dsh-connect-workbuddy 4.5.1 → 4.6.0

package/lib/{host-heartbeat-Vd2tNdsv.js → host-heartbeat-BxBvvAZq.js}

@@ -3825,7 +3825,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.5.1";
+const WORKBUDDY_CONNECT_VERSION = "4.6.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -1074,6 +1074,20 @@ interface WorkBuddyShim {
  * retry may happen before anything has been written to the client.
  */
 type WorkBuddyFailoverAccount = (triedAccountIds: readonly string[]) => Promise<WorkBuddyCredential | undefined>;
+/**
+ * Why the pool had no candidate, asked only after failover came up empty.
+ *
+ * A separate callback rather than a richer return type on
+ * {@link WorkBuddyFailoverAccount}: the loop calls that one on the HOT PATH of
+ * every retry, and a policy that had to explain its refusal on every call would
+ * make the common case pay for the rare one. This runs at most once per failed
+ * request, and only when the answer is already going to be an error.
+ *
+ * Returns a short Chinese clause naming the reason (e.g. "池中其余账号都在冷却"),
+ * or undefined when the host has nothing to add — in which case the reply says
+ * only that no other account was available.
+ */
+type WorkBuddyFailoverShortfall = () => Promise<string | undefined>;
 /** Constructor dependencies. */
 interface WorkBuddyShimOptions {
   store: WorkBuddyCredentialStore;
@@ -1086,6 +1100,19 @@ interface WorkBuddyShimOptions {
    * reported as-is.
    */
   failoverAccount?: WorkBuddyFailoverAccount;
+  /**
+   * Why the pool had no usable candidate, asked after failover found none.
+   *
+   * The failure path uses this to answer the question the user is actually left
+   * with — "why did nothing else work?" — instead of only reporting that every
+   * attempt failed. Without it the pool's own reasoning is invisible at exactly
+   * the moment it matters, and "换个模型" reads as a guess rather than as the
+   * conclusion of a search the plugin already performed.
+   *
+   * Optional, and its absence is a supported state: a host that does not supply
+   * it produces the same reply as before this option existed.
+   */
+  failoverShortfall?: WorkBuddyFailoverShortfall;
   /**
    * Called before the FIRST attempt of every chat request, so the plugin can
    * point the store at the account the pool's ranking says should serve.
@@ -2660,7 +2687,6 @@ interface WorkBuddyWebPool {
    * an id whose model has left the catalog must survive a save so the user's
    * record of what they chose is not silently destroyed.
    */
-  targetModelIdByAccount?: Readonly<Record<string, string>>;
   /**
    * Where the target came from. `'stale'` means the SAVED id is no longer in
    * the catalog — a distinct state from `'none'` (no free model exists),
@@ -2953,7 +2979,6 @@ interface WorkBuddyPoolDeps {
     enabled: boolean;
     targetModelId: string;
     /** Per-account override of `targetModelId` (issue #61). */
-    targetModelIdByAccount?: Readonly<Record<string, string>>;
     /**
      * Tokens each test probe sends as saved; `0` when the user never chose.
      *
@@ -3051,16 +3076,11 @@ interface WorkBuddyPoolDeps {
    */
   test?(region: WorkBuddyRegion,
   /**
-   * One model for the whole batch, or a per-account resolver (issue #61).
-   *
-   * The resolver form is what lets a batch honour a per-account test model; a
-   * resolver that names no model yields an `unavailable` row for that account
-   * rather than silently testing the region default.
+   * The model the whole batch is measured on — ONE value, by design: every
+   * member of the batch must be probed on the same model or a green batch
+   * stops meaning a single thing (see the removal note in `account-pool-run.ts`).
    */
-  modelId: string | ((accountId: string) => {
-    modelId?: string;
-    staleModelId?: string;
-  }), onRow?: (row: WorkBuddyPoolTestRow) => void): Promise<readonly WorkBuddyPoolTestRow[]>;
+  modelId: string, onRow?: (row: WorkBuddyPoolTestRow) => void): Promise<readonly WorkBuddyPoolTestRow[]>;
   /** The region's live catalog, used to resolve the free target model. */
   catalog?(region: WorkBuddyRegion): readonly WorkBuddyModelInfo[];
 }
@@ -3200,7 +3220,6 @@ interface WorkBuddyPoolPreferences {
    * chatting with. An id that is no longer in the catalog is reported as stale
    * rather than replaced, so no credits are spent on a model nobody chose.
    */
-  targetModelIdByAccount?: Record<string, string>;
   /**
    * How much input a probe sends, in tokens — the pool's biggest single knob.
    *

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as isEncryptedFieldWrapper, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as deriveAtRestKey, K as WORKBUDDY_APP_EXECUTABLE_ENV, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as fetchAtRestKeyPayload, Y as deriveAtRestKeyId, Z as findWorkbuddyAppExecutable, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as workbuddyAppExecutableCandidates, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as withFileLock, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as isWorkbuddyBundle, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as readAtRestKey, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as writeFileAtomic, m as deriveCatalog, n as clearHostHeartbeat, nt as macosNestedAppBundles, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as clearAtRestKeyCache, r as isHeartbeatProcessAlive, rt as openEncryptedField, s as writeHostHeartbeat, st as resolveDshHome, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosBundleExecutable, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-Vd2tNdsv.js";
+import { $ as isEncryptedFieldWrapper, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as deriveAtRestKey, K as WORKBUDDY_APP_EXECUTABLE_ENV, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as fetchAtRestKeyPayload, Y as deriveAtRestKeyId, Z as findWorkbuddyAppExecutable, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as workbuddyAppExecutableCandidates, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as withFileLock, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as isWorkbuddyBundle, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as readAtRestKey, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as writeFileAtomic, m as deriveCatalog, n as clearHostHeartbeat, nt as macosNestedAppBundles, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as clearAtRestKeyCache, r as isHeartbeatProcessAlive, rt as openEncryptedField, s as writeHostHeartbeat, st as resolveDshHome, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosBundleExecutable, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-BxBvvAZq.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1719,20 +1719,25 @@ function describeAccount(credential) {
 * One short phrase for why an account was abandoned, for the in-reply notice.
 *
 * Kept to the distinction the user can act on rather than the internal kind
-* name: "rate limited" says wait or add an account, "rejected" says the sign-in
+* name: "账号被限流" says wait or add an account, "登录已失效" says the sign-in
 * is the problem. The numeric kind would only send them to the log.
+*
+* The wording is what `failoverNoticeText` interpolates into a Chinese sentence,
+* so these are Chinese phrases rather than English ones — the reader of a failed
+* turn in this product reads Chinese, and an English clause inside Chinese prose
+* was the previous build's most visible rough edge.
 */
 function failoverReasonText(failure) {
-	if (failure.ok) return "unusable";
+	if (failure.ok) return "不可用";
 	switch (failure.kind) {
-		case "soft_rate": return "rate limited";
-		case "hard_credit": return "out of credits";
-		case "model_busy": return "throttled on this model (not the account)";
-		case "session_dead": return "signed out";
-		case "policy_reject": return "rejected by policy";
-		case "not_found": return "model unavailable";
-		case "server": return "erroring upstream";
-		default: return `unusable (http ${failure.status})`;
+		case "soft_rate": return "被限流";
+		case "hard_credit": return "积分已耗尽";
+		case "model_busy": return "该模型当前繁忙（不是账号问题）";
+		case "session_dead": return "登录已失效";
+		case "policy_reject": return "被服务端策略拒绝";
+		case "not_found": return "模型不可用";
+		case "server": return "上游异常";
+		default: return `不可用（http ${failure.status}）`;
 	}
 }
 /**
@@ -1747,9 +1752,13 @@ function failoverReasonText(failure) {
 * over is the one the user is about to keep talking to, and naming it invites
 * the reading that they must now manage it. What they need is to know the one
 * they chose did not answer, and why.
+*
+* Chinese, matching the rest of a failed turn's copy: the host renders its own
+* quota sentence in Chinese, the pool rows are Chinese, and an English clause
+* here was the one line of the reply a Chinese reader had to decode.
 */
 function failoverNoticeText(from, reason) {
-	return `\n\n> [dsh-connect-workbuddy] 「${from}」was ${reason} — this answer came from another account\n\n`;
+	return `\n\n> [dsh-connect-workbuddy] 「${from}」${reason}，已改用池中另一个账号回答\n\n`;
 }
 /** One frame carrying replacement text for a frame whose content was consumed. */
 function contentFrame(chunk, choice, content) {
@@ -1774,6 +1783,7 @@ function createWorkBuddyShim(options) {
 	const { store, client, catalog } = options;
 	const logger = options.logger;
 	const failoverAccount = options.failoverAccount;
+	const failoverShortfall = options.failoverShortfall;
 	const prepareAccount = options.prepareAccount;
 	const onAccountFailure = options.onAccountFailure;
 	const onRequestBody = options.onRequestBody;
@@ -1971,7 +1981,9 @@ function createWorkBuddyShim(options) {
 		reportFailures();
 		if (!result.ok) {
 			const attempts = triedAccountIds.length;
-			const note = attempts > 1 ? ` (after trying ${attempts} accounts)` : "";
+			const note = attempts > 1 ? `（已尝试 ${attempts} 个账号）` : "";
+			const shortfall = failoverShortfall === void 0 ? void 0 : await failoverShortfall().catch(() => void 0);
+			const why = shortfall === void 0 ? "" : `：${shortfall}`;
 			if (result.kind === "policy_reject") {
 				const detail = result.detail;
 				const lead = detail?.displayMsg ?? result.message.slice(0, 200);
@@ -1992,7 +2004,7 @@ function createWorkBuddyShim(options) {
 				writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, message, hostErrorCode(result.kind));
 				return;
 			}
-			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status})${note}: ${result.message.slice(0, 400)}`, hostErrorCode(result.kind));
+			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy 上游失败：${failoverReasonText(result)}（http ${result.status}）${note}${why}。${result.message.slice(0, 400)}` + (failoverShortfall === void 0 ? "" : "。池中没有其他可用账号，建议换一个模型继续，或稍后等待该账号的额度恢复"), hostErrorCode(result.kind));
 			return;
 		}
 		res.writeHead(200, {
@@ -2448,25 +2460,54 @@ function parseRetryAfter(value, nowMs) {
 	return parsed;
 }
 /**
-* The upstream's reset sentence, as its Chinese gateway writes it.
+* The `<timestamp> UTC±N` core of the upstream's reset sentence.
+*
+* Shared by both spellings below so the two can never drift into accepting
+* different timestamps: the offset handling and the calendar round-trip check in
+* {@link parseUpstreamResetAt} are what make a parsed value trustworthy, and two
+* copies of this shape would be two chances to loosen one of them.
+*/
+const RESET_STAMP = String.raw`(\d{4})-(\d{2})-(\d{2})[ T](\d{2}):(\d{2}):(\d{2})\s*UTC\s*([+-])(\d{1,2})(?::?(\d{2}))?`;
+/**
+* The upstream's reset sentence, in BOTH spellings this service uses.
 *
-* Measured on a live 429 (code 6004), verbatim:
+* Chinese gateway, measured on a live 429 (code 6004), verbatim:
 *
 *   `您的使用量已超出频率限制，将在 2026-09-30 02:30:30 UTC+8 重置，您也可以切换其他模型继续使用。`
 *
-* The two halves are captured separately because the second one is the whole
-* reason this parser exists: the upstream DOES name a time, and the plugin was
-* showing "the upstream gave no time" while the answer was sitting right there
-* in the body. The earlier note in this module ("the upstream provides no
-* rate-limit metadata") was drawn from the RESPONSE HEADERS alone — true as far
-* as it went, and wrong as a conclusion, because the time is in the body text.
+* International gateway, measured on the same code over the same account pool,
+* verbatim:
+*
+*   `usage exceeds frequency limit, but don't worry, your usage will reset at
+*    2026-10-16 11:34:04 UTC+8, alternatively, you can switch to the other
+*    models to continue using it.`
 *
-* Deliberately loose about the surrounding wording (`[\s\S]*?` on both sides)
-* and strict about the parts that must not be guessed: the keyword 重置, the
-* timestamp shape, and an explicit UTC offset. A message that merely mentions
-* 重置 without a parsable offset yields no time, which is the honest answer.
+* WHY THERE ARE TWO. Each gateway states the time in its own language, and the
+* marker sits on a DIFFERENT SIDE of the timestamp: 重置 follows it in Chinese,
+* while `reset at` precedes it in English — so one pattern cannot cover both by
+* loosening the surrounding prose alone. The original pattern demanded the
+* Chinese keyword, so an English body parsed to nothing and the card said
+* 「上游未给出何时恢复」 about a message that had just named the exact minute.
+*
+* That is the honest-absence contract broken in the OTHER direction — not a
+* made-up time, but a real time discarded — and it is the worse of the two
+* failures, because the account stays excluded on the 30-minute fallback instead
+* of the ~18 hours upstream asked for. The pool then returns the account to
+* candidacy early and spends a request rediscovering the same 6004.
+*
+* Both patterns stay deliberately loose about the surrounding prose and strict
+* about the parts that must not be guessed: a keyword, the timestamp shape, and
+* an explicit UTC offset. A message that merely mentions a reset without a
+* parsable offset still yields no time, which remains the honest answer.
 */
-const UPSTREAM_RESET_PATTERN = /将在?\s*(\d{4})-(\d{2})-(\d{2})[ T](\d{2}):(\d{2}):(\d{2})\s*UTC\s*([+-])(\d{1,2})(?::?(\d{2}))?[\s\S]*?重置/u;
+const UPSTREAM_RESET_PATTERN_ZH = new RegExp(`将在?\\s*${RESET_STAMP}[\\s\\S]*?重置`, "u");
+/**
+* The English spelling, anchored on `reset at` / `refresh on` IMMEDIATELY before
+* the timestamp — the same strictness as the Chinese pattern, which requires its
+* marker immediately after it. A message that mentions a reset somewhere else
+* entirely therefore still yields no time.
+*/
+const UPSTREAM_RESET_PATTERN_EN = new RegExp(`(?:reset|resets|refresh|refreshes)\\s+(?:at|on)\\s+${RESET_STAMP}`, "iu");
 /**
 * Parse the reset time out of an upstream failure message.
 *
@@ -2484,7 +2525,7 @@ const UPSTREAM_RESET_PATTERN = /将在?\s*(\d{4})-(\d{2})-(\d{2})[ T](\d{2}):(\d
 * would be fiction in the other direction.
 */
 function parseUpstreamResetAt(message) {
-	const match = UPSTREAM_RESET_PATTERN.exec(message);
+	const match = UPSTREAM_RESET_PATTERN_ZH.exec(message) ?? UPSTREAM_RESET_PATTERN_EN.exec(message);
 	if (match === null) return void 0;
 	const [, year, month, day, hour, minute, second, sign, offsetHours, offsetMinutes] = match;
 	const offsetTotalMinutes = (sign === "-" ? -1 : 1) * (Number(offsetHours) * 60 + Number(offsetMinutes ?? "0"));
@@ -2752,22 +2793,7 @@ async function testAllAccounts(targets, modelId, deps, onRow) {
 	const rows = [];
 	for (const [index, target] of targets.entries()) {
 		if (index > 0) await (deps.wait ?? defaultWait)(400);
-		const wanted = typeof modelId === "function" ? modelId(target.accountId) : { modelId };
-		if (wanted.modelId === void 0) {
-			const row = {
-				accountId: target.accountId,
-				accountName: target.accountName,
-				result: {
-					modelId: wanted.staleModelId ?? "",
-					outcome: "unavailable",
-					message: wanted.staleModelId === void 0 ? "this region offers no model to test" : `the test model "${wanted.staleModelId}" is no longer offered in this region`
-				}
-			};
-			rows.push(row);
-			onRow?.(row);
-			continue;
-		}
-		const row = await testOne(target, wanted.modelId, deps);
+		const row = await testOne(target, modelId, deps);
 		rows.push(row);
 		onRow?.(row);
 	}
@@ -3074,30 +3100,6 @@ function pickFreeModel(catalog) {
 * That is the safe direction: no credits are spent while the roster is unknown,
 * and the card offers to switch back to automatic.
 */
-/**
-* The model ONE account's test should target (issue #61).
-*
-* The region-wide `targetModelId` is one value, but `6004` is an ACCOUNT × MODEL
-* condition: the reporter measured two accounts where `hy4-preview-f` answered
-* `ok` and `step-5-preview` returned `429 / 6004` at the same moment. Testing
-* only the region's model therefore cannot answer "can this account serve the
-* model I actually use", which is the question the pool's test button is read as
-* answering.
-*
-* A per-account override is the smallest thing that makes the question
-* answerable, and it is additive: an account with no entry keeps using
-* `targetModelId`, so every existing profile behaves identically.
-*
-* Returns a PREFERENCE, not a resolved target — `resolveTargetModel` still
-* validates it against the catalog, so an override pointing at a model this
-* region no longer offers is reported as stale rather than silently swapped for
-* one the user did not choose.
-*/
-function targetModelPreference(preferences, accountId) {
-	const perAccount = accountId === void 0 ? void 0 : preferences.targetModelIdByAccount?.[accountId];
-	if (perAccount !== void 0 && perAccount !== "") return perAccount;
-	return preferences.targetModelId;
-}
 function resolveTargetModel(catalog, preferredId) {
 	if (preferredId !== void 0 && preferredId !== "") return catalog.some((model) => model.id === preferredId) ? {
 		modelId: preferredId,
@@ -3606,7 +3608,7 @@ const POOL_STORE_PREFIX = ".workbuddy-pool";
 function isProbe(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const candidate = value;
-	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string") && (candidate["accountName"] === void 0 || typeof candidate["accountName"] === "string") && (candidate["source"] === void 0 || typeof candidate["source"] === "string");
+	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string") && (candidate["accountName"] === void 0 || typeof candidate["accountName"] === "string") && (candidate["modelId"] === void 0 || typeof candidate["modelId"] === "string") && (candidate["source"] === void 0 || typeof candidate["source"] === "string");
 }
 /**
 * One region's path for measured pool facts.
@@ -3618,6 +3620,49 @@ function workbuddyPoolStorePath(region) {
 	return join(resolveDshHome(), `${POOL_STORE_PREFIX}.${region}.json`);
 }
 /**
+* The recovery time a stored record implies — declared, or recoverable from its
+* own body.
+*
+* The field itself wins when present: it is what the writer computed with the
+* full input set (`Retry-After` header, quota-refresh point, body), and
+* re-deriving it could only lose information.
+*
+* The fallback exists because a record can state a time in its `message` and
+* still have no `retryAtMs`. That is not a hypothetical — it is what the English
+* `6004` body produced, since the parser that ran at write time matched only the
+* Chinese 「… 重置」 sentence:
+*
+*   `{"code":6004,"msg":"usage exceeds frequency limit, but don't worry, your
+*     usage will reset at 2026-10-16 11:34:04 UTC+8, …"}`
+*
+* leaving a record that names the exact minute it will serve again while
+* `retryDue` falls back to {@link POOL_UNKNOWN_COOLDOWN_MS}. The row then told the
+* user 「上游未给出何时恢复」 about a body that had just said when, and the pool
+* put the account back ~18 hours early to rediscover the same limit.
+*
+* Read-time healing is the only place this can be repaired for EXISTING records:
+* every consumer receives probes through {@link readPoolProbes} —
+* `accountExclusions` (the composer panel), `poolMembersOf` /
+* `localPoolMembers` (the card AND failover routing), `memberNames` — so healing
+* here fixes all of them at once. Re-deriving at each consumer instead would be
+* three copies of one rule, and the next consumer added would silently miss it.
+*
+* Not a permanent second derivation: `writePoolProbes` reads through this
+* function before it writes, so the very next write persists the healed value.
+*
+* Scoped to the two outcomes whose vocabulary HAS a stated time, matching
+* {@link WorkBuddyPoolProbe.retryAtMs}. Widening it would let an incidental
+* sentence in an `ok` body attach a countdown to a healthy account —
+* `AccountPool.tsx` prints any present `retryAtMs` beside the outcome, so that
+* would render a waiting time on an account that is not waiting for anything.
+*/
+function retryAtMsOf(probe) {
+	if (probe.retryAtMs !== void 0) return probe.retryAtMs;
+	if (probe.outcome !== "rate-limited" && probe.outcome !== "out-of-credit") return void 0;
+	if (probe.message === void 0) return void 0;
+	return parseUpstreamResetAt(probe.message);
+}
+/**
 * Read one region's measured facts.
 *
 * Contains NO credentials. The one free-text field is `message`, and it is
@@ -3650,13 +3695,15 @@ async function readPoolProbes(region) {
 	const probes = {};
 	for (const [accountId, probe] of Object.entries(document.probes)) {
 		if (accountId === "" || !isProbe(probe)) continue;
+		const retryAtMs = retryAtMsOf(probe);
 		probes[accountId] = {
 			outcome: probe.outcome,
 			atMs: probe.atMs,
 			...knownProbeSource(probe.source) === void 0 ? {} : { source: knownProbeSource(probe.source) },
-			...probe.retryAtMs === void 0 ? {} : { retryAtMs: probe.retryAtMs },
+			...retryAtMs === void 0 ? {} : { retryAtMs },
 			...probe.message === void 0 ? {} : { message: probe.message },
-			...probe.accountName === void 0 ? {} : { accountName: probe.accountName }
+			...probe.accountName === void 0 ? {} : { accountName: probe.accountName },
+			...probe.modelId === void 0 ? {} : { modelId: probe.modelId }
 		};
 	}
 	return probes;
@@ -4349,7 +4396,7 @@ async function workBuddyWebPool(deps, region) {
 				...measured.probe.modelId === void 0 ? {} : { modelId: measured.probe.modelId }
 			} },
 			...(() => {
-				const perRow = resolveTargetModel(catalog, targetModelPreference(preferences, account.id));
+				const perRow = resolveTargetModel(catalog, preferences.targetModelId);
 				return {
 					...perRow.modelId === void 0 ? {} : { testModelId: perRow.modelId },
 					testModelSource: perRow.source,
@@ -4368,7 +4415,6 @@ async function workBuddyWebPool(deps, region) {
 		...target.modelId === void 0 ? {} : { targetModelId: target.modelId },
 		...target.staleModelId === void 0 ? {} : { staleTargetModelId: target.staleModelId },
 		targetModelSource: target.source,
-		targetModelIdByAccount: preferences.targetModelIdByAccount ?? {},
 		memberAccountIds: preferences.memberAccountIds,
 		...preferences.probeInputTokens === void 0 ? {} : { probeInputTokens: preferences.probeInputTokens },
 		effectiveMemberAccountIds: effectiveMembersOf(accounts.map((account) => account.accountId), new Set(preferences.memberAccountIds)),
@@ -4613,19 +4659,17 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						error: "pool test unavailable"
 					});
 					const preferences = pool.preferences(region);
-					const catalog = pool.catalog?.(region) ?? [];
 					/**
 					* The model ONE member is tested on (issue #61).
 					*
-					* Per account, because a test model is a per-account choice: `6004` is
-					* an account × model condition, so a batch that tested every member on
-					* one model would report "可用" for an account whose own model is the
-					* one that is limited. Resolution still runs through
-					* `resolveTargetModel`, so a stale override is reported, never
-					* silently swapped.
+					* ONE model for the whole batch, and it is also the gate: if the region
+					* cannot name a target model the card is told to pick one before any
+					* credits are spent. Every member is therefore measured on the SAME
+					* model, which is what makes a green batch mean one thing. Resolution
+					* runs through `resolveTargetModel`, so a stale target is reported,
+					* never silently swapped for another model.
 					*/
-					const targetFor = (accountId) => resolveTargetModel(catalog, targetModelPreference(preferences, accountId));
-					const target = resolveTargetModel(catalog, targetModelPreference(preferences, void 0));
+					const target = resolveTargetModel(pool.catalog?.(region) ?? [], preferences.targetModelId);
 					if (target.modelId === void 0) return json(res, 409, {
 						action: "test",
 						modelId: void 0,
@@ -4647,7 +4691,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						modelId: target.modelId
 					});
 					try {
-						await pool.test(region, targetFor, (row) => {
+						await pool.test(region, target.modelId, (row) => {
 							writeLine({ row });
 						});
 						writeLine({ done: true });
@@ -4985,7 +5029,6 @@ const modelConfig = z.object({
 const poolConfig = z.object({
 	enabled: z.boolean().default(false).description("Whether this region's account pool is active (opt-in). While on, a failed chat request is retried against the other usable pool members before the error is reported."),
 	targetModelId: z.string().default("").description("Model id to test; empty means pick a zero-multiplier model from this region's catalog"),
-	targetModelIdByAccount: z.dict(z.string()).default({}).description("Per-account test model, keyed by account id; an account with no entry uses targetModelId. Use this when an account must be tested on the model you actually chat with, because 6004 is an account-by-model condition."),
 	/**
 	* Sizing of the test probe, as a token count the user picks from a fixed set.
 	*
@@ -5249,6 +5292,7 @@ function apply(ctx, config) {
 				},
 				prepareAccount: () => applyPoolSelection(region),
 				failoverAccount: (triedAccountIds) => failoverAccountFor(region, triedAccountIds),
+				failoverShortfall: () => explainPoolShortfall(region),
 				onAccountFailure: (accountId, failure) => {
 					recordAccountFailure(region, accountId, failure);
 				}
@@ -5587,7 +5631,7 @@ function apply(ctx, config) {
 			* rather than pretending a test ran.
 			*/
 			testOne: async (region, accountId) => {
-				const target = regionTargetModel(region, accountId);
+				const target = regionTargetModel(region);
 				if (target === void 0) return void 0;
 				const store = stacks[region].store;
 				const credential = await store.credentialFor(accountId).catch(() => void 0);
@@ -5762,6 +5806,57 @@ function apply(ctx, config) {
 		}
 	};
 	/**
+	* Why the pool left a failed request with nowhere to go, in one short clause.
+	*
+	* Runs ONLY after a request has already failed, so it may afford work the hot
+	* path cannot — but it still reads local state only (the probe store and the
+	* member list), because spending a network call to explain a failure would add
+	* a second delay to a request the user is already waiting on.
+	*
+	* It counts rather than lists. The reply is one line inside an error message,
+	* and enumerating accounts there would bury the advice; the card is where a
+	* per-account breakdown belongs, and it already shows one.
+	*
+	* Returns `undefined` when the pool is OFF or has no members — in which case
+	* there is no pool story to tell, and the shim renders its own sentence
+	* without one. That is a real state, not a failure: the plugin supports
+	* running with no pool at all.
+	*/
+	const explainPoolShortfall = async (region) => {
+		if (!poolPreferencesOf(current(), region).enabled) return void 0;
+		const members = await localPoolMembers(region);
+		if (members.length === 0) return void 0;
+		const nowMs = Date.now();
+		const excluded = members.map((member) => ({
+			id: member.account.id,
+			excludedBy: exclusionOf(member.probe, nowMs)
+		})).filter((entry) => entry.excludedBy !== void 0);
+		if (excluded.length === 0) return "池中其余账号本次请求都已尝试过";
+		const counts = /* @__PURE__ */ new Map();
+		for (const entry of excluded) counts.set(entry.excludedBy, (counts.get(entry.excludedBy) ?? 0) + 1);
+		return `池中已无可用账号（${[...counts.entries()].map(([reason, count]) => `${String(count)} 个${poolExclusionClause(reason)}`).join("、")}）`;
+	};
+	/**
+	* One exclusion reason as a short Chinese clause for
+	* {@link explainPoolShortfall}.
+	*
+	* Separate from the card's own labels (`exclusion-text.ts` in the client half)
+	* on purpose: those are standalone table cells ("被限流"), where these are
+	* glued into a sentence and must read after a count ("1 个账号被限流"). Sharing
+	* one string would force one of the two to read wrong.
+	*/
+	function poolExclusionClause(reason) {
+		switch (reason) {
+			case "rate-limited": return "账号被限流";
+			case "out-of-credit": return "账号积分耗尽";
+			case "model-busy": return "账号撞上模型繁忙";
+			case "credential-rejected": return "账号登录已失效";
+			case "not-found": return "账号已不存在";
+			case "unusable": return "账号不可用";
+			default: return "账号不可用";
+		}
+	}
+	/**
 	* The last CREDITS reading per region, so a request can rank by balance
 	* without fetching one.
 	*
@@ -5957,8 +6052,8 @@ function apply(ctx, config) {
 	* issue #61), so a row test and a batch test never measure different models.
 	* Undefined mirrors the route's 409 states.
 	*/
-	const regionTargetModel = (region, accountId) => {
-		return resolveTargetModel(displayModels(current(), region), targetModelPreference(poolPreferencesOf(current(), region), accountId)).modelId;
+	const regionTargetModel = (region) => {
+		return resolveTargetModel(displayModels(current(), region), poolPreferencesOf(current(), region).targetModelId).modelId;
 	};
 	/** One region's pool preferences, with the schema's defaults applied. */
 	/**
@@ -5975,7 +6070,6 @@ function apply(ctx, config) {
 		return {
 			enabled: pool?.enabled === true,
 			targetModelId: pool?.targetModelId ?? "",
-			targetModelIdByAccount: { ...pool?.targetModelIdByAccount },
 			...probeInputTokens === void 0 ? {} : { probeInputTokens },
 			memberAccountIds: pool?.memberAccountIds ?? []
 		};

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "4.5.1",
+  "version": "4.6.0",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",