkBuddy/5.8.3 WorkBuddy/5.8.3 CLI/2.161.0";
 const JSON_TIMEOUT_MS = 3e4;
 const ERROR_BODY_LIMIT = 4096;
 /**
@@ -2110,8 +2392,28 @@ function parseUpstreamModel(value) {
 * selector serves them. Without a usable `cli` roster the whole parsed catalog
 * is exposed rather than nothing: the roster is an upstream detail that may
 * change, and an empty answer would silently disarm the provider.
+*
+* ROUTERS ARE NOT MODELS. The upstream lists `auto` (CN) and its global
+* equivalents alongside real models, but those entries are ROUTING decisions,
+* not models: the gateway resolves them to whichever model it thinks fits, so
+* a row for one would offer a name whose price, context window and behaviour
+* are all decided at request time by something else. Selected this way it also
+* duplicates a real row — upstream resolves CN `auto` to `hy4-preview`, which
+* is already in the same roster. They are dropped here, at the single place
+* the roster is built, so the card, the picker, the probe and the discovery
+* route all agree. A user who already had one enabled keeps it through
+* `keepIds` below: this removes the OFFER, never a running model (issue #32's
+* failure mode).
+*
+* `keepIds` is the user's own selection riding along with the refresh. The
+* upstream roster may drop a model the user is actually running — the app
+* channel's `cli` roster dropped `minimax-m2.7` on 2026-10-21 while the SAME
+* document still publishes it (`x0.26`) and the chat endpoint still answers for
+* it (measured HTTP 200). A roster read is therefore the upstream's roster PLUS
+* the kept ids this document still lists: a refresh may add or withdraw
+* upstream models, but it never silently withdraws a model the user is on.
 */
-function selectCliModels(rawModels, agents) {
+function selectCliModels(rawModels, agents, keepIds = []) {
 	const byId = /* @__PURE__ */ new Map();
 	for (const model of Array.isArray(rawModels) ? rawModels : []) {
 		const parsed = parseUpstreamModel(model);
@@ -2125,9 +2427,33 @@ function selectCliModels(rawModels, agents) {
 			break;
 		}
 	}
-	const models = (cliIds !== void 0 && cliIds.length > 0 ? cliIds : [...byId.keys()]).map((id) => byId.get(id)).filter((model) => model !== void 0);
-	if (models.length === 0) throw new Error("workbuddy model catalog resolved to an empty list");
-	return models;
+	const ids = cliIds !== void 0 && cliIds.length > 0 ? cliIds : [...byId.keys()];
+	const models = ids.filter((id) => !isRouterModelId(id)).map((id) => byId.get(id)).filter((model) => model !== void 0);
+	const kept = keepIds.filter((id) => !ids.includes(id)).map((id) => byId.get(id)).filter((model) => model !== void 0);
+	const resolved = [...models, ...kept];
+	if (resolved.length === 0) throw new Error("workbuddy model catalog resolved to an empty list");
+	return resolved;
+}
+/**
+* The roster plus the promotion badges the SAME document carries.
+*
+* `data.modelPromotions` and `data.modelTiers` sit beside `data.models` in
+* the upstream's `/v3/config` document, so the badges cost no extra request:
+* they are read out of the response the roster was read from. Which models
+* they name is resolved here; WHICH badge holds at a given moment is not
+* (see `src/promo.ts` — a badge is a function of the clock).
+*
+* BOTH regions publish the feed, and they publish it in the app channel's
+* document: measured 2026-10-21 on the same accounts the app reads, CN
+* `/v3/config` carries 8 promotions + 1 tier badge (Chinese labels such as
+* `夜间折扣` / `限时免费` / `订阅优先`, with `schedule.daily` night windows),
+* and the global gateway carries 5 promotions + 1 tier badge. The feed is
+* absent only from the CLI channel's answer, which the plugin never reads a
+* product configuration as (see {@link PRODUCT_UA}).
+*/
+function withPromos(models, data) {
+	const promos = parseWorkBuddyPromos(data["modelPromotions"], data["modelTiers"]);
+	return promos.length === 0 ? models : attachPromos(models, promos);
 }
 /**
 * Upstream HTTP client. One instance serves the whole plugin; requests take
@@ -2269,13 +2595,14 @@ var WorkBuddyUpstreamClient = class {
 	/**
 	* Read the model directory for the credential's region.
 	*
-	* Both regions prefer `/v3/config`, the document the WorkBuddy app itself
-	* consumes, so the plugin's roster and the app's agree. They differ in the
-	* user agent that requests it, and that difference is load-bearing: `/v3`
-	* serves a different roster per client channel. Global asks as the desktop
-	* channel (see {@link DESKTOP_UA}); CN asks as the CLI channel
-	* ({@link CLIENT_UA}), which is the only CN channel whose `/v3` answer
-	* contains the free `hy4-preview-f` (see {@link GLOBAL_CONFIG_PATH}).
+	* Both regions read `/v3/config`, the document the WorkBuddy app itself
+	* consumes, and both read it as the APP's product identity
+	* ({@link PRODUCT_UA}) — the header the app sends, not the CLI channel's.
+	* That is load-bearing, not cosmetic: the CLI channel's answer is a strict
+	* subset of the app channel's and publishes neither `modelPromotions` nor
+	* `modelTiers`, so reading `/v3/config` as the CLI channel is what left the
+	* CN card without a single promotion badge while the app showed one on the
+	* same account (see {@link PRODUCT_UA}).
 	*
 	* CN falls back to the legacy {@link MODELS_CATALOG_PATH} when `/v3` fails,
 	* returns a non-zero envelope, or resolves to no usable model, so a gateway
@@ -2286,8 +2613,14 @@ var WorkBuddyUpstreamClient = class {
 	*
 	* No user-side toggle is involved: the region comes from the credential's
 	* `domain`.
+	*
+	* `keepModelIds` is the user's own selection, passed through to
+	* {@link selectCliModels}: a model the upstream roster dropped but the SAME
+	* document still publishes stays in the roster, so reading the directory
+	* never withdraws a model the user is running (issue #32's failure mode,
+	* one step upstream of it).
 	*/
-	async fetchModels(credential, signal) {
+	async fetchModels(credential, signal, keepModelIds = []) {
 		const timeout = signal ?? AbortSignal.timeout(JSON_TIMEOUT_MS);
 		if (regionOf(credential.domain) === "global") {
 			const response = await fetch(`${globalBase(credential.domain)}${GLOBAL_CONFIG_PATH}`, {
@@ -2299,14 +2632,14 @@ var WorkBuddyUpstreamClient = class {
 					"X-Product": "SaaS",
 					"X-Requested-With": "XMLHttpRequest",
 					"Connection": "close",
-					"User-Agent": DESKTOP_UA
+					"User-Agent": PRODUCT_UA
 				},
 				signal: timeout
 			});
 			const envelope = await readEnvelope(response);
 			if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
 			const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
-			return selectCliModels(data["models"], data["agents"]);
+			return withPromos(selectCliModels(data["models"], data["agents"], keepModelIds), data);
 		}
 		const readCatalog = async (path) => {
 			const response = await fetch(`${chatBase(credential)}${path}`, {
@@ -2315,14 +2648,14 @@ var WorkBuddyUpstreamClient = class {
 					"Accept": "application/json",
 					"Origin": originReferer(credential),
 					"Referer": `${originReferer(credential)}/`,
-					"User-Agent": CLIENT_UA
+					"User-Agent": PRODUCT_UA
 				},
 				signal: timeout
 			});
 			const envelope = await readEnvelope(response);
 			if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
 			const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
-			return selectCliModels(data["models"], data["agents"]);
+			return withPromos(selectCliModels(data["models"], data["agents"], keepModelIds), data);
 		};
 		try {
 			return await readCatalog(GLOBAL_CONFIG_PATH);
@@ -4000,14 +4333,14 @@ var WorkBuddyCredentialStore = class {
 * Static CLI models captured from the CN endpoint (2026-08-30). The upstream
 * refresh replaces this list at startup; it exists so the provider registers
 * with a usable catalog even while the first fetch is in flight or offline.
+*
+* The upstream's `auto` ROUTER is deliberately absent, matching what
+* `selectCliModels` now does to the live roster: it resolves to a different
+* model per request, so it is not a row this plugin can describe. Keeping it
+* here would have reintroduced it on the offline/第一帧 path only, which is the
+* hardest kind of inconsistency to notice.
 */
 const FALLBACK_WORKBUDDY_MODELS = [
-	{
-		id: "auto",
-		name: "Auto",
-		contextWindow: 168e3,
-		maxTokens: 32e3
-	},
 	{
 		id: "hy3",
 		name: "Hy3",
@@ -4255,8 +4588,23 @@ function applyContextBudgets(catalog, budgets = {}) {
 		contextWindow: budgets[model.id] === void 0 ? model.contextWindow : Math.min(model.contextWindow, budgets[model.id])
 	}));
 }
+/**
+* Derive the runtime catalog from the last-refreshed directory plus the user's
+* selection.
+*
+* An empty selection means "never configured" and serves the whole directory.
+* But a NON-empty selection that intersects the directory in nothing must NOT
+* serve nothing: that is the issue #32 failure mode (the picker empties out),
+* and it now has a realistic trigger — a user whose only ticked model was the
+* upstream's `auto` router, which this version stops offering. Such a selection
+* degrades to the whole directory rather than to silence: the user asked for
+* "some models to be on", and the alternative is a region with no models at
+* all. An empty directory still yields an empty result; the guard is only about
+* a selection that no longer matches anything.
+*/
 function deriveCatalog(catalog, enabled, budgets = {}) {
-	return applyContextBudgets(enabled.size === 0 ? catalog : catalog.filter((model) => enabled.has(model.id)), budgets);
+	const selected = enabled.size === 0 ? catalog : catalog.filter((model) => enabled.has(model.id));
+	return applyContextBudgets(selected.length === 0 && enabled.size > 0 ? catalog : selected, budgets);
 }
 /**
 * Mutable catalog shared by the shim's `/v1/models` and the adapter.
@@ -4515,7 +4863,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.13.2";
+const WORKBUDDY_CONNECT_VERSION = "4.14.1";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -4673,4 +5021,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { withEffectiveOff as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, defaultOffModelIds as J, systemOpeningsOfBody as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, recordRefusal as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, offDefaultFor as X, lastRefusalFor as Y, offRefused as Z, WORKBUDDY_AUTH_FILENAME as _, writeFileAtomic as _t, readHostHeartbeat as a, findWorkbuddyAppExecutable as at, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, isWorkbuddyBundle as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, openEncryptedField as dt, WORKBUDDY_APP_EXECUTABLE_ENV as et, WorkBuddyCatalog as f, readAtRestKey as ft, ENCRYPTED_CREDENTIAL_CODE as g, withFileLock as gt, fallbackModelsFor as h, resolveDshHome as ht, processStartTimeMs as i, fetchAtRestKeyPayload as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, macosBundleExecutable as lt, deriveCatalog as m, hostPeersInfo as mt, clearHostHeartbeat as n, deriveAtRestKey as nt, workbuddyHostHeartbeatPath as o, findWorkbuddyAppExecutableWithSource as ot, applyContextBudgets as p, workbuddyAppExecutableCandidates as pt, REFUSES_OFF_MODEL_IDS as q, isHeartbeatProcessAlive as r, deriveAtRestKeyId as rt, writeHostHeartbeat as s, isEncryptedFieldWrapper as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, clearAtRestKeyCache as tt, FALLBACK_WORKBUDDY_MODELS as u, macosNestedAppBundles as ut, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, knownRegionOf as z };
+export { withEffectiveOff as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, defaultOffModelIds as J, systemOpeningsOfBody as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, recordRefusal as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, offDefaultFor as X, lastRefusalFor as Y, offRefused as Z, WORKBUDDY_AUTH_FILENAME as _, hostPeersInfo as _t, readHostHeartbeat as a, deriveAtRestKey as at, WorkBuddyEncryptedCredentialError as b, writeFileAtomic as bt, WORKBUDDY_CONNECT_VERSION as c, findWorkbuddyAppExecutable as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, isWorkbuddyBundle as dt, NATIVE_MODALITY_BY_MODEL_ID as et, WorkBuddyCatalog as f, macosBundleExecutable as ft, ENCRYPTED_CREDENTIAL_CODE as g, workbuddyAppExecutableCandidates as gt, fallbackModelsFor as h, readAtRestKey as ht, processStartTimeMs as i, clearAtRestKeyCache as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, findWorkbuddyAppExecutableWithSource as lt, deriveCatalog as m, openEncryptedField as mt, clearHostHeartbeat as n, nativeModalityOf as nt, workbuddyHostHeartbeatPath as o, deriveAtRestKeyId as ot, applyContextBudgets as p, macosNestedAppBundles as pt, REFUSES_OFF_MODEL_IDS as q, isHeartbeatProcessAlive as r, WORKBUDDY_APP_EXECUTABLE_ENV as rt, writeHostHeartbeat as s, fetchAtRestKeyPayload as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, imageDefaultFor as tt, FALLBACK_WORKBUDDY_MODELS as u, isEncryptedFieldWrapper as ut, WORKBUDDY_AUTH_FILE_ENV as v, resolveDshHome as vt, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, withFileLock as yt, knownRegionOf as z };