dsh-connect-workbuddy 4.4.4 → 4.4.6

package/lib/index.d.ts

@@ -640,23 +640,36 @@ interface WorkBuddyUpstreamModel {
 interface WorkBuddyCreditPackage {
   packageName: string;
   /**
-   * Remaining credit, always read from `CapacityRemain` (issue #48).
+   * Remaining credit, always read from the CYCLE family (issue #58).
    *
    * The upstream reports a monthly resource (`CapacityType 4`) with TWO
-   * capacity families, and they answer different questions:
-   *
-   * - `CapacityRemain` / `CapacitySize` / `CapacityUsed` — the capacity POOL.
-   * - `CycleCapacityRemain` / `CycleCapacitySize` / `CycleCapacityUsed` — the
-   *   CURRENT BILLING CYCLE.
-   *
-   * "How much credit do I have" is the pool, so that is what this field
-   * carries. Reading `CycleCapacityRemain` here was the defect: on three real
-   * global accounts the upstream returned `CapacityRemain=100` together with
-   * `CycleCapacityRemain=0` and `CycleCapacityUsed=100` inside an UNFINISHED
-   * cycle (`CycleEndTime` days out, `Status=0`), so the plugin reported 0
-   * credits for accounts that were not exhausted at all.
+   * capacity families, and for a long time this field carried the POOL one on
+   * the theory that the pool answers "how much do I have" (issue #48). That was
+   * wrong, and the official client settles it: on a live CN account the client
+   * shows `总剩余积分 2,196.61` = `套餐基础积分 500` + `平台奖励积分 1,696.61`,
+   * which is EXACTLY Σ `CycleCapacityRemainPrecise` over the same response
+   * (1696.61 + 500), while Σ `CapacityRemain` is 2,196 — the pool figure lands
+   * on the right integer only because that account's cycle is untouched, and
+   * the cent is what proves which family the client reads.
+   *
+   * The pool family is not a balance at all: on a monthly resource whose cycle
+   * is fully spent it still reports `CapacityRemain=500, CapacityUsed=0`, i.e.
+   * "nothing used, everything left", while the cycle reports
+   * `CycleCapacityUsed=500`. Read as a balance it OVER-reports by the whole
+   * monthly allowance of every account (measured on 8/8 CN accounts: pool and
+   * cycle agree only where the cycle is untouched).
+   *
+   * Independent confirmation comes from the international gateway: three global
+   * accounts report `CapacityRemain=100` while the gateway REFUSES their chat
+   * requests with `14018 Credits exhausted`, so the pool figure is not spendable
+   * credit there either.
+   *
+   * A gift (`CapacityType 1`) carries both families with identical values, so
+   * reading the cycle uniformly costs nothing and removes the branch that
+   * produced the defect.
    */
   remain: number;
+  /** The package's capacity, from the same family as {@link remain}. */
   size: number;
   /** CapacityType 4: refreshed every cycle and never expires. */
   monthly: boolean;
@@ -664,16 +677,6 @@ interface WorkBuddyCreditPackage {
   refreshAtMs?: number;
   /** One-off expiry; the package disappears from the account at this time. */
   expiresAtMs?: number;
-  /**
-   * Remaining credit in the CURRENT cycle; only on monthly packages.
-   *
-   * Kept beside {@link remain} because it answers the one question the pool
-   * total cannot: whether THIS cycle's allowance is spent. That is what makes
-   * `refreshAtMs` meaningful — "you are out until the cycle resets" is a
-   * different statement from "you are out of credit", and only the cycle
-   * figure can tell them apart.
-   */
-  cycleRemain?: number;
 }
 /** Aggregated credit answer for one credential. */
 interface WorkBuddyCredits {
@@ -795,6 +798,15 @@ declare function knownRegionOf(domain: string): WorkBuddyRegion | undefined;
  * `tool_choice` (the upstream's field is a string; object forms return 400),
  * and guarantee a leading system message.
  */
+/**
+ * The model id a prepared body asks for, when it carries one (issue #61).
+ *
+ * Lives beside {@link prepareChatBody} because it reads the same shape: the
+ * serialized OpenAI body, after this plugin's rewrites. Never throws — a
+ * malformed body is the upstream's to reject, not a reason to lose the failure
+ * measurement that this id is needed for.
+ */
+declare function modelIdOfBody(bodyJson: string): string | undefined;
 declare function prepareChatBody(source: string): string;
 /** Marker carried by {@link WorkBuddyCredentialRejectedError}; survives bundling. */
 declare const CREDENTIAL_REJECTED_CODE = "WORKBUDDY_CREDENTIAL_REJECTED";
@@ -1104,7 +1116,29 @@ interface WorkBuddyShimOptions {
     status: number;
     kind: UpstreamErrorKind;
     message: string;
+    /**
+     * The model that request asked for (issue #61).
+     *
+     * Carried because the failure is remembered against the ACCOUNT, and `6004`
+     * is an account × model condition: without this the record cannot say which
+     * model the measurement belongs to, so the card has to present a
+     * single-model result as account-level availability.
+     */
+    modelId?: string;
   }) => void;
+  /**
+   * Called with the FINAL serialized body of every chat request, just before it
+   * goes upstream (issue #59).
+   *
+   * It exists so the plugin can record what was actually sent without the shim
+   * having to know where that record goes: the region belongs to whoever wires
+   * this up, and the report is a plugin concern. The body handed over is the
+   * post-`prepareChatBody` one, because THAT is what the upstream counts.
+   *
+   * Fired without awaiting: a request must never wait on a diagnostic. The
+   * callee must treat the string as read-only.
+   */
+  onRequestBody?: (bodyJson: string) => void;
 }
 /**
  * Start the loopback endpoint. Requests must carry the shim's shared secret;
@@ -1941,6 +1975,49 @@ interface WorkBuddyPoolProbe {
    * old probe files stay readable rather than being discarded.
    */
   message?: string;
+  /**
+   * WHICH MODEL this measurement is about (issue #61).
+   *
+   * The pool's "test all accounts" action probes ONE model — the region's
+   * `targetModelId` — while `6004` is an ACCOUNT × MODEL condition: the reporter
+   * measured two accounts where `hy4-preview-f` answered and `step-5-preview`
+   * returned `429 / 6004` at the same moment. A row rendered as plain "可用"
+   * therefore claims more than the measurement says, and the pool's own routing
+   * reads that `ok` as an account-level fact.
+   *
+   * Storing the model id is what makes the claim checkable: the card can say
+   * WHICH model an `ok` came from, and a reader can see that a different model
+   * was never tested at all. `probeModel()` has always returned this field; the
+   * write simply dropped it.
+   *
+   * Deliberately NOT inherited by {@link mergePoolProbe} when an update omits it
+   * — the opposite of `accountName` and `retryAtMs`. Those two describe the
+   * ACCOUNT (a name that a later writer could not see is still true, and a
+   * future refresh time is still in the future), whereas the model describes
+   * THIS measurement. Carrying an older model id forward would relabel a fresh
+   * measurement with a model it was not taken on, which is exactly the confusion
+   * this field exists to end. ABSENT therefore means "unknown scope", never a
+   * guess.
+   */
+  modelId?: string;
+  /**
+   * The account's display name AT THE MOMENT IT WAS MEASURED (issue #60).
+   *
+   * Stored because a saved pool member can outlive its sign-in. Once the
+   * desktop app drops a login, that id resolves to no listed account, so the
+   * card has nothing left to render for it — and the old warning ("1 saved
+   * account is no longer signed in") was a count with no subject, leaving the
+   * user unable to tell WHICH account had gone. The name was in hand at write
+   * time (both writers already carry it) and nowhere afterwards, so the record
+   * is the only place it can survive.
+   *
+   * ABSENT on records written before this field existed, and when the desktop
+   * app recorded no name: the card then falls back to a short id prefix rather
+   * than inventing a label. Snapshots are never refreshed from a LISTING — only
+   * a real measurement writes this, so a stale name cannot be "confirmed" by a
+   * routine scan that never saw the account.
+   */
+  accountName?: string;
 }
 /** One account's live credit situation, as the pool ranks it. */
 interface WorkBuddyPoolCredits {
@@ -2104,13 +2181,6 @@ interface WorkBuddyWebCreditPackage {
   size: number;
   /** CapacityType 4: refreshed every cycle and never expires. */
   monthly: boolean;
-  /**
-   * Balance of the CURRENT cycle (`CycleCapacityRemain`); only on monthly
-   * packages. `0` on a live package means this cycle's allowance is spent,
-   * which is what {@link cycleRefreshMs} is telling the user to wait for — and
-   * is deliberately NOT the same as {@link remain} being 0 (issue #48).
-   */
-  cycleRemain?: number;
   /** Next cycle start (the monthly refresh point) in ms; only on monthly packages. */
   cycleRefreshMs?: number;
   /** One-off expiry in ms; the package disappears from the account then. */
@@ -2469,7 +2539,13 @@ interface WorkBuddyWebPoolAccount {
   expiringSoon?: number;
   /** When the nearest package expires, in ms. */
   nearestExpiryMs?: number;
-  /** The last test of the target model, absent when never tested. */
+  /**
+   * The last test of this account's target model, absent when never tested.
+   *
+   * The model is recorded INSIDE the probe (issue #61) rather than assumed from
+   * the row's current setting: the setting can be changed after the test, and a
+   * result must keep naming what it actually measured.
+   */
   probe?: {
     outcome: WorkBuddyWebProbeOutcome;
     atMs: number;
@@ -2481,6 +2557,16 @@ interface WorkBuddyWebPoolAccount {
      * guess which of the two it was.
      */
     source?: 'test-batch' | 'live-request';
+    /**
+     * WHICH model this measurement is about (issue #61).
+     *
+     * `6004` is an account × model condition, so an `ok` without a model reads as
+     * account-level availability — which is exactly the false positive the
+     * reporter hit: the card said 可用 for two accounts whose actual model
+     * returned `429 / 6004`. ABSENT for records written before the field existed;
+     * the card must then say the scope is unknown rather than assume it.
+     */
+    modelId?: string;
     /** Only when the upstream named a time; never invented locally. */
     retryAtMs?: number;
     /**
@@ -2513,6 +2599,17 @@ interface WorkBuddyWebPoolAccount {
    * result the user just watched succeed.
    */
   checkedInToday?: boolean;
+  /**
+   * The model a TEST of this row would use (issue #61).
+   *
+   * Per row, because a test model can be chosen per account: the card shows it
+   * beside the row it applies to rather than implying one model for the table.
+   */
+  testModelId?: string;
+  /** Where this row's test target came from (see {@link WorkBuddyWebPool.targetModelSource}). */
+  testModelSource?: 'preferred' | 'free' | 'none' | 'stale';
+  /** This row's saved override that the region no longer offers. */
+  staleTestModelId?: string;
 }
 /**
  * The pool's state for one region.
@@ -2542,6 +2639,14 @@ interface WorkBuddyWebPool {
    * would run against a model the upstream does not offer.
    */
   staleTargetModelId?: string;
+  /**
+   * The SAVED per-account test models, keyed by account id (issue #61).
+   *
+   * Sent verbatim rather than as the effective set: the card edits this map, and
+   * an id whose model has left the catalog must survive a save so the user's
+   * record of what they chose is not silently destroyed.
+   */
+  targetModelIdByAccount?: Readonly<Record<string, string>>;
   /**
    * Where the target came from. `'stale'` means the SAVED id is no longer in
    * the catalog — a distinct state from `'none'` (no free model exists),
@@ -2567,6 +2672,17 @@ interface WorkBuddyWebPool {
    * ran on ZERO accounts and reported success.
    */
   effectiveMemberAccountIds?: readonly string[];
+  /**
+   * Last measured display name per saved member id (issue #60).
+   *
+   * Only ids the roster above does NOT list are useful here: those are the
+   * members whose sign-in has gone, and whose name therefore survives nowhere
+   * else. The card renders a name when there is one and a short id prefix when
+   * there is not — the point is that the ghost warning stops being a
+   * subjectless count ("1 saved account is no longer signed in") that the user
+   * has no way to act on.
+   */
+  memberNames?: Readonly<Record<string, string>>;
   accounts: readonly WorkBuddyWebPoolAccount[];
   /**
    * The models a manual target can be chosen from.
@@ -2815,6 +2931,8 @@ interface WorkBuddyPoolDeps {
   preferences(region: WorkBuddyRegion): {
     enabled: boolean;
     targetModelId: string;
+    /** Per-account override of `targetModelId` (issue #61). */
+    targetModelIdByAccount?: Readonly<Record<string, string>>;
     /**
      * Tokens each test probe sends as saved; `0` when the user never chose.
      *
@@ -2837,6 +2955,16 @@ interface WorkBuddyPoolDeps {
    * checked) instead of passing the guard and running a batch over nothing.
    */
   effectiveMemberAccountIds?(region: WorkBuddyRegion): Promise<readonly string[]>;
+  /**
+   * Last display name measured for each of a region's saved member ids
+   * (issue #60), from the runtime probe store — no upstream call.
+   *
+   * The card needs this for the one case it cannot answer from its own props: a
+   * saved member whose sign-in is gone resolves to no listed account, so its
+   * name exists ONLY in the measurement that once saw it. Optional: a Host
+   * built without it still renders, with the id-prefix fallback.
+   */
+  memberNames?(region: WorkBuddyRegion): Promise<Readonly<Record<string, string>>>;
   /**
    * Test ONE account against the region's target model.
    *
@@ -2900,7 +3028,18 @@ interface WorkBuddyPoolDeps {
    * the route handles both, because a missing reporter must degrade to the
    * previous behaviour rather than to no rows at all.
    */
-  test?(region: WorkBuddyRegion, modelId: string, onRow?: (row: WorkBuddyPoolTestRow) => void): Promise<readonly WorkBuddyPoolTestRow[]>;
+  test?(region: WorkBuddyRegion,
+  /**
+   * One model for the whole batch, or a per-account resolver (issue #61).
+   *
+   * The resolver form is what lets a batch honour a per-account test model; a
+   * resolver that names no model yields an `unavailable` row for that account
+   * rather than silently testing the region default.
+   */
+  modelId: string | ((accountId: string) => {
+    modelId?: string;
+    staleModelId?: string;
+  }), onRow?: (row: WorkBuddyPoolTestRow) => void): Promise<readonly WorkBuddyPoolTestRow[]>;
   /** The region's live catalog, used to resolve the free target model. */
   catalog?(region: WorkBuddyRegion): readonly WorkBuddyModelInfo[];
 }
@@ -3010,6 +3149,18 @@ interface WorkBuddyPoolPreferences {
   enabled?: boolean;
   /** Model id to test; `''` means auto-pick a free model from this region. */
   targetModelId?: string;
+  /**
+   * Per-account override of {@link targetModelId}, keyed by account id (#61).
+   *
+   * `6004` is an ACCOUNT × MODEL condition, so "can this account serve" has no
+   * single answer: the reporter measured two accounts where one model answered
+   * and another returned `429 / 6004` in the same second. The region-wide target
+   * stays the default — this map only says "for THIS account, test THAT model",
+   * which is what makes the pool's verdict match the model the user is actually
+   * chatting with. An id that is no longer in the catalog is reported as stale
+   * rather than replaced, so no credits are spent on a model nobody chose.
+   */
+  targetModelIdByAccount?: Record<string, string>;
   /**
    * How much input a probe sends, in tokens — the pool's biggest single knob.
    *
@@ -3181,4 +3332,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, modelIdOfBody, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };