dsh-workbuddy-connect 0.7.0 → 0.7.2

package/lib/{host-heartbeat-d_lBAk8t.js → host-heartbeat-DJb8l_4O.js}

@@ -387,15 +387,36 @@ function randomSentinel() {
 	return `probe_sentinel_${randomBytes(12).toString("hex")}`;
 }
 /**
-* The upstream's "this effort value is not supported" code, measured
-* 2026-09-11 (plan §4.2). It is *not* treated as a permanent protocol promise:
-* anything unrecognized degrades to `unknown` rather than to a capability
-* conclusion.
+* The upstream's "this effort value is not supported" codes, per region, as
+* measured on each live endpoint. The sets are kept separate so a code only
+* ever widens detection for the endpoint it was measured on.
+*
+* - `invalid_reasoning_effort` — the China endpoint, measured 2026-09-11
+*   (plan §4.2). Also kept for `global` as a fallback spelling.
+* - `model_param_invalid` — the global endpoint, measured 2026-10-01. A
+*   non-canonical value is answered `400` / `11133` with this code, which names
+*   no field (`extError.param` is empty), instead of one that names the effort.
+*   It is generic enough to be readable here only because the baseline step has
+*   already proved the *same* request without `reasoning_effort` succeeds,
+*   leaving the sentinel as the only difference between the two attempts. A
+*   sibling code in the same `11133` envelope that names another parameter
+*   (`integer_below_min_value`, the `max_tokens` floor) and a body carrying no
+*   `extError` at all (`11102`, unknown model) are therefore not mistaken for
+*   it, and neither is a level-sweep answer. It is *not* added to `cn`: that
+*   endpoint was measured answering the specific code, and reading a generic
+*   code there would widen attribution beyond what was observed.
+*
+* Neither is treated as a permanent protocol promise: anything unrecognized
+* still degrades to `unknown` rather than to a capability conclusion.
 */
-const INVALID_EFFORT_CODE = "invalid_reasoning_effort";
+const INVALID_EFFORT_CODES = {
+	cn: /* @__PURE__ */ new Set(["invalid_reasoning_effort"]),
+	global: /* @__PURE__ */ new Set(["invalid_reasoning_effort", "model_param_invalid"])
+};
 /** Whether an attempt is an attributable rejection of the effort value. */
-function isEffortRejection(attempt) {
-	return attempt.status === 400 && attempt.errorCode === INVALID_EFFORT_CODE;
+function isEffortRejection(attempt, region) {
+	const codes = INVALID_EFFORT_CODES[region];
+	return attempt.status === 400 && attempt.errorCode !== void 0 && codes.has(attempt.errorCode);
 }
 /** Whether an attempt shows the upstream accepted the request and streamed. */
 function isAcceptance(attempt) {
@@ -411,12 +432,15 @@ function unknownReason(stage, attempt) {
 * Probe one model.
 *
 * `options.candidates` exists so tests can shorten the sweep; production always
-* uses {@link PROBE_EFFORT_CANDIDATES}.
+* uses {@link PROBE_EFFORT_CANDIDATES}. `options.region` selects which
+* endpoint's rejection vocabulary is read; it defaults to `cn`, which is also
+* the production default for the China app.
 */
 async function probeModel(options) {
 	const sentinel = options.sentinel ?? randomSentinel;
 	const candidates = options.candidates ?? PROBE_EFFORT_CANDIDATES;
 	const timeoutMs = options.timeoutMs ?? 3e4;
+	const region = options.region ?? "cn";
 	let requests = 0;
 	const attempt = async (effort) => {
 		requests += 1;
@@ -447,7 +471,7 @@ async function probeModel(options) {
 		efforts: [],
 		requests
 	};
-	if (!isEffortRejection(sentinelAttempt)) return {
+	if (!isEffortRejection(sentinelAttempt, region)) return {
 		validation: "unknown",
 		efforts: [],
 		requests,
@@ -460,7 +484,7 @@ async function probeModel(options) {
 			accepted.push(effort);
 			continue;
 		}
-		if (isEffortRejection(levelAttempt)) continue;
+		if (isEffortRejection(levelAttempt, region)) continue;
 		return {
 			validation: "unknown",
 			efforts: [],
@@ -822,6 +846,95 @@ function envelopeError(status, envelope) {
 	return /* @__PURE__ */ new Error(`workbuddy upstream ${kind} (http ${status}): ${envelope.msg.slice(0, 160)}`);
 }
 /**
+* Parse the billing response's `CycleEndTime` into epoch milliseconds.
+*
+* The upstream sends a zone-less timestamp (`YYYY-MM-DD HH:mm:ss`). This reads it
+* as the running machine's local time, which is what the official desktop client
+* does — it feeds the same field straight to `new Date(value).getTime()`. That
+* makes the plugin agree with the app on the same machine; it is **not** evidence
+* of which zone the server or the account uses, which remains unestablished.
+*
+* A naive read does mean a machine in a different zone than the account's gets a
+* shifted instant. That is accepted here rather than guessed at: inventing an
+* offset would be asserting a zone nobody has verified.
+*
+* @returns Epoch milliseconds, or undefined when absent, malformed, or not a real
+* calendar moment (see the round-trip check below).
+*/
+function parseCycleEndTime(value) {
+	if (typeof value !== "string" || value.trim() === "") return void 0;
+	const match = /^(\d{4})-(\d{2})-(\d{2})[ T](\d{2}):(\d{2}):(\d{2})$/u.exec(value.trim());
+	if (match === null) return void 0;
+	const [, y, mo, d, h, mi, s] = match;
+	const [year, month, day, hour, minute, second] = [
+		y,
+		mo,
+		d,
+		h,
+		mi,
+		s
+	].map(Number);
+	const date = new Date(year, month - 1, day, hour, minute, second);
+	const parsed = date.getTime();
+	if (!Number.isFinite(parsed)) return void 0;
+	if (date.getFullYear() !== year || date.getMonth() !== month - 1 || date.getDate() !== day || date.getHours() !== hour || date.getMinutes() !== minute || date.getSeconds() !== second) return;
+	return parsed;
+}
+/** Empty bucket, used whenever no account qualifies. */
+const NO_EXPIRING_CREDIT = {
+	total: 0,
+	packages: 0
+};
+/**
+* Sum the credit lapsing within `horizonMs` of `nowMs`.
+*
+* Only positive balances count: a package with nothing left is not a loss, and
+* including it would make every long-lived account look permanently at risk.
+* Only *future* expiries count too — a package already past its end time would
+* otherwise satisfy every forward horizon at once (`end - now` is negative,
+* hence "within 24 hours"), making a long-dead package look permanently
+* imminent. See {@link WorkBuddyCreditExpiry} for why the past is not reported.
+*/
+function expiringWithin(accounts, nowMs, horizonMs) {
+	return sumExpiring(accounts, (end) => end > nowMs && end - nowMs <= horizonMs);
+}
+/** Shared accumulator over accounts whose end time passes `matches`. */
+function sumExpiring(accounts, matches) {
+	let total = 0;
+	let packages = 0;
+	let earliestEndTimeMs;
+	for (const account of accounts) {
+		const end = account.endTimeMs;
+		if (end === void 0 || account.remain <= 0) continue;
+		if (!matches(end)) continue;
+		total += account.remain;
+		packages += 1;
+		if (earliestEndTimeMs === void 0 || end < earliestEndTimeMs) earliestEndTimeMs = end;
+	}
+	if (packages === 0) return NO_EXPIRING_CREDIT;
+	return {
+		total,
+		packages,
+		...earliestEndTimeMs === void 0 ? {} : { earliestEndTimeMs }
+	};
+}
+/**
+* Bucket an account's credit by how soon it lapses.
+*
+* Returns undefined when no account carried a usable end time, so a caller can
+* tell "nothing is expiring" apart from "we never learned when anything
+* expires" — the second must not render as reassurance.
+*/
+function summariseExpiry(accounts, nowMs) {
+	if (!accounts.some((account) => account.endTimeMs !== void 0)) return {};
+	const DAY = 864e5;
+	return { expiry: {
+		within24h: expiringWithin(accounts, nowMs, DAY),
+		within3d: expiringWithin(accounts, nowMs, 3 * DAY),
+		within7d: expiringWithin(accounts, nowMs, 7 * DAY)
+	} };
+}
+/**
 * Upstream HTTP client. One instance serves the whole plugin; requests take
 * the credential explicitly so token refreshes apply on the next call.
 *
@@ -863,7 +976,7 @@ var WorkBuddyUpstreamClient = class {
 					...chatHeaders(credential, userAgent, identity.clientVersion),
 					"Authorization": `Bearer ${credential.accessToken}`
 				},
-				body: region === "global" ? prepareInternationalChatBody(bodyJson) : bodyJson,
+				body: region === "global" ? prepareInternationalChatBody(bodyJson) : prepareCnChatBody(bodyJson),
 				...signal === void 0 ? {} : { signal }
 			});
 		} catch (error) {
@@ -1066,15 +1179,18 @@ var WorkBuddyUpstreamClient = class {
 			else remain = capacityRemain;
 			if (remain < 0) remain = 0;
 			total += remain;
+			const endTimeMs = parseCycleEndTime(account["CycleEndTime"]);
 			accounts.push({
 				packageName: typeof account["PackageName"] === "string" ? account["PackageName"] : "(unnamed)",
 				remain,
-				size: size > 0 ? size : numberField("CapacitySize")
+				size: size > 0 ? size : numberField("CapacitySize"),
+				...endTimeMs === void 0 ? {} : { endTimeMs }
 			});
 		}
 		return {
 			total,
-			accounts
+			accounts,
+			...summariseExpiry(accounts, now.getTime())
 		};
 	}
 	/**
@@ -1411,6 +1527,32 @@ function modelWithCurrentPromotion(model, now = Date.now()) {
 * JSON object is returned unchanged, exactly as {@link prepareChatBody} does,
 * so this is safe to run over an already-prepared-or-not body.
 */
+/**
+* Prepare a body for the **CN** endpoint.
+*
+* Until #87 the CN wire was the caller's body verbatim. The only difference
+* now is the shared {@link dropUnsupportedEffort} strip, whose region scope was
+* lifted once measurements showed this endpoint rejects `off` too.
+*
+* Deliberately **not** routed through {@link prepareChatBody}: the shim already
+* applies it before handing the body to {@link WorkBuddyUpstreamClient.chatStream},
+* and re-running it would be a second `stream`/`developer`/`tool_choice`
+* normalisation of an already-normalised body. Only the strip belongs here.
+*
+* A body that is not a JSON object is returned unchanged, so this is safe to
+* run over an already-prepared-or-not body.
+*/
+function prepareCnChatBody(source) {
+	let body;
+	try {
+		body = JSON.parse(source);
+	} catch {
+		return source;
+	}
+	if (!isObject(body)) return source;
+	dropUnsupportedEffort(body);
+	return JSON.stringify(body);
+}
 function prepareInternationalChatBody(source) {
 	const prepared = prepareChatBody(source);
 	let body;
@@ -1432,25 +1574,34 @@ function prepareInternationalChatBody(source) {
 	return JSON.stringify(body);
 }
 /**
-* Remove the adapter's own `off` effort spelling from the **international** wire.
+* Remove the adapter's own `off` effort spelling from the wire, on every region.
 *
 * `thinkingLevelMap.off` is pinned to the literal `'off'` for models that
 * declare `canDisableThinking`, so that the level stays selectable. pi-ai
-* sends that value for any request carrying no explicit level, and the
-* international endpoint rejects it on the GPT family with HTTP 400 `11133` /
-* `extError.param === 'reasoning.effort'` (issue #49). Omission is the only
-* form measured good on every such model; a literal `'none'` is *not* a safe
-* substitute — accepted by the GPT-5.6 family and GLM, rejected by
-* `gpt-6-astra`.
-*
-* Consequences, stated honestly: the international picker still offers Off,
-* but selecting it now means "the field is omitted" — the model's actual
-* behaviour is decided upstream and is *not* guaranteed to disable thinking
-* or to match the catalog's `defaultEffort`. Declared spellings
-* (`low`/`medium`/`high`/`xhigh`/`max`) and an explicit `none` pass through
-* untouched. The CN variant is deliberately unaffected: its endpoint has
-* accepted this spelling in every measurement so far, and keeping its wire
-* unchanged is a scope decision, not a claim about that endpoint's future.
+* sends that value for any request carrying no explicit level — which is why
+* this covers **Default and Off alike**: the two produce the same body, so a
+* fix that only removed the menu entry would leave Default failing.
+*
+* Both endpoints reject it, which is why this is no longer region-scoped
+* (#87): the international GPT family answers HTTP 400 `11133` /
+* `extError.param === 'reasoning.effort'` (issue #49), and the CN endpoint
+* rejects it on models that declare `onlyReasoning` — measured on
+* `deepseek-v4.1-flash` with 400 / `11150`, while `low`/`high`/`max` pass
+* (issue #87). Omission is the only form measured good on every such model; a
+* literal `'none'` is *not* a safe substitute — accepted by the GPT-5.6 family
+* and GLM, rejected by `gpt-6-astra`.
+*
+* Consequences, stated honestly: the picker still offers Off for models where
+* the upstream declares `canDisableThinking`, but selecting it now means "the
+* field is omitted" — the model's actual behaviour is decided upstream and is
+* *not* guaranteed to disable thinking or to match the catalog's
+* `defaultEffort`. Declared spellings (`low`/`medium`/`high`/`xhigh`/`max`)
+* and an explicit `none` pass through untouched.
+*
+* The CN strip replaces a scope decision whose premise did not hold: the
+* earlier note here said that endpoint "has accepted this spelling in every
+* measurement so far". Measurements since (#87) show it rejects `off` on
+* validating models — the earlier runs had simply not hit one.
 */
 function dropUnsupportedEffort(obj) {
 	if (obj["reasoning_effort"] === "off") delete obj["reasoning_effort"];
@@ -1850,6 +2001,60 @@ const WINDOWS_REGISTRY_ROOTS = [
 ];
 const WINDOWS_REGISTRY_OUTPUT_MAX_BYTES = 1048576;
 const WINDOWS_ELECTRON_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u;
+/**
+* The PowerShell command that re-reads one uninstall root as UTF-8.
+*
+* Used *only* as a fallback, and only to supply data: the caller feeds its
+* output through the same {@link parseWindowsRegistryOutput} and
+* {@link inspectWindowsElectronCandidate} as the `reg.exe` path, so candidate
+* validation, uniqueness, and the "we could not check" rules are unchanged.
+*
+* Why a different tool rather than a smarter decode: `reg.exe` writes in a
+* code page chosen by the console it inherits, and no inspection of the
+* resulting bytes can recover which one. .NET's registry API returns strings,
+* so the question never arises.
+*
+* Structure notes, each one a defect fixed after review:
+*
+* - **`param` is the first statement.** A `param` block must lead the script
+*   block; putting the encoding assignment before it is a parse error in
+*   Windows PowerShell 5.1.
+* - **`[Console]::OutputEncoding` is set explicitly.** Windows PowerShell 5.1
+*   encodes redirected stdout with it, so UTF-8 is *defined* for this child
+*   rather than inferred from what comes back.
+* - **Exit codes distinguish "root absent" from "root unreadable"** (`2` and
+*   `3`). The caller branches on the code, never on message text, so the
+*   localized diagnostics below cannot change an outcome.
+* - **An unopenable subkey is `3`, not `continue`.** Skipping it silently
+*   could drop a real candidate and make the product look absent, which is
+*   precisely the confusion the caller's `incomplete` state exists to prevent.
+* - **Output is JSON.** PowerShell does the escaping, so paths containing
+*   spaces, commas, or quotes no longer depend on column positions, and only
+*   the two values this plugin reads are collected.
+*
+* The root is passed as a `-Root` argument, never interpolated into the
+* command text.
+*/
+const WINDOWS_REGISTRY_RELATIVE_POWERSHELL = "System32\\WindowsPowerShell\\v1.0\\powershell.exe";
+/** Exit code meaning the root key does not exist (a normal, expected outcome). */
+const WINDOWS_POWERSHELL_ROOT_ABSENT = 2;
+/** Exit code meaning the root exists but a part of it could not be read. */
+const WINDOWS_POWERSHELL_ROOT_UNREADABLE = 3;
+const WINDOWS_POWERSHELL_QUERY_SCRIPT = [
+	"param([string]$Root)",
+	"[Console]::OutputEncoding=[Text.Encoding]::UTF8;",
+	"$ErrorActionPreference=\"Stop\";",
+	"$path=\"Registry::\"+$Root;",
+	"if (-not (Test-Path -LiteralPath $path)) { [Console]::Error.Write(\"root absent\"); exit 2 };",
+	"try { $k=Get-Item -LiteralPath $path -ErrorAction Stop } catch { [Console]::Error.Write(\"root unreadable\"); exit 3 };",
+	"$out=@();",
+	"foreach ($n in $k.GetSubKeyNames()) {",
+	"  try { $p=$k.OpenSubKey($n); if ($null -eq $p) { throw \"null\" } } catch { [Console]::Error.Write(\"subkey unreadable\"); exit 3 };",
+	"  $d=$p.GetValue(\"DisplayName\");$i=$p.GetValue(\"DisplayIcon\");",
+	"  if ($null -ne $d -or $null -ne $i) { $out += [pscustomobject]@{ displayName=[string]$d; displayIcon=[string]$i } }",
+	"};",
+	"ConvertTo-Json -InputObject @($out) -Compress -Depth 3"
+].join(" ");
 /** One discovery subprocess's own limits; see {@link WorkBuddyAtRestKeyProviderOptions}. */
 const WORKBUDDY_DISCOVERY_STEP_TIMEOUT_MS = 3e3;
 const MDFIND_MAX_OUTPUT_BYTES = 1048576;
@@ -1944,6 +2149,15 @@ function workBuddyDiscoveryTools(bundleId) {
 function workBuddyWindowsDiscoveryTools() {
 	const systemRoot = process.env.SystemRoot?.trim();
 	const regPath = systemRoot === void 0 || systemRoot === "" ? void 0 : join(systemRoot, "System32", "reg.exe");
+	/**
+	* The fallback interpreter. Resolved by absolute path from SystemRoot, like
+	* `reg.exe`: never through PATH, which a user can change.
+	*
+	* Windows PowerShell 5.1 ships with Windows, so unlike `pwsh` it can be
+	* relied on; the script is written to its syntax (see
+	* {@link WINDOWS_POWERSHELL_QUERY_SCRIPT}).
+	*/
+	const powershellPath = systemRoot === void 0 || systemRoot === "" ? void 0 : join(systemRoot, WINDOWS_REGISTRY_RELATIVE_POWERSHELL);
 	const runTool = (root, signal) => new Promise((resolve, reject) => {
 		if (regPath === void 0) {
 			reject(new DiscoveryIncompleteError("SystemRoot is not configured"));
@@ -1961,13 +2175,14 @@ function workBuddyWindowsDiscoveryTools() {
 		], {
 			maxBuffer: WINDOWS_REGISTRY_OUTPUT_MAX_BYTES,
 			timeout: WORKBUDDY_DISCOVERY_STEP_TIMEOUT_MS,
-			windowsHide: true
+			windowsHide: true,
+			encoding: "buffer"
 		}, (error, stdout, stderr) => {
 			if (settled) return;
 			settled = true;
 			if (error !== null && error !== void 0) {
-				if (error.killed !== true && (error.code === 1 || error.code === "1") && windowsRegistryKeyMissing(stderr)) {
-					resolve("");
+				if (error.killed !== true && (error.code === 1 || error.code === "1") && windowsRegistryKeyMissing(stderr.toString("utf8"))) {
+					resolve(Buffer.alloc(0));
 					return;
 				}
 				reject(new DiscoveryIncompleteError(`reg.exe could not complete (${error.killed === true ? "timed out" : String(error.code ?? "unavailable")})`));
@@ -1986,7 +2201,119 @@ function workBuddyWindowsDiscoveryTools() {
 			signal.removeEventListener("abort", abort);
 		});
 	});
-	return { queryUninstallRoot: runTool };
+	/**
+	* Re-read one root through PowerShell's Unicode registry API (#88).
+	*
+	* Returns the same column-shaped document the `reg.exe` path produces, so
+	* the caller's parser and candidate checks apply unchanged. Every failure
+	* that means "we could not tell" is a {@link DiscoveryIncompleteError}, and
+	* a root that simply does not exist yields an empty document — one of the
+	* three roots being absent is normal and must not fail the search.
+	*/
+	const runFallback = (root, signal) => new Promise((resolve, reject) => {
+		if (powershellPath === void 0) {
+			reject(new DiscoveryIncompleteError("SystemRoot is not configured"));
+			return;
+		}
+		if (signal.aborted) {
+			reject(new DiscoveryIncompleteError("powershell.exe was not started: the discovery budget was already spent"));
+			return;
+		}
+		let settled = false;
+		const child = execFile(powershellPath, [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			WINDOWS_POWERSHELL_QUERY_SCRIPT,
+			"-Root",
+			root
+		], {
+			maxBuffer: WINDOWS_REGISTRY_OUTPUT_MAX_BYTES,
+			timeout: WORKBUDDY_DISCOVERY_STEP_TIMEOUT_MS,
+			windowsHide: true,
+			encoding: "utf8"
+		}, (error, stdout) => {
+			if (settled) return;
+			settled = true;
+			if (error !== null && error !== void 0) {
+				const code = error.killed === true ? void 0 : Number(error.code);
+				if (code === WINDOWS_POWERSHELL_ROOT_ABSENT) {
+					resolve("");
+					return;
+				}
+				if (code === WINDOWS_POWERSHELL_ROOT_UNREADABLE) {
+					reject(new DiscoveryIncompleteError(`powershell.exe could not read the registry root ${root}`));
+					return;
+				}
+				reject(new DiscoveryIncompleteError(`powershell.exe could not complete (${error.killed === true ? "timed out" : String(error.code ?? "unavailable")})`));
+				return;
+			}
+			const records = parseWindowsUninstallJson(stdout);
+			if (records === void 0) {
+				reject(new DiscoveryIncompleteError("powershell.exe output was not the expected registry document"));
+				return;
+			}
+			resolve(records);
+		});
+		const abort = () => {
+			if (settled) return;
+			settled = true;
+			child.kill();
+			reject(new DiscoveryIncompleteError("powershell.exe was abandoned: the discovery budget was spent"));
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		child.on("close", () => {
+			signal.removeEventListener("abort", abort);
+		});
+	});
+	return { queryUninstallRoot: async (root, signal) => {
+		const raw = await runTool(root, signal);
+		if (isAsciiOnly(raw)) return raw.toString("utf8");
+		return await runFallback(root, signal);
+	} };
+}
+/**
+* Whether every byte is ASCII, the one case where a decode cannot be wrong.
+*
+* @param bytes - the child's raw stdout.
+*/
+function isAsciiOnly(bytes) {
+	for (const byte of bytes) if (byte >= 128) return false;
+	return true;
+}
+/**
+* Turn the fallback's JSON into the same column-shaped document
+* {@link parseWindowsRegistryOutput} already consumes.
+*
+* Re-encoding into the `reg query` text form on purpose: the parser and
+* {@link parseWindowsDisplayIcon} carry the candidate-quoting rules that are
+* shared with existing tests, and the seam between this tool and the provider
+* is a string. Records carrying neither value are skipped, and the key name is
+* synthetic because only the values are read.
+*
+* @param output - the child's UTF-8 stdout.
+* @returns the document, or `undefined` when it was not the expected JSON.
+*/
+function parseWindowsUninstallJson(output) {
+	let document;
+	try {
+		document = JSON.parse(output);
+	} catch {
+		return;
+	}
+	const rows = Array.isArray(document) ? document : [document];
+	const lines = [];
+	for (const [index, row] of rows.entries()) {
+		if (typeof row !== "object" || row === null) continue;
+		const record = row;
+		const displayName = record["displayName"];
+		const displayIcon = record["displayIcon"];
+		if (typeof displayName !== "string" && typeof displayIcon !== "string") continue;
+		lines.push(`HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{PS-${String(index)}}`);
+		if (typeof displayName === "string") lines.push(`    DisplayName    REG_SZ    ${displayName}`);
+		if (typeof displayIcon === "string") lines.push(`    DisplayIcon    REG_SZ    ${displayIcon}`);
+	}
+	return lines.join("\r\n");
 }
 /**
 * In-memory protector-key resolver: one spawn per key id, single-flight, never
@@ -3611,7 +3938,7 @@ var WorkBuddyCatalog = class {
 };
 //#endregion
 //#region src/version.ts
-const WORKBUDDY_CONNECT_VERSION = "0.7.0";
+const WORKBUDDY_CONNECT_VERSION = "0.7.2";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -3782,4 +4109,4 @@ function isHeartbeatProcessAlive(heartbeat) {
 	return startAtMs <= heartbeat.registeredAt;
 }
 //#endregion
-export { extractDisplayErrorMessage as A, CN_APP_VERSION_FILENAME as B, WORKBUDDY_VARIANTS as C, WORKBUDDY_UPDATE_PATH as D, WORKBUDDY_STATUS_PATH as E, prepareInternationalChatBody as F, resolveChatIdentity as G, chatUserAgent as H, regionOf as I, appUserAgent as J, validCliVersion as K, PROBE_EFFORT_CANDIDATES as L, normalizeCredits as M, parseModelCatalog as N, WorkBuddyUpstreamClient as O, prepareChatBody as P, validAppVersion as Q, probeModel as R, CN_VARIANT as S, WORKBUDDY_PROBE_PATH as T, fallbackChatIdentity as U, FALLBACK_CN_APP_VERSION as V, readCliVersion as W, readBundleVersion as X, installedAppVersion as Y, resolveAppVersion as Z, desktopAuthCandidatesFor as _, readHostHeartbeat as a, atRestKeyProviderFor as b, WORKBUDDY_CONNECT_VERSION as c, WorkBuddyCatalog as d, WORKBUDDY_AUTH_FILENAME as f, defaultDesktopAuthPath as g, defaultDesktopAuthCandidates as h, processStartTimeMs as i, modelWithCurrentPromotion as j, classifyUpstreamError as k, FALLBACK_WORKBUDDY_AI_MODELS as l, WorkBuddyCredentialStore as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, WORKBUDDY_AUTH_FILE_ENV as p, WORKBUDDY_APP_VERSION_FILENAME as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, FALLBACK_WORKBUDDY_MODELS as u, parseWorkBuddyAuth as v, variantFor as w, AI_VARIANT as x, workbuddyOwnAuthPath as y, randomSentinel as z };
+export { validAppVersion as $, extractDisplayErrorMessage as A, randomSentinel as B, WORKBUDDY_VARIANTS as C, WORKBUDDY_UPDATE_PATH as D, WORKBUDDY_STATUS_PATH as E, prepareCnChatBody as F, readCliVersion as G, FALLBACK_CN_APP_VERSION as H, prepareInternationalChatBody as I, WORKBUDDY_APP_VERSION_FILENAME as J, resolveChatIdentity as K, regionOf as L, normalizeCredits as M, parseModelCatalog as N, WorkBuddyUpstreamClient as O, prepareChatBody as P, resolveAppVersion as Q, PROBE_EFFORT_CANDIDATES as R, CN_VARIANT as S, WORKBUDDY_PROBE_PATH as T, chatUserAgent as U, CN_APP_VERSION_FILENAME as V, fallbackChatIdentity as W, installedAppVersion as X, appUserAgent as Y, readBundleVersion as Z, desktopAuthCandidatesFor as _, readHostHeartbeat as a, atRestKeyProviderFor as b, WORKBUDDY_CONNECT_VERSION as c, WorkBuddyCatalog as d, WORKBUDDY_AUTH_FILENAME as f, defaultDesktopAuthPath as g, defaultDesktopAuthCandidates as h, processStartTimeMs as i, modelWithCurrentPromotion as j, classifyUpstreamError as k, FALLBACK_WORKBUDDY_AI_MODELS as l, WorkBuddyCredentialStore as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, WORKBUDDY_AUTH_FILE_ENV as p, validCliVersion as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, FALLBACK_WORKBUDDY_MODELS as u, parseWorkBuddyAuth as v, variantFor as w, AI_VARIANT as x, workbuddyOwnAuthPath as y, probeModel as z };

package/lib/index.d.ts

@@ -229,17 +229,22 @@ type ProbeOutcome = {
   requests: number;
   reason: string;
 };
+/** Which endpoint's rejection vocabulary a probe interprets. */
+type ProbeRegion = 'cn' | 'global';
 /**
  * Probe one model.
  *
  * `options.candidates` exists so tests can shorten the sweep; production always
- * uses {@link PROBE_EFFORT_CANDIDATES}.
+ * uses {@link PROBE_EFFORT_CANDIDATES}. `options.region` selects which
+ * endpoint's rejection vocabulary is read; it defaults to `cn`, which is also
+ * the production default for the China app.
  */
 declare function probeModel(options: {
   send: ProbeSender;
   sentinel?: SentinelFactory;
   candidates?: readonly WorkBuddyEffort[];
   timeoutMs?: number;
+  region?: ProbeRegion;
 }): Promise<ProbeOutcome>;
 //#endregion
 //#region src/upstream.d.ts
@@ -325,6 +330,49 @@ interface WorkBuddyCreditAccount {
   remain: number;
   size: number;
   unlimited?: true;
+  /**
+   * When the package's own cycle ends, in epoch milliseconds.
+   *
+   * The upstream has always sent this (`CycleEndTime`, a zone-less
+   * `YYYY-MM-DD HH:mm:ss` string) and the query itself already filters on
+   * `PackageEndTimeRange`, but the field used to be dropped here — so a card
+   * could show "500 credit" for a package expiring in an hour with nothing to
+   * distinguish it from one expiring next month. Absent when the upstream omits
+   * or malforms it, which must never read as "no expiry".
+   *
+   * The zone the upstream means is **not established**: reading the string as
+   * the running machine's local time follows the official desktop client (see
+   * {@link parseCycleEndTime}), and is not a claim about the account's zone.
+   */
+  endTimeMs?: number;
+}
+/** Credit whose package expires within a horizon the user should act on. */
+interface WorkBuddyExpiringCredits {
+  /** Sum of {@link WorkBuddyCreditAccount.remain} over the window. */
+  total: number;
+  /** How many packages contribute to {@link total}. */
+  packages: number;
+  /** The soonest `endTimeMs` among them. */
+  earliestEndTimeMs?: number;
+}
+/**
+ * Credit at risk, bucketed by how soon it lapses.
+ *
+ * Thresholds are calendar-ish (24h / 3d / 7d) rather than "this month": a package
+ * expiring at 08:00 tomorrow is not helped by a monthly average, and the upstream
+ * genuinely staggers expiries per package.
+ *
+ * Only *future* horizons are reported. An already-lapsed package is deliberately
+ * **not** summarised here: the personal billing query this feeds filters
+ * `Status: [0, 3]` (`valid` + `usedUp`) from the current time forward, while the
+ * upstream marks a lapsed package `Status: 2` (`expired`) — a status this query
+ * never returns. Historical expiry would need its own query, which is out of
+ * scope.
+ */
+interface WorkBuddyCreditExpiry {
+  within24h: WorkBuddyExpiringCredits;
+  within3d: WorkBuddyExpiringCredits;
+  within7d: WorkBuddyExpiringCredits;
 }
 /** Aggregated credit answer for one credential. */
 interface WorkBuddyCredits {
@@ -342,6 +390,13 @@ interface WorkBuddyCredits {
    */
   unlimited?: true;
   cycleResetTime?: string;
+  /**
+   * Credit lapsing soon, so a card can warn instead of only reporting a total.
+   *
+   * Absent when no account carried a usable end time — the plugin must not
+   * claim "nothing expires soon" on the strength of data it never received.
+   */
+  expiry?: WorkBuddyCreditExpiry;
 }
 /** Token refresh answer; fields the upstream omits stay absent. */
 interface WorkBuddyRefreshOutcome {
@@ -604,6 +659,22 @@ declare function modelWithCurrentPromotion(model: WorkBuddyUpstreamModel, now?:
  * JSON object is returned unchanged, exactly as {@link prepareChatBody} does,
  * so this is safe to run over an already-prepared-or-not body.
  */
+/**
+ * Prepare a body for the **CN** endpoint.
+ *
+ * Until #87 the CN wire was the caller's body verbatim. The only difference
+ * now is the shared {@link dropUnsupportedEffort} strip, whose region scope was
+ * lifted once measurements showed this endpoint rejects `off` too.
+ *
+ * Deliberately **not** routed through {@link prepareChatBody}: the shim already
+ * applies it before handing the body to {@link WorkBuddyUpstreamClient.chatStream},
+ * and re-running it would be a second `stream`/`developer`/`tool_choice`
+ * normalisation of an already-normalised body. Only the strip belongs here.
+ *
+ * A body that is not a JSON object is returned unchanged, so this is safe to
+ * run over an already-prepared-or-not body.
+ */
+declare function prepareCnChatBody(source: string): string;
 declare function prepareInternationalChatBody(source: string): string;
 //#endregion
 //#region src/variants.d.ts
@@ -1271,6 +1342,12 @@ declare const WORKBUDDY_STREAM_IDLE_TIMEOUT_MS = 300000;
 interface WorkBuddyAdapterOptions {
   providerId?: string;
   displayName?: string;
+  /**
+   * Which endpoint this adapter serves, from the variant descriptor. Decides
+   * only whether the CN `onlyReasoning` veto hides `off` (#87); defaults to
+   * `'cn'`, the same legacy default `providerId` carries.
+   */
+  region?: WorkBuddyRegion;
   shim: WorkBuddyShim;
   store: WorkBuddyCredentialStore;
   catalog: WorkBuddyCatalog;
@@ -1463,6 +1540,12 @@ interface WorkBuddyProbeServiceOptions {
    */
   account: () => string | undefined;
   sentinel?: SentinelFactory;
+  /**
+   * Which endpoint's rejection vocabulary sweeps read. The two apps talk to
+   * different upstreams that answer a bad effort with different codes, so each
+   * runtime passes its own region instead of sharing one widening set.
+   */
+  region: ProbeRegion;
   /** Injectable for tests; defaults to the live upstream sender. */
   send?: (modelId: string) => ProbeSender;
 }
@@ -1634,4 +1717,4 @@ declare function visibilityAccountOf(credential: Pick<WorkBuddyCredential, 'uid'
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { AI_VARIANT, type AppVersionInfo, CN_APP_VERSION_FILENAME, CN_VARIANT, type ChatIdentity, Config, FALLBACK_CN_APP_VERSION, FALLBACK_WORKBUDDY_AI_MODELS, FALLBACK_WORKBUDDY_MODELS, PROBE_EFFORT_CANDIDATES, type ProbeAttempt, type ProbeOutcome, type ProbeSender, type ResolveChatIdentityOptions, type UpstreamErrorKind, WORKBUDDY_AI_SETTINGS_NS, WORKBUDDY_APP_VERSION_FILENAME, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CATALOG_FILENAME, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_PROBE_FILENAME, WORKBUDDY_PROVIDER, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_VARIANTS, WORKBUDDY_VISIBILITY_FILENAME, type WorkBuddyAdapter, type WorkBuddyAppVersionSource, type WorkBuddyAuthStatus, WorkBuddyCatalog, type WorkBuddyCatalogFetch, WorkBuddyCatalogStore, type WorkBuddyChatResult, type WorkBuddyCredential, WorkBuddyCredentialStore, type WorkBuddyCredits, type WorkBuddyEffort, type WorkBuddyHostHeartbeat, type WorkBuddyModelBilling, type WorkBuddyModelInfo, type WorkBuddyModelReasoning, type WorkBuddyProbeRecord, WorkBuddyProbeService, type WorkBuddyProbeStatus, WorkBuddyProbeStore, type WorkBuddyProbeValidation, type WorkBuddyPromotion, type WorkBuddyRefreshOutcome, type WorkBuddyShim, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyVariant, WorkBuddyVisibilityStore, appUserAgent, apply, chatUserAgent, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthPath, desktopAuthCandidatesFor, fallbackChatIdentity, fingerprintModel, inject, installedAppVersion, isHeartbeatProcessAlive, modelWithCurrentPromotion, name, normalizeCredits, parseModelCatalog, parseWorkBuddyAuth, prepareChatBody, prepareInternationalChatBody, probeModel, processStartTimeMs, randomSentinel, readBundleVersion, readCliVersion, readHostHeartbeat, regionOf, resolveAppVersion, resolveChatIdentity, validAppVersion, validCliVersion, variantFor, visibilityAccountOf, workbuddyCatalogPath, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, workbuddyProbePath, workbuddyVisibilityPath };
+export { AI_VARIANT, type AppVersionInfo, CN_APP_VERSION_FILENAME, CN_VARIANT, type ChatIdentity, Config, FALLBACK_CN_APP_VERSION, FALLBACK_WORKBUDDY_AI_MODELS, FALLBACK_WORKBUDDY_MODELS, PROBE_EFFORT_CANDIDATES, type ProbeAttempt, type ProbeOutcome, type ProbeSender, type ResolveChatIdentityOptions, type UpstreamErrorKind, WORKBUDDY_AI_SETTINGS_NS, WORKBUDDY_APP_VERSION_FILENAME, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CATALOG_FILENAME, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_PROBE_FILENAME, WORKBUDDY_PROVIDER, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_VARIANTS, WORKBUDDY_VISIBILITY_FILENAME, type WorkBuddyAdapter, type WorkBuddyAppVersionSource, type WorkBuddyAuthStatus, WorkBuddyCatalog, type WorkBuddyCatalogFetch, WorkBuddyCatalogStore, type WorkBuddyChatResult, type WorkBuddyCredential, WorkBuddyCredentialStore, type WorkBuddyCredits, type WorkBuddyEffort, type WorkBuddyHostHeartbeat, type WorkBuddyModelBilling, type WorkBuddyModelInfo, type WorkBuddyModelReasoning, type WorkBuddyProbeRecord, WorkBuddyProbeService, type WorkBuddyProbeStatus, WorkBuddyProbeStore, type WorkBuddyProbeValidation, type WorkBuddyPromotion, type WorkBuddyRefreshOutcome, type WorkBuddyShim, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyVariant, WorkBuddyVisibilityStore, appUserAgent, apply, chatUserAgent, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthPath, desktopAuthCandidatesFor, fallbackChatIdentity, fingerprintModel, inject, installedAppVersion, isHeartbeatProcessAlive, modelWithCurrentPromotion, name, normalizeCredits, parseModelCatalog, parseWorkBuddyAuth, prepareChatBody, prepareCnChatBody, prepareInternationalChatBody, probeModel, processStartTimeMs, randomSentinel, readBundleVersion, readCliVersion, readHostHeartbeat, regionOf, resolveAppVersion, resolveChatIdentity, validAppVersion, validCliVersion, variantFor, visibilityAccountOf, workbuddyCatalogPath, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, workbuddyProbePath, workbuddyVisibilityPath };