dsh-connect-workbuddy 4.14.0 → 4.14.1

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 4.14.1 (2026-10-21)
+
+> 版本号是 **patch**：没有接口、配置项或请求结构的变更，发往上游的请求体**一个字节都没变**。本版只改「哪些上游条目算作模型」这一处判断，以及它带出的一个目录退化路径。
+
+### Fixes
+
+- **不再把上游的 `auto` 路由器当成模型列出来**
+  - **它不是模型**：国内区 `cli` 名单里的 `auto` 是一个**路由决策**，网关在请求时把它解析成它认为合适的那一个（实测 → `hy4-preview`）。所以它的价格、上下文窗口与行为都由别人在请求时决定，插件无法如实描述；把它列成一行，用户看到的将是一行「倍率未知、行为不定」的条目。
+  - **它还制造重复**：同一份名单里本来就有它会被解析到的那个真实模型（`hy4-preview`），于是选择器出现两行指向同一个上游模型、其中一行没有倍率。
+  - **改在名单构建的单一位置**（`selectCliModels`），因此卡片、模型选择器、探针与发现路由看到的是同一份结果，不会出现「卡片上没有、选择器里还有」。
+  - **用显式表而不是名字启发式**：新增 `ROUTER_MODEL_IDS` / `isRouterModelId`（`src/native-modality.ts`），与既有的 `nativeModalityOf(...) === 'router'` 共用同一个来源。路由是上游的概念、没有声明字段，按名字猜迟早会误伤真实模型。
+  - **静态兜底同步移除**：`FALLBACK_WORKBUDDY_MODELS` 里也有 `auto`。只改实时名单的话，它会在离线/首帧路径上复活——那是这类不一致里最难察觉的一种。
+  - **空名单守卫挪到并入保留模型之后**：否则名单只剩 router 时，守卫会在合并前抛错，把「上游改了 router」放大成「这个区域一个模型都没有」。现在「上游名单为空、但用户仍有在跑的真实模型」会正常降级为后者。
+
+- **勾选与目录零交集时退回整个目录，而不是返回空**
+  - 真实触发路径正是一位「只勾过 `auto`」的用户：4.14.0 里他还能勾选它，本版不再提供之后，他的 `enabledModelIds` 与目录的交集为空，运行时目录会变成空的——那是 issue #32 的故障形态（选择器突然没有模型，且没有任何报错）。
+  - `deriveCatalog` 现在只在「非空勾选 ∩ 目录 = ∅」时退回整个目录。用户勾选表达的是「要一些模型开着」，不是「一个都不要」；空目录仍然返回空，这条只处理「勾选不再匹配任何东西」。
+
+### Tests
+
+- `tests/upstream.spec.ts` 新增 2 条：**router 绝不作为模型出现**（名单里 `auto` 与 `hy4-preview` 同时存在时，结果只有后者）；**名单只剩 router 时保留模型仍然生效**——这条专门钉住「守卫在合并前还是合并后」这个坑，守卫放错位置它会红。
+- `tests/catalog.spec.ts` 新增/改写：两区静态兜底都不含 `auto`；勾选只命中 router 时退回整个目录而不是空。
+- 既有两条把 `auto` 当素材的用例改用真实模型（`hy3`），避免测试本身依赖刚被删掉的行为。
+- **真实上游核验**（只读 GET，不消耗积分）：国内区 `cli` 名单 20 → **19** 条，`auto` 已不在其中；其余 9 枚活动徽标一个不少，与 WorkBuddy 客户端逐条一致。
+
 ## 4.14.0 (2026-10-21)
 
 > 版本号是 **minor**：有用户可见的功能与行为变更（模型行新增上游活动徽标；国内区改以 App 身份读产品配置，因此目录与客户端一致）。发往上游的**聊天**请求体、路由 id、凭据、计费与换号规则一律未变——变的只有**读取模型目录**那一次 GET 的 User-Agent。

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as WORKBUDDY_APP_EXECUTABLE_ENV, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, mt as hostPeersInfo, o as workbuddyHostHeartbeatPath, ot as findWorkbuddyAppExecutableWithSource, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-B1I95fKS.js";
+import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, _t as hostPeersInfo, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, lt as findWorkbuddyAppExecutableWithSource, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, rt as WORKBUDDY_APP_EXECUTABLE_ENV, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-D1WnqQY2.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -1501,6 +1501,71 @@ window.__ModuleLoader__.load({
 			return t("row.poolProbeDaysAgo", { count: Math.round(age / DAY_MS) });
 		}
 		//#endregion
+		//#region src/native-modality.ts
+		/**
+		* Reviewed vendor classifications, keyed by EXACT model id (never a prefix).
+		* Ids absent from this record are `unknown` — see {@link nativeModalityOf}.
+		*/
+		const NATIVE_MODALITY_BY_MODEL_ID = {
+			"deepseek-v4-pro": "text",
+			"glm-5.1": "text",
+			"glm-5.2": "text",
+			"glm-5.3": "text",
+			"hy3": "text",
+			"hy4-preview": "text",
+			"deepseek-v4.1-flash": "multimodal",
+			"glm-5.3-flash": "multimodal",
+			"glm-5v-turbo": "multimodal",
+			"kimi-k2.6": "multimodal",
+			"kimi-k2.7": "multimodal",
+			"kimi-k3-1": "multimodal",
+			"minimax-m3": "multimodal"
+		};
+		/**
+		* Ids the upstream lists in the model roster that are ROUTERS, not models.
+		*
+		* `auto` (CN) is the one observed today: the gateway resolves it to whichever
+		* model it considers the best fit (measured: CN `auto` → `hy4-preview`), so its
+		* price, context window and behaviour are decided at request time by something
+		* else. Offering it as a row advertises a model whose terms the plugin cannot
+		* state, and it duplicates a real row already in the same roster.
+		*
+		* Kept as an explicit table rather than a heuristic: a router is an upstream
+		* concept with no declared flag, and guessing from the name would eventually
+		* hide a real model. Add an id here only after the same kind of evidence.
+		*/
+		const ROUTER_MODEL_IDS = /* @__PURE__ */ new Set(["auto"]);
+		/** Whether this id is an upstream router rather than a model. */
+		function isRouterModelId(modelId) {
+			return ROUTER_MODEL_IDS.has(modelId);
+		}
+		/**
+		* Native modality of one model id. Exact match only: a new model never
+		* inherits a classification from its family, its display name, or the
+		* platform's image flag.
+		*/
+		function nativeModalityOf(modelId) {
+			if (isRouterModelId(modelId)) return "router";
+			return NATIVE_MODALITY_BY_MODEL_ID[modelId] ?? "unknown";
+		}
+		/**
+		* Whether a model refresh should PRE-CHECK this model's image box.
+		*
+		* Only a documented `multimodal` is pre-checked. `text` is documented as
+		* unable to read images, and `unknown` is deliberately left unchecked rather
+		* than guessed — the whole reason this table exists is that the platform flag
+		* guessed wrong. A platform `supportsImages: false` still vetoes, so a
+		* documented-multimodal id can never be pre-checked against the platform's
+		* explicit "no".
+		*
+		* The user can always tick a box by hand; this decides a DEFAULT only, and the
+		* effective runtime flag remains the saved `imageModelIds`.
+		*/
+		function imageDefaultFor(info) {
+			if (info.supportsImages === false) return false;
+			return NATIVE_MODALITY_BY_MODEL_ID[info.id] === "multimodal";
+		}
+		//#endregion
 		//#region src/promo.ts
 		/**
 		* `'HH:mm'` → minutes since midnight, or undefined for anything else.
@@ -3735,55 +3800,6 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
-		//#region src/native-modality.ts
-		/**
-		* Reviewed vendor classifications, keyed by EXACT model id (never a prefix).
-		* Ids absent from this record are `unknown` — see {@link nativeModalityOf}.
-		*/
-		const NATIVE_MODALITY_BY_MODEL_ID = {
-			"deepseek-v4-pro": "text",
-			"glm-5.1": "text",
-			"glm-5.2": "text",
-			"glm-5.3": "text",
-			"hy3": "text",
-			"hy4-preview": "text",
-			"deepseek-v4.1-flash": "multimodal",
-			"glm-5.3-flash": "multimodal",
-			"glm-5v-turbo": "multimodal",
-			"kimi-k2.6": "multimodal",
-			"kimi-k2.7": "multimodal",
-			"kimi-k3-1": "multimodal",
-			"minimax-m3": "multimodal"
-		};
-		/** The `auto` entry is a router that picks a model, not a model itself. */
-		const ROUTER_MODEL_ID = "auto";
-		/**
-		* Native modality of one model id. Exact match only: a new model never
-		* inherits a classification from its family, its display name, or the
-		* platform's image flag.
-		*/
-		function nativeModalityOf(modelId) {
-			if (modelId === ROUTER_MODEL_ID) return "router";
-			return NATIVE_MODALITY_BY_MODEL_ID[modelId] ?? "unknown";
-		}
-		/**
-		* Whether a model refresh should PRE-CHECK this model's image box.
-		*
-		* Only a documented `multimodal` is pre-checked. `text` is documented as
-		* unable to read images, and `unknown` is deliberately left unchecked rather
-		* than guessed — the whole reason this table exists is that the platform flag
-		* guessed wrong. A platform `supportsImages: false` still vetoes, so a
-		* documented-multimodal id can never be pre-checked against the platform's
-		* explicit "no".
-		*
-		* The user can always tick a box by hand; this decides a DEFAULT only, and the
-		* effective runtime flag remains the saved `imageModelIds`.
-		*/
-		function imageDefaultFor(info) {
-			if (info.supportsImages === false) return false;
-			return NATIVE_MODALITY_BY_MODEL_ID[info.id] === "multimodal";
-		}
-		//#endregion
 		//#region src/client/promo-badge.ts
 		/**
 		* The UI's language, as the browser reports it.

package/lib/{host-heartbeat-B1I95fKS.js → host-heartbeat-D1WnqQY2.js}

@@ -962,6 +962,71 @@ function clearAtRestKeyCache() {
 	cachedAppExecutable = void 0;
 }
 //#endregion
+//#region src/native-modality.ts
+/**
+* Reviewed vendor classifications, keyed by EXACT model id (never a prefix).
+* Ids absent from this record are `unknown` — see {@link nativeModalityOf}.
+*/
+const NATIVE_MODALITY_BY_MODEL_ID = {
+	"deepseek-v4-pro": "text",
+	"glm-5.1": "text",
+	"glm-5.2": "text",
+	"glm-5.3": "text",
+	"hy3": "text",
+	"hy4-preview": "text",
+	"deepseek-v4.1-flash": "multimodal",
+	"glm-5.3-flash": "multimodal",
+	"glm-5v-turbo": "multimodal",
+	"kimi-k2.6": "multimodal",
+	"kimi-k2.7": "multimodal",
+	"kimi-k3-1": "multimodal",
+	"minimax-m3": "multimodal"
+};
+/**
+* Ids the upstream lists in the model roster that are ROUTERS, not models.
+*
+* `auto` (CN) is the one observed today: the gateway resolves it to whichever
+* model it considers the best fit (measured: CN `auto` → `hy4-preview`), so its
+* price, context window and behaviour are decided at request time by something
+* else. Offering it as a row advertises a model whose terms the plugin cannot
+* state, and it duplicates a real row already in the same roster.
+*
+* Kept as an explicit table rather than a heuristic: a router is an upstream
+* concept with no declared flag, and guessing from the name would eventually
+* hide a real model. Add an id here only after the same kind of evidence.
+*/
+const ROUTER_MODEL_IDS = /* @__PURE__ */ new Set(["auto"]);
+/** Whether this id is an upstream router rather than a model. */
+function isRouterModelId(modelId) {
+	return ROUTER_MODEL_IDS.has(modelId);
+}
+/**
+* Native modality of one model id. Exact match only: a new model never
+* inherits a classification from its family, its display name, or the
+* platform's image flag.
+*/
+function nativeModalityOf(modelId) {
+	if (isRouterModelId(modelId)) return "router";
+	return NATIVE_MODALITY_BY_MODEL_ID[modelId] ?? "unknown";
+}
+/**
+* Whether a model refresh should PRE-CHECK this model's image box.
+*
+* Only a documented `multimodal` is pre-checked. `text` is documented as
+* unable to read images, and `unknown` is deliberately left unchecked rather
+* than guessed — the whole reason this table exists is that the platform flag
+* guessed wrong. A platform `supportsImages: false` still vetoes, so a
+* documented-multimodal id can never be pre-checked against the platform's
+* explicit "no".
+*
+* The user can always tick a box by hand; this decides a DEFAULT only, and the
+* effective runtime flag remains the saved `imageModelIds`.
+*/
+function imageDefaultFor(info) {
+	if (info.supportsImages === false) return false;
+	return NATIVE_MODALITY_BY_MODEL_ID[info.id] === "multimodal";
+}
+//#endregion
 //#region src/off-thinking.ts
 /**
 * Ids observed to REFUSE `reasoning_effort: "off"` with HTTP 400 despite
@@ -2328,6 +2393,18 @@ function parseUpstreamModel(value) {
 * is exposed rather than nothing: the roster is an upstream detail that may
 * change, and an empty answer would silently disarm the provider.
 *
+* ROUTERS ARE NOT MODELS. The upstream lists `auto` (CN) and its global
+* equivalents alongside real models, but those entries are ROUTING decisions,
+* not models: the gateway resolves them to whichever model it thinks fits, so
+* a row for one would offer a name whose price, context window and behaviour
+* are all decided at request time by something else. Selected this way it also
+* duplicates a real row — upstream resolves CN `auto` to `hy4-preview`, which
+* is already in the same roster. They are dropped here, at the single place
+* the roster is built, so the card, the picker, the probe and the discovery
+* route all agree. A user who already had one enabled keeps it through
+* `keepIds` below: this removes the OFFER, never a running model (issue #32's
+* failure mode).
+*
 * `keepIds` is the user's own selection riding along with the refresh. The
 * upstream roster may drop a model the user is actually running — the app
 * channel's `cli` roster dropped `minimax-m2.7` on 2026-10-21 while the SAME
@@ -2351,10 +2428,11 @@ function selectCliModels(rawModels, agents, keepIds = []) {
 		}
 	}
 	const ids = cliIds !== void 0 && cliIds.length > 0 ? cliIds : [...byId.keys()];
-	const models = ids.map((id) => byId.get(id)).filter((model) => model !== void 0);
-	if (models.length === 0) throw new Error("workbuddy model catalog resolved to an empty list");
+	const models = ids.filter((id) => !isRouterModelId(id)).map((id) => byId.get(id)).filter((model) => model !== void 0);
 	const kept = keepIds.filter((id) => !ids.includes(id)).map((id) => byId.get(id)).filter((model) => model !== void 0);
-	return [...models, ...kept];
+	const resolved = [...models, ...kept];
+	if (resolved.length === 0) throw new Error("workbuddy model catalog resolved to an empty list");
+	return resolved;
 }
 /**
 * The roster plus the promotion badges the SAME document carries.
@@ -4255,14 +4333,14 @@ var WorkBuddyCredentialStore = class {
 * Static CLI models captured from the CN endpoint (2026-08-30). The upstream
 * refresh replaces this list at startup; it exists so the provider registers
 * with a usable catalog even while the first fetch is in flight or offline.
+*
+* The upstream's `auto` ROUTER is deliberately absent, matching what
+* `selectCliModels` now does to the live roster: it resolves to a different
+* model per request, so it is not a row this plugin can describe. Keeping it
+* here would have reintroduced it on the offline/第一帧 path only, which is the
+* hardest kind of inconsistency to notice.
 */
 const FALLBACK_WORKBUDDY_MODELS = [
-	{
-		id: "auto",
-		name: "Auto",
-		contextWindow: 168e3,
-		maxTokens: 32e3
-	},
 	{
 		id: "hy3",
 		name: "Hy3",
@@ -4510,8 +4588,23 @@ function applyContextBudgets(catalog, budgets = {}) {
 		contextWindow: budgets[model.id] === void 0 ? model.contextWindow : Math.min(model.contextWindow, budgets[model.id])
 	}));
 }
+/**
+* Derive the runtime catalog from the last-refreshed directory plus the user's
+* selection.
+*
+* An empty selection means "never configured" and serves the whole directory.
+* But a NON-empty selection that intersects the directory in nothing must NOT
+* serve nothing: that is the issue #32 failure mode (the picker empties out),
+* and it now has a realistic trigger — a user whose only ticked model was the
+* upstream's `auto` router, which this version stops offering. Such a selection
+* degrades to the whole directory rather than to silence: the user asked for
+* "some models to be on", and the alternative is a region with no models at
+* all. An empty directory still yields an empty result; the guard is only about
+* a selection that no longer matches anything.
+*/
 function deriveCatalog(catalog, enabled, budgets = {}) {
-	return applyContextBudgets(enabled.size === 0 ? catalog : catalog.filter((model) => enabled.has(model.id)), budgets);
+	const selected = enabled.size === 0 ? catalog : catalog.filter((model) => enabled.has(model.id));
+	return applyContextBudgets(selected.length === 0 && enabled.size > 0 ? catalog : selected, budgets);
 }
 /**
 * Mutable catalog shared by the shim's `/v1/models` and the adapter.
@@ -4770,7 +4863,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.14.0";
+const WORKBUDDY_CONNECT_VERSION = "4.14.1";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -4928,4 +5021,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { withEffectiveOff as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, defaultOffModelIds as J, systemOpeningsOfBody as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, recordRefusal as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, offDefaultFor as X, lastRefusalFor as Y, offRefused as Z, WORKBUDDY_AUTH_FILENAME as _, writeFileAtomic as _t, readHostHeartbeat as a, findWorkbuddyAppExecutable as at, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, isWorkbuddyBundle as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, openEncryptedField as dt, WORKBUDDY_APP_EXECUTABLE_ENV as et, WorkBuddyCatalog as f, readAtRestKey as ft, ENCRYPTED_CREDENTIAL_CODE as g, withFileLock as gt, fallbackModelsFor as h, resolveDshHome as ht, processStartTimeMs as i, fetchAtRestKeyPayload as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, macosBundleExecutable as lt, deriveCatalog as m, hostPeersInfo as mt, clearHostHeartbeat as n, deriveAtRestKey as nt, workbuddyHostHeartbeatPath as o, findWorkbuddyAppExecutableWithSource as ot, applyContextBudgets as p, workbuddyAppExecutableCandidates as pt, REFUSES_OFF_MODEL_IDS as q, isHeartbeatProcessAlive as r, deriveAtRestKeyId as rt, writeHostHeartbeat as s, isEncryptedFieldWrapper as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, clearAtRestKeyCache as tt, FALLBACK_WORKBUDDY_MODELS as u, macosNestedAppBundles as ut, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, knownRegionOf as z };
+export { withEffectiveOff as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, defaultOffModelIds as J, systemOpeningsOfBody as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, recordRefusal as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, offDefaultFor as X, lastRefusalFor as Y, offRefused as Z, WORKBUDDY_AUTH_FILENAME as _, hostPeersInfo as _t, readHostHeartbeat as a, deriveAtRestKey as at, WorkBuddyEncryptedCredentialError as b, writeFileAtomic as bt, WORKBUDDY_CONNECT_VERSION as c, findWorkbuddyAppExecutable as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, isWorkbuddyBundle as dt, NATIVE_MODALITY_BY_MODEL_ID as et, WorkBuddyCatalog as f, macosBundleExecutable as ft, ENCRYPTED_CREDENTIAL_CODE as g, workbuddyAppExecutableCandidates as gt, fallbackModelsFor as h, readAtRestKey as ht, processStartTimeMs as i, clearAtRestKeyCache as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, findWorkbuddyAppExecutableWithSource as lt, deriveCatalog as m, openEncryptedField as mt, clearHostHeartbeat as n, nativeModalityOf as nt, workbuddyHostHeartbeatPath as o, deriveAtRestKeyId as ot, applyContextBudgets as p, macosNestedAppBundles as pt, REFUSES_OFF_MODEL_IDS as q, isHeartbeatProcessAlive as r, WORKBUDDY_APP_EXECUTABLE_ENV as rt, writeHostHeartbeat as s, fetchAtRestKeyPayload as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, imageDefaultFor as tt, FALLBACK_WORKBUDDY_MODELS as u, isEncryptedFieldWrapper as ut, WORKBUDDY_AUTH_FILE_ENV as v, resolveDshHome as vt, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, withFileLock as yt, knownRegionOf as z };

package/lib/index.d.ts

@@ -1286,6 +1286,12 @@ type WorkBuddyModelInfo = WorkBuddyUpstreamModel;
  * Static CLI models captured from the CN endpoint (2026-08-30). The upstream
  * refresh replaces this list at startup; it exists so the provider registers
  * with a usable catalog even while the first fetch is in flight or offline.
+ *
+ * The upstream's `auto` ROUTER is deliberately absent, matching what
+ * `selectCliModels` now does to the live roster: it resolves to a different
+ * model per request, so it is not a row this plugin can describe. Keeping it
+ * here would have reintroduced it on the offline/第一帧 path only, which is the
+ * hardest kind of inconsistency to notice.
  */
 declare const FALLBACK_WORKBUDDY_MODELS: readonly WorkBuddyModelInfo[];
 /**
@@ -1312,6 +1318,20 @@ declare function fallbackModelsFor(region: 'cn' | 'global'): readonly WorkBuddyM
  * never been configured must still serve models rather than nothing.
  */
 type WorkBuddyContextBudget = number;
+/**
+ * Derive the runtime catalog from the last-refreshed directory plus the user's
+ * selection.
+ *
+ * An empty selection means "never configured" and serves the whole directory.
+ * But a NON-empty selection that intersects the directory in nothing must NOT
+ * serve nothing: that is the issue #32 failure mode (the picker empties out),
+ * and it now has a realistic trigger — a user whose only ticked model was the
+ * upstream's `auto` router, which this version stops offering. Such a selection
+ * degrades to the whole directory rather than to silence: the user asked for
+ * "some models to be on", and the alternative is a region with no models at
+ * all. An empty directory still yields an empty result; the guard is only about
+ * a selection that no longer matches anything.
+ */
 declare function deriveCatalog(catalog: readonly WorkBuddyModelInfo[], enabled: ReadonlySet<string>, budgets?: Readonly<Record<string, WorkBuddyContextBudget | undefined>>): WorkBuddyModelInfo[];
 /**
  * Mutable catalog shared by the shim's `/v1/models` and the adapter.

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as withEffectiveOff, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as defaultOffModelIds, K as systemOpeningsOfBody, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as recordRefusal, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as offDefaultFor, Y as lastRefusalFor, Z as offRefused, _ as WORKBUDDY_AUTH_FILENAME, _t as writeFileAtomic, a as readHostHeartbeat, at as findWorkbuddyAppExecutable, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as isWorkbuddyBundle, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as openEncryptedField, et as WORKBUDDY_APP_EXECUTABLE_ENV, f as WorkBuddyCatalog, ft as readAtRestKey, g as ENCRYPTED_CREDENTIAL_CODE, gt as withFileLock, h as fallbackModelsFor, ht as resolveDshHome, i as processStartTimeMs, it as fetchAtRestKeyPayload, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as macosBundleExecutable, m as deriveCatalog, n as clearHostHeartbeat, nt as deriveAtRestKey, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, pt as workbuddyAppExecutableCandidates, q as REFUSES_OFF_MODEL_IDS, r as isHeartbeatProcessAlive, rt as deriveAtRestKeyId, s as writeHostHeartbeat, st as isEncryptedFieldWrapper, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as clearAtRestKeyCache, u as FALLBACK_WORKBUDDY_MODELS, ut as macosNestedAppBundles, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-B1I95fKS.js";
+import { $ as withEffectiveOff, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as defaultOffModelIds, K as systemOpeningsOfBody, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as recordRefusal, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as offDefaultFor, Y as lastRefusalFor, Z as offRefused, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as deriveAtRestKey, b as WorkBuddyEncryptedCredentialError, bt as writeFileAtomic, c as WORKBUDDY_CONNECT_VERSION, ct as findWorkbuddyAppExecutable, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as isWorkbuddyBundle, et as NATIVE_MODALITY_BY_MODEL_ID, f as WorkBuddyCatalog, ft as macosBundleExecutable, g as ENCRYPTED_CREDENTIAL_CODE, gt as workbuddyAppExecutableCandidates, h as fallbackModelsFor, ht as readAtRestKey, i as processStartTimeMs, it as clearAtRestKeyCache, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, m as deriveCatalog, mt as openEncryptedField, n as clearHostHeartbeat, nt as nativeModalityOf, o as workbuddyHostHeartbeatPath, ot as deriveAtRestKeyId, p as applyContextBudgets, pt as macosNestedAppBundles, q as REFUSES_OFF_MODEL_IDS, r as isHeartbeatProcessAlive, rt as WORKBUDDY_APP_EXECUTABLE_ENV, s as writeHostHeartbeat, st as fetchAtRestKeyPayload, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as imageDefaultFor, u as FALLBACK_WORKBUDDY_MODELS, ut as isEncryptedFieldWrapper, v as WORKBUDDY_AUTH_FILE_ENV, vt as resolveDshHome, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, yt as withFileLock, z as knownRegionOf } from "./host-heartbeat-D1WnqQY2.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -6173,55 +6173,6 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 	}, "dsh-connect-workbuddy: Web status route");
 }
 //#endregion
-//#region src/native-modality.ts
-/**
-* Reviewed vendor classifications, keyed by EXACT model id (never a prefix).
-* Ids absent from this record are `unknown` — see {@link nativeModalityOf}.
-*/
-const NATIVE_MODALITY_BY_MODEL_ID = {
-	"deepseek-v4-pro": "text",
-	"glm-5.1": "text",
-	"glm-5.2": "text",
-	"glm-5.3": "text",
-	"hy3": "text",
-	"hy4-preview": "text",
-	"deepseek-v4.1-flash": "multimodal",
-	"glm-5.3-flash": "multimodal",
-	"glm-5v-turbo": "multimodal",
-	"kimi-k2.6": "multimodal",
-	"kimi-k2.7": "multimodal",
-	"kimi-k3-1": "multimodal",
-	"minimax-m3": "multimodal"
-};
-/** The `auto` entry is a router that picks a model, not a model itself. */
-const ROUTER_MODEL_ID = "auto";
-/**
-* Native modality of one model id. Exact match only: a new model never
-* inherits a classification from its family, its display name, or the
-* platform's image flag.
-*/
-function nativeModalityOf(modelId) {
-	if (modelId === ROUTER_MODEL_ID) return "router";
-	return NATIVE_MODALITY_BY_MODEL_ID[modelId] ?? "unknown";
-}
-/**
-* Whether a model refresh should PRE-CHECK this model's image box.
-*
-* Only a documented `multimodal` is pre-checked. `text` is documented as
-* unable to read images, and `unknown` is deliberately left unchecked rather
-* than guessed — the whole reason this table exists is that the platform flag
-* guessed wrong. A platform `supportsImages: false` still vetoes, so a
-* documented-multimodal id can never be pre-checked against the platform's
-* explicit "no".
-*
-* The user can always tick a box by hand; this decides a DEFAULT only, and the
-* effective runtime flag remains the saved `imageModelIds`.
-*/
-function imageDefaultFor(info) {
-	if (info.supportsImages === false) return false;
-	return NATIVE_MODALITY_BY_MODEL_ID[info.id] === "multimodal";
-}
-//#endregion
 //#region src/index.ts
 /** Stable Cordis plugin name. */
 const name = "dsh-connect-workbuddy";

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型（国内版与国际版）接入 DeepSeek Harness：每次刷新按上游目录自动读取每个模型的积分倍率，支持逐模型图片输入开关、多账号切换与账号池自动换号，并提供每日签到、卡片与输入框里的胶囊积分读数等只读积分概览。",
-  "version": "4.14.0",
+  "version": "4.14.1",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",