dsh-connect-workbuddy 4.6.4 → 4.6.6

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## 4.6.6 (2026-10-17)
+
+> 版本号是 **patch**：只动诊断（`WORKBUDDY_BODY_REPORT` 的报告内容），不改请求、响应、计费或界面。**默认行为完全不变**——报告默认仍是关的，关着时这版与 4.6.5 行为等价。
+
+### Fixes
+
+- **body 报告只记「发了什么」不记「上游算了多少」，导致 #59 的抓取无法回答它要问的问题（issue #59）**
+  - **缺口**：`WORKBUDDY_BODY_REPORT` 抓的是**本地组装好、发往上游之前**的 body 构成（`bodyBytes` / `chars` / 各块字符数）。而 #59 要判定的是「同一份历史为什么国际网关算 1.94 倍」。**只有「发出侧」时，两种世界长得一模一样**：
+    - **A** 网关对几乎相同的字节算出两倍 → **上游的问题**，插件无能为力；
+    - **B** 两边发出的 body 其实不同 → **我们的问题**，要修。
+
+    报告者 10-16 抓到的配对 body 总量只差 **0.3%**（3,554,248 vs 3,565,415 字节），但仅凭这个数无法区分 A 与 B —— 缺的正是「上游回了多少」。
+  - **改了什么**：报告每行新增 `promptTokens` / `completionTokens` / `cachedTokens` 三个**可选**字段，取自上游响应流里的 `usage` 块。至此一行同时给出两半：**发出去的字节** 与 **网关算的 token**，两者一比即可定案。
+  - **为什么必须新加一个响应侧钩子**：`usage` 走的是**响应流**，而不是请求。`createWorkBuddyShim` 原先只有 `onRequestBody`（请求发出前），响应侧不记任何东西 —— 而 `usage` 只在上游的**最后一帧**才出现。新增 `onUpstreamUsage`，在 `RecoveryStream` 解析每一帧时读取。
+  - **★ 一个位置性缺陷，写完就撞上了**：`usage` 帧**不带 `choices`**（它是流末尾的独立帧），而 `handleFrame()` 里第一个早退分支就是「没有 choices 就原样转发」。把读取放在那个分支之后，代码跑起来一切正常、**永不报错**，只是永远拿不到数。守卫 `tests/issue59-upstream-usage.spec.ts` 的第 1 例专门钉这一条：**变异（把读取挪到 `choices` 检查之后）→ 红 2 例**，正是原始的漏读形态。
+  - **「没有」不等于「零」**：上游没报 `usage`（请求失败、流被截断、非流式路径）时字段**缺省**，而不是写 `0`。这是全条的关键区分——把「没测到」记成「没花钱」，会让整个对比失效。守卫用一条显式用例钉住（变异：把缺失记成 `promptTokens: 0` → **5 例全红**）。
+  - **每个流只报一次**：`usageReported` 幂等，因为 failover 重试会**另起一个 `RecoveryStream`**，同一个 body 可能被量两次；先到的那次是实际服务的那次。
+  - **写回同一行，不新起一行**：两个半边的可观测时刻不同（发出侧在请求前、计费侧在流结束后），所以 `recordBodyReport` 改为返回一个 handle，等 `usage` 到了再**回填它自己那一行**。之所以不能追加第三行：报告者的用法是「取 `cn.jsonl` 与 `global.jsonl` 的**最后一行**对比」，多出来的 usage-only 行会**静默变成被比较的那一行**。
+  - **行身份靠四元组匹配**（`at` + `region` + `bodyBytes` + `messageCount`），故意不用 `at` 一个字段：同一毫秒内可能有两笔请求。**这里踩到并修掉了一个测试自身的洞**：初版测试标注的是**最后一行**，而回填是从文件末尾**倒着找**的 —— 于是把 `bodyBytes` 校验整个删掉，测试**照样全绿**。改成标注**靠前**那一行后，该变异立刻转红；`messageCount` 同理（构造了两份**字节数完全相同、消息条数不同**的 body：一条 51 字符的消息 与 两条 11 字符的消息，都是 196 字节）。**最终变异验证**：去掉 `bodyBytes` 校验 → 红 1；去掉 `messageCount` 校验 → 红 1；两者都去掉 → 红 2。
+  - **两道幂等闸刻意保留冗余**：handle 内的 `done` 与磁盘上的「已标注就跳过」互为备份，各自覆盖另一种情形（后者专治「同一 body 的第二个 handle」）。只删一道**行为上不可观测**，删两道才红——这一点写进了代码注释，免得后人以为其中一道是死代码而删掉。
+  - **缓存命中一并记录**：两个网关的缓存命中**拼写不同**（OpenAI 的 `prompt_tokens_details.cached_tokens` 与国内的 `prompt_cache_hit_tokens`），两种都读、取先命中者，否则同一份对话在两个区域会显示成一个有缓存、一个没有。
+  - **对 #59 的实际意义**：这一版让报告者**不必再做重放实验**——同一会话两区各抓一次，直接比 `promptTokens` 两列即可区分 A / B。重放要发的是一整份真实历史，既贵，又会引入「两次请求之间还发生了什么」的新变量。
+  - **本条不包含对 1.94 倍的结论**：它补的是**验证手段**。那个结论仍待报告者带新字段重抓后才能下。
+
+## 4.6.5 (2026-10-16)
+
+> 版本号是 **patch**：两处诊断正确性修复，没有接口或配置变更。
+
+### Fixes
+
+- **国际版 App 探测不到：可执行文件候选缺了 `WorkBuddyAI.exe` 与 `WorkBuddyAI` 目录（issue #68）**
+  - **症状**：只装了国际版的机器上，插件拿不到密钥 payload 的**来源** → 凭据读不出 → 界面显示成「属于另一个地区」。而报告者实测国际版装在 **`%LOCALAPPDATA%\Programs\WorkBuddyAI\WorkBuddyAI.exe`** —— **目录名与二进制名都和国内版不同**，`workbuddyAppExecutableCandidates()` 的 win32 分支两个都没覆盖。
+  - **为什么这类漏探特别难查**：它的失败形态**不是「找不到可执行文件」**，而是「凭据读不出」，最后被下游渲染成区域问题。探针少一个候选与「用户没装 App」在界面上长得一样。
+  - **改了什么**：新增 `WINDOWS_APP_EXECUTABLE_NAMES`（`WorkBuddy.exe` / `WorkBuddyAI.exe`）与 `WINDOWS_APP_SUBDIRECTORIES`（`Programs\WorkBuddy` / `WorkBuddy` / `Programs\WorkBuddyAI` / `WorkBuddyAI`），候选按「三个 base × 四个目录 × 两个二进制」笛卡尔积生成（16 个，原先是 4 个）。**目录与二进制不做配对假设**：观察到的是 `WorkBuddyAI\WorkBuddyAI.exe`，但一个 miss 在这里是不可见的，所以两种拼法都试。
+  - **`normalizeRegistryExecutable()` 同步放宽**：它是另一处按文件名判断的地方，也必须认国际版 —— 否则注册表里指向国际版二进制的 `DisplayIcon` 会被当成「别的产品的二进制」拒掉。**这个值是会被启动的**，所以只加白名单里的两个名字，不是「任何 exe 都收」。
+  - **守卫**：`tests/at-rest.spec.ts` 新增 2 例并把原先断言候选数为 `4` 的那条改成断言**乘积**（`3 × 4 × 2`）—— 用乘积而不是常量，是为了让「少掉一个维度」这种编辑无法靠集合变小而静默通过。新增例子断言国际版路径在内、国内版仍在且在它之前；另一条断言注册表校验接受两种二进制、且**仍拒绝** `uninstall.exe` 与 `WorkBuddy.exe.bak`。**变异验证**：① 去掉 `WorkBuddyAI.exe` → 红 3 例；② 去掉 `WorkBuddyAI` 目录 → 红 2 例；③ 注册表校验不再限制文件名 → 红 2 例。
+  - **证据档位**：报告的路径来自报告者的真机（属 A 档观察）；**本仓库无法在真机上复现**（无一等 Windows 机器在手），所以这条修复的依据是 A 档观察 + 本仓库的形态断言，未在真机复核 —— 按 `docs/WINDOWS.md` §2 的口径，其「国际版路径命中」仍是 **C 档（约定推导）**，待 Windows 用户回报后升格。
+
+- **「另一个地区」把「解密失败」盖住了：优先级顺序把更具体的诊断吃掉（issue #68）**
+  - **症状**：凭据**解密失败**时，卡片显示的是「找到了你的 WorkBuddy 登录信息，但它**属于另一个地区的标签页**」。报告者据此去切 tab，**而切 tab 永远救不了解密失败** —— 两个区域都读不出来，密钥推导才是问题。
+  - **根因**：`signedOutNotice()` 里 `wrong-region` **先于** `encrypted` 判定，而这两者**不是互斥的，它们会同时出现**，且同时出现是**常态**：`diagnose()` 会探测**两个区域**的文件，于是一台装了**两个 WorkBuddy 版本**的机器上，新版的文件解密失败（`encrypted`），旧版的文件仍能解开、只是属于另一个区域（`wrong-region`）。先判 `wrong-region` 的后果是：只要有一个可解的兄弟文件，headline 就永远说「切 tab」，把真正的阻塞压在下面。
+  - **改了什么**：把 `encrypted` 提到 `wrong-region` **之前**。判据不是「哪个更常见」，而是「**哪个是硬阻塞**」—— 另一个标签页上有可读的登录是一条更便宜的修法，但前提是**有登录可读**。诚实地说：原先的顺序把用户推向唯一不可能起作用的动作，而这**正是这个函数存在的理由**，只是两个原因的位置对调了。
+  - **反向那一半也保住了**：没有 `encrypted` 时，`wrong-region` 仍然胜出（新增一条测试钉住），否则就是用一个错 headline 换另一个。
+  - **守卫**：`tests/searched-paths.spec.ts` 新增 2 例 —— ① 两者共存时 `encrypted` 胜出，且**断言渲染出的字符串**里不含「切换到上方对应标签页」（文案才是用户看到的东西）；② 无阻塞时 `wrong-region` 仍胜出。**变异验证**：把顺序恢复成 `wrong-region` 先判 → 红 1 例。
+
 ## 4.6.4 (2026-10-16)
 
 > 版本号是 **patch**：只动开发脚本与测试，**不改插件运行时行为**。

package/docs/WINDOWS.md

@@ -40,11 +40,50 @@ Windows 在本项目里不是「顺带能跑」的平台，而是**有专属分
 
 | 档位 | 含义 | 实例 |
 | --- | --- | --- |
-| **A 真机取证** | 在真实 Windows 上取得，可作为最终判据 | ① `tests/at-rest.spec.ts` 里固定向量 `keyId=9127dea1b44020a7`，**采自真实 Windows 安装**（2026-09-26 在本机复核：`workbuddy-desktop.info` 的 `nickname` / `phoneNumber` / `accessToken` 信封全部使用该 keyId）；② issue #13 报告的 `E:\WorkBuddy\WorkBuddy.exe`；③ **§1-5 的控制台闪窗**（见下方专门说明）；④ §1-1 凭据目录与 §1-2 可执行文件候选在真机上命中（`doctor` 全绿，见 §7 记录） |
+| **A 真机取证** | 在真实 Windows 上取得，可作为最终判据 | ① 真实 Windows 安装（2026-09-26）里 `workbuddy-desktop.info` 的 `nickname` / `phoneNumber` / `accessToken` 信封**观察到 `keyId=9127dea1b44020a7`**；② issue #13 报告的 `E:\WorkBuddy\WorkBuddy.exe`；③ **§1-5 的控制台闪窗**（见下方专门说明）；④ §1-1 凭据目录与 §1-2 可执行文件候选在真机上命中（`doctor` 全绿，见 §7 记录） |
 | **B CI 实测** | `windows-latest` 上跑过，覆盖跨平台正确性 | 套件全绿；`tests/auth.spec.ts` 的 `win32` 分支断言（注入 `platform`/`home`/`env`，**任何主机上都能跑**） |
 | **C 约定推导** | 按平台约定写出 + 单元测试钉住，**未在真机逐项验证** | 四个凭据/可执行文件候选路径中**未在本机命中的那些**（见 §7 记录：本机只命中了 `%LOCALAPPDATA%\Programs\WorkBuddy` 与 `%LOCALAPPDATA%\...\auth`，其余候选仍属 C 档） |
+
+> **2026-10-16 更正（issue #68 逼出来的）**：上面 ① 此前写作「`tests/at-rest.spec.ts` 里**固定向量** `keyId=9127dea1b44020a7`」，并把该测试当作这条观察的守卫。**那个说法是错的**：观察本身成立（§7 的记录也独立记着它），但**推导出该 keyId 的那把 secret 从未被留存**，所以测试只能断言 16 位十六进制**形态**，无法复现该值 —— 它此前并未真正钉住这个向量，而文档把它读成了「已钉住」。
+>
+> 现已把测试改名为「derives a 16-hex-char id, which is the shape the real envelopes carry」并在注释里写明它不证明什么；**推导规则**（哈希 base64 串而非解码字节、取 `sha256(key)` 前 16 位十六进制）由它上面的两条测试真正钉住 —— 那两条才是否证得动的。
+>
+> 若要真正钉住这个向量，需要**连同推导它的一把 secret 一起取样**（或至少记录 `sha256(secret)` 的输入形式）；在那之前，① 仍是**观察记录**，不是**回归守卫**。登记在此，免得下一个人再把它当成守卫。
+>
+> **2026-10-16 再更正（issue #68 结案，A 档）**：这条「需要连同 secret 一起取样」的待办**已在 macOS 上一台装着两个版本的真机上完成**，三个 keyId 全部对上、且**全部由同一把 secret 推出**。结论与探针见 §2.1。**要点：`keyId` 不是「哪把 key 在加密」的证据** —— 同一个 secret 在不同哈希输入下会给出**三个都合法**的 keyId，而三者互不相等。此前把「exe 报的 keyId ≠ 凭据要求」读成「推导还没定案」，是把身份标识别当成密钥标识用了。
 | **D 未验证** | 无任何上述支撑 | —— |
 
+### 2.1 keyId 到底是什么：三值同源，已结案（issue #68，2026-10-16）
+
+**争议**：解密路径上出现三个互不相等的 16 位十六进制值，看起来像「有三把不同的 key，不知道哪把对」：
+
+| 值 | 出现处 |
+| --- | --- |
+| `9127dea1b44020a7` | 凭据信封**要求**的 `keyId`（`accessToken` / `nickname` / `refreshToken` 全部一致） |
+| `c74aaf9df09104a5` | `deriveAtRestKeyId()` 对 `Electron` 进程取回的 payload 算出的值 |
+| `66ef584820ad33e7` | 把 `atRestSecretKey` 先 base64 解码、再对**解码字节**做 sha256 得到的值 |
+
+三者不等，于是被读成「protector key 的推导没定案」。**这个读法是错的**，因为三个值来自**同一把 secret**，只是哈希输入不同：
+
+```text
+secret = <payload>.atRestSecretKey        （base64 文本，32 字节明文）
+key    = sha256(secret as utf8)           ← 插件采用的形式
+keyId  = hex(sha256(key))[0..16]
+```
+
+- `c74aaf9df09104a5` = `hex(sha256(secret))[0..16]` —— **秘密本身**的摘要，不是 key 的 keyId。它长得像 keyId，所以极易被误认为「另一把候选 key」。
+- `66ef584820ad33e7` = `hex(sha256(base64_decode(secret)))[0..16]` —— 对**解码后的字节**做哈希。这是最自然的错误猜法（文档里那句「哈希 base64 串而非解码字节」正是为它写的），但它**不打开任何信封**。
+- `9127dea1b44020a7` = `hex(sha256(sha256(secret as utf8)))[0..16]` —— **只有它**能让 GCM 标签通过。
+
+**验证（macOS 真机，`/Applications` 下同时装着两个版本）**：对 `workbuddy-desktop.info`（国内）与 `workbuddy-desktop-ai.info`（国际）的 8 个信封逐一开箱，`nickname` 与 `accessToken` 全部解出；`accounts[].nickname` / `allAccounts[].nickname`（长度 16/16/36 字节，都不是令牌）也一致。**两个区域的文件用同一把 key** —— 区域差别在文件与账户，不在密钥。
+
+**两个此前被当成「另一条加密路径」的东西，都不是**：
+
+- `~/.workbuddy/keyblob` 与 `~/.workbuddy-ai/keyblob` 里的 `keyId`（`1ade3d8d51807afa` / `1d071c4d12239dda`）是**另一个层级**：keyblob 自己的 `keyId` 标识它包裹的那把 data key，而 `slot[0].protectorKeyId` 仍是 `9127dea1b44020a7`（即上面的保护者）。**它们从未出现在凭据链上**，未被也不应被当作凭据 key 的候选。
+- keyblob 的 `wrapped`（32 字节密文）与凭据信封的 16/36 字节 `nickname` 不是同一种载荷，混在一张表里会继续生出假候选。
+
+**给下一个人**：判定「哪把 key 对」**不要比 keyId**，要看 GCM 标签是否通过 —— keyId 只是**身份标签**，同一份密钥材料在三种输入形式下有三种合法拼法。要正确定位，跑 `doctor` 拿到的 `atRestDecryption` 只说明**能不能拿到 payload**；`nickname` 是否解出才是**这把 key 对不对**的判据。本机实测的判据链与本节的探针脚本见提交信息（`scripts/` 不入包）。
+
 ### A 档取证：§1-5 的控制台闪窗（2026-09-26，Windows 11 22621）
 
 **缺陷**：`src/host-heartbeat.ts` 的 `processStartTimeMs()` 以 `execFileSync('powershell', …, { encoding: 'utf8' })` 启动子进程，**未设 `windowsHide`**；同仓库的 `src/at-rest.ts` 却设了。两处不一致。

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, K as WORKBUDDY_APP_EXECUTABLE_ENV, O as legacyWorkbuddyOwnAuthPath, Q as findWorkbuddyAppExecutableWithSource, S as defaultDesktopAuthCandidates, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, ot as hostPeersInfo, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-BvxLN-O5.js";
+import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, K as WORKBUDDY_APP_EXECUTABLE_ENV, O as legacyWorkbuddyOwnAuthPath, Q as findWorkbuddyAppExecutableWithSource, S as defaultDesktopAuthCandidates, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, ot as hostPeersInfo, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-NHBxcmkQ.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -3652,11 +3652,15 @@ window.__ModuleLoader__.load({
 		* is precisely the action that cannot work when the credential exists but is
 		* encrypted. Leaving it in the collapsed list meant the headline contradicted
 		* the detail below it — and the headline is the only part most users read.
+		*
+		* `encrypted` outranks `wrong-region` as well, which is a change (issue #68):
+		* the two are not alternatives, they co-occur, and when they do the unreadable
+		* key is the blocker. See the note in {@link signedOutNotice}.
 		*/
 		function signedOutNotice(input) {
 			if (input.selectionLost) return { key: "row.selectionLostMessage" };
-			if (input.searched.some((item) => item.reason === "wrong-region")) return { key: "row.signedOutWrongRegion" };
 			if (input.searched.some((item) => item.reason === "encrypted")) return { key: "row.signedOutEncrypted" };
+			if (input.searched.some((item) => item.reason === "wrong-region")) return { key: "row.signedOutWrongRegion" };
 			if (input.searched.length > 0) return { key: "row.signedOutHint" };
 			return input.message === void 0 ? { key: "row.signedOutHint" } : {
 				key: "row.signedOutHint",

package/lib/{host-heartbeat-BvxLN-O5.js → host-heartbeat-NHBxcmkQ.js}

@@ -335,8 +335,41 @@ const SYMMETRIC_SCHEME = "sym-v1";
 const WORKBUDDY_APP_EXECUTABLE_ENV = "WORKBUDDY_APP_EXECUTABLE";
 /** How long the app is given to answer with its key payload. */
 const KEY_FETCH_TIMEOUT_MS = 1e4;
-/** File name of the WorkBuddy desktop executable on Windows. */
-const APP_EXECUTABLE_NAME = "WorkBuddy.exe";
+/**
+* File names the WorkBuddy desktop executable goes by on Windows.
+*
+* `WorkBuddy.exe` is the domestic build. The international build ships as
+* **`WorkBuddyAI.exe` under a `WorkBuddyAI` directory** (issue #68), and the
+* probe list below carries no candidate that matched it — so a machine with only
+* the international app installed could not find the key payload's source and
+* reported the credentials as unreadable, which the UI then described as a
+* wrong-region sign-in.
+*
+* Kept as a LIST rather than a second constant because the same name test is
+* used in two places that must agree: the directory joiners below, and the
+* registry-value validator (`normalizeRegistryExecutable`), which must accept a
+* `DisplayIcon` pointing at either binary. The first entry is the canonical one
+* used when a directory is known to hold the domestic build.
+*/
+const APP_EXECUTABLE_NAMES = ["WorkBuddy.exe", "WorkBuddyAI.exe"];
+/** The canonical executable name; the rest of {@link APP_EXECUTABLE_NAMES}. */
+const APP_EXECUTABLE_NAME = APP_EXECUTABLE_NAMES[0];
+/**
+* Windows install directories the desktop app is observed to use, in probe
+* order, relative to a base such as `%LOCALAPPDATA%` or `%ProgramFiles%`.
+*
+* `Programs\WorkBuddy` is the common per-user layout; `WorkBuddy` is the flatter
+* one some installers produce. The `WorkBuddyAI` pair is the international
+* build's layout (issue #68) — both spellings are carried because the directory
+* and the binary were observed to agree, but a future build could pair either
+* way, and a miss here is invisible (it surfaces as "unreadable credentials").
+*/
+const WINDOWS_APP_SUBDIRECTORIES = [
+	["Programs", "WorkBuddy"],
+	["WorkBuddy"],
+	["Programs", "WorkBuddyAI"],
+	["WorkBuddyAI"]
+];
 /**
 * macOS bundles the desktop app may be installed as, in probe order.
 *
@@ -581,7 +614,8 @@ function normalizeRegistryExecutable(value) {
 	if (unquoted === void 0 || unquoted === "") return void 0;
 	const withoutIndex = unquoted.replace(/,\s*-?\d+\s*$/u, "");
 	if (withoutIndex === "") return void 0;
-	if (win32.basename(withoutIndex).toLowerCase() !== APP_EXECUTABLE_NAME.toLowerCase()) return void 0;
+	const base = win32.basename(withoutIndex).toLowerCase();
+	if (!APP_EXECUTABLE_NAMES.some((name) => name.toLowerCase() === base)) return void 0;
 	return withoutIndex;
 }
 /**
@@ -653,7 +687,15 @@ function workbuddyAppExecutableCandidates(platform = process.platform, home = ho
 		const local = env["LOCALAPPDATA"]?.trim();
 		const programFiles = env["ProgramFiles"]?.trim();
 		const programFilesX86 = env["ProgramFiles(x86)"]?.trim();
-		candidates.push(local === void 0 || local === "" ? void 0 : win32.join(local, "Programs", "WorkBuddy", APP_EXECUTABLE_NAME), local === void 0 || local === "" ? void 0 : win32.join(local, "WorkBuddy", APP_EXECUTABLE_NAME), programFiles === void 0 || programFiles === "" ? void 0 : win32.join(programFiles, "WorkBuddy", APP_EXECUTABLE_NAME), programFilesX86 === void 0 || programFilesX86 === "" ? void 0 : win32.join(programFilesX86, "WorkBuddy", APP_EXECUTABLE_NAME));
+		const bases = [
+			local === void 0 || local === "" ? void 0 : local,
+			programFiles === void 0 || programFiles === "" ? void 0 : programFiles,
+			programFilesX86 === void 0 || programFilesX86 === "" ? void 0 : programFilesX86
+		];
+		for (const base of bases) {
+			if (base === void 0) continue;
+			for (const subdirectory of WINDOWS_APP_SUBDIRECTORIES) for (const name of APP_EXECUTABLE_NAMES) candidates.push(win32.join(base, ...subdirectory, name));
+		}
 	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
 	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
 }
@@ -3907,7 +3949,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.6.4";
+const WORKBUDDY_CONNECT_VERSION = "4.6.6";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -1166,6 +1166,28 @@ interface WorkBuddyShimOptions {
    * callee must treat the string as read-only.
    */
   onRequestBody?: (bodyJson: string) => void;
+  /**
+   * Called with the token counts the UPSTREAM reported for the request whose
+   * body was just handed to {@link onRequestBody} (issue #59).
+   *
+   * `onRequestBody` records what we SENT; this records what the gateway
+   * CHARGED. The issue cannot be settled with only one of them: a difference
+   * between two captures is ambiguous until both sides are known, because
+   * "the gateway counted the same bytes differently" and "the two bodies were
+   * not the same" look identical from the sent side alone.
+   *
+   * May fire zero times (the upstream reported no `usage`, or the stream was
+   * cut before its final frame) or more than once per body (a failover retry
+   * reaches a second upstream). The callee is expected to keep the FIRST
+   * real measurement, since that is the one the report's line belongs to.
+   *
+   * Fired without awaiting, and never allowed to fail the request.
+   */
+  onUpstreamUsage?: (usage: {
+    promptTokens?: number;
+    completionTokens?: number;
+    cachedTokens?: number;
+  }) => void;
 }
 /**
  * Start the loopback endpoint. Requests must carry the shim's shared secret;

package/lib/index.js

@@ -1,6 +1,6 @@
-import { $ as isEncryptedFieldWrapper, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as deriveAtRestKey, K as WORKBUDDY_APP_EXECUTABLE_ENV, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as fetchAtRestKeyPayload, Y as deriveAtRestKeyId, Z as findWorkbuddyAppExecutable, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as workbuddyAppExecutableCandidates, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as withFileLock, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as isWorkbuddyBundle, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as readAtRestKey, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as writeFileAtomic, m as deriveCatalog, n as clearHostHeartbeat, nt as macosNestedAppBundles, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as clearAtRestKeyCache, r as isHeartbeatProcessAlive, rt as openEncryptedField, s as writeHostHeartbeat, st as resolveDshHome, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosBundleExecutable, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-BvxLN-O5.js";
+import { $ as isEncryptedFieldWrapper, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as deriveAtRestKey, K as WORKBUDDY_APP_EXECUTABLE_ENV, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as fetchAtRestKeyPayload, Y as deriveAtRestKeyId, Z as findWorkbuddyAppExecutable, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, at as workbuddyAppExecutableCandidates, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as withFileLock, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as isWorkbuddyBundle, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as readAtRestKey, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as writeFileAtomic, m as deriveCatalog, n as clearHostHeartbeat, nt as macosNestedAppBundles, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as clearAtRestKeyCache, r as isHeartbeatProcessAlive, rt as openEncryptedField, s as writeHostHeartbeat, st as resolveDshHome, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosBundleExecutable, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-NHBxcmkQ.js";
 import z from "@deepseek-ai/schemastery";
-import { appendFile, mkdir, readFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { join } from "node:path";
 import { createProvider } from "@earendil-works/pi-ai";
@@ -412,6 +412,354 @@ function createWorkBuddyAdapter(options) {
 		}
 	};
 }
+//#endregion
+//#region src/body-report.ts
+/**
+* Body-composition report: WHAT was sent upstream, in counts (issue #59).
+*
+* WHY THIS EXISTS. Issue #59's reporter measured the SAME conversation charged
+* ~708K tokens by the CN gateway and ~1.374M by the international one (1.94×),
+* which turns a region switch into an instant `code 11115 prompt is too long`.
+* Two worlds explain that, and they have opposite owners:
+*
+*   - the gateways count identical bytes differently (upstream's business); or
+*   - the two requests did not carry the same messages (ours to fix).
+*
+* The second world was left standing by two independent measurements. The
+* reporter ran this project's `--kind`/`--language` probe on BOTH regions and
+* got the same tokens-per-1000-chars on byte-identical prose, code and JSON
+* (ratios 0.98–1.06 across six cells), so identical bytes really do bill
+* identically. And a code trace showed historical `reasoning` never reaches the
+* wire at all: pi-ai only forwards `thinking` blocks as text when
+* `compat.requiresThinkingAsText` is set — this plugin never sets it — and the
+* `reasoning_details` route needs a signature the stream parser never writes.
+* With the counting difference excluded and reasoning excluded, the remaining
+* candidate is that the two bodies differ in the first place.
+*
+* This module exists to settle exactly that, and it can do it WITHOUT either
+* region having credit: the body is assembled locally, before the upstream ever
+* gets a chance to answer `14018 Credits exhausted`. Capture one composition per
+* region in the same session and diff them.
+*
+* It records COUNTS ONLY — never a byte of message text, no account name, no
+* token. That is a hard rule, not a default: the point is to compare shape
+* (`messages.length`, per-block type, CJK vs non-CJK characters, total bytes),
+* and every one of those is answerable arithmetically. `tests/issue59-body-report.spec.ts`
+* asserts the report cannot leak a fixture's text.
+*/
+/**
+* Environment variable that enables the report.
+*
+* Unset or blank means OFF — a diagnostic that writes files must be opt-in.
+* `1`/`true` writes to `<DSH home>/body-reports/`; anything else is read as a
+* directory path, so a user can point it at an existing folder (and, on
+* Windows, one with spaces).
+*/
+const WORKBUDDY_BODY_REPORT_ENV = "WORKBUDDY_BODY_REPORT";
+/**
+* Character ranges that tokenize (and therefore bill) like CJK.
+*
+* Deliberately generous: the caller's question is "how much of this is the ~3×
+* kind", and the measured spread is 0.669 vs 0.224 tokens/char, so a character
+* class that is borderline costs far less than mis-attributing a whole bucket.
+* Ranges follow Unicode blocks, plus the compatibility forms and the two
+* extension planes where rare Han characters live.
+*/
+const CJK_RANGES = [
+	[11904, 12031],
+	[12288, 12351],
+	[12352, 12543],
+	[13312, 19903],
+	[19968, 40959],
+	[63744, 64255],
+	[65072, 65103],
+	[65280, 65519],
+	[131072, 195103]
+];
+/** Whether one code point bills like CJK. */
+function isCjkCodePoint(code) {
+	return CJK_RANGES.some(([low, high]) => code >= low && code <= high);
+}
+/** Count characters (code points) and how many of them are CJK. */
+function countChars(text) {
+	let chars = 0;
+	let cjkChars = 0;
+	for (const character of text) {
+		chars += 1;
+		const code = character.codePointAt(0);
+		if (code !== void 0 && isCjkCodePoint(code)) cjkChars += 1;
+	}
+	return {
+		chars,
+		cjkChars
+	};
+}
+/** Build one block report from already-extracted text. */
+function block(type, text) {
+	return {
+		type,
+		...countChars(text)
+	};
+}
+/** Whether a value is a plain object (not null, not an array). */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Describe one message's blocks.
+*
+* The role decides what a content string IS, and that is not cosmetic: a
+* `tool` message's payload is a tool result, so counting it as `text` would hide
+* the very bucket a long agentic session is mostly made of.
+*/
+function describeMessage(message) {
+	const role = typeof message["role"] === "string" ? message["role"] : "unknown";
+	const blocks = [];
+	const content = message["content"];
+	/**
+	* The block type a plain string carries, by the ROLE carrying it.
+	*
+	* A `tool` message's string is a tool RESULT and a `system` one is the system
+	* prompt; calling both `text` would fold the biggest bucket of a long agentic
+	* session into the smallest one, which is the opposite of what a composition
+	* report is for.
+	*/
+	const stringType = role === "tool" ? "tool-result" : role === "system" || role === "developer" ? "system" : "text";
+	if (typeof content === "string") {
+		if (content !== "") blocks.push(block(stringType, content));
+	} else if (Array.isArray(content)) for (const part of content) {
+		if (!isRecord(part)) continue;
+		const type = typeof part["type"] === "string" ? part["type"] : "unknown";
+		if (type === "text") {
+			const text = part["text"];
+			if (typeof text === "string" && text !== "") blocks.push(block(stringType, text));
+			continue;
+		}
+		blocks.push({
+			type: type === "image_url" ? "image" : type,
+			chars: 0,
+			cjkChars: 0
+		});
+	}
+	const toolCalls = message["tool_calls"];
+	if (Array.isArray(toolCalls)) for (const call of toolCalls) {
+		if (!isRecord(call)) continue;
+		const fn = call["function"];
+		const name = isRecord(fn) && typeof fn["name"] === "string" ? fn["name"] : "";
+		const args = isRecord(fn) && typeof fn["arguments"] === "string" ? fn["arguments"] : "";
+		blocks.push(block("tool-call", `${name}${args}`));
+	}
+	for (const field of [
+		"reasoning_content",
+		"reasoning",
+		"reasoning_text"
+	]) {
+		const value = message[field];
+		if (typeof value === "string" && value !== "") blocks.push(block("reasoning", value));
+	}
+	return {
+		role,
+		chars: blocks.reduce((sum, entry) => sum + entry.chars, 0),
+		cjkChars: blocks.reduce((sum, entry) => sum + entry.cjkChars, 0),
+		blocks
+	};
+}
+/**
+* Describe one serialized request body.
+*
+* Returns `undefined` when the body is not a JSON object — a diagnostic must
+* never be the reason a chat request fails, so every caller treats `undefined`
+* as "nothing to report" rather than an error.
+*/
+function describeBody(bodyJson, region, nowMs) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyJson);
+	} catch {
+		return;
+	}
+	if (!isRecord(parsed)) return void 0;
+	const rawMessages = parsed["messages"];
+	const messages = Array.isArray(rawMessages) ? rawMessages.filter(isRecord).map(describeMessage) : [];
+	const rawTools = parsed["tools"];
+	const tools = Array.isArray(rawTools) ? block("tools", rawTools.map((tool) => isRecord(tool) ? JSON.stringify(tool) : "").join("")) : {
+		type: "tools",
+		chars: 0,
+		cjkChars: 0
+	};
+	const chars = messages.reduce((sum, message) => sum + message.chars, 0) + tools.chars;
+	const cjkChars = messages.reduce((sum, message) => sum + message.cjkChars, 0) + tools.cjkChars;
+	return {
+		at: new Date(nowMs).toISOString(),
+		region,
+		...typeof parsed["model"] === "string" ? { model: parsed["model"] } : {},
+		bodyBytes: Buffer.byteLength(bodyJson, "utf8"),
+		messageCount: messages.length,
+		chars,
+		cjkChars,
+		tools,
+		messages
+	};
+}
+/** A finite, non-negative token count, or undefined for anything else. */
+function tokenCount(value) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+}
+/**
+* Read the token counts out of one already-parsed SSE chunk.
+*
+* Returns undefined when the chunk carries no `usage` — which is every chunk but
+* the last one on a streamed answer, so this is called for each frame and must
+* stay cheap and total. The cache-hit count is looked for under BOTH spellings
+* observed on the two gateways (`prompt_tokens_details.cached_tokens`, OpenAI's,
+* and `prompt_cache_hit_tokens`, which the domestic gateway also emits); taking
+* the first one present keeps the report comparable across regions instead of
+* showing 0 on whichever side uses the other name.
+*/
+function usageOfChunk(chunk) {
+	const usage = chunk["usage"];
+	if (typeof usage !== "object" || usage === null || Array.isArray(usage)) return void 0;
+	const record = usage;
+	const promptTokens = tokenCount(record["prompt_tokens"]);
+	const completionTokens = tokenCount(record["completion_tokens"]);
+	const details = record["prompt_tokens_details"];
+	const cachedTokens = (typeof details === "object" && details !== null && !Array.isArray(details) ? tokenCount(details["cached_tokens"]) : void 0) ?? tokenCount(record["prompt_cache_hit_tokens"]);
+	if (promptTokens === void 0 && completionTokens === void 0 && cachedTokens === void 0) return void 0;
+	return {
+		...promptTokens === void 0 ? {} : { promptTokens },
+		...completionTokens === void 0 ? {} : { completionTokens },
+		...cachedTokens === void 0 ? {} : { cachedTokens }
+	};
+}
+/**
+* Resolve the directory the report writes to, or `undefined` when disabled.
+*
+* Exported for the same reason the other env-var resolvers in this plugin are:
+* the behaviour is worth a unit test, and the test must not have to set a real
+* process-wide variable to get one.
+*/
+function bodyReportDirectory(env = process.env) {
+	const configured = env[WORKBUDDY_BODY_REPORT_ENV];
+	if (configured === void 0) return void 0;
+	const trimmed = configured.trim();
+	if (trimmed === "") return void 0;
+	if (trimmed === "1" || trimmed.toLowerCase() === "true") return join(resolveDshHome(), "body-reports");
+	return trimmed;
+}
+/**
+* Append one composition to `<dir>/<region>.jsonl`.
+*
+* One file per region is the whole point: the reporter captures a session, then
+* diffs `cn.jsonl`'s last line against `global.jsonl`'s. JSON Lines rather than
+* one file per request because a single turn makes many upstream calls (one per
+* tool step) and the LAST one is the interesting one.
+*
+* Read-modify-write is avoided on purpose — a long session would rewrite a
+* growing file on every step. The lock keeps two concurrent requests from
+* interleaving a line.
+*/
+async function appendBodyReport(directory, report) {
+	const file = join(directory, `${report.region}.jsonl`);
+	await mkdir(directory, { recursive: true });
+	const line = `${JSON.stringify(report)}\n`;
+	await withFileLock(file, () => appendFile(file, line, "utf8"));
+}
+/**
+* Record one outgoing body, if the report is enabled, and return a handle that
+* can carry the upstream's `usage` back onto the SAME line.
+*
+* NEVER THROWS and never awaits long: this is called on the request path, and a
+* chat request must not fail (or stall) because a diagnostic could not write a
+* file. A failure is reported through `onError` so the caller can log it.
+*
+* The returned function exists because the two halves of the #59 comparison are
+* only available at different times: what we SENT is known before the request
+* leaves, what the gateway CHARGED only after the stream ends. Writing a second
+* line for the usage would be worse than useless — the reporter diffs "the last
+* line of cn.jsonl against the last line of global.jsonl", and a trailing
+* usage-only line would silently become the one being compared.
+*/
+async function recordBodyReport(region, bodyJson, options = {}) {
+	const directory = bodyReportDirectory(options.env);
+	if (directory === void 0) return () => {};
+	try {
+		const report = describeBody(bodyJson, region, options.nowMs ?? Date.now());
+		if (report === void 0) return () => {};
+		await appendBodyReport(directory, report);
+		return attachUsage(directory, report, options.onError);
+	} catch (error) {
+		options.onError?.(error);
+		return () => {};
+	}
+}
+/**
+* How many trailing lines are searched for the line this handle wrote.
+*
+* One would be enough for a single-threaded request, but a turn can have several
+* requests in flight (parallel tool steps) and their lines interleave, so the
+* target is not necessarily last. A small bounded window keeps the read cheap on
+* a file that grows to tens of megabytes, while still finding a line that landed
+* a couple of appends ago.
+*/
+const USAGE_ATTACH_WINDOW = 32;
+/**
+* Return a callback that rewrites its own line with the upstream's counts.
+*
+* Matched by `at` + `region` + `bodyBytes` + `messageCount`, all four being
+* stable for a finished request: `at` alone can collide when two requests are
+* timestamped in the same millisecond, and `bodyBytes` tells apart the two
+* different bodies a failover or a retry can produce. A line that is already
+* annotated is left alone, so a second call cannot double-apply.
+*/
+function attachUsage(directory, report, onError) {
+	/**
+	* Two independent idempotence guards, kept redundant on purpose.
+	*
+	* `done` avoids a second disk read within one handle's lifetime; the
+	* "already annotated" check inside the loop catches the OTHER case — a second
+	* handle for the same body, which is what a failover retry produces (it opens
+	* its own stream, and therefore its own handle). Either alone is enough for
+	* the common path, so removing just one is not observable behaviourally;
+	* removing BOTH is, and `tests/issue59-body-report.spec.ts` pins that.
+	*/
+	let done = false;
+	return (usage) => {
+		if (usage === void 0 || done) return;
+		done = true;
+		const file = join(directory, `${report.region}.jsonl`);
+		(async () => {
+			try {
+				await withFileLock(file, async () => {
+					const lines = (await readFile(file, "utf8")).split("\n");
+					for (let index = lines.length - 1; index >= 0 && index >= lines.length - USAGE_ATTACH_WINDOW; index -= 1) {
+						const line = lines[index];
+						if (line === void 0 || line === "") continue;
+						let parsed;
+						try {
+							parsed = JSON.parse(line);
+						} catch {
+							continue;
+						}
+						if (!isRecord(parsed)) continue;
+						if (parsed["at"] !== report.at) continue;
+						if (parsed["region"] !== report.region) continue;
+						if (parsed["bodyBytes"] !== report.bodyBytes) continue;
+						if (parsed["messageCount"] !== report.messageCount) continue;
+						if (parsed["promptTokens"] !== void 0) return;
+						lines[index] = JSON.stringify({
+							...parsed,
+							...usage
+						});
+						await writeFile(file, lines.join("\n"), "utf8");
+						return;
+					}
+				});
+			} catch (error) {
+				onError?.(error);
+			}
+		})();
+	};
+}
 /** One or two full-width bars — the count is a spelling variable. */
 const BARS = `｜｜?`;
 new RegExp(`${BARS}DSML${BARS}`, "g");
@@ -1337,6 +1685,7 @@ function readBody(req) {
 var RecoveryStream = class {
 	res;
 	logger;
+	onUsage;
 	carry = "";
 	decoder = new TextDecoder("utf-8");
 	/** Frames received after the hold began, in arrival order. */
@@ -1377,9 +1726,10 @@ var RecoveryStream = class {
 	* a stray line behind.
 	*/
 	notice;
-	constructor(res, gate, logger, notice) {
+	constructor(res, gate, logger, notice, onUsage) {
 		this.res = res;
 		this.logger = logger;
+		this.onUsage = onUsage;
 		this.buffer = gate === void 0 ? void 0 : new DsmlStreamBuffer(gate);
 		this.notice = notice;
 	}
@@ -1510,6 +1860,33 @@ var RecoveryStream = class {
 			start = newline + 1;
 		}
 	}
+	/** Whether a usage measurement has already been reported for this stream. */
+	usageReported = false;
+	/**
+	* Read the upstream's token counts out of one parsed chunk and report them.
+	*
+	* FIRES AT MOST ONCE per stream, and only when there is a real number to
+	* report. Two reasons, both load-bearing:
+	*
+	*   - a streamed answer's `usage` arrives on its final frame, but a failover
+	*     retry starts a NEW `RecoveryStream`, so a second call here would be a
+	*     second measurement for the same line;
+	*   - a chunk with no `usage` (which is every chunk but the last) must not be
+	*     reported as zero — an absent measurement and a measurement of zero are
+	*     different facts, and the #59 comparison turns entirely on that
+	*     difference.
+	*/
+	noteUsage(chunk) {
+		if (this.usageReported || this.onUsage === void 0) return;
+		const usage = usageOfChunk(chunk);
+		if (usage === void 0) return;
+		this.usageReported = true;
+		try {
+			this.onUsage(usage);
+		} catch (error) {
+			this.logger?.warn("dsh-connect-workbuddy: usage report failed", error);
+		}
+	}
 	/** Handle one complete frame, rewriting it only when recovery produced something. */
 	handleFrame(frame) {
 		const payload = dataPayload(frame);
@@ -1530,6 +1907,7 @@ var RecoveryStream = class {
 			return;
 		}
 		const choices = chunk["choices"];
+		this.noteUsage(chunk);
 		const choice = Array.isArray(choices) ? choices[0] : void 0;
 		if (typeof choice !== "object" || choice === null || Array.isArray(choice)) {
 			this.send(frame, false);
@@ -1932,6 +2310,7 @@ function createWorkBuddyShim(options) {
 	const prepareAccount = options.prepareAccount;
 	const onAccountFailure = options.onAccountFailure;
 	const onRequestBody = options.onRequestBody;
+	const onUpstreamUsage = options.onUpstreamUsage;
 	const SHARED_SECRET = randomBytes(32).toString("base64url");
 	/** Constant-time bearer check; absent or mismatched bearers are rejected. */
 	function bearerOk(req) {
@@ -2181,7 +2560,7 @@ function createWorkBuddyShim(options) {
 			...declared.pinnedToolName === void 0 ? {} : { pinnedToolName: declared.pinnedToolName }
 		};
 		const notice = switchedFrom === void 0 || switchedBecause === void 0 ? void 0 : failoverNoticeText(switchedFrom, switchedBecause);
-		const writer = new RecoveryStream(res, gate, logger, notice);
+		const writer = new RecoveryStream(res, gate, logger, notice, onUpstreamUsage);
 		await writer.consume(result.response.body);
 		if (gate !== void 0 && !writer.delivered && writer.residueSeen && !controller.signal.aborted) {
 			logger?.warn("dsh-connect-workbuddy: the turn produced DSML markup only; retrying it once");
@@ -2223,246 +2602,6 @@ function createWorkBuddyShim(options) {
 	};
 }
 //#endregion
-//#region src/body-report.ts
-/**
-* Body-composition report: WHAT was sent upstream, in counts (issue #59).
-*
-* WHY THIS EXISTS. Issue #59's reporter measured the SAME conversation charged
-* ~708K tokens by the CN gateway and ~1.374M by the international one (1.94×),
-* which turns a region switch into an instant `code 11115 prompt is too long`.
-* Two worlds explain that, and they have opposite owners:
-*
-*   - the gateways count identical bytes differently (upstream's business); or
-*   - the two requests did not carry the same messages (ours to fix).
-*
-* The second world was left standing by two independent measurements. The
-* reporter ran this project's `--kind`/`--language` probe on BOTH regions and
-* got the same tokens-per-1000-chars on byte-identical prose, code and JSON
-* (ratios 0.98–1.06 across six cells), so identical bytes really do bill
-* identically. And a code trace showed historical `reasoning` never reaches the
-* wire at all: pi-ai only forwards `thinking` blocks as text when
-* `compat.requiresThinkingAsText` is set — this plugin never sets it — and the
-* `reasoning_details` route needs a signature the stream parser never writes.
-* With the counting difference excluded and reasoning excluded, the remaining
-* candidate is that the two bodies differ in the first place.
-*
-* This module exists to settle exactly that, and it can do it WITHOUT either
-* region having credit: the body is assembled locally, before the upstream ever
-* gets a chance to answer `14018 Credits exhausted`. Capture one composition per
-* region in the same session and diff them.
-*
-* It records COUNTS ONLY — never a byte of message text, no account name, no
-* token. That is a hard rule, not a default: the point is to compare shape
-* (`messages.length`, per-block type, CJK vs non-CJK characters, total bytes),
-* and every one of those is answerable arithmetically. `tests/issue59-body-report.spec.ts`
-* asserts the report cannot leak a fixture's text.
-*/
-/**
-* Environment variable that enables the report.
-*
-* Unset or blank means OFF — a diagnostic that writes files must be opt-in.
-* `1`/`true` writes to `<DSH home>/body-reports/`; anything else is read as a
-* directory path, so a user can point it at an existing folder (and, on
-* Windows, one with spaces).
-*/
-const WORKBUDDY_BODY_REPORT_ENV = "WORKBUDDY_BODY_REPORT";
-/**
-* Character ranges that tokenize (and therefore bill) like CJK.
-*
-* Deliberately generous: the caller's question is "how much of this is the ~3×
-* kind", and the measured spread is 0.669 vs 0.224 tokens/char, so a character
-* class that is borderline costs far less than mis-attributing a whole bucket.
-* Ranges follow Unicode blocks, plus the compatibility forms and the two
-* extension planes where rare Han characters live.
-*/
-const CJK_RANGES = [
-	[11904, 12031],
-	[12288, 12351],
-	[12352, 12543],
-	[13312, 19903],
-	[19968, 40959],
-	[63744, 64255],
-	[65072, 65103],
-	[65280, 65519],
-	[131072, 195103]
-];
-/** Whether one code point bills like CJK. */
-function isCjkCodePoint(code) {
-	return CJK_RANGES.some(([low, high]) => code >= low && code <= high);
-}
-/** Count characters (code points) and how many of them are CJK. */
-function countChars(text) {
-	let chars = 0;
-	let cjkChars = 0;
-	for (const character of text) {
-		chars += 1;
-		const code = character.codePointAt(0);
-		if (code !== void 0 && isCjkCodePoint(code)) cjkChars += 1;
-	}
-	return {
-		chars,
-		cjkChars
-	};
-}
-/** Build one block report from already-extracted text. */
-function block(type, text) {
-	return {
-		type,
-		...countChars(text)
-	};
-}
-/** Whether a value is a plain object (not null, not an array). */
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
-* Describe one message's blocks.
-*
-* The role decides what a content string IS, and that is not cosmetic: a
-* `tool` message's payload is a tool result, so counting it as `text` would hide
-* the very bucket a long agentic session is mostly made of.
-*/
-function describeMessage(message) {
-	const role = typeof message["role"] === "string" ? message["role"] : "unknown";
-	const blocks = [];
-	const content = message["content"];
-	/**
-	* The block type a plain string carries, by the ROLE carrying it.
-	*
-	* A `tool` message's string is a tool RESULT and a `system` one is the system
-	* prompt; calling both `text` would fold the biggest bucket of a long agentic
-	* session into the smallest one, which is the opposite of what a composition
-	* report is for.
-	*/
-	const stringType = role === "tool" ? "tool-result" : role === "system" || role === "developer" ? "system" : "text";
-	if (typeof content === "string") {
-		if (content !== "") blocks.push(block(stringType, content));
-	} else if (Array.isArray(content)) for (const part of content) {
-		if (!isRecord(part)) continue;
-		const type = typeof part["type"] === "string" ? part["type"] : "unknown";
-		if (type === "text") {
-			const text = part["text"];
-			if (typeof text === "string" && text !== "") blocks.push(block(stringType, text));
-			continue;
-		}
-		blocks.push({
-			type: type === "image_url" ? "image" : type,
-			chars: 0,
-			cjkChars: 0
-		});
-	}
-	const toolCalls = message["tool_calls"];
-	if (Array.isArray(toolCalls)) for (const call of toolCalls) {
-		if (!isRecord(call)) continue;
-		const fn = call["function"];
-		const name = isRecord(fn) && typeof fn["name"] === "string" ? fn["name"] : "";
-		const args = isRecord(fn) && typeof fn["arguments"] === "string" ? fn["arguments"] : "";
-		blocks.push(block("tool-call", `${name}${args}`));
-	}
-	for (const field of [
-		"reasoning_content",
-		"reasoning",
-		"reasoning_text"
-	]) {
-		const value = message[field];
-		if (typeof value === "string" && value !== "") blocks.push(block("reasoning", value));
-	}
-	return {
-		role,
-		chars: blocks.reduce((sum, entry) => sum + entry.chars, 0),
-		cjkChars: blocks.reduce((sum, entry) => sum + entry.cjkChars, 0),
-		blocks
-	};
-}
-/**
-* Describe one serialized request body.
-*
-* Returns `undefined` when the body is not a JSON object — a diagnostic must
-* never be the reason a chat request fails, so every caller treats `undefined`
-* as "nothing to report" rather than an error.
-*/
-function describeBody(bodyJson, region, nowMs) {
-	let parsed;
-	try {
-		parsed = JSON.parse(bodyJson);
-	} catch {
-		return;
-	}
-	if (!isRecord(parsed)) return void 0;
-	const rawMessages = parsed["messages"];
-	const messages = Array.isArray(rawMessages) ? rawMessages.filter(isRecord).map(describeMessage) : [];
-	const rawTools = parsed["tools"];
-	const tools = Array.isArray(rawTools) ? block("tools", rawTools.map((tool) => isRecord(tool) ? JSON.stringify(tool) : "").join("")) : {
-		type: "tools",
-		chars: 0,
-		cjkChars: 0
-	};
-	const chars = messages.reduce((sum, message) => sum + message.chars, 0) + tools.chars;
-	const cjkChars = messages.reduce((sum, message) => sum + message.cjkChars, 0) + tools.cjkChars;
-	return {
-		at: new Date(nowMs).toISOString(),
-		region,
-		...typeof parsed["model"] === "string" ? { model: parsed["model"] } : {},
-		bodyBytes: Buffer.byteLength(bodyJson, "utf8"),
-		messageCount: messages.length,
-		chars,
-		cjkChars,
-		tools,
-		messages
-	};
-}
-/**
-* Resolve the directory the report writes to, or `undefined` when disabled.
-*
-* Exported for the same reason the other env-var resolvers in this plugin are:
-* the behaviour is worth a unit test, and the test must not have to set a real
-* process-wide variable to get one.
-*/
-function bodyReportDirectory(env = process.env) {
-	const configured = env[WORKBUDDY_BODY_REPORT_ENV];
-	if (configured === void 0) return void 0;
-	const trimmed = configured.trim();
-	if (trimmed === "") return void 0;
-	if (trimmed === "1" || trimmed.toLowerCase() === "true") return join(resolveDshHome(), "body-reports");
-	return trimmed;
-}
-/**
-* Append one composition to `<dir>/<region>.jsonl`.
-*
-* One file per region is the whole point: the reporter captures a session, then
-* diffs `cn.jsonl`'s last line against `global.jsonl`'s. JSON Lines rather than
-* one file per request because a single turn makes many upstream calls (one per
-* tool step) and the LAST one is the interesting one.
-*
-* Read-modify-write is avoided on purpose — a long session would rewrite a
-* growing file on every step. The lock keeps two concurrent requests from
-* interleaving a line.
-*/
-async function appendBodyReport(directory, report) {
-	const file = join(directory, `${report.region}.jsonl`);
-	await mkdir(directory, { recursive: true });
-	const line = `${JSON.stringify(report)}\n`;
-	await withFileLock(file, () => appendFile(file, line, "utf8"));
-}
-/**
-* Record one outgoing body, if the report is enabled.
-*
-* NEVER THROWS and never awaits long: this is called on the request path, and a
-* chat request must not fail (or stall) because a diagnostic could not write a
-* file. A failure is reported through `onError` so the caller can log it.
-*/
-async function recordBodyReport(region, bodyJson, options = {}) {
-	const directory = bodyReportDirectory(options.env);
-	if (directory === void 0) return;
-	try {
-		const report = describeBody(bodyJson, region, options.nowMs ?? Date.now());
-		if (report === void 0) return;
-		await appendBodyReport(directory, report);
-	} catch (error) {
-		options.onError?.(error);
-	}
-}
-//#endregion
 //#region src/probe.ts
 /**
 * How long to bench a MODEL that answered 14003 with no stated time.
@@ -5425,6 +5564,17 @@ function apply(ctx, config) {
 			refresh: (credential) => client.refreshToken(credential)
 		});
 		const catalog = new WorkBuddyCatalog(region);
+		/**
+		* Where the next upstream `usage` should be written.
+		*
+		* The body report is two-phase (send, then charge), and the two phases are
+		* wired through different callbacks, so the seam between them has to live
+		* somewhere. `noop` rather than `undefined` keeps the usage path free of a
+		* presence check on the hot request path — and a request whose report was
+		* disabled resolves to the same noop, so nothing needs to know whether
+		* reporting is on.
+		*/
+		let pendingUsage = () => {};
 		stacks[region] = {
 			store,
 			catalog,
@@ -5449,7 +5599,12 @@ function apply(ctx, config) {
 				* setup completes.
 				*/
 				onRequestBody: (body) => {
-					recordBodyReport(region, body, { onError: (error) => ctx.logger.warn("dsh-connect-workbuddy: body report failed", error) });
+					recordBodyReport(region, body, { onError: (error) => ctx.logger.warn("dsh-connect-workbuddy: body report failed", error) }).then((attach) => {
+						pendingUsage = attach;
+					}).catch((error) => ctx.logger.warn("dsh-connect-workbuddy: body report failed", error));
+				},
+				onUpstreamUsage: (usage) => {
+					pendingUsage?.(usage);
 				},
 				prepareAccount: () => applyPoolSelection(region),
 				failoverAccount: (triedAccountIds) => failoverAccountFor(region, triedAccountIds),

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "4.6.4",
+  "version": "4.6.6",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",