dsh-workbuddy-bridge 0.2.0 → 0.3.0

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as normalizeCredits, B as FALLBACK_CN_APP_VERSION, C as desktopAuthCandidatesFor, D as cnAppDiscovery, E as WorkBuddyAtRestKeyProvider, F as PROBE_EFFORT_CANDIDATES, G as validCliVersion, H as fallbackChatIdentity, I as probeModel, J as installedAppVersion, K as WORKBUDDY_APP_VERSION_FILENAME, L as randomSentinel, M as prepareChatBody, N as prepareInternationalChatBody, O as WorkBuddyUpstreamClient, P as regionOf, R as classifyUpstreamError, S as defaultDesktopAuthPath, T as workbuddyOwnAuthPath, U as readCliVersion, V as chatUserAgent, W as resolveChatIdentity, X as resolveAppVersion, Y as readBundleVersion, Z as validAppVersion, _ as WorkBuddyCatalog, a as WORKBUDDY_HOST_HEARTBEAT_FILENAME, b as WorkBuddyCredentialStore, c as processStartTimeMs, d as writeHostHeartbeat, f as WORKBUDDY_BRIDGE_VERSION, g as FALLBACK_WORKBUDDY_MODELS, h as FALLBACK_WORKBUDDY_AI_MODELS, i as variantFor, j as parseModelCatalog, k as modelWithCurrentPromotion, l as readHostHeartbeat, n as CN_VARIANT, o as clearHostHeartbeat, q as appUserAgent, r as WORKBUDDY_VARIANTS, s as isHeartbeatProcessAlive, t as AI_VARIANT, u as workbuddyHostHeartbeatPath, v as WORKBUDDY_AUTH_FILENAME, w as parseWorkBuddyAuth, x as defaultDesktopAuthCandidates, y as WORKBUDDY_AUTH_FILE_ENV, z as CN_APP_VERSION_FILENAME } from "./variants-DP0Ho0Tc.js";
+import { A as modelWithCurrentPromotion, B as CN_APP_VERSION_FILENAME, C as defaultDesktopAuthPath, D as WorkBuddyAtRestKeyProvider, E as workbuddyOwnAuthPath, F as regionOf, G as resolveChatIdentity, H as chatUserAgent, I as PROBE_EFFORT_CANDIDATES, J as appUserAgent, K as validCliVersion, L as probeModel, M as parseModelCatalog, N as prepareChatBody, O as cnAppDiscovery, P as prepareInternationalChatBody, Q as validAppVersion, R as randomSentinel, S as defaultDesktopAuthCandidates, T as parseWorkBuddyAuth, U as fallbackChatIdentity, V as FALLBACK_CN_APP_VERSION, W as readCliVersion, X as readBundleVersion, Y as installedAppVersion, Z as resolveAppVersion, _ as FALLBACK_WORKBUDDY_MODELS, a as WORKBUDDY_HOST_HEARTBEAT_FILENAME, b as WORKBUDDY_AUTH_FILE_ENV, c as processStartTimeMs, d as writeHostHeartbeat, f as WORKBUDDY_BRIDGE_VERSION, g as FALLBACK_WORKBUDDY_AI_MODELS, i as variantFor, j as normalizeCredits, k as WorkBuddyUpstreamClient, l as readHostHeartbeat, n as CN_VARIANT, o as clearHostHeartbeat, p as WORKBUDDY_CREDIT_PATH, q as WORKBUDDY_APP_VERSION_FILENAME, r as WORKBUDDY_VARIANTS, s as isHeartbeatProcessAlive, t as AI_VARIANT, u as workbuddyHostHeartbeatPath, v as WorkBuddyCatalog, w as desktopAuthCandidatesFor, x as WorkBuddyCredentialStore, y as WORKBUDDY_AUTH_FILENAME, z as classifyUpstreamError } from "./variants-3SmUZ0e_.js";
 import z from "@deepseek-ai/schemastery";
 import { dirname, join, resolve } from "node:path";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
@@ -10,6 +10,7 @@ import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
+import { StringDecoder } from "node:string_decoder";
 //#region src/catalog/store.ts
 /**
 * The last catalog that actually loaded, kept per variant and per account.
@@ -265,6 +266,44 @@ var WorkBuddyVisibilityStore = class {
 	}
 };
 //#endregion
+//#region src/probe/efforts.ts
+/** The resolution for a model that does not reason: no switch, nothing to detect. */
+const NO_SWITCH = {
+	efforts: [],
+	source: "none",
+	detectable: false,
+	canDisable: false
+};
+/**
+* Resolve one model's thinking-level switch.
+*
+* @param info - the catalog row, whose `reasoning` block carries any declaration.
+* @param observed - this account's recorded detection for the model, if any.
+*/
+function resolveEfforts(info, observed) {
+	const reasoning = info.reasoning;
+	if (reasoning === void 0 || reasoning.supports !== true) return NO_SWITCH;
+	const declared = reasoning.supportedEfforts;
+	if (declared !== void 0 && declared.length > 0) return {
+		efforts: declared,
+		source: "declared",
+		detectable: false,
+		canDisable: reasoning.canDisableThinking === true
+	};
+	if (observed?.validation === "validating" && observed.efforts.length > 0) return {
+		efforts: observed.efforts,
+		source: "observed",
+		detectable: true,
+		canDisable: false
+	};
+	return {
+		efforts: [],
+		source: "none",
+		detectable: true,
+		canDisable: false
+	};
+}
+//#endregion
 //#region src/llm/adapter.ts
 /**
 * The `workbuddy` pi-ai provider: one loopback-backed adapter registered
@@ -361,44 +400,28 @@ function withCatalogDisplay(name, info) {
 	return suffix === void 0 ? name : `${name}${RATE_SEPARATOR}${suffix}`;
 }
 /**
-* Resolve a WorkBuddy model's reasoning capability into pi-ai's
+* Translate a model's resolved thinking-level switch into pi-ai's
 * `thinkingLevelMap` (every level pinned to its wire spelling or `null` for
 * unsupported), mirroring `dsh-llm-pi-ai`'s own `resolveModelReasoning`.
 *
-* Two sources, strictly ordered (`docs/reasoning-effort-probe-plan.md` §5):
-*
-* 1. **The declared set.** When the upstream declares a non-empty
-*    `supportedEfforts`, exactly those values are offered and nothing else.
-*    This always wins: an observation never widens or narrows a declared set.
-* 2. **A local observation.** Rows without a declared set (the older
-*    `{effort, summary}` shape) normally get no control at all — their
-*    selectable set is client-side knowledge the catalog does not carry, and
-*    the desktop app differs per model there. If the user authorized a probe
-*    and it established that the upstream *validates* the parameter, the
-*    verified spellings are offered.
-*
-* A `non-validating` observation deliberately yields no control: the upstream
-* accepts values that cannot exist (measured on `glm-5.2`), so every per-level
-* acceptance it produced would be a false positive.
-*
-* `off` is offered only when the upstream declares `canDisableThinking: true`.
-* It is never probed — disabling thinking is a separate capability, and the
-* per-model acceptance of `off` cannot be inferred from the row's shape.
+* The *decision* of which levels a model offers is not made here — it lives in
+* {@link resolveEfforts}, which the status document reads too. That sharing is
+* the point: the composer's bulb is lit from the same answer the picker is
+* built from, so a model cannot show a control in one place and none in the
+* other. This function only reshapes that answer for pi-ai.
 *
 * The offered set is described internally as "verified accepted", never as
 * "verified effective": acceptance proves the upstream did not reject the
 * spelling, not that it changes what the model does.
 */
 function reasoningFields(info, observed) {
-	const reasoning = info.reasoning;
-	if (reasoning === void 0 || reasoning.supports !== true) return { reasoning: false };
-	const declared = reasoning.supportedEfforts;
-	const efforts = declared !== void 0 && declared.length > 0 ? declared : observed?.validation === "validating" && observed.efforts.length > 0 ? observed.efforts : void 0;
-	if (efforts === void 0) return { reasoning: false };
+	const resolved = resolveEfforts(info, observed);
+	if (resolved.efforts.length === 0) return { reasoning: false };
+	const efforts = resolved.efforts;
 	return {
 		reasoning: true,
 		thinkingLevelMap: {
-			off: reasoning.canDisableThinking === true && declared !== void 0 && declared.length > 0 ? "off" : null,
+			off: resolved.canDisable ? "off" : null,
 			minimal: null,
 			low: efforts.includes("low") ? "low" : null,
 			medium: efforts.includes("medium") ? "medium" : null,
@@ -604,6 +627,67 @@ function originIsLoopback(origin) {
 * @module dsh-workbuddy-bridge/shim
 */
 const REQUEST_BODY_LIMIT = 67108864;
+/**
+* Pull the response id and `credit` out of one SSE `data:` payload.
+*
+* WorkBuddy's OpenAI-compatible stream reports what a message cost as an extra
+* `credit` member beside the standard token buckets on the final usage frame
+* (measured: `glm-5.3` answering 900 tokens reported `credit: 0.51`). The
+* member is not part of the OpenAI schema, so it is read defensively off the
+* parsed object rather than through any typed shape, and every frame without a
+* usable number is skipped.
+*
+* @param payload - the text after `data: ` on one frame.
+* @returns the response id and credit, or undefined when this frame carries none.
+*/
+function readCreditFrame(payload) {
+	if (payload === "" || payload.startsWith("[DONE]")) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(payload);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const frame = parsed;
+	const id = typeof frame["id"] === "string" ? frame["id"] : "";
+	if (id === "") return void 0;
+	const usage = frame["usage"];
+	if (typeof usage !== "object" || usage === null || Array.isArray(usage)) return void 0;
+	const credit = usage["credit"];
+	if (typeof credit !== "number" || !Number.isFinite(credit) || credit < 0) return void 0;
+	return {
+		id,
+		credit
+	};
+}
+/**
+* Split a raw chunk into complete SSE `data:` payloads, carrying the trailing
+* partial line into the next chunk.
+*
+* A TCP read boundary lands wherever it likes — mid-JSON, mid-line — so
+* scanning each chunk on its own would parse a truncated object and drop the
+* very frame that carries the cost. The remainder is returned for the caller to
+* prepend.
+*
+* @param carry - bytes left over from the previous chunk.
+* @param chunk - the bytes just read.
+* @returns the complete payloads, and the new carry.
+*/
+function readCreditChunk(carry, chunk) {
+	const lines = (carry + chunk).split("\n");
+	const carryOver = lines.pop() ?? "";
+	const payloads = [];
+	for (const line of lines) {
+		const trimmed = line.trimEnd();
+		if (!trimmed.startsWith("data:")) continue;
+		payloads.push(trimmed.slice(5).trim());
+	}
+	return {
+		payloads,
+		carry: carryOver
+	};
+}
 /** Chat-completion POSTs must carry a JSON body type (simple-request CSRF drops here). */
 function isJsonContentType(req) {
 	const type = req.headers["content-type"];
@@ -656,7 +740,7 @@ function readBody$1(req) {
 * is the boundary, and the upstream credential comes from the store alone.
 */
 function createWorkBuddyShim(options) {
-	const { store, client, catalog } = options;
+	const { store, client, catalog, observeCredit } = options;
 	const logger = options.logger;
 	const SHARED_SECRET = randomBytes(32).toString("base64url");
 	/** Constant-time bearer check; absent or mismatched bearers are rejected. */
@@ -750,18 +834,50 @@ function createWorkBuddyShim(options) {
 		res.writeHead(200, {
 			"Content-Type": "text/event-stream",
 			"Cache-Control": "no-cache",
-			"Connection": "keep-alive",
+			Connection: "keep-alive",
 			"X-Accel-Buffering": "no"
 		});
 		let sawDone = false;
+		/**
+		* Bytes of the frame currently being read.
+		*
+		* The cost arrives on the last usage frame, and that frame is exactly the
+		* one a TCP read boundary is most likely to split: parsing each chunk in
+		* isolation would drop it. Complete lines are accumulated into `carry` and
+		* only whole `data:` payloads are inspected.
+		*/
+		let carry = "";
+		/** The last cost observed for this response; reported once, at the end. */
+		let observed;
+		/**
+		* Decodes the byte stream without splitting a multi-byte character across
+		* chunks.
+		*
+		* `chunk.toString('utf8')` would turn a character straddling a read
+		* boundary into U+FFFD, and since answers routinely contain Chinese that is
+		* not hypothetical. A mangled frame fails `JSON.parse` and is dropped —
+		* which for the frame carrying the cost would mean a message silently
+		* losing its label.
+		*/
+		const decoder = new StringDecoder("utf8");
 		const body = Readable.fromWeb(result.response.body);
 		body.on("data", (chunk) => {
 			if (chunk.includes("[DONE]")) sawDone = true;
+			if (observeCredit === void 0) return;
+			const read = readCreditChunk(carry, decoder.write(chunk));
+			carry = read.carry;
+			for (const payload of read.payloads) {
+				const frame = readCreditFrame(payload);
+				if (frame !== void 0) observed = frame;
+			}
 		});
 		body.on("error", (error) => {
 			logger?.warn("dsh-workbuddy-bridge: upstream stream failed mid-flight", error);
 			if (!sawDone && res.writable) res.end("data: [DONE]\n\n");
 		});
+		body.on("end", () => {
+			if (observeCredit !== void 0 && observed !== void 0) observeCredit(observed.id, observed.credit);
+		});
 		body.pipe(res);
 	}
 	return {
@@ -776,16 +892,226 @@ function createWorkBuddyShim(options) {
 	};
 }
 //#endregion
+//#region src/llm/credit-log.ts
+/**
+* Per-message credit accounting, as two plain registries the Host half fills.
+*
+* WorkBuddy reports what a message actually cost as a `credit` field on the
+* last usage frame of its OpenAI-compatible SSE stream. That number is
+* **server-supplied**: the desktop app accumulates `cost.amount` stage
+* increments and never multiplies tokens by the catalog's `x0.79` multiplier
+* (the multiplier is display copy). So the plugin must not invent a formula —
+* it observes the number where it exists.
+*
+* The field travels on the stream the shim already proxies, and the same
+* stream carries the upstream response id (`cmb-…`) that DSH records on the
+* assistant message as `source.replayState.response.responseId`. That pair is
+* what makes attribution exact rather than guessed:
+*
+* ```text
+*   SSE id + SSE usage.credit  ──►  creditLog.record(id, credit)
+*                                        │
+*   session/event assistant/message ─────┴──► index.set(sessionId, messageId, credit)
+*        (messageId, responseId)                      │
+*                                              browser row fetches by messageId
+* ```
+*
+* Both structures are pure data with no Host dependencies, so the matching
+* rules are unit-testable without a Session, a socket, or an upstream.
+*
+* @module dsh-workbuddy-bridge/credit-log
+*/
+/** How many response ids one log remembers before dropping the oldest. */
+const DEFAULT_LOG_LIMIT = 512;
+/**
+* Bounded `responseId → credit` registry, with one-shot waiters.
+*
+* The waiter exists because the two writes race in principle: the shim sees the
+* credit when the last SSE frame arrives, while the Session event that names
+* the response id is appended when the stream settles. Either order must
+* produce the same attribution, so a lookup that misses registers interest and
+* is answered by the next `record` instead of silently reporting "unknown".
+*/
+var WorkBuddyCreditLog = class {
+	limit;
+	/**
+	* Insertion-ordered, so eviction is FIFO. A `Map` is used rather than an
+	* object because the response id is attacker-influenced text: a plain object
+	* would let `__proto__` reach the prototype chain.
+	*/
+	credits = /* @__PURE__ */ new Map();
+	/** Pending attributions, keyed by response id; each resolves at most once. */
+	waiters = /* @__PURE__ */ new Map();
+	constructor(limit = DEFAULT_LOG_LIMIT) {
+		this.limit = limit;
+	}
+	/**
+	* Remember what one response cost.
+	*
+	* A non-finite or negative value is refused rather than stored: the field is
+	* remote input, and a `NaN` reaching the browser would render as `NaN` in the
+	* credit label instead of being reported as unknown.
+	*/
+	record(responseId, credit) {
+		if (responseId === "") return;
+		if (!Number.isFinite(credit) || credit < 0) return;
+		this.credits.delete(responseId);
+		this.credits.set(responseId, credit);
+		this.evict();
+		const waiter = this.waiters.get(responseId);
+		if (waiter !== void 0) {
+			this.waiters.delete(responseId);
+			waiter(credit);
+		}
+	}
+	/** What one response cost, or undefined when it was never observed. */
+	lookup(responseId) {
+		return this.credits.get(responseId);
+	}
+	/**
+	* Call `onCredit` once, when this response's credit becomes known.
+	*
+	* @returns a canceller; calling it after the credit landed is a no-op.
+	*/
+	await(responseId, onCredit) {
+		const known = this.credits.get(responseId);
+		if (known !== void 0) {
+			onCredit(known);
+			return () => {};
+		}
+		this.waiters.set(responseId, onCredit);
+		return () => {
+			if (this.waiters.get(responseId) === onCredit) this.waiters.delete(responseId);
+		};
+	}
+	/** Drop the oldest entries until the log is inside its bound. */
+	evict() {
+		while (this.credits.size > this.limit) {
+			const oldest = this.credits.keys().next();
+			if (oldest.done === true) return;
+			this.credits.delete(oldest.value);
+		}
+	}
+};
+/**
+* `sessionId → messageId → credit`, the shape the browser row reads.
+*
+* Nested rather than a flat `messageId → credit` map so the route can answer
+* one Session without shipping every Session's accounting, and so a Session's
+* rows can be dropped as a unit.
+*/
+var WorkBuddySessionCreditIndex = class {
+	perSessionLimit;
+	/** Per-Session maps, each bounded independently. */
+	sessions = /* @__PURE__ */ new Map();
+	constructor(perSessionLimit = DEFAULT_LOG_LIMIT) {
+		this.perSessionLimit = perSessionLimit;
+	}
+	/** Attribute one message's cost, refreshing its position in its Session. */
+	set(sessionId, messageId, credit) {
+		if (sessionId === "" || messageId === "") return;
+		if (!Number.isFinite(credit) || credit < 0) return;
+		let messages = this.sessions.get(sessionId);
+		if (messages === void 0) {
+			messages = /* @__PURE__ */ new Map();
+			this.sessions.set(sessionId, messages);
+		}
+		messages.delete(messageId);
+		messages.set(messageId, credit);
+		while (messages.size > this.perSessionLimit) {
+			const oldest = messages.keys().next();
+			if (oldest.done === true) break;
+			messages.delete(oldest.value);
+		}
+	}
+	/**
+	* One Session's accounting as a plain object, or an empty object when the
+	* Session has none. Always an object, never undefined: the browser half then
+	* needs no "no data yet" branch distinct from "no credits recorded".
+	*/
+	forSession(sessionId) {
+		const messages = this.sessions.get(sessionId);
+		if (messages === void 0) return {};
+		return Object.fromEntries(messages);
+	}
+	/** Forget one Session's accounting, e.g. when it leaves the store. */
+	delete(sessionId) {
+		this.sessions.delete(sessionId);
+	}
+};
+/**
+* Read the upstream response id out of an assistant message's replay state.
+*
+* `replayState` is declared `unknown` on the LLM seam on purpose: it is
+* adapter-private state that only the owning adapter may interpret. This walks
+* it structurally and gives up quietly on anything unexpected, reading only the
+* pi-ai envelope's `response.responseId` and only when it is a non-empty string.
+*
+* A missing id is the normal case for a non-WorkBuddy provider and for a
+* message assembled from a stream that never carried one. It means "cannot
+* attribute", never "costs nothing" -- which is why every caller treats
+* `undefined` as a reason to do nothing rather than to record a zero.
+*
+* @param replayState - the message source's adapter-private state.
+* @returns the upstream response id, or undefined when there is none to read.
+*/
+function responseIdOf(replayState) {
+	if (typeof replayState !== "object" || replayState === null) return void 0;
+	const response = replayState["response"];
+	if (typeof response !== "object" || response === null) return void 0;
+	const responseId = response["responseId"];
+	return typeof responseId === "string" && responseId !== "" ? responseId : void 0;
+}
+/**
+* Attribute one observed response cost to the message that caused it.
+*
+* The two halves of the key are produced by different layers and in either
+* order, so this is a join rather than a straight read:
+*
+* - the **shim** sees `usage.credit` on the stream and knows the upstream
+*   response id, but nothing about DSH's message ids;
+* - the **session log** records the assistant message with its DSH `messageId`
+*   and, inside `source.replayState.response.responseId`, that same id.
+*
+* The event normally lands *after* the stream's final frame (the message is
+* appended once the stream settles), so the log usually answers immediately.
+* The waiter covers the opposite interleaving instead of leaving that message
+* permanently unlabelled.
+*
+* @param log - the variant's response-id to credit registry.
+* @param index - the shared session to message to credit index.
+* @param sessionId - the Session the event came from.
+* @param data - the event's data payload, read structurally.
+* @returns whether an attribution was made or armed.
+*/
+function attributeCredit(log, index, sessionId, data) {
+	const message = data.message;
+	const messageId = message?.id;
+	if (typeof messageId !== "string" || messageId === "") return false;
+	const responseId = responseIdOf(message?.source?.replayState);
+	if (responseId === void 0) return false;
+	const known = log.lookup(responseId);
+	if (known !== void 0) {
+		index.set(sessionId, messageId, known);
+		return true;
+	}
+	log.await(responseId, (credit) => {
+		index.set(sessionId, messageId, credit);
+	});
+	return true;
+}
+//#endregion
 //#region src/probe/store.ts
 /**
 * Local record of reasoning-effort probes.
 *
 * What this stores is an *observation*, never a claim about the upstream: a
 * model's row is only consulted when the catalog carries no explicit
-* `supportedEfforts` set, and it always loses to a declared set. The plan this
-* implements (`docs/reasoning-effort-probe-plan.md` §5) requires that a result
-* is invalidated whenever the model's catalog row changes, so every record
-* carries a fingerprint of the fields the probe depended on.
+* `supportedEfforts` set, and it always loses to a declared set. Every record
+* carries a fingerprint of the fields the probe depended on, so a result is
+* invalidated whenever the model's catalog row changes — the precedence rules
+* are asserted by `tests/probe-store.spec.ts`, and the fingerprint's own input
+* key order is a compatibility contract (`docs/ARCHITECTURE.md`).
 *
 * The file lives beside the plugin's own credential copy under `$DSH_HOME`,
 * never in the desktop app's files, and carries no token, prompt, or response
@@ -980,17 +1306,6 @@ var WorkBuddyProbeStore = class {
 		} catch {}
 	}
 };
-/**
-* Order observations newest-first for display.
-*
-* The store keeps insertion order so the file reads chronologically, but the
-* card wants the most recent detection at the top: a sweep the user just ran
-* should not appear below every earlier one, which is what appending to an
-* insertion-ordered list does.
-*/
-function newestFirst(records) {
-	return [...records].sort((a, b) => b.probedAt - a.probedAt);
-}
 //#endregion
 //#region src/probe/service.ts
 /**
@@ -1120,7 +1435,7 @@ var WorkBuddyProbeService = class {
 function safeMessage(error) {
 	return (error instanceof Error ? error.message : String(error)).replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]").slice(0, 500);
 }
-function json$1(res, status, body) {
+function json$2(res, status, body) {
 	const payload = JSON.stringify(body);
 	res.writeHead(status, {
 		"Content-Type": "application/json",
@@ -1134,7 +1449,7 @@ function json$1(res, status, body) {
 * DNS-rebinding pages (their Host is the attacker's domain, not loopback);
 * the card's same-origin fetches carry no Origin and pass on Host alone.
 */
-function loopbackRequest(req) {
+function loopbackRequest$1(req) {
 	return hostIsLoopback(req.headers.host) && originIsLoopback(req.headers.origin);
 }
 /**
@@ -1219,17 +1534,17 @@ async function workBuddyWebStatus(deps) {
 function workBuddyStatusHandler(deps) {
 	return async (req, res) => {
 		if (req.method !== "GET") {
-			json$1(res, 405, { error: "method not allowed" });
+			json$2(res, 405, { error: "method not allowed" });
 			return;
 		}
-		if (!loopbackRequest(req)) {
-			json$1(res, 403, { error: "request-not-trusted" });
+		if (!loopbackRequest$1(req)) {
+			json$2(res, 403, { error: "request-not-trusted" });
 			return;
 		}
 		try {
-			json$1(res, 200, await workBuddyWebStatus(deps));
+			json$2(res, 200, await workBuddyWebStatus(deps));
 		} catch (error) {
-			json$1(res, 500, { error: safeMessage(error) });
+			json$2(res, 500, { error: safeMessage(error) });
 		}
 	};
 }
@@ -1248,12 +1563,79 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 	}, "dsh-workbuddy-bridge: Web status route");
 }
 //#endregion
+//#region src/web/credit.ts
+/**
+* The request must be addressed to the loopback interface, and a
+* browser-attached Origin must be loopback too. Identical to the status route's
+* guard: the Host check drops DNS-rebinding pages, and the card's same-origin
+* fetches carry no Origin and pass on Host alone.
+*/
+function loopbackRequest(req) {
+	return hostIsLoopback(req.headers.host) && originIsLoopback(req.headers.origin);
+}
+function json$1(res, status, body) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"Content-Type": "application/json",
+		"Cache-Control": "no-store",
+		"Content-Length": Buffer.byteLength(payload)
+	});
+	res.end(payload);
+}
+/**
+* One Session's accounting.
+*
+* A missing `sessionId` is answered with an empty document rather than an
+* error: the browser half asks on behalf of whatever Session it is rendering,
+* and "this Session has no recorded costs" is a normal, silent state — the row
+* simply shows no label.
+*
+* @param deps - the accounting index.
+* @param sessionId - the Session to answer for.
+* @returns the document the browser half renders from.
+*/
+function workBuddySessionCredits(deps, sessionId) {
+	return {
+		sessionId,
+		credits: deps.credits.forSession(sessionId)
+	};
+}
+/** The credit route's request handler, extracted so tests can mount it bare. */
+function workBuddyCreditHandler(deps) {
+	return async (req, res) => {
+		if (req.method !== "GET") {
+			json$1(res, 405, { error: "method not allowed" });
+			return;
+		}
+		if (!loopbackRequest(req)) {
+			json$1(res, 403, { error: "request-not-trusted" });
+			return;
+		}
+		json$1(res, 200, workBuddySessionCredits(deps, new URL(req.url ?? "/", "http://127.0.0.1").searchParams.get("sessionId") ?? ""));
+	};
+}
+/** Mount the GET credit route on an optional webServer context. */
+function registerWorkBuddyCreditRoute(ctx, deps) {
+	const path = deps.path ?? "/plugins/dsh-workbuddy-bridge/credit";
+	ctx.effect(() => {
+		const dispose = ctx.webServer.register({
+			kind: "exact",
+			path,
+			handler: workBuddyCreditHandler(deps)
+		});
+		return () => {
+			dispose();
+		};
+	}, "dsh-workbuddy-bridge: Web credit route");
+}
+//#endregion
 //#region src/web/probe-route.ts
 /**
 * Probe control route: the only state-changing endpoint the plugin exposes.
 *
-* Two guards, because they stop different things (see `docs/reasoning-effort-probe-plan.md`
-* §6.4 and the v0.3.1 note in AGENTS.md about their exact scope):
+* Two guards, because they stop different things (each is pinned by its own
+* spec — `tests/loopback.spec.ts` for the first, `tests/probe-route.spec.ts`
+* for both together):
 *
 * 1. **Loopback Host + Origin**, shared with the status route. This drops
 *    DNS-rebinding pages, whose requests arrive addressed to the attacker's
@@ -1531,7 +1913,7 @@ function fallbackFor(variant) {
 	return variant.id === CN_VARIANT.id ? FALLBACK_WORKBUDDY_MODELS : FALLBACK_WORKBUDDY_AI_MODELS;
 }
 /** Build one variant's stores and probe state. */
-function createVariantRuntime(config, variant, identityOf, accountOf, keyProvider) {
+function createVariantRuntime(config, variant, identityOf, accountOf, keyProvider, creditIndex) {
 	const client = new WorkBuddyUpstreamClient();
 	const configured = configuredAuthFile(config, variant);
 	const store = new WorkBuddyCredentialStore({
@@ -1564,6 +1946,8 @@ function createVariantRuntime(config, variant, identityOf, accountOf, keyProvide
 			consent: () => config.probeConsent,
 			account: () => identityOf(variant.id)
 		}),
+		creditLog: new WorkBuddyCreditLog(),
+		creditIndex,
 		savedCatalogs,
 		visibilityStore,
 		account: () => accountOf(variant.id),
@@ -1589,41 +1973,57 @@ function catalogSection(runtime) {
 	};
 }
 /**
-* Whether a model can be probed by hand: it reasons and the upstream declares
-* no effort set for it.
-*
-* Deliberately *not* filtered by whether a result already exists. Dropping a
-* model once it has been detected made the list shrink with use, so
-* re-detecting one model — after an upstream change, say — meant clearing every
-* other result first. The list stays stable and the card marks which entries
-* already have an answer.
+* One row per reasoning model, describing its thinking-level switch.
+*
+* The judgement comes from {@link resolveEfforts} — the *same* function the
+* adapter builds the model picker from — so the composer's bulb and the picker
+* cannot describe different models. That sharing is the fix for what used to be
+* two independent answers: a candidate list ("who could be probed") beside a
+* result list ("who has been probed"), which between them told the user nothing
+* about the only question they had, namely which models let them pick a level.
+*
+* Read through `recordFor` rather than straight from the store, so a record the
+* adapter already discounts — its catalog row changed, it aged past the TTL, or
+* the upstream has since declared a set — is discounted here too. A model the
+* upstream dropped leaves the catalog entirely and drops out of this list.
 */
-function isProbeCandidate(info) {
-	if (info.reasoning?.supports !== true) return false;
-	return (info.reasoning.supportedEfforts?.length ?? 0) === 0;
-}
-/** Compact probe state for one card: consent, candidates, observations. */
 function probeSection(runtime, consent) {
-	const models = runtime.catalog.current();
-	const results = models.flatMap((info) => {
+	const models = runtime.catalog.current().flatMap((info) => {
+		if (info.reasoning?.supports !== true) return [];
 		const record = runtime.probeService.recordFor(info.id);
-		if (record === void 0) return [];
+		const resolved = resolveEfforts(info, record);
 		return [{
 			id: info.id,
 			name: info.name,
-			validation: record.validation,
-			efforts: record.efforts,
-			probedAt: record.probedAtMs
+			efforts: resolved.efforts,
+			source: resolved.source,
+			detectable: resolved.detectable,
+			...record === void 0 ? {} : {
+				validation: record.validation,
+				probedAt: record.probedAtMs
+			}
 		}];
 	});
 	return {
 		consent,
 		running: runtime.probeService.isRunning(),
-		candidates: models.filter(isProbeCandidate).map((info) => info.id),
-		results: newestFirst(results)
+		models: detectedFirst(models)
 	};
 }
 /**
+* Order the effort rows for display: most recently detected first, then the
+* catalog's own order.
+*
+* The list is no longer "the models you could probe" but "every model and what
+* its switch does", so it must stay stable as detections land — a row that
+* moves when its own result arrives is a row the user has to find again. Only
+* the detected rows are promoted, and ties keep catalog order (a stable sort),
+* which is what makes the movement predictable.
+*/
+function detectedFirst(rows) {
+	return [...rows].sort((a, b) => (b.probedAt ?? -1) - (a.probedAt ?? -1));
+}
+/**
 * Start one variant: its loopback endpoint, provider registration, and
 * configuration-card wiring.
 *
@@ -1634,12 +2034,15 @@ function probeSection(runtime, consent) {
 * @returns whether the provider registered.
 */
 async function startVariant(ctx, runtime) {
-	const { variant, store, client, catalog, probeService } = runtime;
+	const { variant, store, client, catalog, probeService, creditLog } = runtime;
 	const shim = createWorkBuddyShim({
 		store,
 		client,
 		catalog,
-		logger: ctx.logger
+		logger: ctx.logger,
+		observeCredit: (responseId, credit) => {
+			creditLog.record(responseId, credit);
+		}
 	});
 	try {
 		await shim.ready;
@@ -1719,7 +2122,8 @@ function apply(ctx, refs) {
 	*/
 	const lastAccounts = /* @__PURE__ */ new Map();
 	const atRestKeysFor = (variant) => new WorkBuddyAtRestKeyProvider({ discovery: variant.id === CN_VARIANT.id ? cnAppDiscovery() : "none" });
-	const runtimes = WORKBUDDY_VARIANTS.map((variant) => createVariantRuntime(config(), variant, (id) => lastIdentities.get(id), (id) => lastAccounts.get(id), atRestKeysFor(variant)));
+	const creditIndex = new WorkBuddySessionCreditIndex();
+	const runtimes = WORKBUDDY_VARIANTS.map((variant) => createVariantRuntime(config(), variant, (id) => lastIdentities.get(id), (id) => lastAccounts.get(id), atRestKeysFor(variant), creditIndex));
 	const probeKey = createProbeKey();
 	/**
 	* Point a variant at an account identity, invalidating whatever the previous
@@ -1783,6 +2187,7 @@ function apply(ctx, refs) {
 		runtime.invalidate();
 	};
 	ctx.inject(["webServer"], (webCtx) => {
+		registerWorkBuddyCreditRoute(webCtx, { credits: creditIndex });
 		for (const runtime of runtimes) {
 			registerWorkBuddyStatusRoute(webCtx, {
 				path: runtime.variant.statusPath,
@@ -1865,6 +2270,39 @@ function apply(ctx, refs) {
 			}, probeKey);
 		}
 	});
+	/**
+	* Attribute an observed response cost to the message that caused it.
+	*
+	* The two halves of the key are produced by different layers and in either
+	* order, so this is deliberately a join rather than a straight read:
+	*
+	* - the **shim** sees `usage.credit` on the stream and knows the upstream
+	*   response id (`cmb-…`), but nothing about DSH's message ids;
+	* - the **session log** records the assistant message with its DSH
+	*   `messageId` and, inside `source.replayState.response.responseId`, that
+	*   same upstream id.
+	*
+	* The session event normally lands *after* the stream's final frame (the
+	* message is appended once the stream settles), so `creditLog.lookup` usually
+	* hits. `creditLog.await` covers the opposite interleaving — a response whose
+	* final frame arrives after its message was appended — instead of leaving
+	* that message permanently unlabelled.
+	*
+	* Only variants' own provider routes are considered: the response id is
+	* matched against each variant's own log, so a DeepSeek-account message can
+	* never be charged a WorkBuddy cost.
+	*/
+	ctx.inject(["sessions"], (sessionCtx) => {
+		sessionCtx.on("session/event", (session, event) => {
+			if (event.type !== "assistant/message") return;
+			const data = event.data;
+			const provider = data.message?.source?.provider;
+			const runtime = typeof provider === "string" ? runtimes.find((candidate) => candidate.variant.id === provider) : void 0;
+			if (runtime === void 0) return;
+			const sessionId = session.id;
+			attributeCredit(runtime.creditLog, runtime.creditIndex, sessionId, data);
+		});
+	});
 	ctx.effect(() => () => {
 		stopped = true;
 		for (const timer of timers) clearInterval(timer);
@@ -1896,8 +2334,7 @@ function apply(ctx, refs) {
 		if (inflight !== void 0 && inflight.identity === identity && inflight.generation === generation) return inflight.promise;
 		inflight?.controller.abort();
 		const controller = new AbortController();
-		let run;
-		run = (async () => {
+		const run = (async () => {
 			let models;
 			try {
 				const credential = await runtime.store.resolve();
@@ -1963,9 +2400,7 @@ function apply(ctx, refs) {
 	*/
 	const syncVariant = async (runtime) => {
 		if (stopped || !runtime.registered) return;
-		const credential = await runtime.store.current().catch((error) => {
-			ctx.logger.warn(`dsh-workbuddy-bridge: ${runtime.variant.displayName} credential read failed`, error);
-		});
+		const credential = await readCredential(runtime);
 		if (stopped) return;
 		if (credential === void 0) {
 			adoptIdentity(runtime, void 0, void 0);
@@ -1981,11 +2416,70 @@ function apply(ctx, refs) {
 		adoptIdentity(runtime, identity, visibilityAccountOf(credential));
 		await fetchCatalog(runtime, identity);
 	};
+	/**
+	* Read a variant's credential, reporting a refusal instead of swallowing it.
+	*
+	* A region mismatch or an unreadable file is *reported*, not treated as
+	* "signed out": the user needs to know which file to fix, and the difference
+	* between "no credential" and "a credential I refused" is exactly what the
+	* card's reason codes are for.
+	*
+	* @returns the credential, or `undefined` when there is none to use.
+	*/
+	const readCredential = async (runtime) => {
+		try {
+			return await runtime.store.current();
+		} catch (error) {
+			ctx.logger.warn(`dsh-workbuddy-bridge: ${runtime.variant.displayName} credential read failed`, error);
+			return;
+		}
+	};
+	/**
+	* Adopt a variant's account **before its provider registers**.
+	*
+	* Registration and revelation used to happen in the other order: the adapter
+	* registered first (reading a catalog that was still hidden, so it built
+	* *zero* models), and the first credential sweep revealed the group afterwards
+	* in a fire-and-forget `syncAll()`. Between those two moments
+	* `ctx.llm.listProviders()` named the provider while `resolveModelInfo`
+	* answered `UNKNOWN_MODEL` for every one of its models — invisible in the
+	* picker, but a session that already had one of those models selected (a
+	* restored conversation, or `agent-default-model`) failed on its first
+	* message. The window is tens of milliseconds here and much longer on a real
+	* machine: macOS unlocks the credential through Spotlight and the app's
+	* Electron, Windows goes through `reg query` and at-rest decryption, and
+	* either can sit on a slow or networked drive.
+	*
+	* Adopting first closes it: when the provider appears, its catalog is already
+	* visible, so the models exist from the first read. Nothing is lost when the
+	* read fails or nobody is signed in — the variant registers hidden exactly as
+	* it does today, and the poll reveals it later.
+	*
+	* @see .agents/notes/2026-10-02-startup-window-fix-direction.md
+	*/
+	const adoptBeforeRegistering = async (runtime) => {
+		const credential = await readCredential(runtime);
+		if (stopped) return;
+		adoptIdentity(runtime, credential === void 0 ? void 0 : credentialIdentity(credential), credential === void 0 ? void 0 : visibilityAccountOf(credential));
+	};
 	/** Run one reconcile sweep across both variants. */
 	const syncAll = async () => {
 		for (const runtime of runtimes) await syncVariant(runtime);
 	};
-	Promise.all(runtimes.map(async (runtime) => startVariant(ctx, runtime))).then(() => {
+	/**
+	* Bring both variants up, then start the credential sweep.
+	*
+	* The phases are ordered and deliberate: adopting an identity must finish
+	* before the matching provider registers (see
+	* {@link adoptBeforeRegistering}), and the catalogs are fetched after
+	* registration so a fetch failure lands on an already-usable group rather than
+	* on nothing. The two variants never wait on each other within a phase — one
+	* slow credential read must not hold the other product's models back.
+	*/
+	const startAll = async () => {
+		await Promise.all(runtimes.map((runtime) => adoptBeforeRegistering(runtime)));
+		if (stopped) return;
+		await Promise.all(runtimes.map(async (runtime) => startVariant(ctx, runtime)));
 		if (stopped) return;
 		if (runtimes.some((runtime) => runtime.registered)) writeHostHeartbeat();
 		syncAll();
@@ -1994,7 +2488,8 @@ function apply(ctx, refs) {
 		}, credentialPollMs());
 		timer.unref?.();
 		timers.push(timer);
-	});
+	};
+	startAll();
 }
 //#endregion
-export { AI_VARIANT, CN_APP_VERSION_FILENAME, CN_VARIANT, Config, FALLBACK_CN_APP_VERSION, FALLBACK_WORKBUDDY_AI_MODELS, FALLBACK_WORKBUDDY_MODELS, PROBE_EFFORT_CANDIDATES, WORKBUDDY_APP_VERSION_FILENAME, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CATALOG_FILENAME, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_PROBE_FILENAME, WORKBUDDY_PROVIDER, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_VARIANTS, WORKBUDDY_VISIBILITY_FILENAME, WorkBuddyCatalog, WorkBuddyCatalogStore, WorkBuddyCredentialStore, WorkBuddyProbeService, WorkBuddyProbeStore, WorkBuddyUpstreamClient, WorkBuddyVisibilityStore, appUserAgent, apply, chatUserAgent, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthPath, desktopAuthCandidatesFor, fallbackChatIdentity, fingerprintModel, inject, installedAppVersion, isHeartbeatProcessAlive, modelWithCurrentPromotion, name, normalizeCredits, parseModelCatalog, parseWorkBuddyAuth, prepareChatBody, prepareInternationalChatBody, probeModel, processStartTimeMs, randomSentinel, readBundleVersion, readCliVersion, readHostHeartbeat, regionOf, resolveAppVersion, resolveChatIdentity, validAppVersion, validCliVersion, variantFor, visibilityAccountOf, workbuddyCatalogPath, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, workbuddyProbePath, workbuddyVisibilityPath };
+export { AI_VARIANT, CN_APP_VERSION_FILENAME, CN_VARIANT, Config, FALLBACK_CN_APP_VERSION, FALLBACK_WORKBUDDY_AI_MODELS, FALLBACK_WORKBUDDY_MODELS, PROBE_EFFORT_CANDIDATES, WORKBUDDY_APP_VERSION_FILENAME, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CATALOG_FILENAME, WORKBUDDY_CREDIT_PATH, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_PROBE_FILENAME, WORKBUDDY_PROVIDER, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_VARIANTS, WORKBUDDY_VISIBILITY_FILENAME, WorkBuddyCatalog, WorkBuddyCatalogStore, WorkBuddyCredentialStore, WorkBuddyCreditLog, WorkBuddyProbeService, WorkBuddyProbeStore, WorkBuddySessionCreditIndex, WorkBuddyUpstreamClient, WorkBuddyVisibilityStore, appUserAgent, apply, chatUserAgent, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthPath, desktopAuthCandidatesFor, fallbackChatIdentity, fingerprintModel, inject, installedAppVersion, isHeartbeatProcessAlive, modelWithCurrentPromotion, name, normalizeCredits, parseModelCatalog, parseWorkBuddyAuth, prepareChatBody, prepareInternationalChatBody, probeModel, processStartTimeMs, randomSentinel, readBundleVersion, readCliVersion, readHostHeartbeat, regionOf, registerWorkBuddyCreditRoute, resolveAppVersion, resolveChatIdentity, validAppVersion, validCliVersion, variantFor, visibilityAccountOf, workBuddyCreditHandler, workBuddySessionCredits, workbuddyCatalogPath, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, workbuddyProbePath, workbuddyVisibilityPath };