dsh-connect-workbuddy 4.4.5 → 4.4.6

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 4.4.6 (2026-10-14)
+
+### Fixes
+
+- **面板的「测试」只测一个模型，却把结果当成账号级结论：账号池说「可用」，一切到实际在用的模型就撞 `429 / 6004`。**（issue #61 报告者报告，维护者在 issue 下确认「测试的是某一个模型……不能换其他模型」）
+  - **现象与证据**：报告者同一时刻、同一脚本测两个国内账号 —— `hy4-preview-f`（当时的 `pool.targetModelId`，面板测的就是它）两个号都可用，而 `step-5-preview`（当时实际在用的模型）两个号都 `429 / 6004`。池文件里这两个号还被更早的一次批量测试记成 `outcome=ok source=test-batch`，而池开着时那份「ok」正是选号依据。**`6004` 是「账号 × 模型」维度的条件**（本项目 10-13 也在三个国际账号上量到 `deepseek-v4.1-flash` 挂、其余模型全通），所以单一模型探测在结构上无法回答「这个账号能不能服务」。
+  - **根因（报告者给出代码位置，本地逐条复核属实）**：`resolveTargetModel()` 只解析出**一个** `modelId`（来自区域级 `pool.targetModelId`），一条路径同时服务批量与逐行测试；而 `probeModel()` 的三个返回分支**早就带着 `modelId`**，落盘时被丢掉了 —— 记录里只有 `outcome/atMs/source/retryAtMs/message`，没有任何字段说明这条 `ok` 是**哪个模型**上的。
+  - **修法（三处，各自成立）**：
+    1. **测量记录记住模型**：`WorkBuddyPoolProbe` 新增可选 `modelId`，两个写入方（批量测试、实时聊天失败）在拿到模型的那一刻写下它。
+    2. **每个账号可单独指定测试模型**：新增设置 `pool.targetModelIdByAccount`（账号 id → 模型 id），读取时先查 map、查不到回落 `targetModelId`。**批量测试与逐行测试走同一条解析**（报告者指出这正是「改一处两处同时生效」的地方），所以「测试所有账号」也会按每个号自己的模型去测。解析仍然过 `resolveTargetModel`：指向本区域已下架模型时**报 `stale`、绝不静默换成另一个模型**（换一个等于花积分测一个用户没选的模型，还把它当作这个号的结论）。
+    3. **卡片显示适用范围**：池表每行的测量结论旁写上「模型 {model}」（记录里没有该字段的旧数据写「未记录模型」，不猜）；每行新增一个测试模型下拉框（留空 = 跟随区域目标），随「保存」一起写入。
+  - **为什么 `modelId` 落盘时不继承**：`accountName` 与 `retryAtMs` 描述的是**账号**（后来者看不到的名字仍然是真的，未来的刷新时刻仍然在未来），而模型描述的是**这一次测量**。把旧的 model id 继承到一次新测量上，等于用不是它的模型给它贴标签 —— 正是这个字段要终结的那种混淆。所以**缺失即「范围未知」，不是猜测**。
+  - **配置向后兼容**：`targetModelIdByAccount` 默认空对象，且**只有非空时才写入** settings（与 `probeInputTokens` 同一条规则）—— 从未用过这个设置的 profile 写出来的槽位与升级前逐字节相同，升级不会看起来像用户改过设置。
+  - **守卫**：`tests/issue61-probe-model-scope.spec.ts`（9 例）覆盖：逐账号优先/回落、空串视为「跟随区域目标」、override 下架时解析为 `stale` 且不带 `modelId`、批量按各账号自己的模型探测、单一模型的旧调用形态不变、解析不出模型时产出 `unavailable` 行并指名那个模型（**没有**回退到别的模型）、批量写入 `modelId`、**不继承**、新测量覆盖旧模型。`tests/pool-route.spec.ts` 新增一条路由级断言：批量路由交给 Host 的是**逐账号解析器**（`a` 用区域目标、`b` 用 `b` 自己的）。**变异验证**：记录不再写 `modelId` → 1 例红；合并改成继承 → 1 例红；批量改回「整批一个模型」→ 1 例红；路由改回传单一 modelId → 路由断言红。
+
+### Features
+
+- **新增「上游请求体构成」诊断（`WORKBUDDY_BODY_REPORT`），用于定案 issue #59：两份请求体到底是不是同一份历史。**（issue #59）
+  - **为什么需要**：报告里同一份历史被国内网关算约 70.8 万 token、国际网关算约 137.4 万（1.94 倍），切区域即 `code 11115 prompt is too long`。两条独立测量已经把范围压到唯一一个问题：报告者在**两个区域**跑本仓库的内容类别探针，逐字节相同的散文/代码/JSON 六格比值全在 **0.98~1.06**（同一段字节两边计价一致）；代码链路核对又表明**历史 reasoning 根本没进请求体**（pi-ai 只在 `compat.requiresThinkingAsText` 为真时把 `thinking` 当文本转发，本插件从未设置；`reasoning_details` 那条路需要流式解析从不写出的签名）。**剩下唯一可能是两份请求体不同**，而这件事**不需要任何区域有积分**就能查：请求体是本地拼好的，`14018 Credits exhausted` 是发出去之后才可能发生的。
+  - **做法**：`src/body-report.ts` 在 shim 把 body 交给上游**之前**记录它的**构成** —— 每条消息的 `role`、逐块的类型（`system`/`text`/`tool-call`/`tool-result`/`reasoning`/`image`）、字符数与其中**中日韩字符**数（实测中文 0.669、英文 0.224 token/字符，差 3 倍，混在一起看不出来）、`tools` 数组、`messages.length` 与 body 总字节数。按区域写 `<dir>/<region>.jsonl`，一次请求一行（一轮对话有很多次上游调用，**最后一次**才是要比的那份）。
+  - **只记计数、不记文本**：不写任何消息内容、账号名或令牌 —— 一个要被贴进公开 issue 的诊断不能有泄漏用户会话的能力。`tests/issue59-body-report.spec.ts` 里有一条专门的断言：用带特征串的 body 生成报告后，序列化结果**不含**该特征串（变异验证：让 `block()` 把 `text` 一起带上 → 该例与 reasoning 那例同时变红）。
+  - **开关**：环境变量 `WORKBUDDY_BODY_REPORT` 未设置或为空白即**关闭**；`1`/`true` 写到 `<DSH home>/body-reports/`；其他值按**目录路径**解释。写文件失败只走日志，**绝不影响聊天请求**（有专门断言）。
+  - **守卫**：`tests/issue59-body-report.spec.ts`（16 例）。
+  - **配套**：`scripts/probe-region-token-accounting.mjs` 新增 `--language en|zh` 与 `--kind prose|code|json`（六种组合确定性填充、跨区域逐字节相同），并补上国内侧实测基线：prose 214.0 / code 287.0 / json 288.3（en），prose 671.0 / code 480.7 / json 397.3（zh），单位 tokens/1k chars。
+
 ## 4.4.5 (2026-10-14)
 
 ### Fixes

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, Z as findWorkbuddyAppExecutableWithSource, a as readHostHeartbeat, at as hostPeersInfo, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-Bj7JvSYJ.js";
+import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, K as WORKBUDDY_APP_EXECUTABLE_ENV, O as legacyWorkbuddyOwnAuthPath, Q as findWorkbuddyAppExecutableWithSource, S as defaultDesktopAuthCandidates, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, ot as hostPeersInfo, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-B2jrUDhg.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -661,6 +661,8 @@ window.__ModuleLoader__.load({
 				targetModelId: preferences.targetModelId,
 				memberAccountIds: preferences.memberAccountIds
 			};
+			const overrides = Object.entries(preferences.targetModelIdByAccount ?? {}).filter(([, modelId]) => modelId !== "");
+			if (overrides.length > 0) slot["targetModelIdByAccount"] = Object.fromEntries(overrides);
 			if (preferences.probeInputTokens !== void 0) slot["probeInputTokens"] = preferences.probeInputTokens;
 			const next = nextRegionPool(scope.getSnapshot().value, region, slot)[region];
 			await writeField(scope, "regions", region, next, (readBack) => {
@@ -672,7 +674,12 @@ window.__ModuleLoader__.load({
 				const stored = pool["memberAccountIds"];
 				if (!Array.isArray(stored) || stored.length !== preferences.memberAccountIds.length) return false;
 				const wanted = new Set(preferences.memberAccountIds);
-				return stored.every((id) => typeof id === "string" && wanted.has(id));
+				if (!stored.every((id) => typeof id === "string" && wanted.has(id))) return false;
+				const storedModels = pool["targetModelIdByAccount"];
+				if (overrides.length === 0) return storedModels === void 0 || typeof storedModels === "object" && storedModels !== null && !Array.isArray(storedModels) && Object.keys(storedModels).length === 0;
+				if (typeof storedModels !== "object" || storedModels === null || Array.isArray(storedModels)) return false;
+				const storedMap = storedModels;
+				return Object.keys(storedMap).length === overrides.length && overrides.every(([accountId, modelId]) => storedMap[accountId] === modelId);
 			});
 		}
 		//#endregion
@@ -1259,6 +1266,21 @@ window.__ModuleLoader__.load({
 			const wanted = new Set(right);
 			return left.every((id) => wanted.has(id));
 		}
+		/**
+		* Whether two per-account test-model maps are equal (issue #61).
+		*
+		* By CONTENT, not by size: moving an account from one model to another keeps the
+		* count and changes the meaning, and clearing an entry is a change a size
+		* comparison would miss entirely when another account was added at the same
+		* time. Order is irrelevant for the same reason it is in {@link sameIds} — the
+		* map is written by key, not by click sequence.
+		*/
+		function sameModelOverrides(left, right) {
+			const leftKeys = Object.keys(left);
+			const rightKeys = Object.keys(right);
+			if (leftKeys.length !== rightKeys.length) return false;
+			return leftKeys.every((key) => left[key] === right[key]);
+		}
 		/** Whether a probe outcome means the model answered. */
 		function outcomeOk(outcome) {
 			return outcome === "ok";
@@ -1345,7 +1367,8 @@ window.__ModuleLoader__.load({
 				enabled: pool?.enabled ?? false,
 				targetModelId: pool?.targetModelId || pool?.staleTargetModelId || "",
 				probeInputTokens: pool?.probeInputTokens ?? 0,
-				memberAccountIds: pool?.memberAccountIds ?? []
+				memberAccountIds: pool?.memberAccountIds ?? [],
+				targetModelIdByAccount: { ...pool?.targetModelIdByAccount }
 			};
 			const active = draftRegion === region && draft !== null ? draft : saved;
 			/**
@@ -1366,7 +1389,7 @@ window.__ModuleLoader__.load({
 			* the pending edit.
 			*/
 			const poolRunning = saved.enabled;
-			const dirty = draftRegion === region && draft !== null && (draft.enabled !== saved.enabled || draft.targetModelId !== saved.targetModelId || draft.probeInputTokens !== saved.probeInputTokens || !sameIds(draft.memberAccountIds, saved.memberAccountIds));
+			const dirty = draftRegion === region && draft !== null && (draft.enabled !== saved.enabled || draft.targetModelId !== saved.targetModelId || draft.probeInputTokens !== saved.probeInputTokens || !sameModelOverrides(draft.targetModelIdByAccount, saved.targetModelIdByAccount) || !sameIds(draft.memberAccountIds, saved.memberAccountIds));
 			/**
 			* Membership that actually resolves to a local sign-in — what a batch runs on.
 			*
@@ -1527,6 +1550,25 @@ window.__ModuleLoader__.load({
 					};
 				});
 			}, [editDraft]);
+			/**
+			* Set ONE account's test model (issue #61).
+			*
+			* `''` REMOVES the entry rather than storing an empty string: "follow the
+			* region target" is the absence of a choice, which is the same shape the host
+			* reads and the same shape an untouched profile has — so nothing about an
+			* older profile changes when this setting is never used.
+			*/
+			const setRowModel = (0, react.useCallback)((accountId, modelId) => {
+				editDraft((current) => {
+					const next = { ...current.targetModelIdByAccount };
+					if (modelId === "") delete next[accountId];
+					else next[accountId] = modelId;
+					return {
+						...current,
+						targetModelIdByAccount: next
+					};
+				});
+			}, [editDraft]);
 			/** Check every listed account, or none of them. */
 			const selectAll = (0, react.useCallback)((next) => {
 				editDraft((current) => ({
@@ -1847,7 +1889,10 @@ window.__ModuleLoader__.load({
 				},
 				onRemove: () => {
 					runRowRemove(account.accountId, account.accountName);
-				}
+				},
+				modelOverride: active.targetModelIdByAccount[account.accountId] ?? "",
+				catalog: pool.catalog ?? [],
+				onModelChange: (modelId) => setRowModel(account.accountId, modelId)
 			}))), effectiveMembers.length === 0 ? (0, react.createElement)("p", {
 				className: "dsm-workbuddy-pool-warn",
 				role: "status"
@@ -1915,6 +1960,7 @@ window.__ModuleLoader__.load({
 		/** One account's row. */
 		function renderAccountRow(input) {
 			const { t, account, checked, canEdit, checkinSupported, onToggle, busy, testDisabled, targetHint, onTest, onRemove } = input;
+			const { modelOverride, catalog, onModelChange } = input;
 			const name = account.accountName === "" ? t("row.accountUnnamed") : account.accountName;
 			const excluded = exclusionText(t, account.excludedBy);
 			const probe = account.probe;
@@ -1952,10 +1998,23 @@ window.__ModuleLoader__.load({
 			}), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-account-name" }, (0, react.createElement)("b", null, name), account.current ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-current-tag" }, t("row.poolCurrentBadge")) : null, (0, react.createElement)("span", { className: checked ? "dsm-workbuddy-pool-member" : "dsm-workbuddy-pool-not-member" }, checked ? t("row.poolMember") : t("row.poolNotMember")), excluded === void 0 ? probe === void 0 ? null : (0, react.createElement)("span", null, t("row.poolTestedAt", { at: formatShort(probe.atMs) })) : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-excluded" }, excluded))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-credits" }, account.credits === void 0 ? (0, react.createElement)("span", null, "—") : (0, react.createElement)("b", null, formatNumber$1(account.credits)), account.expiringSoon !== void 0 && account.expiringSoon > 0 ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-soon" }, t("row.poolCreditSoon", { count: formatNumber$1(account.expiringSoon) })) : account.nearestExpiryMs === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-soon-plain" }, t("row.poolCreditNearest", { at: formatShort(account.nearestExpiryMs) }))), (0, react.createElement)("span", {
 				className: "dsm-workbuddy-pool-probe",
 				...probe?.message === void 0 ? {} : { title: probe.message }
-			}, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-main" }, probeLine), probeLabel === void 0 && age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-prov" }, probeLabel === void 0 ? null : (0, react.createElement)("span", { className: probeLabel.className }, probeLabel.text), probeLabel === void 0 || age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-sep" }, "·"), age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-age" }, age))), checkinSupported ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checkin" }, account.checkedInToday === void 0 ? (0, react.createElement)("span", {
+			}, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-main" }, probeLine), probeLabel === void 0 && age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-prov" }, probeLabel === void 0 ? null : (0, react.createElement)("span", { className: probeLabel.className }, probeLabel.text), probeLabel === void 0 || age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-sep" }, "·"), age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-age" }, age), probe === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-model" }, probe.modelId === void 0 ? t("row.poolProbeModelUnknown") : t("row.poolProbeModel", { model: probe.modelId })))), checkinSupported ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checkin" }, account.checkedInToday === void 0 ? (0, react.createElement)("span", {
 				className: "dsm-workbuddy-pool-unknown",
 				title: t("row.poolNeverTested")
-			}, t("row.poolCheckinUnknown")) : account.checkedInToday ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checked" }, t("row.poolCheckedIn")) : t("row.poolNotCheckedIn")) : null, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-row-actions" }, (0, react.createElement)("button", {
+			}, t("row.poolCheckinUnknown")) : account.checkedInToday ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checked" }, t("row.poolCheckedIn")) : t("row.poolNotCheckedIn")) : null, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-row-actions" }, (0, react.createElement)("select", {
+				className: "dsm-workbuddy-pool-select dsm-workbuddy-pool-row-model",
+				value: modelOverride,
+				disabled: !canEdit,
+				title: t("row.poolRowModelHint"),
+				"aria-label": t("row.poolRowModelAria", { accountName: name }),
+				onChange: (event) => onModelChange(event.currentTarget.value)
+			}, (0, react.createElement)("option", { value: "" }, t("row.poolRowModelInherit")), modelOverride !== "" && !catalog.some((model) => model.id === modelOverride) ? (0, react.createElement)("option", {
+				value: modelOverride,
+				disabled: true
+			}, t("row.poolTargetStaleOption", { model: modelOverride })) : null, ...catalog.map((model) => (0, react.createElement)("option", {
+				value: model.id,
+				key: model.id
+			}, model.name))), (0, react.createElement)("button", {
 				type: "button",
 				className: "dsm-btn dsm-btn-outline dsm-workbuddy-pool-small-btn",
 				disabled: busy || testDisabled,
@@ -3140,6 +3199,10 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-pool-prov-unknown{background:var(--dsw-alias-bg-layer-3,#2a2c33);border:1px solid var(--dsw-alias-border-l1,#2c2d31);color:var(--dsw-alias-label-secondary,#c6c9d0)}
 .dsm-workbuddy-pool-prov-sep{color:var(--dsw-alias-label-dimmed,#9aa0a6);opacity:.7}
 .dsm-workbuddy-pool-prov-age{color:var(--dsw-alias-label-tertiary,#999);white-space:nowrap}
+/* WHICH model a verdict is about (issue #61). Deliberately quiet: it is scope
+   information on the provenance line, not a status of its own, so an ok row and
+   a rate-limited row must not look different because of it. */
+.dsm-workbuddy-pool-prov-model{color:var(--dsw-alias-label-tertiary,#999);white-space:nowrap;overflow:hidden;text-overflow:ellipsis;max-width:190px}
 .dsm-workbuddy-pool-members{display:flex;flex-direction:column;gap:10px}
 .dsm-workbuddy-pool-members-head{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;flex-wrap:wrap}
 .dsm-workbuddy-pool-members-title{margin:0 0 3px;font-size:13px;font-weight:600;color:var(--dsw-alias-label-primary,#e6e6e6)}
@@ -3193,6 +3256,9 @@ window.__ModuleLoader__.load({
 /* Per-row actions (test / remove), right side of each pool row. */
 .dsm-workbuddy-pool-row-actions{display:flex;gap:6px;align-items:center;justify-content:flex-end;flex:none}
 .dsm-workbuddy-pool-row-actions .dsm-workbuddy-pool-small-btn{padding:2px 10px;font-size:12px}
+/* This account's own test model (issue #61). Narrower than the section-level
+   picker so a long model name cannot push the two buttons out of the row. */
+.dsm-workbuddy-pool-row-model{max-width:150px;padding:2px 6px;font-size:12px}
 @media (max-width:760px){.dsm-workbuddy-pool-row{grid-template-columns:1fr 1fr;row-gap:6px}.dsm-workbuddy-pool-select{max-width:180px}}
 /* Pool switch, namespaced under .dsm-workbuddy-pool so it cannot collide with host styles. */
 .dsm-workbuddy-pool .sw{position:relative;display:inline-block;width:38px;height:22px;flex:none;cursor:pointer}
@@ -5571,6 +5637,11 @@ window.__ModuleLoader__.load({
 			"row.poolProbeSourceTest": "tested",
 			"row.poolProbeSourceLive": "hit by a live request",
 			"row.poolProbeSourceUnknown": "source unknown",
+			"row.poolProbeModel": "model {model}",
+			"row.poolProbeModelUnknown": "model not recorded",
+			"row.poolRowModelHint": "Which model this account's test uses. Leave it on \"region target\" to follow the pool's model; pick one when this account must be tested on the model you actually chat with.",
+			"row.poolRowModelAria": "Test model for {accountName}",
+			"row.poolRowModelInherit": "region target",
 			"row.poolSettingsTitle": "Account pool settings",
 			"row.poolSettingsHint": "These are preferences: they take effect when you save (same as the model list). Test results are written automatically and are not affected by this button.",
 			"row.poolEnabled": "Enable the account pool",
@@ -5837,6 +5908,11 @@ window.__ModuleLoader__.load({
 			"row.poolProbeSourceTest": "测得",
 			"row.poolProbeSourceLive": "聊天撞上",
 			"row.poolProbeSourceUnknown": "来源未知",
+			"row.poolProbeModel": "模型 {model}",
+			"row.poolProbeModelUnknown": "未记录模型",
+			"row.poolRowModelHint": "这个账号测试用哪个模型。留「区域目标」就跟随账号池的目标模型；当某个号必须用你实际在聊的模型来测时，在这里单独指定。",
+			"row.poolRowModelAria": "{accountName} 的测试模型",
+			"row.poolRowModelInherit": "区域目标",
 			"row.poolSettingsTitle": "账号池设置",
 			"row.poolSettingsHint": "下面是偏好设置：点保存才生效（与「模型管理」一致）。测试结果由插件自动写入，不受这个保存按钮影响。",
 			"row.poolEnabled": "启用账号池",

package/lib/{host-heartbeat-Bj7JvSYJ.js → host-heartbeat-B2jrUDhg.js}

@@ -1220,6 +1220,24 @@ function ensureSystemHead(obj) {
 * `tool_choice` (the upstream's field is a string; object forms return 400),
 * and guarantee a leading system message.
 */
+/**
+* The model id a prepared body asks for, when it carries one (issue #61).
+*
+* Lives beside {@link prepareChatBody} because it reads the same shape: the
+* serialized OpenAI body, after this plugin's rewrites. Never throws — a
+* malformed body is the upstream's to reject, not a reason to lose the failure
+* measurement that this id is needed for.
+*/
+function modelIdOfBody(bodyJson) {
+	try {
+		const parsed = JSON.parse(bodyJson);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+		const model = parsed["model"];
+		return typeof model === "string" && model !== "" ? model : void 0;
+	} catch {
+		return;
+	}
+}
 function prepareChatBody(source) {
 	let body;
 	try {
@@ -3807,7 +3825,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.4.5";
+const WORKBUDDY_CONNECT_VERSION = "4.4.6";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -3965,4 +3983,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { isWorkbuddyBundle as $, workbuddyAccountId as A, parseCreditMultiplier as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, WORKBUDDY_APP_EXECUTABLE_ENV as G, parseUpstreamModel as H, classifyUpstreamError as I, deriveAtRestKeyId as J, clearAtRestKeyCache as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, isEncryptedFieldWrapper as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, prepareChatBody as U, parseReasoning as V, regionOf as W, findWorkbuddyAppExecutable as X, fetchAtRestKeyPayload as Y, findWorkbuddyAppExecutableWithSource as Z, WORKBUDDY_AUTH_FILENAME as _, readHostHeartbeat as a, hostPeersInfo as at, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, writeFileAtomic as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, macosBundleExecutable as et, WorkBuddyCatalog as f, ENCRYPTED_CREDENTIAL_CODE as g, fallbackModelsFor as h, processStartTimeMs as i, workbuddyAppExecutableCandidates as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, deriveCatalog as m, clearHostHeartbeat as n, openEncryptedField as nt, workbuddyHostHeartbeatPath as o, resolveDshHome as ot, applyContextBudgets as p, deriveAtRestKey as q, isHeartbeatProcessAlive as r, readAtRestKey as rt, writeHostHeartbeat as s, withFileLock as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, macosNestedAppBundles as tt, FALLBACK_WORKBUDDY_MODELS as u, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, knownRegionOf as z };
+export { isEncryptedFieldWrapper as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, deriveAtRestKey as J, WORKBUDDY_APP_EXECUTABLE_ENV as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, findWorkbuddyAppExecutableWithSource as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, fetchAtRestKeyPayload as X, deriveAtRestKeyId as Y, findWorkbuddyAppExecutable as Z, WORKBUDDY_AUTH_FILENAME as _, readHostHeartbeat as a, workbuddyAppExecutableCandidates as at, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, withFileLock as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, isWorkbuddyBundle as et, WorkBuddyCatalog as f, ENCRYPTED_CREDENTIAL_CODE as g, fallbackModelsFor as h, processStartTimeMs as i, readAtRestKey as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, writeFileAtomic as lt, deriveCatalog as m, clearHostHeartbeat as n, macosNestedAppBundles as nt, workbuddyHostHeartbeatPath as o, hostPeersInfo as ot, applyContextBudgets as p, clearAtRestKeyCache as q, isHeartbeatProcessAlive as r, openEncryptedField as rt, writeHostHeartbeat as s, resolveDshHome as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, macosBundleExecutable as tt, FALLBACK_WORKBUDDY_MODELS as u, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, knownRegionOf as z };

package/lib/index.d.ts

@@ -798,6 +798,15 @@ declare function knownRegionOf(domain: string): WorkBuddyRegion | undefined;
  * `tool_choice` (the upstream's field is a string; object forms return 400),
  * and guarantee a leading system message.
  */
+/**
+ * The model id a prepared body asks for, when it carries one (issue #61).
+ *
+ * Lives beside {@link prepareChatBody} because it reads the same shape: the
+ * serialized OpenAI body, after this plugin's rewrites. Never throws — a
+ * malformed body is the upstream's to reject, not a reason to lose the failure
+ * measurement that this id is needed for.
+ */
+declare function modelIdOfBody(bodyJson: string): string | undefined;
 declare function prepareChatBody(source: string): string;
 /** Marker carried by {@link WorkBuddyCredentialRejectedError}; survives bundling. */
 declare const CREDENTIAL_REJECTED_CODE = "WORKBUDDY_CREDENTIAL_REJECTED";
@@ -1107,7 +1116,29 @@ interface WorkBuddyShimOptions {
     status: number;
     kind: UpstreamErrorKind;
     message: string;
+    /**
+     * The model that request asked for (issue #61).
+     *
+     * Carried because the failure is remembered against the ACCOUNT, and `6004`
+     * is an account × model condition: without this the record cannot say which
+     * model the measurement belongs to, so the card has to present a
+     * single-model result as account-level availability.
+     */
+    modelId?: string;
   }) => void;
+  /**
+   * Called with the FINAL serialized body of every chat request, just before it
+   * goes upstream (issue #59).
+   *
+   * It exists so the plugin can record what was actually sent without the shim
+   * having to know where that record goes: the region belongs to whoever wires
+   * this up, and the report is a plugin concern. The body handed over is the
+   * post-`prepareChatBody` one, because THAT is what the upstream counts.
+   *
+   * Fired without awaiting: a request must never wait on a diagnostic. The
+   * callee must treat the string as read-only.
+   */
+  onRequestBody?: (bodyJson: string) => void;
 }
 /**
  * Start the loopback endpoint. Requests must carry the shim's shared secret;
@@ -1944,6 +1975,31 @@ interface WorkBuddyPoolProbe {
    * old probe files stay readable rather than being discarded.
    */
   message?: string;
+  /**
+   * WHICH MODEL this measurement is about (issue #61).
+   *
+   * The pool's "test all accounts" action probes ONE model — the region's
+   * `targetModelId` — while `6004` is an ACCOUNT × MODEL condition: the reporter
+   * measured two accounts where `hy4-preview-f` answered and `step-5-preview`
+   * returned `429 / 6004` at the same moment. A row rendered as plain "可用"
+   * therefore claims more than the measurement says, and the pool's own routing
+   * reads that `ok` as an account-level fact.
+   *
+   * Storing the model id is what makes the claim checkable: the card can say
+   * WHICH model an `ok` came from, and a reader can see that a different model
+   * was never tested at all. `probeModel()` has always returned this field; the
+   * write simply dropped it.
+   *
+   * Deliberately NOT inherited by {@link mergePoolProbe} when an update omits it
+   * — the opposite of `accountName` and `retryAtMs`. Those two describe the
+   * ACCOUNT (a name that a later writer could not see is still true, and a
+   * future refresh time is still in the future), whereas the model describes
+   * THIS measurement. Carrying an older model id forward would relabel a fresh
+   * measurement with a model it was not taken on, which is exactly the confusion
+   * this field exists to end. ABSENT therefore means "unknown scope", never a
+   * guess.
+   */
+  modelId?: string;
   /**
    * The account's display name AT THE MOMENT IT WAS MEASURED (issue #60).
    *
@@ -2483,7 +2539,13 @@ interface WorkBuddyWebPoolAccount {
   expiringSoon?: number;
   /** When the nearest package expires, in ms. */
   nearestExpiryMs?: number;
-  /** The last test of the target model, absent when never tested. */
+  /**
+   * The last test of this account's target model, absent when never tested.
+   *
+   * The model is recorded INSIDE the probe (issue #61) rather than assumed from
+   * the row's current setting: the setting can be changed after the test, and a
+   * result must keep naming what it actually measured.
+   */
   probe?: {
     outcome: WorkBuddyWebProbeOutcome;
     atMs: number;
@@ -2495,6 +2557,16 @@ interface WorkBuddyWebPoolAccount {
      * guess which of the two it was.
      */
     source?: 'test-batch' | 'live-request';
+    /**
+     * WHICH model this measurement is about (issue #61).
+     *
+     * `6004` is an account × model condition, so an `ok` without a model reads as
+     * account-level availability — which is exactly the false positive the
+     * reporter hit: the card said 可用 for two accounts whose actual model
+     * returned `429 / 6004`. ABSENT for records written before the field existed;
+     * the card must then say the scope is unknown rather than assume it.
+     */
+    modelId?: string;
     /** Only when the upstream named a time; never invented locally. */
     retryAtMs?: number;
     /**
@@ -2527,6 +2599,17 @@ interface WorkBuddyWebPoolAccount {
    * result the user just watched succeed.
    */
   checkedInToday?: boolean;
+  /**
+   * The model a TEST of this row would use (issue #61).
+   *
+   * Per row, because a test model can be chosen per account: the card shows it
+   * beside the row it applies to rather than implying one model for the table.
+   */
+  testModelId?: string;
+  /** Where this row's test target came from (see {@link WorkBuddyWebPool.targetModelSource}). */
+  testModelSource?: 'preferred' | 'free' | 'none' | 'stale';
+  /** This row's saved override that the region no longer offers. */
+  staleTestModelId?: string;
 }
 /**
  * The pool's state for one region.
@@ -2556,6 +2639,14 @@ interface WorkBuddyWebPool {
    * would run against a model the upstream does not offer.
    */
   staleTargetModelId?: string;
+  /**
+   * The SAVED per-account test models, keyed by account id (issue #61).
+   *
+   * Sent verbatim rather than as the effective set: the card edits this map, and
+   * an id whose model has left the catalog must survive a save so the user's
+   * record of what they chose is not silently destroyed.
+   */
+  targetModelIdByAccount?: Readonly<Record<string, string>>;
   /**
    * Where the target came from. `'stale'` means the SAVED id is no longer in
    * the catalog — a distinct state from `'none'` (no free model exists),
@@ -2840,6 +2931,8 @@ interface WorkBuddyPoolDeps {
   preferences(region: WorkBuddyRegion): {
     enabled: boolean;
     targetModelId: string;
+    /** Per-account override of `targetModelId` (issue #61). */
+    targetModelIdByAccount?: Readonly<Record<string, string>>;
     /**
      * Tokens each test probe sends as saved; `0` when the user never chose.
      *
@@ -2935,7 +3028,18 @@ interface WorkBuddyPoolDeps {
    * the route handles both, because a missing reporter must degrade to the
    * previous behaviour rather than to no rows at all.
    */
-  test?(region: WorkBuddyRegion, modelId: string, onRow?: (row: WorkBuddyPoolTestRow) => void): Promise<readonly WorkBuddyPoolTestRow[]>;
+  test?(region: WorkBuddyRegion,
+  /**
+   * One model for the whole batch, or a per-account resolver (issue #61).
+   *
+   * The resolver form is what lets a batch honour a per-account test model; a
+   * resolver that names no model yields an `unavailable` row for that account
+   * rather than silently testing the region default.
+   */
+  modelId: string | ((accountId: string) => {
+    modelId?: string;
+    staleModelId?: string;
+  }), onRow?: (row: WorkBuddyPoolTestRow) => void): Promise<readonly WorkBuddyPoolTestRow[]>;
   /** The region's live catalog, used to resolve the free target model. */
   catalog?(region: WorkBuddyRegion): readonly WorkBuddyModelInfo[];
 }
@@ -3045,6 +3149,18 @@ interface WorkBuddyPoolPreferences {
   enabled?: boolean;
   /** Model id to test; `''` means auto-pick a free model from this region. */
   targetModelId?: string;
+  /**
+   * Per-account override of {@link targetModelId}, keyed by account id (#61).
+   *
+   * `6004` is an ACCOUNT × MODEL condition, so "can this account serve" has no
+   * single answer: the reporter measured two accounts where one model answered
+   * and another returned `429 / 6004` in the same second. The region-wide target
+   * stays the default — this map only says "for THIS account, test THAT model",
+   * which is what makes the pool's verdict match the model the user is actually
+   * chatting with. An id that is no longer in the catalog is reported as stale
+   * rather than replaced, so no credits are spent on a model nobody chose.
+   */
+  targetModelIdByAccount?: Record<string, string>;
   /**
    * How much input a probe sends, in tokens — the pool's biggest single knob.
    *
@@ -3216,4 +3332,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, modelIdOfBody, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/lib/index.js

@@ -1,6 +1,6 @@
-import { $ as isWorkbuddyBundle, A as workbuddyAccountId, B as parseCreditMultiplier, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, H as parseUpstreamModel, I as classifyUpstreamError, J as deriveAtRestKeyId, K as clearAtRestKeyCache, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as isEncryptedFieldWrapper, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as prepareChatBody, V as parseReasoning, W as regionOf, X as findWorkbuddyAppExecutable, Y as fetchAtRestKeyPayload, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as writeFileAtomic, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as macosBundleExecutable, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as workbuddyAppExecutableCandidates, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as openEncryptedField, o as workbuddyHostHeartbeatPath, ot as resolveDshHome, p as applyContextBudgets, q as deriveAtRestKey, r as isHeartbeatProcessAlive, rt as readAtRestKey, s as writeHostHeartbeat, st as withFileLock, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosNestedAppBundles, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-Bj7JvSYJ.js";
+import { $ as isEncryptedFieldWrapper, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as deriveAtRestKey, K as WORKBUDDY_APP_EXECUTABLE_ENV, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as fetchAtRestKeyPayload, Y as deriveAtRestKeyId, Z as findWorkbuddyAppExecutable, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as workbuddyAppExecutableCandidates, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as withFileLock, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as isWorkbuddyBundle, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as readAtRestKey, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as writeFileAtomic, m as deriveCatalog, n as clearHostHeartbeat, nt as macosNestedAppBundles, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as clearAtRestKeyCache, r as isHeartbeatProcessAlive, rt as openEncryptedField, s as writeHostHeartbeat, st as resolveDshHome, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosBundleExecutable, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-B2jrUDhg.js";
 import z from "@deepseek-ai/schemastery";
-import { readFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { join } from "node:path";
 import { createProvider } from "@earendil-works/pi-ai";
@@ -1776,6 +1776,7 @@ function createWorkBuddyShim(options) {
 	const failoverAccount = options.failoverAccount;
 	const prepareAccount = options.prepareAccount;
 	const onAccountFailure = options.onAccountFailure;
+	const onRequestBody = options.onRequestBody;
 	const SHARED_SECRET = randomBytes(32).toString("base64url");
 	/** Constant-time bearer check; absent or mismatched bearers are rejected. */
 	function bearerOk(req) {
@@ -1886,6 +1887,12 @@ function createWorkBuddyShim(options) {
 		}
 		const raw = (await readBody(req)).toString("utf8");
 		const prepared = prepareChatBody(raw);
+		const requestModelId = modelIdOfBody(prepared);
+		if (onRequestBody !== void 0) try {
+			onRequestBody(prepared);
+		} catch (error) {
+			logger?.warn("dsh-connect-workbuddy: body report failed", error);
+		}
 		const controller = new AbortController();
 		res.on("close", () => controller.abort());
 		let result = await client.chatStream(credential, prepared, controller.signal);
@@ -1929,7 +1936,8 @@ function createWorkBuddyShim(options) {
 					onAccountFailure(entry.accountId, {
 						status: entry.failure.status,
 						kind: entry.failure.kind,
-						message: entry.failure.message
+						message: entry.failure.message,
+						...requestModelId === void 0 ? {} : { modelId: requestModelId }
 					});
 				} catch (error) {
 					logger?.warn("dsh-connect-workbuddy: recording an account failure failed", error);
@@ -2042,6 +2050,246 @@ function createWorkBuddyShim(options) {
 	};
 }
 //#endregion
+//#region src/body-report.ts
+/**
+* Body-composition report: WHAT was sent upstream, in counts (issue #59).
+*
+* WHY THIS EXISTS. Issue #59's reporter measured the SAME conversation charged
+* ~708K tokens by the CN gateway and ~1.374M by the international one (1.94×),
+* which turns a region switch into an instant `code 11115 prompt is too long`.
+* Two worlds explain that, and they have opposite owners:
+*
+*   - the gateways count identical bytes differently (upstream's business); or
+*   - the two requests did not carry the same messages (ours to fix).
+*
+* The second world was left standing by two independent measurements. The
+* reporter ran this project's `--kind`/`--language` probe on BOTH regions and
+* got the same tokens-per-1000-chars on byte-identical prose, code and JSON
+* (ratios 0.98–1.06 across six cells), so identical bytes really do bill
+* identically. And a code trace showed historical `reasoning` never reaches the
+* wire at all: pi-ai only forwards `thinking` blocks as text when
+* `compat.requiresThinkingAsText` is set — this plugin never sets it — and the
+* `reasoning_details` route needs a signature the stream parser never writes.
+* With the counting difference excluded and reasoning excluded, the remaining
+* candidate is that the two bodies differ in the first place.
+*
+* This module exists to settle exactly that, and it can do it WITHOUT either
+* region having credit: the body is assembled locally, before the upstream ever
+* gets a chance to answer `14018 Credits exhausted`. Capture one composition per
+* region in the same session and diff them.
+*
+* It records COUNTS ONLY — never a byte of message text, no account name, no
+* token. That is a hard rule, not a default: the point is to compare shape
+* (`messages.length`, per-block type, CJK vs non-CJK characters, total bytes),
+* and every one of those is answerable arithmetically. `tests/issue59-body-report.spec.ts`
+* asserts the report cannot leak a fixture's text.
+*/
+/**
+* Environment variable that enables the report.
+*
+* Unset or blank means OFF — a diagnostic that writes files must be opt-in.
+* `1`/`true` writes to `<DSH home>/body-reports/`; anything else is read as a
+* directory path, so a user can point it at an existing folder (and, on
+* Windows, one with spaces).
+*/
+const WORKBUDDY_BODY_REPORT_ENV = "WORKBUDDY_BODY_REPORT";
+/**
+* Character ranges that tokenize (and therefore bill) like CJK.
+*
+* Deliberately generous: the caller's question is "how much of this is the ~3×
+* kind", and the measured spread is 0.669 vs 0.224 tokens/char, so a character
+* class that is borderline costs far less than mis-attributing a whole bucket.
+* Ranges follow Unicode blocks, plus the compatibility forms and the two
+* extension planes where rare Han characters live.
+*/
+const CJK_RANGES = [
+	[11904, 12031],
+	[12288, 12351],
+	[12352, 12543],
+	[13312, 19903],
+	[19968, 40959],
+	[63744, 64255],
+	[65072, 65103],
+	[65280, 65519],
+	[131072, 195103]
+];
+/** Whether one code point bills like CJK. */
+function isCjkCodePoint(code) {
+	return CJK_RANGES.some(([low, high]) => code >= low && code <= high);
+}
+/** Count characters (code points) and how many of them are CJK. */
+function countChars(text) {
+	let chars = 0;
+	let cjkChars = 0;
+	for (const character of text) {
+		chars += 1;
+		const code = character.codePointAt(0);
+		if (code !== void 0 && isCjkCodePoint(code)) cjkChars += 1;
+	}
+	return {
+		chars,
+		cjkChars
+	};
+}
+/** Build one block report from already-extracted text. */
+function block(type, text) {
+	return {
+		type,
+		...countChars(text)
+	};
+}
+/** Whether a value is a plain object (not null, not an array). */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Describe one message's blocks.
+*
+* The role decides what a content string IS, and that is not cosmetic: a
+* `tool` message's payload is a tool result, so counting it as `text` would hide
+* the very bucket a long agentic session is mostly made of.
+*/
+function describeMessage(message) {
+	const role = typeof message["role"] === "string" ? message["role"] : "unknown";
+	const blocks = [];
+	const content = message["content"];
+	/**
+	* The block type a plain string carries, by the ROLE carrying it.
+	*
+	* A `tool` message's string is a tool RESULT and a `system` one is the system
+	* prompt; calling both `text` would fold the biggest bucket of a long agentic
+	* session into the smallest one, which is the opposite of what a composition
+	* report is for.
+	*/
+	const stringType = role === "tool" ? "tool-result" : role === "system" || role === "developer" ? "system" : "text";
+	if (typeof content === "string") {
+		if (content !== "") blocks.push(block(stringType, content));
+	} else if (Array.isArray(content)) for (const part of content) {
+		if (!isRecord(part)) continue;
+		const type = typeof part["type"] === "string" ? part["type"] : "unknown";
+		if (type === "text") {
+			const text = part["text"];
+			if (typeof text === "string" && text !== "") blocks.push(block(stringType, text));
+			continue;
+		}
+		blocks.push({
+			type: type === "image_url" ? "image" : type,
+			chars: 0,
+			cjkChars: 0
+		});
+	}
+	const toolCalls = message["tool_calls"];
+	if (Array.isArray(toolCalls)) for (const call of toolCalls) {
+		if (!isRecord(call)) continue;
+		const fn = call["function"];
+		const name = isRecord(fn) && typeof fn["name"] === "string" ? fn["name"] : "";
+		const args = isRecord(fn) && typeof fn["arguments"] === "string" ? fn["arguments"] : "";
+		blocks.push(block("tool-call", `${name}${args}`));
+	}
+	for (const field of [
+		"reasoning_content",
+		"reasoning",
+		"reasoning_text"
+	]) {
+		const value = message[field];
+		if (typeof value === "string" && value !== "") blocks.push(block("reasoning", value));
+	}
+	return {
+		role,
+		chars: blocks.reduce((sum, entry) => sum + entry.chars, 0),
+		cjkChars: blocks.reduce((sum, entry) => sum + entry.cjkChars, 0),
+		blocks
+	};
+}
+/**
+* Describe one serialized request body.
+*
+* Returns `undefined` when the body is not a JSON object — a diagnostic must
+* never be the reason a chat request fails, so every caller treats `undefined`
+* as "nothing to report" rather than an error.
+*/
+function describeBody(bodyJson, region, nowMs) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyJson);
+	} catch {
+		return;
+	}
+	if (!isRecord(parsed)) return void 0;
+	const rawMessages = parsed["messages"];
+	const messages = Array.isArray(rawMessages) ? rawMessages.filter(isRecord).map(describeMessage) : [];
+	const rawTools = parsed["tools"];
+	const tools = Array.isArray(rawTools) ? block("tools", rawTools.map((tool) => isRecord(tool) ? JSON.stringify(tool) : "").join("")) : {
+		type: "tools",
+		chars: 0,
+		cjkChars: 0
+	};
+	const chars = messages.reduce((sum, message) => sum + message.chars, 0) + tools.chars;
+	const cjkChars = messages.reduce((sum, message) => sum + message.cjkChars, 0) + tools.cjkChars;
+	return {
+		at: new Date(nowMs).toISOString(),
+		region,
+		...typeof parsed["model"] === "string" ? { model: parsed["model"] } : {},
+		bodyBytes: Buffer.byteLength(bodyJson, "utf8"),
+		messageCount: messages.length,
+		chars,
+		cjkChars,
+		tools,
+		messages
+	};
+}
+/**
+* Resolve the directory the report writes to, or `undefined` when disabled.
+*
+* Exported for the same reason the other env-var resolvers in this plugin are:
+* the behaviour is worth a unit test, and the test must not have to set a real
+* process-wide variable to get one.
+*/
+function bodyReportDirectory(env = process.env) {
+	const configured = env[WORKBUDDY_BODY_REPORT_ENV];
+	if (configured === void 0) return void 0;
+	const trimmed = configured.trim();
+	if (trimmed === "") return void 0;
+	if (trimmed === "1" || trimmed.toLowerCase() === "true") return join(resolveDshHome(), "body-reports");
+	return trimmed;
+}
+/**
+* Append one composition to `<dir>/<region>.jsonl`.
+*
+* One file per region is the whole point: the reporter captures a session, then
+* diffs `cn.jsonl`'s last line against `global.jsonl`'s. JSON Lines rather than
+* one file per request because a single turn makes many upstream calls (one per
+* tool step) and the LAST one is the interesting one.
+*
+* Read-modify-write is avoided on purpose — a long session would rewrite a
+* growing file on every step. The lock keeps two concurrent requests from
+* interleaving a line.
+*/
+async function appendBodyReport(directory, report) {
+	const file = join(directory, `${report.region}.jsonl`);
+	await mkdir(directory, { recursive: true });
+	const line = `${JSON.stringify(report)}\n`;
+	await withFileLock(file, () => appendFile(file, line, "utf8"));
+}
+/**
+* Record one outgoing body, if the report is enabled.
+*
+* NEVER THROWS and never awaits long: this is called on the request path, and a
+* chat request must not fail (or stall) because a diagnostic could not write a
+* file. A failure is reported through `onError` so the caller can log it.
+*/
+async function recordBodyReport(region, bodyJson, options = {}) {
+	const directory = bodyReportDirectory(options.env);
+	if (directory === void 0) return;
+	try {
+		const report = describeBody(bodyJson, region, options.nowMs ?? Date.now());
+		if (report === void 0) return;
+		await appendBodyReport(directory, report);
+	} catch (error) {
+		options.onError?.(error);
+	}
+}
+//#endregion
 //#region src/probe.ts
 /**
 * How long to bench a MODEL that answered 14003 with no stated time.
@@ -2504,7 +2752,22 @@ async function testAllAccounts(targets, modelId, deps, onRow) {
 	const rows = [];
 	for (const [index, target] of targets.entries()) {
 		if (index > 0) await (deps.wait ?? defaultWait)(400);
-		const row = await testOne(target, modelId, deps);
+		const wanted = typeof modelId === "function" ? modelId(target.accountId) : { modelId };
+		if (wanted.modelId === void 0) {
+			const row = {
+				accountId: target.accountId,
+				accountName: target.accountName,
+				result: {
+					modelId: wanted.staleModelId ?? "",
+					outcome: "unavailable",
+					message: wanted.staleModelId === void 0 ? "this region offers no model to test" : `the test model "${wanted.staleModelId}" is no longer offered in this region`
+				}
+			};
+			rows.push(row);
+			onRow?.(row);
+			continue;
+		}
+		const row = await testOne(target, wanted.modelId, deps);
 		rows.push(row);
 		onRow?.(row);
 	}
@@ -2567,6 +2830,7 @@ function probeUpdatesOf(rows) {
 			outcome: row.result.outcome,
 			atMs,
 			source: "test-batch",
+			modelId: row.result.modelId,
 			...row.accountName === "" ? {} : { accountName: row.accountName },
 			...row.result.retryAtMs === void 0 ? {} : { retryAtMs: row.result.retryAtMs },
 			...row.result.message === void 0 ? {} : { message: row.result.message }
@@ -2810,6 +3074,30 @@ function pickFreeModel(catalog) {
 * That is the safe direction: no credits are spent while the roster is unknown,
 * and the card offers to switch back to automatic.
 */
+/**
+* The model ONE account's test should target (issue #61).
+*
+* The region-wide `targetModelId` is one value, but `6004` is an ACCOUNT × MODEL
+* condition: the reporter measured two accounts where `hy4-preview-f` answered
+* `ok` and `step-5-preview` returned `429 / 6004` at the same moment. Testing
+* only the region's model therefore cannot answer "can this account serve the
+* model I actually use", which is the question the pool's test button is read as
+* answering.
+*
+* A per-account override is the smallest thing that makes the question
+* answerable, and it is additive: an account with no entry keeps using
+* `targetModelId`, so every existing profile behaves identically.
+*
+* Returns a PREFERENCE, not a resolved target — `resolveTargetModel` still
+* validates it against the catalog, so an override pointing at a model this
+* region no longer offers is reported as stale rather than silently swapped for
+* one the user did not choose.
+*/
+function targetModelPreference(preferences, accountId) {
+	const perAccount = accountId === void 0 ? void 0 : preferences.targetModelIdByAccount?.[accountId];
+	if (perAccount !== void 0 && perAccount !== "") return perAccount;
+	return preferences.targetModelId;
+}
 function resolveTargetModel(catalog, preferredId) {
 	if (preferredId !== void 0 && preferredId !== "") return catalog.some((model) => model.id === preferredId) ? {
 		modelId: preferredId,
@@ -4014,7 +4302,8 @@ async function workBuddyWebPool(deps, region) {
 	const preferences = pool.preferences(region);
 	const members = await pool.members(region);
 	const ranked = rankPool(members, Date.now());
-	const target = resolveTargetModel(pool.catalog?.(region) ?? [], preferences.targetModelId);
+	const catalog = pool.catalog?.(region) ?? [];
+	const target = resolveTargetModel(catalog, preferences.targetModelId);
 	const currentAccountId = await pool.currentAccountId?.(region);
 	const byId = new Map(members.map((member) => [member.account.id, member]));
 	const rankedIds = new Set(ranked.map((row) => row.account.id));
@@ -4053,8 +4342,17 @@ async function workBuddyWebPool(deps, region) {
 				atMs: measured.probe.atMs,
 				...measured.probe.source === void 0 ? {} : { source: measured.probe.source },
 				...measured.probe.retryAtMs === void 0 ? {} : { retryAtMs: measured.probe.retryAtMs },
-				...measured.probe.message === void 0 ? {} : { message: measured.probe.message }
+				...measured.probe.message === void 0 ? {} : { message: measured.probe.message },
+				...measured.probe.modelId === void 0 ? {} : { modelId: measured.probe.modelId }
 			} },
+			...(() => {
+				const perRow = resolveTargetModel(catalog, targetModelPreference(preferences, account.id));
+				return {
+					...perRow.modelId === void 0 ? {} : { testModelId: perRow.modelId },
+					testModelSource: perRow.source,
+					...perRow.staleModelId === void 0 ? {} : { staleTestModelId: perRow.staleModelId }
+				};
+			})(),
 			...row?.excludedBy === void 0 ? {} : { excludedBy: row.excludedBy },
 			current: account.id === currentAccountId,
 			member,
@@ -4067,6 +4365,7 @@ async function workBuddyWebPool(deps, region) {
 		...target.modelId === void 0 ? {} : { targetModelId: target.modelId },
 		...target.staleModelId === void 0 ? {} : { staleTargetModelId: target.staleModelId },
 		targetModelSource: target.source,
+		targetModelIdByAccount: preferences.targetModelIdByAccount ?? {},
 		memberAccountIds: preferences.memberAccountIds,
 		...preferences.probeInputTokens === void 0 ? {} : { probeInputTokens: preferences.probeInputTokens },
 		effectiveMemberAccountIds: effectiveMembersOf(accounts.map((account) => account.accountId), new Set(preferences.memberAccountIds)),
@@ -4310,7 +4609,20 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						reason: "pool-unavailable",
 						error: "pool test unavailable"
 					});
-					const target = resolveTargetModel(pool.catalog?.(region) ?? [], pool.preferences(region).targetModelId);
+					const preferences = pool.preferences(region);
+					const catalog = pool.catalog?.(region) ?? [];
+					/**
+					* The model ONE member is tested on (issue #61).
+					*
+					* Per account, because a test model is a per-account choice: `6004` is
+					* an account × model condition, so a batch that tested every member on
+					* one model would report "可用" for an account whose own model is the
+					* one that is limited. Resolution still runs through
+					* `resolveTargetModel`, so a stale override is reported, never
+					* silently swapped.
+					*/
+					const targetFor = (accountId) => resolveTargetModel(catalog, targetModelPreference(preferences, accountId));
+					const target = resolveTargetModel(catalog, targetModelPreference(preferences, void 0));
 					if (target.modelId === void 0) return json(res, 409, {
 						action: "test",
 						modelId: void 0,
@@ -4332,7 +4644,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						modelId: target.modelId
 					});
 					try {
-						await pool.test(region, target.modelId, (row) => {
+						await pool.test(region, targetFor, (row) => {
 							writeLine({ row });
 						});
 						writeLine({ done: true });
@@ -4670,6 +4982,7 @@ const modelConfig = z.object({
 const poolConfig = z.object({
 	enabled: z.boolean().default(false).description("Whether this region's account pool is active (opt-in). While on, a failed chat request is retried against the other usable pool members before the error is reported."),
 	targetModelId: z.string().default("").description("Model id to test; empty means pick a zero-multiplier model from this region's catalog"),
+	targetModelIdByAccount: z.dict(z.string()).default({}).description("Per-account test model, keyed by account id; an account with no entry uses targetModelId. Use this when an account must be tested on the model you actually chat with, because 6004 is an account-by-model condition."),
 	/**
 	* Sizing of the test probe, as a token count the user picks from a fixed set.
 	*
@@ -4927,6 +5240,9 @@ function apply(ctx, config) {
 				* traffic once the provider is registered, which happens after this whole
 				* setup completes.
 				*/
+				onRequestBody: (body) => {
+					recordBodyReport(region, body, { onError: (error) => ctx.logger.warn("dsh-connect-workbuddy: body report failed", error) });
+				},
 				prepareAccount: () => applyPoolSelection(region),
 				failoverAccount: (triedAccountIds) => failoverAccountFor(region, triedAccountIds),
 				onAccountFailure: (accountId, failure) => {
@@ -5260,7 +5576,7 @@ function apply(ctx, config) {
 			* rather than pretending a test ran.
 			*/
 			testOne: async (region, accountId) => {
-				const target = regionTargetModel(region);
+				const target = regionTargetModel(region, accountId);
 				if (target === void 0) return void 0;
 				const store = stacks[region].store;
 				const credential = await store.credentialFor(accountId).catch(() => void 0);
@@ -5535,6 +5851,7 @@ function apply(ctx, config) {
 			outcome,
 			atMs: Date.now(),
 			source: "live-request",
+			...failure.modelId === void 0 ? {} : { modelId: failure.modelId },
 			...retryAtMs === void 0 ? {} : { retryAtMs },
 			...message === "" ? {} : { message }
 		} });
@@ -5625,11 +5942,12 @@ function apply(ctx, config) {
 	/**
 	* The model a per-row test would use right now: the SAME resolution the
 	* batch route performs (`resolveTargetModel` over the region's displayed
-	* catalog and the saved preference), so a row test and a batch test never
-	* measure different models. Undefined mirrors the route's 409 states.
+	* catalog and the saved preference — including a per-account override,
+	* issue #61), so a row test and a batch test never measure different models.
+	* Undefined mirrors the route's 409 states.
 	*/
-	const regionTargetModel = (region) => {
-		return resolveTargetModel(displayModels(current(), region), poolPreferencesOf(current(), region).targetModelId).modelId;
+	const regionTargetModel = (region, accountId) => {
+		return resolveTargetModel(displayModels(current(), region), targetModelPreference(poolPreferencesOf(current(), region), accountId)).modelId;
 	};
 	/** One region's pool preferences, with the schema's defaults applied. */
 	const poolPreferencesOf = (config, region) => {
@@ -5638,6 +5956,7 @@ function apply(ctx, config) {
 		return {
 			enabled: pool?.enabled === true,
 			targetModelId: pool?.targetModelId ?? "",
+			targetModelIdByAccount: { ...pool?.targetModelIdByAccount },
 			...probeInputTokens === void 0 ? {} : { probeInputTokens },
 			memberAccountIds: pool?.memberAccountIds ?? []
 		};
@@ -5812,4 +6131,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, modelIdOfBody, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "4.4.5",
+  "version": "4.4.6",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",