dsh-connect-workbuddy 5.7.0 → 5.8.0

package/lib/{host-heartbeat-CVz2J0Xt.js → host-heartbeat-BiVFMXGE.js}

@@ -1883,6 +1883,14 @@ const CLIENT_UA = "CLI/2.63.2 CodeBuddy/2.63.2";
 * `/v3/config` as {@link PRODUCT_UA}.
 */
 const PRODUCT_UA = "WorkBuddy/5.8.3 WorkBuddy/5.8.3 CLI/2.161.0";
+/**
+* The app version inside {@link PRODUCT_UA}, for headers that need it alone.
+*
+* Derived from the UA instead of repeated as a literal: the `X-IDE-Version`
+* header (issue #132) must agree with what the UA claims, and two independent
+* literals is exactly how those two drift apart at the next version bump.
+*/
+const APP_VERSION = PRODUCT_UA.match(/WorkBuddy\/([^\s]+)/u)?.[1] ?? "5.8.3";
 const JSON_TIMEOUT_MS = 3e4;
 const ERROR_BODY_LIMIT = 4096;
 /**
@@ -1964,11 +1972,148 @@ const CREDITS_EXHAUSTED_CODE = "\"code\":14018";
 /** Session-invalidation markers that mean "sign in again in the WorkBuddy app". */
 const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
 /**
+* The business code a failure envelope states, or `undefined` when it names none.
+*
+* WHY PARSE RATHER THAN SEARCH THE TEXT. The five marker constants below this
+* file used to look for the quoted-key form (`'"code":11140'`) with `includes`,
+* which is exact only for ONE serialization: measured behaviour of the real
+* gateway is compact JSON, so it worked. It is nonetheless a spelling test
+* dressed up as a code test, and two spellings that a proxy, a re-serializer or
+* a nested envelope can produce fell through it — `{"code": 11140}` (a space) and
+* `"code":"11140"` (a string). The consequence of a MISS is not neutral: with no
+* policy marker and no channel marker, the body classifies as `client`, and
+* `outcomeOfFailure(403, …)` then answers `credential-rejected`, which marks a
+* perfectly healthy account as SIGNED OUT and benches it (issue #127 review).
+*
+* Reading the field is exact for all three spellings and for the nested
+* `{"error":{"data":{"code":…}}}` shape this file already documents at the
+* credit markers. `JSON.parse` also decodes `\uXXXX` escapes, which raw-text
+* matching cannot see (see {@link isAccountRestrictedBody}).
+*
+* The body arrives TRUNCATED to {@link ERROR_BODY_LIMIT}, so a parse failure is
+* normal for a large HTML error page and falls back to the compact/spaced text
+* forms rather than reporting no code. A request id is hexadecimal and can
+* contain `11140` by coincidence, which is why the fallback anchors on the
+* quoted key and a digit boundary rather than the bare digits.
+*/
+function businessCodeOf(body) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		const match = /"code"\s*:\s*"?(\d{4,6}(?!\d))/u.exec(body);
+		return match?.[1] === void 0 ? void 0 : Number(match[1]);
+	}
+	if (typeof parsed !== "object" || parsed === null) return void 0;
+	const raw = parsed;
+	const direct = asBusinessCode(raw["code"]);
+	if (direct !== void 0) return direct;
+	const error = raw["error"];
+	if (typeof error === "object" && error !== null) {
+		const data = error["data"];
+		if (typeof data === "object" && data !== null) {
+			const nested = asBusinessCode(data["code"]);
+			if (nested !== void 0) return nested;
+		}
+	}
+	const data = raw["data"];
+	if (typeof data === "object" && data !== null) return asBusinessCode(data["code"]);
+}
+/** One code field, accepting the number and the string spelling alike. */
+function asBusinessCode(value) {
+	if (typeof value === "number" && Number.isInteger(value)) return value;
+	if (typeof value === "string" && /^\d{4,6}$/u.test(value.trim())) return Number(value.trim());
+}
+/** The `11140` content-policy family, whatever the envelope's JSON spelling is. */
+const CONTENT_POLICY_CODE = 11140;
+/**
 * Content-policy refusal markers from the chat gateway. The quoted-key form
 * avoids substring hits inside unrelated values (request ids are hex and can
 * contain `11140` by coincidence).
-*/
-const POLICY_REJECT_MARKERS = ["request illegal", "\"code\":11140"];
+*
+* `request illegal` is deliberately absent: the live `11128` channel-gate body
+* uses the SAME `msg`, so this marker used to run first and classify that gate
+* as `policy_reject`. The consequence was severe — the channel rescue ladder
+* never ran, the reply changed 400 to 403, and users were told to switch
+* accounts for a request-side refusal (issue #127).
+*/
+function isContentPolicyBody(body) {
+	return businessCodeOf(body) === CONTENT_POLICY_CODE;
+}
+/**
+* Whether a failure body is the account-restriction member of the `11140`
+* family (issue #127).
+*
+* TWO HALVES MUST BOTH HOLD — the business code `"code":11140` AND one of the
+* restriction spellings. This is the same rule this file already applies to the
+* `11128` family after issue #127: a bare sentence never classifies anything,
+* because it is text that can appear anywhere.
+*
+* WHY THE CODE HALF IS NOT OPTIONAL HERE. The verdict is the heaviest in the
+* classifier: `account_restricted` is failover-worthy AND benches the account
+* with NO cooldown — nothing but a re-authorisation returns it. Measured before
+* the code was required (see `classifyUpstreamError`), a body that merely
+* MENTIONS the phrase classified as `account_restricted` whatever else it was:
+* a 402 credit exhaustion, a 401 dead session, and even a 500 whose generic
+* `retry later` text happened to contain the words. Each of those would have
+* taken an account permanently out of the pool for a condition that was about
+* the wallet, the token, or the platform. The code half is what keeps a heavy,
+* non-self-healing verdict pinned to the one business code that states it.
+*
+* Both measured `displayMsg` spellings are recognised (the Chinese sentence and
+* its English translation). A `11140` body carrying neither stays
+* `policy_reject`: inventing an account verdict from the shared code alone would
+* bench an account over a request-side refusal — the mirror-image error, which
+* the code half must not be allowed to fix by loosening the phrase half.
+*/
+const ACCOUNT_RESTRICTED_MARKERS = ["账号存在异常行为", "restricted due to unusual activity"];
+/**
+* Whether a failure body is the account-restriction member of the `11140` family.
+*
+* Three separations make this decision safe, and all three were earned by the
+* issue #127 review:
+*
+* 1. **Code-gated.** Only a `11140` envelope can reach the phrase test
+*    ({@link isContentPolicyBody}). The phrase alone is not evidence about the
+*    account: a risk-control throttle, a credit notice or an HTML edge page can
+*    carry the same sentence, and this verdict is the only IRREVERSIBLE one in
+*    the classifier — it benches the account with no cooldown.
+* 2. **Decoded text.** The match runs on `displayMsg` / `displayTips` / `msg`
+*    after `JSON.parse`, not on the raw bytes. An upstream or proxy that
+*    serializes non-ASCII as `\uXXXX` (Python's `json.dumps` default) would
+*    otherwise never match the Chinese sentence, and a restriction would silently
+*    degrade to a content refusal. Matching the FIELD rather than the whole body
+*    also stops the phrase in an unrelated field from deciding the class.
+* 3. **Whitespace-normalized.** A line break inside the sentence survives as
+*    `\n` in raw JSON and as real whitespace once parsed; collapsing runs of
+*    whitespace means both spellings match.
+*/
+function isAccountRestrictedBody(body) {
+	if (!isContentPolicyBody(body)) return false;
+	const haystack = accountVerdictText(body);
+	if (haystack === "") return false;
+	return ACCOUNT_RESTRICTED_MARKERS.some((marker) => haystack.includes(normalizeVerdictText(marker)));
+}
+/** The sentences an account verdict can be stated in: display fields, then `msg`. */
+function accountVerdictText(body) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		return normalizeVerdictText(body);
+	}
+	if (typeof parsed !== "object" || parsed === null) return "";
+	const raw = parsed;
+	return normalizeVerdictText([
+		localizedText(raw["displayMsg"]),
+		localizedText(raw["displayTips"]),
+		typeof raw["msg"] === "string" ? raw["msg"] : void 0
+	].filter((value) => typeof value === "string").join(" "));
+}
+/** NFKC, zero-width stripped, whitespace runs collapsed, lower-cased. */
+function normalizeVerdictText(text) {
+	return text.normalize("NFKC").replace(/[\u200b-\u200d\ufeff]/gu, "").replace(/\s+/gu, " ").trim().toLowerCase();
+}
 /**
 * Business code of the MODEL-scoped throttle (`14003`, "too many requests").
 *
@@ -2252,7 +2397,8 @@ function classifyUpstreamError(status, body) {
 	for (const marker of HARD_CREDIT_MARKERS) if (lower.includes(marker.toLowerCase()) || body.includes(marker)) return "hard_credit";
 	if (body.includes(CREDITS_EXHAUSTED_CODE)) return "hard_credit";
 	for (const marker of SESSION_DEAD_MARKERS) if (body.includes(marker)) return "session_dead";
-	for (const marker of POLICY_REJECT_MARKERS) if (body.includes(marker)) return "policy_reject";
+	if (isAccountRestrictedBody(body)) return "account_restricted";
+	if (isContentPolicyBody(body)) return "policy_reject";
 	if (isChannelRejectBody(body)) return "channel_reject";
 	if (isModelBusyBody(body)) return "model_busy";
 	if (parseQueueAnswer(body) !== void 0) return "model_queue";
@@ -2426,8 +2572,8 @@ function commonHeaders(credential) {
 *
 * VALUES. The gateway does not verify where these ids come from — any well-formed
 * UUID passes — so nothing here is a secret and nothing is persisted. They are
-* still freshly generated per request, matching the official client's
-* `randomUUID()` per call: reusing one value across requests would forge a
+* still freshly generated per request, as the official client generates
+* its own per call: reusing one value across requests would forge a
 * conversation identity the plugin does not actually have, and the first thing
 * that would break is the upstream's own correlation of a session it is being
 * told about twice under one id.
@@ -2437,17 +2583,77 @@ function commonHeaders(credential) {
 * side is exactly how the 3.1.0 defect became international-only and invisible
 * from the CN side. One code path, both regions.
 *
-* @returns the three headers, every value distinct.
+* @returns the three headers (four when the usage identity is on, which adds
+* `X-Request-ID`), every value distinct.
 */
-function conversationHeaders() {
+function conversationHeaders(shape, identity = {}) {
+	const officialIds = shape === "chat" && identity.usageIdentity === true;
+	const id = officialIds ? uuidv7 : randomUUID;
+	const messageId = id();
 	return {
-		"X-Conversation-ID": randomUUID(),
-		"X-Conversation-Request-ID": randomUUID(),
-		"X-Conversation-Message-ID": randomUUID()
+		"X-Conversation-ID": id(),
+		"X-Conversation-Request-ID": id(),
+		"X-Conversation-Message-ID": messageId,
+		...officialIds ? { "X-Request-ID": messageId } : {}
+	};
+}
+/**
+* A 32-character lowercase UUIDv7, as the official client's request ids appear.
+*
+* WHY THE FORMAT MATTERS AT ALL (issue #132). The gateway echoes
+* `X-Conversation-Message-ID` back as the SSE `id`, and the WorkBuddy usage page
+* shows that value as the request id. Official traffic therefore shows
+* `01a169…`-style 32-hex ids, while this plugin's `randomUUID()` produced
+* hyphenated v4 ids — so the same account's usage page read as two different
+* clients, and a reporter comparing them concluded the plugin was not the
+* official client. Nothing upstream REJECTS a v4 id — the hyphenated v4 this
+* plugin has always sent is what answers 200 today — so this is a
+* display-fidelity fix, not a gate.
+*
+* Only the FORMAT is aligned, never the value's meaning: the timestamp prefix
+* is the moment this request was generated, which is exactly what a v7 id is
+* for. It is NOT a claim that these ids correlate with an official session —
+* the plugin still generates a fresh identity per request (see
+* {@link conversationHeaders}).
+*/
+function uuidv7(nowMs = Date.now()) {
+	const bytes = randomBytes(16);
+	for (let index = 0; index < 6; index++) bytes[index] = Math.floor(nowMs / 2 ** (8 * (5 - index))) & 255;
+	bytes[6] = bytes[6] & 15 | 112;
+	bytes[8] = bytes[8] & 63 | 128;
+	return bytes.toString("hex");
+}
+/**
+* The IDE identity headers the official desktop client sends on chat (issue #132).
+*
+* WHY. The gateway records the usage page's 使用端 (client) column from
+* `X-IDE-Name`, and it is EMPTY when the header is absent. The plugin has always
+* spoken the CLI channel — {@link CLIENT_UA}, which is correct for the chat
+* contract — but it sent no `X-IDE-*` at all, so every request this plugin made
+* appeared on the user's own usage page as an unidentified client while the
+* official app's requests read `WorkBuddy`. That is a reporting mismatch, not a
+* gate: the reporter measured that adding the header changes the usage column
+* and nothing else (HTTP 200, model unaffected).
+*
+* `X-IDE-Type` stays `CLI` on purpose. Claiming the desktop app's type as well
+* would be a bigger identity claim than the one this fix needs, and the mixed
+* CLI + WorkBuddy shape is what the reporter measured. The version comes from
+* {@link PRODUCT_UA} rather than a second hardcoded number, so the two cannot
+* drift apart when the app version is bumped.
+*
+* Sent only when {@link WorkBuddyWireIdentity.usageIdentity} is on — see that
+* field for the evidence tier behind the default.
+*/
+function ideHeaders(identity) {
+	if (identity.usageIdentity !== true) return {};
+	return {
+		"X-IDE-Type": "CLI",
+		"X-IDE-Name": "WorkBuddy",
+		"X-IDE-Version": APP_VERSION
 	};
 }
 /** Chat request headers, including the X-No-* conventions the official CLI uses. */
-function chatHeaders(credential) {
+function chatHeaders(credential, identity = {}) {
 	return {
 		...commonHeaders(credential),
 		"Content-Type": "application/json",
@@ -2455,7 +2661,8 @@ function chatHeaders(credential) {
 		...credential.enterpriseId === void 0 || credential.enterpriseId === "" ? { "X-No-Enterprise-Id": "1" } : { "X-Enterprise-Id": credential.enterpriseId },
 		...credential.domain === "" ? { "X-No-Department-Info": "1" } : { "X-Domain": credential.domain },
 		"X-Product": "SaaS",
-		...conversationHeaders()
+		...ideHeaders(identity),
+		...conversationHeaders("chat", identity)
 	};
 }
 /** Refresh-endpoint headers; X-Refresh-Token appears here and nowhere else. */
@@ -2492,9 +2699,17 @@ function billingHeaders(credential) {
 * 探针当时没带，带了只是多一个可能被网关拒掉的变量，没有收益。
 *
 * 复用 {@link conversationHeaders}：官方 CLI 的 ImageService 也是每次现生成
-* 一组会话 UUID，且两个区走同一条代码路径（见该函数的注释）。
-*/
-function imageHeaders(credential) {
+* 一组会话 UUID。但这里**传 `'image'`，且刻意不跟 `usageIdentity` 开关走**：
+* issue #132 的实测只覆盖 chat，而生图这两个入口在 2026-10-21 是用带连字符的
+* v4 答的 200，而 id 的**格式**从来不是生图那道闸问的事。把对齐「顺手统一」到
+* 这里，等于用一条没人测过的字节去换一次显示对齐——`tests/upstream.spec.ts` 里
+* 那条生图守卫钉的就是这一点，而 `shape` 是**唯一**挡住它的东西：客户端把
+* `usageIdentity` 一路传进了 `imageHeaders`，是 `'image'` 这个形状参数让它即便带着开关
+* 也不采用 chat 的形状。守卫因此真能失败——两个方向都实跑过：把 `'image'` 改成
+* `'chat'` 会红，删掉 `shape === 'chat'` 判据也会红。（identity 没接进来之前，`shape`
+* 是空转参数、只改它守卫照样绿；接进来是这一步的前提，别退回成不传 identity。）
+*/
+function imageHeaders(credential, identity = {}) {
 	return {
 		"Authorization": `Bearer ${credential.accessToken}`,
 		"Accept": "application/json, text/plain, */*",
@@ -2505,7 +2720,7 @@ function imageHeaders(credential) {
 		...credential.uid === "" ? { "X-No-User-Id": "1" } : { "X-User-Id": credential.uid },
 		...credential.enterpriseId === void 0 || credential.enterpriseId === "" ? { "X-No-Enterprise-Id": "1" } : { "X-Enterprise-Id": credential.enterpriseId },
 		...credential.domain === "" ? { "X-No-Department-Info": "1" } : { "X-Domain": credential.domain },
-		...conversationHeaders()
+		...conversationHeaders("image", identity)
 	};
 }
 /**
@@ -3041,6 +3256,133 @@ function modelIdOfBody(bodyJson) {
 	}
 }
 /**
+* Prefixes the DSH harness uses for the context it injects as `user` messages.
+*
+* MEASURED shapes, not guesses: the harness's time-context provider appends
+* `Time sampled while preparing turn N, step M: …`, its runtime-context
+* provider appends `Current runtime context. …`, and its reminders arrive as
+* `<system-reminder>` blocks. `billion-context` may additionally wrap each
+* message in an `<acp …>mNNNNN</acp>` marker, so the pattern TOLERATES that
+* marker in front of an injected block — the marker itself is never removed
+* from an injected message (see {@link ACP_LEADING_TAG} for where a marker IS
+* removed, and why that is only the recorded prompt).
+*
+* A body whose trailing user message starts with none of these is left exactly
+* as it arrived — the alternative (moving "the last non-empty user message")
+* would reorder real conversations from other clients.
+*/
+const INJECTED_USER_PREFIX = /^(?:<acp\b[^>]*>m\d{1,8}<\/acp>[ \t]*\r?\n?)*(?:Time sampled while preparing turn \d+, step \d+:|Current runtime context\.|<system-reminder>)/u;
+/**
+* The per-message marker `billion-context` puts in front of every message.
+*
+* Stripped from the REAL prompt only (issue #132), because the usage page takes
+* that message verbatim and the recorded row would otherwise open with
+* `<acp …>m00042</acp>` instead of what the user typed. Only the marker is
+* removed, never any text: the earlier messages keep theirs, so a model that
+* cites a past message by its `mNNNNN` id can still do it — the one id lost is
+* the message being answered right now, which is the only reference that cannot
+* matter. Injected messages keep their marker too: they are not the row being
+* recorded, and touching them would widen the edit for no benefit. Done only
+* under the same opt-in as the reorder, since it deletes bytes the upstream
+* counts.
+*/
+const ACP_LEADING_TAG = /^<acp\b[^>]*>m\d{1,8}<\/acp>[ \t]*\r?\n?/u;
+/**
+* The plain text of one message's content, for prefix matching only.
+*
+* Array-shaped content contributes its text parts joined by a newline; a
+* non-text part is skipped rather than stringified, because `[object Object]`
+* would make every prefix test miss.
+*/
+function textOfContent(content) {
+	if (typeof content === "string") return content;
+	if (!Array.isArray(content)) return "";
+	const parts = [];
+	for (const part of content) {
+		if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
+		const record = part;
+		if (typeof record["text"] !== "string") continue;
+		parts.push(record["text"]);
+	}
+	return parts.join("\n");
+}
+/**
+* Drop the leading `billion-context` marker from one message's content.
+*
+* Handles both shapes (a bare string, or array content whose first `text` part
+* carries the marker) and leaves everything else untouched. Returns whether it
+* changed anything, so a body with no marker is not re-serialized for nothing.
+*/
+function stripLeadingAcpTag(content) {
+	if (typeof content === "string") {
+		if (!ACP_LEADING_TAG.test(content)) return {
+			value: content,
+			changed: false
+		};
+		return {
+			value: content.replace(ACP_LEADING_TAG, ""),
+			changed: true
+		};
+	}
+	if (!Array.isArray(content)) return {
+		value: content,
+		changed: false
+	};
+	for (const part of content) {
+		if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
+		const record = part;
+		if (record["type"] !== "text" || typeof record["text"] !== "string") continue;
+		if (!ACP_LEADING_TAG.test(record["text"])) continue;
+		record["text"] = record["text"].replace(ACP_LEADING_TAG, "");
+		return {
+			value: content,
+			changed: true
+		};
+	}
+	return {
+		value: content,
+		changed: false
+	};
+}
+/** Whether this message is one of the harness's injected context blocks. */
+function isInjectedUserMessage(message) {
+	if (message["role"] !== "user") return false;
+	return INJECTED_USER_PREFIX.test(textOfContent(message["content"]).replace(/^\s+/u, ""));
+}
+/**
+* Move the trailing injected `user` messages above the real prompt.
+*
+* Returns `true` when the order changed, so the caller can serialize only once.
+* Never throws, and a body with nothing to move keeps its exact message order.
+*/
+function keepPromptLast(messages) {
+	let promptIndex = -1;
+	for (let index = messages.length - 1; index >= 0; index--) {
+		const value = messages[index];
+		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+		const message = value;
+		if (message["role"] !== "user") continue;
+		if (isInjectedUserMessage(message)) continue;
+		if (textOfContent(message["content"]).trim() === "") continue;
+		promptIndex = index;
+		break;
+	}
+	if (promptIndex < 0) return false;
+	const trailing = messages.slice(promptIndex + 1).filter((value) => typeof value === "object" && value !== null && !Array.isArray(value) ? isInjectedUserMessage(value) : false);
+	if (trailing.length === 0) return false;
+	const kept = messages.filter((value, index) => !(index > promptIndex && typeof value === "object" && value !== null && !Array.isArray(value) && isInjectedUserMessage(value)));
+	kept.splice(promptIndex, 0, ...trailing);
+	const prompt = kept[promptIndex + trailing.length];
+	if (typeof prompt === "object" && prompt !== null && !Array.isArray(prompt)) {
+		const message = prompt;
+		const stripped = stripLeadingAcpTag(message["content"]);
+		if (stripped.changed) message["content"] = stripped.value;
+	}
+	messages.length = 0;
+	messages.push(...kept);
+	return true;
+}
+/**
 * Normalize an OpenAI chat-completions body for the WorkBuddy upstream: force
 * `stream: true` (the upstream rejects non-streaming), flatten `tool_choice`
 * (the upstream's field is a string; object forms return 400), rewrite
@@ -3057,7 +3399,7 @@ function modelIdOfBody(bodyJson) {
 * upstream already answers keeps its prompt as close to byte-for-byte as these
 * rules allow.
 */
-function prepareChatBody(source) {
+function prepareChatBody(source, options) {
 	let body;
 	try {
 		body = JSON.parse(source);
@@ -3073,6 +3415,7 @@ function prepareChatBody(source) {
 		if (message["role"] === "developer") message["role"] = "system";
 	}
 	ensureSystemHead(obj);
+	if (options?.keepPromptLast === true && Array.isArray(obj["messages"])) keepPromptLast(obj["messages"]);
 	neutralizeChannelFingerprints(obj);
 	normalizeToolChoice(obj);
 	dropRefusedReasoning(obj);
@@ -3526,6 +3869,7 @@ function requestEvidenceOf(bodyJson) {
 */
 var WorkBuddyUpstreamClient = class {
 	onFallback;
+	identity;
 	/**
 	* Reports a fallback the catalog reader had to take.
 	*
@@ -3535,8 +3879,9 @@ var WorkBuddyUpstreamClient = class {
 	* `ctx.logger.warn` in; without a host the event is dropped, which is the
 	* same silence the previous single-source reader had.
 	*/
-	constructor(onFallback) {
+	constructor(onFallback, identity = {}) {
 		this.onFallback = onFallback;
+		this.identity = identity;
 	}
 	/** POST the chat endpoint; a successful answer is the raw SSE response. */
 	async chatStream(credential, bodyJson, signal) {
@@ -3545,7 +3890,7 @@ var WorkBuddyUpstreamClient = class {
 			response = await fetch(`${chatBase(credential)}/v2/chat/completions`, {
 				method: "POST",
 				headers: {
-					...chatHeaders(credential),
+					...chatHeaders(credential, this.identity),
 					"Authorization": `Bearer ${credential.accessToken}`
 				},
 				body: bodyJson,
@@ -3608,7 +3953,7 @@ var WorkBuddyUpstreamClient = class {
 			response = await fetch(`${chatBase(credential)}/v2/chat/completions`, {
 				method: "POST",
 				headers: {
-					...chatHeaders(credential),
+					...chatHeaders(credential, this.identity),
 					"Authorization": `Bearer ${credential.accessToken}`
 				},
 				body: bodyJson,
@@ -3810,7 +4155,7 @@ var WorkBuddyUpstreamClient = class {
 	async generateImage(credential, request, signal) {
 		const response = await fetch(`${chatBase(credential)}${IMAGE_GENERATIONS_PATH}`, {
 			method: "POST",
-			headers: imageHeaders(credential),
+			headers: imageHeaders(credential, this.identity),
 			body: JSON.stringify(buildImageBody(request)),
 			signal: signal ?? AbortSignal.timeout(IMAGE_TIMEOUT_MS)
 		});
@@ -5176,9 +5521,21 @@ var WorkBuddyCredentialStore = class {
 	* refuses to use is what made the dropdown look healthy while every request
 	* failed with 401.
 	*
+	* THE POOL'S RUNTIME OVERRIDE IS PART OF `current()`, SO IT IS PART OF THIS.
+	* `current()` consults `rotatedAccountId` FIRST; this method used to ignore it
+	* and answer from `accountId` alone. With the pool on, the two therefore
+	* disagreed on every rotation: the shim billed account B while the card marked
+	* account A — the reporter's screenshot showed 「当前选用」 on a rate-limited
+	* account while the pill's total belonged to the one actually serving. Worse,
+	* the usage document takes its `credential` from `current()` and its
+	* `account.accountId` from this list, so one document could name two accounts.
+	*
 	* So an explicit selection that matches NO local account marks nothing as
 	* selected (no silent fallback to a different account — see {@link current}).
 	* The implicit default is marked only when nothing was explicitly chosen.
+	* A live rotation marker wins over both, mirroring `current()`'s precedence,
+	* and only while it still names a local account — `current()` falls through in
+	* that case, and so does this.
 	*/
 	async accounts() {
 		const credentials = await this.readAll();
@@ -5186,6 +5543,7 @@ var WorkBuddyCredentialStore = class {
 		const hasExplicitSelection = this.accountId !== void 0;
 		const selectedExists = hasExplicitSelection && credentials.some((credential) => workbuddyAccountId(credential) === this.accountId);
 		const defaultSelected = this.preferred(credentials);
+		const rotatedId = this.rotatedAccountId !== void 0 && credentials.some((credential) => workbuddyAccountId(credential) === this.rotatedAccountId) ? this.rotatedAccountId : void 0;
 		return credentials.map((credential) => {
 			const id = workbuddyAccountId(credential);
 			return {
@@ -5196,7 +5554,7 @@ var WorkBuddyCredentialStore = class {
 				source: credential.source,
 				tokenExpiresAtMs: credential.expiresAtMs,
 				filePath: credential.filePath,
-				selected: selectedExists ? id === this.accountId : !hasExplicitSelection && credential === defaultSelected
+				selected: rotatedId !== void 0 ? id === rotatedId : selectedExists ? id === this.accountId : !hasExplicitSelection && credential === defaultSelected
 			};
 		});
 	}
@@ -6148,10 +6506,221 @@ function generationOf(version) {
 	if (match === null) return "legacy";
 	return Number(match[1]) >= 87 ? "modern" : "legacy";
 }
+/** The versions this build can read (add a new one on upgrade, keep old ones). */
+const KNOWN_ROSTER_SEEN_VERSIONS = Object.freeze([1]);
+/**
+* The "new" window: a first-seen stamp inside it counts as new.
+*
+* 7 days is a deliberate scale — it has to cover "the user was away a few days
+* and came back to two new models" without letting one bulk upload still carry
+* a marker two weeks later. The window is a CONSTANT here rather than a config:
+* a "new model" marker that could be tuned to 365 days has no meaning.
+*/
+const ROSTER_SEEN_NEW_WINDOW_MS = 6048e5;
+/**
+* How long a read answer stays valid before the file is read again.
+*
+* Another process may have just written, so the answer has to be visible within
+* a tick — but a single snapshot assembly should not re-read the file several
+* times.
+*/
+const ROSTER_SEEN_READ_TTL_MS = 5e3;
+/** Filename prefix for one region's first-sighting history. */
+const ROSTER_SEEN_FILE_PREFIX = ".workbuddy-roster-seen";
+const EMPTY_PAYLOAD = {
+	seen: {},
+	version: null
+};
+/** Whether this build can read a stored version. */
+function isKnownRosterSeenVersion(version) {
+	return typeof version === "number" && KNOWN_ROSTER_SEEN_VERSIONS.includes(version);
+}
+/**
+* Normalise a first-seen table: keep only entries whose id is a non-empty
+* string and whose stamp is a finite positive number.
+*
+* Dropping rather than repairing a bad entry is deliberate: a stamp of 0 or
+* negative makes `now - stamp` come out as decades, and that id would count as
+* "new" forever. Better to let it take a real stamp the next time it appears.
+*/
+function normalizeRosterSeen(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {};
+	const out = {};
+	for (const [id, stamp] of Object.entries(raw)) {
+		if (id === "") continue;
+		if (typeof stamp !== "number" || !Number.isFinite(stamp) || stamp <= 0) continue;
+		out[id] = stamp;
+	}
+	return out;
+}
+/**
+* One region's path for its first-sighting history.
+*
+* Region-keyed for the same reason the credential and pool copies are: the two
+* regions are parallel stacks and must never overwrite each other's history.
+*/
+function rosterSeenPath(region, dir) {
+	if (typeof dir === "string" && dir !== "") return join(dir, `${ROSTER_SEEN_FILE_PREFIX}.${region}.json`);
+	return join(resolveDshHome(), `${ROSTER_SEEN_FILE_PREFIX}.${region}.json`);
+}
+/**
+* The ids from a first-seen table that are still "new", oldest first.
+*
+* Ascending on purpose: the caller shows only the first few names (the pill
+* tooltip / popover budget), and the ones seen EARLIEST are the ones closest to
+* expiring — and the ones the reader is most likely to have already met and
+* needs told "it really only just appeared".
+*/
+function freshIdsOf(seen, nowMs) {
+	return Object.entries(seen).filter(([, first]) => nowMs - first < ROSTER_SEEN_NEW_WINDOW_MS).sort((left, right) => left[1] - right[1]).map(([id]) => id);
+}
+/**
+* Parse a raw JSON value into a payload; an unreadable version reads as an
+* empty table but KEEPS the version number — reads stay permissive, while the
+* write guard refuses to overwrite it (the two halves are one rule).
+*/
+function parseRosterSeenPayload(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return EMPTY_PAYLOAD;
+	const source = raw;
+	const version = typeof source["version"] === "number" ? source["version"] : null;
+	if (!isKnownRosterSeenVersion(version)) return {
+		seen: {},
+		version
+	};
+	return {
+		seen: normalizeRosterSeen(source["seen"]),
+		version
+	};
+}
+/**
+* The file-backed first-sighting table for one region.
+*/
+function createFileRosterSeenStore(region, options = {}) {
+	const { dir, ttlMs = ROSTER_SEEN_READ_TTL_MS } = options;
+	const filePath = rosterSeenPath(region, dir);
+	/** Read the file's raw JSON, or `null` for a missing or unreadable file. */
+	const readRaw = async () => {
+		try {
+			return JSON.parse(await readFile(filePath, "utf8"));
+		} catch {
+			return null;
+		}
+	};
+	let cached;
+	const readPayload = async () => {
+		if (cached !== void 0 && Date.now() - cached.at < ttlMs) return cached.payload;
+		const payload = parseRosterSeenPayload(await readRaw());
+		cached = {
+			payload,
+			at: Date.now()
+		};
+		return payload;
+	};
+	let writeTail = Promise.resolve();
+	const enqueueWrite = (task) => {
+		const run = writeTail.then(task, task);
+		writeTail = run.then(() => void 0, () => void 0);
+		return run;
+	};
+	return {
+		/**
+		* Record one round's complete catalog and answer which of its ids are still
+		* inside the new window.
+		*
+		* One call diffs AND persists (see the module note). The first write is
+		* SEEDING: every id is stamped as already expired and `newIds` answers
+		* empty.
+		*/
+		async note(ids, nowMs = Date.now()) {
+			const list = Array.isArray(ids) ? ids.filter((id) => typeof id === "string" && id !== "") : [];
+			const unique = [...new Set(list)];
+			if (unique.length === 0) return { newIds: [] };
+			const now = Number.isFinite(nowMs) ? nowMs : Date.now();
+			return enqueueWrite(() => withFileLock(filePath, async () => {
+				const current = parseRosterSeenPayload(await readRaw());
+				if (current.version !== null && !isKnownRosterSeenVersion(current.version)) return { newIds: [] };
+				const previous = current.seen;
+				const seeded = current.version === null;
+				const next = {};
+				for (const id of unique) {
+					const first = previous[id];
+					next[id] = typeof first === "number" && first > 0 ? Math.min(first, now) : seeded ? now - ROSTER_SEEN_NEW_WINDOW_MS : now;
+				}
+				if (Object.keys(next).length > 200) return { newIds: [] };
+				if (seeded || Object.keys(previous).length !== Object.keys(next).length || Object.keys(next).some((id) => previous[id] !== next[id])) {
+					await writeFileAtomic(filePath, `${JSON.stringify({
+						version: 1,
+						seen: next,
+						updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+					}, null, 2)}\n`, {
+						mode: 384,
+						dirMode: 448
+					});
+					cached = {
+						payload: {
+							seen: next,
+							version: 1
+						},
+						at: Date.now()
+					};
+				}
+				return { newIds: seeded ? [] : freshIdsOf(next, now) };
+			}));
+		},
+		/**
+		* Read-only: the ids that still count as "new" right now (ascending).
+		*
+		* NEVER WRITES. The snapshot and the provider route are read paths, and
+		* writing happens only in the reconciler's `note`; a read path that topped
+		* up stamps would let one panel poll rewrite "who is new".
+		*/
+		async fresh(nowMs = Date.now()) {
+			return freshIdsOf((await readPayload()).seen, Number.isFinite(nowMs) ? nowMs : Date.now());
+		},
+		/** Whether this table has ever been written (seeded vs "really none new"). */
+		async isSet() {
+			return (await readPayload()).version !== null;
+		},
+		/**
+		* The read-only readout the usage route carries, or the version note when
+		* the on-disk history is in a version this build cannot read.
+		*/
+		async readout(nowMs = Date.now()) {
+			const payload = await readPayload();
+			const version = payload.version;
+			if (version === null || isKnownRosterSeenVersion(version)) return { newModelIds: freshIdsOf(payload.seen, Number.isFinite(nowMs) ? nowMs : Date.now()) };
+			return {
+				newModelIds: [],
+				versionNote: `The first-sighting history is stored in version ${String(version)}, which this build cannot read; it is answered as empty, so the pill shows no new-model marker. Known versions: ${KNOWN_ROSTER_SEEN_VERSIONS.join(", ")}.`
+			};
+		},
+		/** The on-disk path (diagnostics and tests). */
+		filePath
+	};
+}
+/**
+* doctor's read-only summary: parse a roster-seen payload without building a
+* store or touching any cache.
+*
+* `null` for a payload the whole shape does not recognise; `versionKnown: false`
+* for a recognised version this build cannot read — so `doctor` can tell "the
+* file is corrupt" from "a newer build wrote it".
+*/
+function describeRosterSeenPayload(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const version = raw["version"];
+	if (typeof version !== "number") return null;
+	const seen = normalizeRosterSeen(raw["seen"]);
+	return {
+		versionKnown: isKnownRosterSeenVersion(version),
+		ids: Object.keys(seen).length,
+		fresh: freshIdsOf(seen, Date.now()).length
+	};
+}
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "5.7.0";
+const WORKBUDDY_CONNECT_VERSION = "5.8.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -6309,4 +6878,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { prepareChatBody as $, parseWorkBuddyAuth as A, readAtRestKey as At, declaredTools as B, defaultDesktopAuthCandidates as C, findWorkbuddyAppExecutable as Ct, isEncryptedCredentialError as D, macosBundleExecutable as Dt, hasEncryptedCredentialFields as E, isWorkbuddyBundle as Et, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as F, writeFileAtomic as Ft, isFirstMessageGateBody as G, isContextTooLongBody as H, WorkBuddyCredentialRejectedError as I, openingEvidenceOfBody as J, knownRegionOf as K, WorkBuddyUpstreamClient as L, workbuddyOwnAuthPath as M, hostPeersInfo as Mt, CONTEXT_OVERFLOW_MARKER as N, resolveDshHome as Nt, isVaultAccountId as O, macosNestedAppBundles as Ot, CREDENTIAL_REJECTED_CODE as P, withFileLock as Pt, perturbChannelFingerprints as Q, channelGateMemberOf as R, authFileName as S, fetchAtRestKeyPayload as St, defaultDesktopAuthPath as T, isEncryptedFieldWrapper as Tt, isConversationIdGateBody as U, forceNeutralHead as V, isCredentialRejectedError as W, parseReasoning as X, parseCreditMultiplier as Y, parseUpstreamModel as Z, ENCRYPTED_CREDENTIAL_CODE as _, nativeModalityOf as _t, readHostHeartbeat as a, lastRefusalFor as at, WorkBuddyCredentialStore as b, deriveAtRestKey as bt, WORKBUDDY_CONNECT_VERSION as c, recordRefusal as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, WorkBuddyImageError as dt, regionOf as et, WorkBuddyCatalog as f, pickImageModel as ft, withoutRouters as g, imageDefaultFor as gt, fallbackModelsFor as h, NATIVE_MODALITY_BY_MODEL_ID as ht, processStartTimeMs as i, defaultOffModelIds as it, workbuddyAccountId as j, workbuddyAppExecutableCandidates as jt, legacyWorkbuddyOwnAuthPath as k, openEncryptedField as kt, piAiRuntimeInfo as l, withEffectiveOff as lt, deriveCatalog as m, queueNoticeText as mt, clearHostHeartbeat as n, attachBusyLevels as nt, workbuddyHostHeartbeatPath as o, offDefaultFor as ot, applyContextBudgets as p, parseQueueAnswer as pt, modelIdOfBody as q, isHeartbeatProcessAlive as r, REFUSES_OFF_MODEL_IDS as rt, writeHostHeartbeat as s, offRefused as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, requestEvidenceOf as tt, FALLBACK_WORKBUDDY_MODELS as u, DEFAULT_IMAGE_SIZE as ut, WORKBUDDY_AUTH_FILENAME as v, WORKBUDDY_APP_EXECUTABLE_ENV as vt, defaultDesktopAuthDirs as w, findWorkbuddyAppExecutableWithSource as wt, WorkBuddyEncryptedCredentialError as x, deriveAtRestKeyId as xt, WORKBUDDY_AUTH_FILE_ENV as y, clearAtRestKeyCache as yt, classifyUpstreamError as z };
+export { parseCreditMultiplier as $, isEncryptedCredentialError as A, isWorkbuddyBundle as At, WorkBuddyCredentialRejectedError as B, WorkBuddyCredentialStore as C, clearAtRestKeyCache as Ct, defaultDesktopAuthDirs as D, findWorkbuddyAppExecutable as Dt, defaultDesktopAuthCandidates as E, fetchAtRestKeyPayload as Et, workbuddyAccountId as F, workbuddyAppExecutableCandidates as Ft, forceNeutralHead as G, channelGateMemberOf as H, workbuddyOwnAuthPath as I, hostPeersInfo as It, isCredentialRejectedError as J, isContextTooLongBody as K, CONTEXT_OVERFLOW_MARKER as L, resolveDshHome as Lt, legacyWorkbuddyOwnAuthPath as M, macosNestedAppBundles as Mt, parseWorkBuddyAuth as N, openEncryptedField as Nt, defaultDesktopAuthPath as O, findWorkbuddyAppExecutableWithSource as Ot, preferredAccountName as P, readAtRestKey as Pt, openingEvidenceOfBody as Q, CREDENTIAL_REJECTED_CODE as R, withFileLock as Rt, WORKBUDDY_AUTH_FILE_ENV as S, WORKBUDDY_APP_EXECUTABLE_ENV as St, authFileName as T, deriveAtRestKeyId as Tt, classifyUpstreamError as U, WorkBuddyUpstreamClient as V, declaredTools as W, knownRegionOf as X, isFirstMessageGateBody as Y, modelIdOfBody as Z, deriveCatalog as _, parseQueueAnswer as _t, readHostHeartbeat as a, requestEvidenceOf as at, ENCRYPTED_CREDENTIAL_CODE as b, imageDefaultFor as bt, WORKBUDDY_CONNECT_VERSION as c, defaultOffModelIds as ct, rosterSeenPath as d, offRefused as dt, parseReasoning as et, piAiRuntimeInfo as f, recordRefusal as ft, applyContextBudgets as g, pickImageModel as gt, WorkBuddyCatalog as h, WorkBuddyImageError as ht, processStartTimeMs as i, regionOf as it, isVaultAccountId as j, macosBundleExecutable as jt, hasEncryptedCredentialFields as k, isEncryptedFieldWrapper as kt, createFileRosterSeenStore as l, lastRefusalFor as lt, FALLBACK_WORKBUDDY_MODELS_GLOBAL as m, DEFAULT_IMAGE_SIZE as mt, clearHostHeartbeat as n, perturbChannelFingerprints as nt, workbuddyHostHeartbeatPath as o, attachBusyLevels as ot, FALLBACK_WORKBUDDY_MODELS as p, withEffectiveOff as pt, isConversationIdGateBody as q, isHeartbeatProcessAlive as r, prepareChatBody as rt, writeHostHeartbeat as s, REFUSES_OFF_MODEL_IDS as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, parseUpstreamModel as tt, describeRosterSeenPayload as u, offDefaultFor as ut, fallbackModelsFor as v, queueNoticeText as vt, WorkBuddyEncryptedCredentialError as w, deriveAtRestKey as wt, WORKBUDDY_AUTH_FILENAME as x, nativeModalityOf as xt, withoutRouters as y, NATIVE_MODALITY_BY_MODEL_ID as yt, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as z, writeFileAtomic as zt };