dsh-connect-workbuddy 4.4.4 → 4.4.6

package/lib/index.js

@@ -1,6 +1,6 @@
-import { $ as isWorkbuddyBundle, A as workbuddyAccountId, B as parseCreditMultiplier, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, H as parseUpstreamModel, I as classifyUpstreamError, J as deriveAtRestKeyId, K as clearAtRestKeyCache, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as isEncryptedFieldWrapper, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as prepareChatBody, V as parseReasoning, W as regionOf, X as findWorkbuddyAppExecutable, Y as fetchAtRestKeyPayload, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as writeFileAtomic, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as macosBundleExecutable, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as workbuddyAppExecutableCandidates, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as openEncryptedField, o as workbuddyHostHeartbeatPath, ot as resolveDshHome, p as applyContextBudgets, q as deriveAtRestKey, r as isHeartbeatProcessAlive, rt as readAtRestKey, s as writeHostHeartbeat, st as withFileLock, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosNestedAppBundles, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-BwbDWvzw.js";
+import { $ as isEncryptedFieldWrapper, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as deriveAtRestKey, K as WORKBUDDY_APP_EXECUTABLE_ENV, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as fetchAtRestKeyPayload, Y as deriveAtRestKeyId, Z as findWorkbuddyAppExecutable, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as workbuddyAppExecutableCandidates, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as withFileLock, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as isWorkbuddyBundle, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as readAtRestKey, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as writeFileAtomic, m as deriveCatalog, n as clearHostHeartbeat, nt as macosNestedAppBundles, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as clearAtRestKeyCache, r as isHeartbeatProcessAlive, rt as openEncryptedField, s as writeHostHeartbeat, st as resolveDshHome, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosBundleExecutable, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-B2jrUDhg.js";
 import z from "@deepseek-ai/schemastery";
-import { readFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { join } from "node:path";
 import { createProvider } from "@earendil-works/pi-ai";
@@ -1776,6 +1776,7 @@ function createWorkBuddyShim(options) {
 	const failoverAccount = options.failoverAccount;
 	const prepareAccount = options.prepareAccount;
 	const onAccountFailure = options.onAccountFailure;
+	const onRequestBody = options.onRequestBody;
 	const SHARED_SECRET = randomBytes(32).toString("base64url");
 	/** Constant-time bearer check; absent or mismatched bearers are rejected. */
 	function bearerOk(req) {
@@ -1886,6 +1887,12 @@ function createWorkBuddyShim(options) {
 		}
 		const raw = (await readBody(req)).toString("utf8");
 		const prepared = prepareChatBody(raw);
+		const requestModelId = modelIdOfBody(prepared);
+		if (onRequestBody !== void 0) try {
+			onRequestBody(prepared);
+		} catch (error) {
+			logger?.warn("dsh-connect-workbuddy: body report failed", error);
+		}
 		const controller = new AbortController();
 		res.on("close", () => controller.abort());
 		let result = await client.chatStream(credential, prepared, controller.signal);
@@ -1929,7 +1936,8 @@ function createWorkBuddyShim(options) {
 					onAccountFailure(entry.accountId, {
 						status: entry.failure.status,
 						kind: entry.failure.kind,
-						message: entry.failure.message
+						message: entry.failure.message,
+						...requestModelId === void 0 ? {} : { modelId: requestModelId }
 					});
 				} catch (error) {
 					logger?.warn("dsh-connect-workbuddy: recording an account failure failed", error);
@@ -2042,6 +2050,246 @@ function createWorkBuddyShim(options) {
 	};
 }
 //#endregion
+//#region src/body-report.ts
+/**
+* Body-composition report: WHAT was sent upstream, in counts (issue #59).
+*
+* WHY THIS EXISTS. Issue #59's reporter measured the SAME conversation charged
+* ~708K tokens by the CN gateway and ~1.374M by the international one (1.94×),
+* which turns a region switch into an instant `code 11115 prompt is too long`.
+* Two worlds explain that, and they have opposite owners:
+*
+*   - the gateways count identical bytes differently (upstream's business); or
+*   - the two requests did not carry the same messages (ours to fix).
+*
+* The second world was left standing by two independent measurements. The
+* reporter ran this project's `--kind`/`--language` probe on BOTH regions and
+* got the same tokens-per-1000-chars on byte-identical prose, code and JSON
+* (ratios 0.98–1.06 across six cells), so identical bytes really do bill
+* identically. And a code trace showed historical `reasoning` never reaches the
+* wire at all: pi-ai only forwards `thinking` blocks as text when
+* `compat.requiresThinkingAsText` is set — this plugin never sets it — and the
+* `reasoning_details` route needs a signature the stream parser never writes.
+* With the counting difference excluded and reasoning excluded, the remaining
+* candidate is that the two bodies differ in the first place.
+*
+* This module exists to settle exactly that, and it can do it WITHOUT either
+* region having credit: the body is assembled locally, before the upstream ever
+* gets a chance to answer `14018 Credits exhausted`. Capture one composition per
+* region in the same session and diff them.
+*
+* It records COUNTS ONLY — never a byte of message text, no account name, no
+* token. That is a hard rule, not a default: the point is to compare shape
+* (`messages.length`, per-block type, CJK vs non-CJK characters, total bytes),
+* and every one of those is answerable arithmetically. `tests/issue59-body-report.spec.ts`
+* asserts the report cannot leak a fixture's text.
+*/
+/**
+* Environment variable that enables the report.
+*
+* Unset or blank means OFF — a diagnostic that writes files must be opt-in.
+* `1`/`true` writes to `<DSH home>/body-reports/`; anything else is read as a
+* directory path, so a user can point it at an existing folder (and, on
+* Windows, one with spaces).
+*/
+const WORKBUDDY_BODY_REPORT_ENV = "WORKBUDDY_BODY_REPORT";
+/**
+* Character ranges that tokenize (and therefore bill) like CJK.
+*
+* Deliberately generous: the caller's question is "how much of this is the ~3×
+* kind", and the measured spread is 0.669 vs 0.224 tokens/char, so a character
+* class that is borderline costs far less than mis-attributing a whole bucket.
+* Ranges follow Unicode blocks, plus the compatibility forms and the two
+* extension planes where rare Han characters live.
+*/
+const CJK_RANGES = [
+	[11904, 12031],
+	[12288, 12351],
+	[12352, 12543],
+	[13312, 19903],
+	[19968, 40959],
+	[63744, 64255],
+	[65072, 65103],
+	[65280, 65519],
+	[131072, 195103]
+];
+/** Whether one code point bills like CJK. */
+function isCjkCodePoint(code) {
+	return CJK_RANGES.some(([low, high]) => code >= low && code <= high);
+}
+/** Count characters (code points) and how many of them are CJK. */
+function countChars(text) {
+	let chars = 0;
+	let cjkChars = 0;
+	for (const character of text) {
+		chars += 1;
+		const code = character.codePointAt(0);
+		if (code !== void 0 && isCjkCodePoint(code)) cjkChars += 1;
+	}
+	return {
+		chars,
+		cjkChars
+	};
+}
+/** Build one block report from already-extracted text. */
+function block(type, text) {
+	return {
+		type,
+		...countChars(text)
+	};
+}
+/** Whether a value is a plain object (not null, not an array). */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Describe one message's blocks.
+*
+* The role decides what a content string IS, and that is not cosmetic: a
+* `tool` message's payload is a tool result, so counting it as `text` would hide
+* the very bucket a long agentic session is mostly made of.
+*/
+function describeMessage(message) {
+	const role = typeof message["role"] === "string" ? message["role"] : "unknown";
+	const blocks = [];
+	const content = message["content"];
+	/**
+	* The block type a plain string carries, by the ROLE carrying it.
+	*
+	* A `tool` message's string is a tool RESULT and a `system` one is the system
+	* prompt; calling both `text` would fold the biggest bucket of a long agentic
+	* session into the smallest one, which is the opposite of what a composition
+	* report is for.
+	*/
+	const stringType = role === "tool" ? "tool-result" : role === "system" || role === "developer" ? "system" : "text";
+	if (typeof content === "string") {
+		if (content !== "") blocks.push(block(stringType, content));
+	} else if (Array.isArray(content)) for (const part of content) {
+		if (!isRecord(part)) continue;
+		const type = typeof part["type"] === "string" ? part["type"] : "unknown";
+		if (type === "text") {
+			const text = part["text"];
+			if (typeof text === "string" && text !== "") blocks.push(block(stringType, text));
+			continue;
+		}
+		blocks.push({
+			type: type === "image_url" ? "image" : type,
+			chars: 0,
+			cjkChars: 0
+		});
+	}
+	const toolCalls = message["tool_calls"];
+	if (Array.isArray(toolCalls)) for (const call of toolCalls) {
+		if (!isRecord(call)) continue;
+		const fn = call["function"];
+		const name = isRecord(fn) && typeof fn["name"] === "string" ? fn["name"] : "";
+		const args = isRecord(fn) && typeof fn["arguments"] === "string" ? fn["arguments"] : "";
+		blocks.push(block("tool-call", `${name}${args}`));
+	}
+	for (const field of [
+		"reasoning_content",
+		"reasoning",
+		"reasoning_text"
+	]) {
+		const value = message[field];
+		if (typeof value === "string" && value !== "") blocks.push(block("reasoning", value));
+	}
+	return {
+		role,
+		chars: blocks.reduce((sum, entry) => sum + entry.chars, 0),
+		cjkChars: blocks.reduce((sum, entry) => sum + entry.cjkChars, 0),
+		blocks
+	};
+}
+/**
+* Describe one serialized request body.
+*
+* Returns `undefined` when the body is not a JSON object — a diagnostic must
+* never be the reason a chat request fails, so every caller treats `undefined`
+* as "nothing to report" rather than an error.
+*/
+function describeBody(bodyJson, region, nowMs) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyJson);
+	} catch {
+		return;
+	}
+	if (!isRecord(parsed)) return void 0;
+	const rawMessages = parsed["messages"];
+	const messages = Array.isArray(rawMessages) ? rawMessages.filter(isRecord).map(describeMessage) : [];
+	const rawTools = parsed["tools"];
+	const tools = Array.isArray(rawTools) ? block("tools", rawTools.map((tool) => isRecord(tool) ? JSON.stringify(tool) : "").join("")) : {
+		type: "tools",
+		chars: 0,
+		cjkChars: 0
+	};
+	const chars = messages.reduce((sum, message) => sum + message.chars, 0) + tools.chars;
+	const cjkChars = messages.reduce((sum, message) => sum + message.cjkChars, 0) + tools.cjkChars;
+	return {
+		at: new Date(nowMs).toISOString(),
+		region,
+		...typeof parsed["model"] === "string" ? { model: parsed["model"] } : {},
+		bodyBytes: Buffer.byteLength(bodyJson, "utf8"),
+		messageCount: messages.length,
+		chars,
+		cjkChars,
+		tools,
+		messages
+	};
+}
+/**
+* Resolve the directory the report writes to, or `undefined` when disabled.
+*
+* Exported for the same reason the other env-var resolvers in this plugin are:
+* the behaviour is worth a unit test, and the test must not have to set a real
+* process-wide variable to get one.
+*/
+function bodyReportDirectory(env = process.env) {
+	const configured = env[WORKBUDDY_BODY_REPORT_ENV];
+	if (configured === void 0) return void 0;
+	const trimmed = configured.trim();
+	if (trimmed === "") return void 0;
+	if (trimmed === "1" || trimmed.toLowerCase() === "true") return join(resolveDshHome(), "body-reports");
+	return trimmed;
+}
+/**
+* Append one composition to `<dir>/<region>.jsonl`.
+*
+* One file per region is the whole point: the reporter captures a session, then
+* diffs `cn.jsonl`'s last line against `global.jsonl`'s. JSON Lines rather than
+* one file per request because a single turn makes many upstream calls (one per
+* tool step) and the LAST one is the interesting one.
+*
+* Read-modify-write is avoided on purpose — a long session would rewrite a
+* growing file on every step. The lock keeps two concurrent requests from
+* interleaving a line.
+*/
+async function appendBodyReport(directory, report) {
+	const file = join(directory, `${report.region}.jsonl`);
+	await mkdir(directory, { recursive: true });
+	const line = `${JSON.stringify(report)}\n`;
+	await withFileLock(file, () => appendFile(file, line, "utf8"));
+}
+/**
+* Record one outgoing body, if the report is enabled.
+*
+* NEVER THROWS and never awaits long: this is called on the request path, and a
+* chat request must not fail (or stall) because a diagnostic could not write a
+* file. A failure is reported through `onError` so the caller can log it.
+*/
+async function recordBodyReport(region, bodyJson, options = {}) {
+	const directory = bodyReportDirectory(options.env);
+	if (directory === void 0) return;
+	try {
+		const report = describeBody(bodyJson, region, options.nowMs ?? Date.now());
+		if (report === void 0) return;
+		await appendBodyReport(directory, report);
+	} catch (error) {
+		options.onError?.(error);
+	}
+}
+//#endregion
 //#region src/probe.ts
 /**
 * How long to bench a MODEL that answered 14003 with no stated time.
@@ -2504,7 +2752,22 @@ async function testAllAccounts(targets, modelId, deps, onRow) {
 	const rows = [];
 	for (const [index, target] of targets.entries()) {
 		if (index > 0) await (deps.wait ?? defaultWait)(400);
-		const row = await testOne(target, modelId, deps);
+		const wanted = typeof modelId === "function" ? modelId(target.accountId) : { modelId };
+		if (wanted.modelId === void 0) {
+			const row = {
+				accountId: target.accountId,
+				accountName: target.accountName,
+				result: {
+					modelId: wanted.staleModelId ?? "",
+					outcome: "unavailable",
+					message: wanted.staleModelId === void 0 ? "this region offers no model to test" : `the test model "${wanted.staleModelId}" is no longer offered in this region`
+				}
+			};
+			rows.push(row);
+			onRow?.(row);
+			continue;
+		}
+		const row = await testOne(target, wanted.modelId, deps);
 		rows.push(row);
 		onRow?.(row);
 	}
@@ -2567,6 +2830,8 @@ function probeUpdatesOf(rows) {
 			outcome: row.result.outcome,
 			atMs,
 			source: "test-batch",
+			modelId: row.result.modelId,
+			...row.accountName === "" ? {} : { accountName: row.accountName },
 			...row.result.retryAtMs === void 0 ? {} : { retryAtMs: row.result.retryAtMs },
 			...row.result.message === void 0 ? {} : { message: row.result.message }
 		};
@@ -2809,6 +3074,30 @@ function pickFreeModel(catalog) {
 * That is the safe direction: no credits are spent while the roster is unknown,
 * and the card offers to switch back to automatic.
 */
+/**
+* The model ONE account's test should target (issue #61).
+*
+* The region-wide `targetModelId` is one value, but `6004` is an ACCOUNT × MODEL
+* condition: the reporter measured two accounts where `hy4-preview-f` answered
+* `ok` and `step-5-preview` returned `429 / 6004` at the same moment. Testing
+* only the region's model therefore cannot answer "can this account serve the
+* model I actually use", which is the question the pool's test button is read as
+* answering.
+*
+* A per-account override is the smallest thing that makes the question
+* answerable, and it is additive: an account with no entry keeps using
+* `targetModelId`, so every existing profile behaves identically.
+*
+* Returns a PREFERENCE, not a resolved target — `resolveTargetModel` still
+* validates it against the catalog, so an override pointing at a model this
+* region no longer offers is reported as stale rather than silently swapped for
+* one the user did not choose.
+*/
+function targetModelPreference(preferences, accountId) {
+	const perAccount = accountId === void 0 ? void 0 : preferences.targetModelIdByAccount?.[accountId];
+	if (perAccount !== void 0 && perAccount !== "") return perAccount;
+	return preferences.targetModelId;
+}
 function resolveTargetModel(catalog, preferredId) {
 	if (preferredId !== void 0 && preferredId !== "") return catalog.some((model) => model.id === preferredId) ? {
 		modelId: preferredId,
@@ -3317,7 +3606,7 @@ const POOL_STORE_PREFIX = ".workbuddy-pool";
 function isProbe(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const candidate = value;
-	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string") && (candidate["source"] === void 0 || typeof candidate["source"] === "string");
+	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string") && (candidate["accountName"] === void 0 || typeof candidate["accountName"] === "string") && (candidate["source"] === void 0 || typeof candidate["source"] === "string");
 }
 /**
 * One region's path for measured pool facts.
@@ -3366,7 +3655,8 @@ async function readPoolProbes(region) {
 			atMs: probe.atMs,
 			...knownProbeSource(probe.source) === void 0 ? {} : { source: knownProbeSource(probe.source) },
 			...probe.retryAtMs === void 0 ? {} : { retryAtMs: probe.retryAtMs },
-			...probe.message === void 0 ? {} : { message: probe.message }
+			...probe.message === void 0 ? {} : { message: probe.message },
+			...probe.accountName === void 0 ? {} : { accountName: probe.accountName }
 		};
 	}
 	return probes;
@@ -3414,10 +3704,14 @@ function knownProbeSource(value) {
 */
 function mergePoolProbe(existing, update) {
 	if (existing === void 0) return update;
-	if (update.retryAtMs !== void 0) return update;
-	if (existing.retryAtMs === void 0 || existing.retryAtMs <= update.atMs) return update;
-	return {
+	const merged = update.accountName === void 0 && existing.accountName !== void 0 ? {
 		...update,
+		accountName: existing.accountName
+	} : update;
+	if (update.retryAtMs !== void 0) return merged;
+	if (existing.retryAtMs === void 0 || existing.retryAtMs <= update.atMs) return merged;
+	return {
+		...merged,
 		retryAtMs: existing.retryAtMs
 	};
 }
@@ -3794,7 +4088,6 @@ function toCredits(answer) {
 			remain: pack.remain,
 			size: pack.size,
 			monthly: pack.monthly,
-			...pack.cycleRemain === void 0 ? {} : { cycleRemain: pack.cycleRemain },
 			...pack.refreshAtMs === void 0 ? {} : { cycleRefreshMs: pack.refreshAtMs },
 			...pack.expiresAtMs === void 0 ? {} : { expiresAtMs: pack.expiresAtMs }
 		})),
@@ -4009,20 +4302,32 @@ async function workBuddyWebPool(deps, region) {
 	const preferences = pool.preferences(region);
 	const members = await pool.members(region);
 	const ranked = rankPool(members, Date.now());
-	const target = resolveTargetModel(pool.catalog?.(region) ?? [], preferences.targetModelId);
+	const catalog = pool.catalog?.(region) ?? [];
+	const target = resolveTargetModel(catalog, preferences.targetModelId);
 	const currentAccountId = await pool.currentAccountId?.(region);
 	const byId = new Map(members.map((member) => [member.account.id, member]));
 	const rankedIds = new Set(ranked.map((row) => row.account.id));
 	const others = await pool.otherAccounts?.(region) ?? [];
 	const checkedIn = await pool.checkedInToday?.(region).catch(() => ({})) ?? {};
-	const accounts = [...ranked.map((row) => ({
+	const rows = [...ranked.map((row) => ({
 		account: row.account,
 		member: true,
 		ranked: row
 	})), ...others.filter((account) => !rankedIds.has(account.id)).map((account) => ({
 		account,
 		member: false
-	}))].map(({ account, member, ranked: row }) => {
+	}))];
+	/**
+	* Names for saved members the roster above does NOT contain (issue #60).
+	*
+	* Read for the SAVED ids only, and only from the measurement record: those
+	* are exactly the accounts the card cannot name from `accounts`, because
+	* nothing about them is left on this machine except the fact that they were
+	* once measured. Best-effort — a failed read names nothing, and the card
+	* falls back to an id prefix rather than inventing a label.
+	*/
+	const memberNames = await pool.memberNames?.(region).catch(() => void 0) ?? void 0;
+	const accounts = rows.map(({ account, member, ranked: row }) => {
 		const measured = byId.get(account.id);
 		return {
 			accountId: account.id,
@@ -4037,8 +4342,17 @@ async function workBuddyWebPool(deps, region) {
 				atMs: measured.probe.atMs,
 				...measured.probe.source === void 0 ? {} : { source: measured.probe.source },
 				...measured.probe.retryAtMs === void 0 ? {} : { retryAtMs: measured.probe.retryAtMs },
-				...measured.probe.message === void 0 ? {} : { message: measured.probe.message }
+				...measured.probe.message === void 0 ? {} : { message: measured.probe.message },
+				...measured.probe.modelId === void 0 ? {} : { modelId: measured.probe.modelId }
 			} },
+			...(() => {
+				const perRow = resolveTargetModel(catalog, targetModelPreference(preferences, account.id));
+				return {
+					...perRow.modelId === void 0 ? {} : { testModelId: perRow.modelId },
+					testModelSource: perRow.source,
+					...perRow.staleModelId === void 0 ? {} : { staleTestModelId: perRow.staleModelId }
+				};
+			})(),
 			...row?.excludedBy === void 0 ? {} : { excludedBy: row.excludedBy },
 			current: account.id === currentAccountId,
 			member,
@@ -4051,9 +4365,11 @@ async function workBuddyWebPool(deps, region) {
 		...target.modelId === void 0 ? {} : { targetModelId: target.modelId },
 		...target.staleModelId === void 0 ? {} : { staleTargetModelId: target.staleModelId },
 		targetModelSource: target.source,
+		targetModelIdByAccount: preferences.targetModelIdByAccount ?? {},
 		memberAccountIds: preferences.memberAccountIds,
 		...preferences.probeInputTokens === void 0 ? {} : { probeInputTokens: preferences.probeInputTokens },
 		effectiveMemberAccountIds: effectiveMembersOf(accounts.map((account) => account.accountId), new Set(preferences.memberAccountIds)),
+		...memberNames === void 0 ? {} : { memberNames },
 		accounts,
 		catalog: deps.displayModels(region).map((model) => ({
 			id: model.id,
@@ -4293,7 +4609,20 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						reason: "pool-unavailable",
 						error: "pool test unavailable"
 					});
-					const target = resolveTargetModel(pool.catalog?.(region) ?? [], pool.preferences(region).targetModelId);
+					const preferences = pool.preferences(region);
+					const catalog = pool.catalog?.(region) ?? [];
+					/**
+					* The model ONE member is tested on (issue #61).
+					*
+					* Per account, because a test model is a per-account choice: `6004` is
+					* an account × model condition, so a batch that tested every member on
+					* one model would report "可用" for an account whose own model is the
+					* one that is limited. Resolution still runs through
+					* `resolveTargetModel`, so a stale override is reported, never
+					* silently swapped.
+					*/
+					const targetFor = (accountId) => resolveTargetModel(catalog, targetModelPreference(preferences, accountId));
+					const target = resolveTargetModel(catalog, targetModelPreference(preferences, void 0));
 					if (target.modelId === void 0) return json(res, 409, {
 						action: "test",
 						modelId: void 0,
@@ -4315,7 +4644,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						modelId: target.modelId
 					});
 					try {
-						await pool.test(region, target.modelId, (row) => {
+						await pool.test(region, targetFor, (row) => {
 							writeLine({ row });
 						});
 						writeLine({ done: true });
@@ -4653,6 +4982,7 @@ const modelConfig = z.object({
 const poolConfig = z.object({
 	enabled: z.boolean().default(false).description("Whether this region's account pool is active (opt-in). While on, a failed chat request is retried against the other usable pool members before the error is reported."),
 	targetModelId: z.string().default("").description("Model id to test; empty means pick a zero-multiplier model from this region's catalog"),
+	targetModelIdByAccount: z.dict(z.string()).default({}).description("Per-account test model, keyed by account id; an account with no entry uses targetModelId. Use this when an account must be tested on the model you actually chat with, because 6004 is an account-by-model condition."),
 	/**
 	* Sizing of the test probe, as a token count the user picks from a fixed set.
 	*
@@ -4910,6 +5240,9 @@ function apply(ctx, config) {
 				* traffic once the provider is registered, which happens after this whole
 				* setup completes.
 				*/
+				onRequestBody: (body) => {
+					recordBodyReport(region, body, { onError: (error) => ctx.logger.warn("dsh-connect-workbuddy: body report failed", error) });
+				},
 				prepareAccount: () => applyPoolSelection(region),
 				failoverAccount: (triedAccountIds) => failoverAccountFor(region, triedAccountIds),
 				onAccountFailure: (accountId, failure) => {
@@ -5140,6 +5473,27 @@ function apply(ctx, config) {
 				return effectiveMembersOf(saved, new Set(accounts.map((account) => account.id)));
 			},
 			/**
+			* Last measured display name per saved member id (issue #60).
+			*
+			* Answers the one question the card cannot answer itself: a saved member
+			* whose sign-in is gone has no row in the roster, so the name the pool
+			* once saw is the only thing that can identify it. Read from the runtime
+			* probe store — no upstream call, and no credential touched.
+			*
+			* Best-effort, and deliberately NOT filtered to ghosts here: the route
+			* knows which ids are unlisted (it built the roster) and names only
+			* those, so this stays a plain lookup with one meaning.
+			*/
+			memberNames: async (region) => {
+				const probes = await readPoolProbes(region);
+				const names = {};
+				for (const [accountId, probe] of Object.entries(probes)) {
+					if (probe.accountName === void 0 || probe.accountName === "") continue;
+					names[accountId] = probe.accountName;
+				}
+				return names;
+			},
+			/**
 			* Local sign-ins the pool does NOT cover.
 			*
 			* Sent so the card can offer them to check in. Membership is an explicit
@@ -5222,7 +5576,7 @@ function apply(ctx, config) {
 			* rather than pretending a test ran.
 			*/
 			testOne: async (region, accountId) => {
-				const target = regionTargetModel(region);
+				const target = regionTargetModel(region, accountId);
 				if (target === void 0) return void 0;
 				const store = stacks[region].store;
 				const credential = await store.credentialFor(accountId).catch(() => void 0);
@@ -5497,6 +5851,7 @@ function apply(ctx, config) {
 			outcome,
 			atMs: Date.now(),
 			source: "live-request",
+			...failure.modelId === void 0 ? {} : { modelId: failure.modelId },
 			...retryAtMs === void 0 ? {} : { retryAtMs },
 			...message === "" ? {} : { message }
 		} });
@@ -5587,11 +5942,12 @@ function apply(ctx, config) {
 	/**
 	* The model a per-row test would use right now: the SAME resolution the
 	* batch route performs (`resolveTargetModel` over the region's displayed
-	* catalog and the saved preference), so a row test and a batch test never
-	* measure different models. Undefined mirrors the route's 409 states.
+	* catalog and the saved preference — including a per-account override,
+	* issue #61), so a row test and a batch test never measure different models.
+	* Undefined mirrors the route's 409 states.
 	*/
-	const regionTargetModel = (region) => {
-		return resolveTargetModel(displayModels(current(), region), poolPreferencesOf(current(), region).targetModelId).modelId;
+	const regionTargetModel = (region, accountId) => {
+		return resolveTargetModel(displayModels(current(), region), targetModelPreference(poolPreferencesOf(current(), region), accountId)).modelId;
 	};
 	/** One region's pool preferences, with the schema's defaults applied. */
 	const poolPreferencesOf = (config, region) => {
@@ -5600,6 +5956,7 @@ function apply(ctx, config) {
 		return {
 			enabled: pool?.enabled === true,
 			targetModelId: pool?.targetModelId ?? "",
+			targetModelIdByAccount: { ...pool?.targetModelIdByAccount },
 			...probeInputTokens === void 0 ? {} : { probeInputTokens },
 			memberAccountIds: pool?.memberAccountIds ?? []
 		};
@@ -5774,4 +6131,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, modelIdOfBody, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "4.4.4",
+  "version": "4.4.6",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",