dsh-workbuddy-xdpool 1.7.2 → 1.7.4

package/lib/index.js

@@ -12,6 +12,39 @@ import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
 //#region src/upstream.ts
+/**
+* Backoff between catalog-fetch attempts.
+*
+* Three retries after the first try, so a startup network hiccup does not cost
+* the user their model list for the whole session. The window covers the case
+* that actually bit: several independent components reported `fetch failed`
+* within the same second while the machine was still bringing its network up,
+* and the very next request succeeded 0.7s later.
+*
+* Deliberately short and bounded. This runs during plugin startup, so a long
+* ladder would delay the provider appearing at all; the total added latency
+* here is ~12s in the worst case, and only when the network is genuinely down.
+*/
+const CATALOG_RETRY_BACKOFF_MS = [
+	1e3,
+	3e3,
+	8e3
+];
+/**
+* Sleep helper for the retry ladder.
+*
+* Deliberately NOT unref'd. An unref'd timer does not keep the event loop
+* alive, so awaiting one can hang forever when nothing else is pending — the
+* retry would simply never resume. That is exactly what the first version of
+* this did, and it wedged the very first end-to-end run: `fetchModels` never
+* settled. The wait is at most a few seconds and only happens on failure, so
+* holding the loop open is the correct trade.
+*/
+function delay(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms);
+	});
+}
 /** CN chat base per dingminhua's on-machine probe (HTTP 200 for chat/models). */
 const CN_CHAT_BASE = "https://copilot.tencent.com";
 /** Billing/console base — `www.codebuddy.cn` is the billing origin. */
@@ -33,6 +66,13 @@ const MODELS_CATALOG_PATH = "/v2/enterprises/personal/models";
 const GLOBAL_CONFIG_PATH = "/v3/config";
 const JSON_TIMEOUT_MS = 3e4;
 const ERROR_BODY_LIMIT = 4096;
+/** True for a request the CALLER aborted, which must never be retried. */
+function isAbortError(error) {
+	if (typeof error !== "object" || error === null) return false;
+	if (error.name === "AbortError") return true;
+	const cause = error.cause;
+	return typeof cause === "object" && cause !== null && cause.name === "AbortError";
+}
 /** Cap on the reassembled compaction reply, guarding against a runaway stream. */
 const COMPLETION_TEXT_LIMIT = 65536;
 /** Insufficient-credit markers, ASCII lowercase plus the original Chinese. */
@@ -745,9 +785,20 @@ function parseTask(value) {
 var WorkBuddyUpstreamClient = class {
 	fetchImpl;
 	clientVersion;
+	/** Backoff ladder for `fetchModels`; empty means a single attempt. */
+	catalogRetryBackoffMs;
+	/**
+	* Optional logger for retry notices.
+	*
+	* Set by the host so a retry is visible in the log with its attempt count —
+	* without it, a retry that eventually succeeds is invisible, and an operator
+	* debugging "why was the catalog slow" has nothing to look at.
+	*/
+	logger;
 	constructor(options = {}) {
 		this.fetchImpl = options.fetchImpl ?? globalThis.fetch;
 		this.clientVersion = options.clientVersion ?? "2.0.4";
+		this.catalogRetryBackoffMs = options.catalogRetryBackoffMs ?? CATALOG_RETRY_BACKOFF_MS;
 	}
 	/**
 	* Normalize an OpenAI chat-completions body for the WorkBuddy upstream:
@@ -904,6 +955,30 @@ var WorkBuddyUpstreamClient = class {
 	* below is common to the two branches.
 	*/
 	async fetchModels(credential, signal) {
+		const attempts = this.catalogRetryBackoffMs.length + 1;
+		let lastError;
+		for (let attempt = 0; attempt < attempts; attempt += 1) try {
+			return await this.fetchModelsOnce(credential, signal);
+		} catch (error) {
+			lastError = error;
+			if (isAbortError(error)) throw error;
+			const wait = this.catalogRetryBackoffMs[attempt];
+			if (wait === void 0) break;
+			this.logger?.warn?.(`dsh-workbuddy-xdpool: model catalog fetch failed (attempt ${attempt + 1}/${attempts}), retrying in ${wait}ms`, error);
+			await delay(wait);
+		}
+		throw lastError;
+	}
+	/**
+	* One catalog attempt, without retries.
+	*
+	* Split out so {@link fetchModels} can retry it: the failure this guards
+	* against is a startup network hiccup, where several independent components
+	* see `fetch failed` inside the same second and the very next request
+	* succeeds — exactly the case a single attempt turns into "the user's model
+	* list is missing half its entries for the rest of the session".
+	*/
+	async fetchModelsOnce(credential, signal) {
 		const global = regionOf(credential.domain) === "global";
 		const url = global ? `${globalBase(credential)}${GLOBAL_CONFIG_PATH}` : `${chatBase(credential)}${MODELS_CATALOG_PATH}`;
 		const headers = global ? {
@@ -1922,42 +1997,155 @@ function macosBundleExecutable(bundle) {
 	return join(bundle, "Contents", "MacOS", name);
 }
 /**
+* Encodings a Windows console child process may emit in, most likely first.
+*
+* `reg.exe` writes with the ACTIVE CODE PAGE, never UTF-8: a Chinese Windows
+* (code page 936) returns a path containing 「腾讯」 as GBK bytes. Decoding
+* those as UTF-8 mangles them into `��Ѷ`, every `existsSync` then fails, and the
+* plugin concludes no desktop app is installed while one is running fine.
+*
+* The list is ordered and each entry is TRIED rather than guessed: the first
+* decoding that yields usable text wins, and the decision is validated against
+* the filesystem rather than by sniffing bytes.
+*/
+const WINDOWS_CONSOLE_ENCODINGS = [
+	"utf-8",
+	"gbk",
+	"big5",
+	"shift_jis",
+	"euc-kr",
+	"windows-1252"
+];
+/**
+* Decode bytes from a Windows console child process.
+*
+* `accept` decides whether a decoding is usable — the callers pass "this text
+* contains a path that actually exists". Bytes that are already UTF-8 pass on
+* the first attempt, so the healthy case pays nothing.
+*/
+function decodeWindowsConsole(buf, accept) {
+	for (const label of WINDOWS_CONSOLE_ENCODINGS) {
+		let text;
+		try {
+			text = new TextDecoder(label, { fatal: false }).decode(buf);
+		} catch {
+			continue;
+		}
+		if (accept(text)) return text;
+	}
+	return new TextDecoder("utf-8", { fatal: false }).decode(buf);
+}
+/** Strip the `"<path>",<index>` decoration DisplayIcon carries. */
+function cleanIconPath(raw) {
+	return raw.replace(/^"/u, "").replace(/",-?\d+$/u, "").replace(/,-?\d+$/u, "").trim();
+}
+/** Registry locations the installer records its own product under. */
+const UNINSTALL_KEY_ROOTS = [
+	"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+	"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+	"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
+];
+/**
 * Windows install locations recorded by the app's own uninstaller.
 *
 * The registry is the authoritative answer: it survives a non-default drive, a
 * renamed folder and a differently-named executable, none of which any fixed
 * path list can predict. Real machines put the app at `D:\workbuddy\WorkBuddy.exe`
-* and `D:\workbuddyai\WorkBuddyAI.exe` — exactly the layouts a
-* `%ProgramFiles%\WorkBuddy\WorkBuddy.exe` probe cannot see, which is why the
-* plugin reported "the desktop app could not provide the key" for an app that was
-* installed and running.
+* and `D:\ruanjian\anzhuang\腾讯\WorkBuddy\WorkBuddy.exe` — layouts a
+* `%ProgramFiles%\WorkBuddy\WorkBuddy.exe` probe cannot see.
 *
 * `DisplayIcon` is the field that actually carries the path (observed as
 * `D:\workbuddy\WorkBuddy.exe,0`); `InstallLocation` is usually empty for these
 * installers, so both are read and either may contribute.
 *
+* Two readers, because neither alone is enough:
+*
+*  - **PowerShell first.** `Get-ItemProperty` talks to the registry API, so no
+*    console code page is involved and non-ASCII paths come back intact. This
+*    is the encoding-proof path.
+*  - **`reg.exe` as a fallback**, for a machine where PowerShell is unavailable
+*    (locked-down or stripped images). Its raw bytes are decoded through
+*    {@link decodeWindowsConsole}, which is what the original code got wrong.
+*
 * Returns [] on any failure — a missing registry key is the normal case on
 * non-Windows, not an error.
 */
 function windowsRegistryAppPaths() {
 	if (process.platform !== "win32") return [];
-	const roots = [
-		["HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
-		["HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
-		["HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"]
-	];
+	const viaPowerShell = windowsRegistryAppPathsViaPowerShell();
+	if (viaPowerShell.length > 0) return viaPowerShell;
+	return windowsRegistryAppPathsViaReg();
+}
+/**
+* Registry read through PowerShell, immune to the console code page.
+*
+* `[Console]::OutputEncoding` is set to UTF-8 so the bytes Node receives are
+* UTF-8 regardless of the machine's code page. Values are printed one per line
+* and matched by the caller, so a Chinese path survives the round trip.
+*
+* Best-effort: any failure (no PowerShell, no keys, a policy restriction)
+* returns [], and the `reg.exe` reader takes over.
+*/
+function windowsRegistryAppPathsViaPowerShell() {
+	const script = [
+		"$ErrorActionPreference='SilentlyContinue'",
+		"try { [Console]::OutputEncoding=[System.Text.Encoding]::UTF8 } catch {}",
+		"$roots=@('HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*')",
+		"foreach($r in $roots){",
+		"  Get-ItemProperty -Path $r | ForEach-Object {",
+		"    $dn=[string]$_.DisplayName; $di=[string]$_.DisplayIcon; $il=[string]$_.InstallLocation",
+		"    if($dn -match 'WorkBuddy|CodeBuddy' -or $di -match 'WorkBuddy|CodeBuddy'){",
+		"      if($di -ne ''){ Write-Output $di }",
+		"      if($il -ne ''){ Write-Output $il }",
+		"    }",
+		"  }",
+		"}"
+	].join("\n");
+	let stdout;
+	try {
+		stdout = execFileSync("powershell", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-ExecutionPolicy",
+			"Bypass",
+			"-Command",
+			script
+		], {
+			encoding: "utf8",
+			timeout: 2e4,
+			windowsHide: true,
+			maxBuffer: 8388608
+		});
+	} catch {
+		return [];
+	}
 	const out = [];
-	for (const [root] of roots) {
-		let listing;
+	for (const line of stdout.split(/\r?\n/u)) {
+		const cleaned = cleanIconPath(line.trim());
+		if (cleaned !== "") out.push(cleaned);
+	}
+	return out;
+}
+/**
+* Registry read through `reg.exe`, with console-code-page detection.
+*
+* Kept as the fallback for machines without PowerShell. The decode step is the
+* fix: the output is captured as BYTES and decoded with whichever encoding
+* yields a path that exists, instead of assuming UTF-8 and quietly producing
+* mojibake that no existence check can ever match.
+*/
+function windowsRegistryAppPathsViaReg() {
+	const out = [];
+	for (const root of UNINSTALL_KEY_ROOTS) {
+		let listingBuf;
 		try {
-			listing = execFileSync("reg", [
+			listingBuf = execFileSync("reg", [
 				"query",
 				root,
 				"/s",
 				"/v",
 				"DisplayName"
 			], {
-				encoding: "utf8",
 				timeout: 1e4,
 				windowsHide: true,
 				maxBuffer: 8388608
@@ -1965,26 +2153,35 @@ function windowsRegistryAppPaths() {
 		} catch {
 			continue;
 		}
-		const keys = listing.split(/\r?\n(?=HKEY_)/u).filter((block) => /WorkBuddy|CodeBuddy/iu.test(block));
+		const keys = decodeWindowsConsole(listingBuf, (text) => /WorkBuddy|CodeBuddy/iu.test(text)).split(/\r?\n(?=HKEY_)/u).filter((block) => /WorkBuddy|CodeBuddy/iu.test(block));
 		for (const key of keys) {
 			const keyPath = /^(HKEY_[^\r\n]+)/u.exec(key)?.[1]?.trim();
 			if (keyPath === void 0) continue;
-			for (const name of ["DisplayIcon", "InstallLocation"]) try {
-				const value = execFileSync("reg", [
-					"query",
-					keyPath,
-					"/v",
-					name
-				], {
-					encoding: "utf8",
-					timeout: 5e3,
-					windowsHide: true
+			for (const name of ["DisplayIcon", "InstallLocation"]) {
+				let valueBuf;
+				try {
+					valueBuf = execFileSync("reg", [
+						"query",
+						keyPath,
+						"/v",
+						name
+					], {
+						timeout: 5e3,
+						windowsHide: true
+					});
+				} catch {
+					continue;
+				}
+				const value = decodeWindowsConsole(valueBuf, (text) => {
+					const candidate = /REG_(?:SZ|EXPAND_SZ)\s+(.+)$/mu.exec(text)?.[1]?.trim();
+					if (candidate === void 0) return false;
+					const path = cleanIconPath(candidate);
+					return path !== "" && existsSync(path);
 				});
 				const raw = /REG_(?:SZ|EXPAND_SZ)\s+(.+)$/mu.exec(value)?.[1]?.trim();
 				if (raw === void 0 || raw === "") continue;
-				const cleaned = raw.replace(/^"/u, "").replace(/",-?\d+$/u, "").replace(/,-?\d+$/u, "").trim();
-				out.push(cleaned);
-			} catch {}
+				out.push(cleanIconPath(raw));
+			}
 		}
 	}
 	return out;
@@ -2253,7 +2450,7 @@ const ENCRYPTED_CREDENTIAL_CODE = "ENCRYPTED_CREDENTIAL";
 var WorkBuddyEncryptedCredentialError = class extends Error {
 	code = ENCRYPTED_CREDENTIAL_CODE;
 	constructor(sourcePath) {
-		super(`workbuddy: ${sourcePath} holds encrypted credentials, but no WorkBuddy desktop app could be located to provide the key. If the app IS installed, it is simply outside the paths this plugin probes — set WORKBUDDY_APP_EXECUTABLE to its full .exe path (then restart DSH) and the credential will open. Signing in again will not help: the credential itself is intact. Run \`dsh-workbuddy-xdpool doctor\` to see which paths were probed.`);
+		super(`workbuddy: ${sourcePath} holds encrypted credentials, but no WorkBuddy desktop app could be located to provide the key. If the app IS installed, it is simply outside the paths this plugin probes — set WORKBUDDY_APP_EXECUTABLE to its full .exe path (then restart DSH) and the credential will open. Signing in again will not help: the credential itself is intact. Run \`dsh-workbuddy-xdpool doctor\` to see which paths were probed — if one of them looks like mojibake (e.g. "??" where a Chinese folder name should be), the registry value could not be decoded on this machine; report that line and use the override above in the meantime.`);
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
@@ -2986,38 +3183,97 @@ ${new Date(until).toISOString()}
 * Static fallback used before the first live catalog fetch, and whenever the
 * upstream cannot be reached.
 *
-* The multipliers are carried on purpose. Without them the provider's model
-* picker silently loses every rate and every free badge the moment the live
-* fetch fails — which reads to the user as "the plugin broke my model list"
-* rather than "the upstream is unreachable". The values are the ones the two
-* gateways actually advertise for these ids (`credits: "x0.79 credits"` and so
-* on), so a fallback row looks the same as a live one.
+* This table is the DOMESTIC (CN) roster, and it is kept in step with what
+* `copilot.tencent.com` actually advertises. It matters more than a "just in
+* case" list usually would: a failed startup fetch falls back to it, and the
+* user sees that as "half my models were deleted" — `deepseek-v4.1-flash`
+* and friends simply vanishing from the picker, with no visible explanation.
+*
+* Every row below was captured from the live endpoint, INCLUDING the window
+* sizes: the previous version carried a 32K window for `hy3` when the gateway
+* says 192K, and listed `kimi-k3` under an id the gateway no longer uses
+* (`kimi-k3-1`). A stale fallback is worse than a short one — it looks
+* authoritative while being wrong.
 *
 * `multiplier: 0` is the gateways' own spelling of "free" (`credits: "x0.00"`),
 * which is what turns on the free badge.
 */
 const FALLBACK_WORKBUDDY_MODELS = [
+	{
+		id: "auto",
+		name: "Auto",
+		contextWindow: 256e3,
+		maxOutputTokens: 32e3,
+		supportsImages: true
+	},
+	{
+		id: "hy4-preview",
+		name: "Hy4 preview",
+		contextWindow: 1e6,
+		maxOutputTokens: 64e3,
+		supportsImages: true,
+		multiplier: .29
+	},
+	{
+		id: "hy3",
+		name: "Hy3",
+		contextWindow: 192e3,
+		maxOutputTokens: 64e3,
+		supportsImages: true,
+		multiplier: 0
+	},
+	{
+		id: "hy3-x",
+		name: "Hy3",
+		contextWindow: 192e3,
+		maxOutputTokens: 64e3,
+		supportsImages: true,
+		multiplier: .05
+	},
+	{
+		id: "deepseek-v4.1-flash",
+		name: "Deepseek-V4.1-Flash",
+		contextWindow: 1e6,
+		maxOutputTokens: 128e3,
+		supportsImages: true,
+		multiplier: .11
+	},
+	{
+		id: "deepseek-v4-pro",
+		name: "Deepseek-V4-Pro",
+		contextWindow: 1e6,
+		maxOutputTokens: 128e3,
+		supportsImages: true,
+		multiplier: .51
+	},
+	{
+		id: "deepseek-v4-flash",
+		name: "DeepSeek-V4-Flash",
+		contextWindow: 1e6,
+		maxOutputTokens: 128e3,
+		supportsImages: true
+	},
 	{
 		id: "glm-5.3",
 		name: "GLM-5.3",
-		contextWindow: 2e5,
-		maxOutputTokens: 128e3,
+		contextWindow: 1e6,
+		maxOutputTokens: 64e3,
 		supportsImages: true,
 		multiplier: .79
 	},
 	{
 		id: "glm-5.3-flash",
 		name: "GLM-5.3-Flash",
-		contextWindow: 2e5,
-		maxOutputTokens: 128e3,
+		contextWindow: 1e6,
+		maxOutputTokens: 131072,
 		supportsImages: true,
 		multiplier: .06
 	},
 	{
 		id: "glm-5.2",
 		name: "GLM-5.2",
-		contextWindow: 2e5,
-		maxOutputTokens: 128e3,
+		contextWindow: 1e6,
+		maxOutputTokens: 64e3,
 		supportsImages: true,
 		multiplier: .79
 	},
@@ -3025,53 +3281,57 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		id: "glm-5.1",
 		name: "GLM-5.1",
 		contextWindow: 2e5,
-		maxOutputTokens: 128e3,
-		supportsImages: false
-	},
-	{
-		id: "deepseek-v4-pro",
-		name: "DeepSeek-V4-Pro",
-		contextWindow: 2e5,
-		maxOutputTokens: 128e3,
-		supportsImages: true
+		maxOutputTokens: 48e3,
+		supportsImages: false,
+		multiplier: .79
 	},
 	{
-		id: "deepseek-v4-flash",
-		name: "DeepSeek-V4-Flash",
+		id: "glm-5v-turbo",
+		name: "GLM-5v-Turbo",
 		contextWindow: 2e5,
-		maxOutputTokens: 128e3,
-		supportsImages: true
+		maxOutputTokens: 64e3,
+		supportsImages: true,
+		multiplier: .71
 	},
 	{
-		id: "kimi-k3",
+		id: "kimi-k3-1",
 		name: "Kimi-K3",
-		contextWindow: 2e5,
-		maxOutputTokens: 128e3,
+		contextWindow: 1e6,
+		maxOutputTokens: 32e3,
 		supportsImages: true,
 		multiplier: 1.62
 	},
 	{
-		id: "minimax-m3",
-		name: "MiniMax-M3",
-		contextWindow: 2e5,
-		maxOutputTokens: 128e3,
-		supportsImages: true
+		id: "kimi-k2.8-preview",
+		name: "Kimi-K2.8-Preview",
+		contextWindow: 1e6,
+		maxOutputTokens: 64e3,
+		supportsImages: true,
+		multiplier: .77
 	},
 	{
-		id: "hy3",
-		name: "Hy3",
-		contextWindow: 32e3,
-		maxOutputTokens: 8e3,
+		id: "kimi-k2.7",
+		name: "Kimi-K2.7-Code",
+		contextWindow: 256e3,
+		maxOutputTokens: 32e3,
 		supportsImages: true,
-		multiplier: 0
+		multiplier: .57
 	},
 	{
-		id: "hy4-preview",
-		name: "Hy4-Preview",
-		contextWindow: 1e6,
-		maxOutputTokens: 128e3,
+		id: "kimi-k2.6",
+		name: "Kimi-K2.6",
+		contextWindow: 256e3,
+		maxOutputTokens: 32e3,
 		supportsImages: true,
-		multiplier: .29
+		multiplier: .52
+	},
+	{
+		id: "minimax-m3",
+		name: "MiniMax-M3",
+		contextWindow: 512e3,
+		maxOutputTokens: 64e3,
+		supportsImages: true,
+		multiplier: .25
 	}
 ];
 /** Live catalog with a static fallback behind it. */
@@ -3080,6 +3340,19 @@ var WorkBuddyCatalog = class {
 	listeners = /* @__PURE__ */ new Set();
 	/** User's model selection. Empty object = follow the catalog unfiltered. */
 	selection = {};
+	/**
+	* Whether `models` came from the gateway or from the static table.
+	*
+	* Tracked so the card can SAY which it is showing. A failed fetch used to be
+	* invisible on screen: the picker simply held fewer models than before, which
+	* the user reasonably read as "the plugin deleted my models" rather than "the
+	* network hiccuped at startup".
+	*/
+	source = "fallback";
+	/** When the live list last landed. */
+	lastUpdatedAt;
+	/** Why the last fetch failed, for display. */
+	lastError;
 	current() {
 		return this.models;
 	}
@@ -3114,6 +3387,7 @@ var WorkBuddyCatalog = class {
 	/** Restore the static fallback, e.g. when the upstream stops answering. */
 	reset() {
 		this.models = FALLBACK_WORKBUDDY_MODELS;
+		this.source = "fallback";
 		this.notify();
 	}
 	/** Replace the user's selection; the adapter rebuilds from `visible()`. */
@@ -3125,6 +3399,31 @@ var WorkBuddyCatalog = class {
 	currentSelection() {
 		return this.selection;
 	}
+	/**
+	* Whether this catalog is serving live data or the built-in table.
+	*
+	* `fallback` is not an error state, but it IS a degraded one: the user is
+	* looking at a shorter roster than the gateway offers, so the card says so
+	* and offers a retry instead of letting them wonder where the models went.
+	*/
+	currentSource() {
+		return this.source;
+	}
+	/**
+	* When the live list last landed, if it ever did.
+	*
+	* Named `catalogUpdatedAt()` rather than `updatedAt()` because the class
+	* already had an `updatedAt` member; two members of the same name is a
+	* compile error, and the awkwardness is a useful signal that the concept is
+	* "when THIS catalog was refreshed", not a generic timestamp.
+	*/
+	catalogUpdatedAt() {
+		return this.lastUpdatedAt;
+	}
+	/** Why the last fetch failed, if it did. */
+	lastFetchError() {
+		return this.lastError;
+	}
 	onChange(listener) {
 		this.listeners.add(listener);
 		return () => this.listeners.delete(listener);
@@ -3135,6 +3434,20 @@ var WorkBuddyCatalog = class {
 	/** Replace the catalog from the live upstream list; keeps the fallback if empty. */
 	updateFromUpstream(models) {
 		this.update(catalogFromUpstream(models));
+		this.source = "live";
+		this.lastUpdatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		this.lastError = void 0;
+	}
+	/**
+	* Record that a fetch attempt failed, leaving the current list in place.
+	*
+	* The list is deliberately NOT reset here: a refresh that fails should keep
+	* whatever working catalog is already loaded, rather than demoting a healthy
+	* session to the static table because one retry ran out.
+	*/
+	noteFetchFailure(message) {
+		this.lastError = message;
+		this.notify();
 	}
 	notify() {
 		for (const listener of this.listeners) listener();
@@ -3778,6 +4091,16 @@ function expertChatEvents(expert, conversationId, requestId) {
 const POOL_STATUS_PATH = "/plugins/dsh-workbuddy-xdpool/status";
 /** Plugin-owned local account rescan endpoint (re-read desktop snapshots). */
 const POOL_RESCAN_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/rescan";
+/**
+* Re-fetch the upstream model catalog for both regions.
+*
+* Separate from {@link POOL_RESCAN_PATH} because they answer different
+* questions, and conflating them misled users: "detect accounts again" only
+* re-read the desktop snapshots, so it could NOT recover a model list that had
+* fallen back to the static table after a failed startup fetch. The only way
+* out was restarting DSH.
+*/
+const POOL_CATALOG_REFRESH_PATH = "/plugins/dsh-workbuddy-xdpool/models/refresh";
 /** Plugin-owned cooldown reset endpoint (clear all 429 cooldowns). */
 const POOL_RESET_COOLDOWN_PATH = "/plugins/dsh-workbuddy-xdpool/cooldowns/reset";
 /** Plugin-owned daily check-in action endpoint (claim today's reward). */
@@ -5949,7 +6272,10 @@ async function poolWebStatus(deps, region = "cn") {
 		shim,
 		automation,
 		creditReserves: deps.pool.creditReservesInOrder(),
-		ignored: deps.ignoredAccounts?.() ?? []
+		ignored: deps.ignoredAccounts?.() ?? [],
+		catalogSource: deps.catalogs[region].currentSource(),
+		...deps.catalogs[region].catalogUpdatedAt() === void 0 ? {} : { catalogUpdatedAt: deps.catalogs[region].catalogUpdatedAt() },
+		...deps.catalogs[region].lastFetchError() === void 0 ? {} : { catalogError: safeMessage(deps.catalogs[region].lastFetchError()) }
 	};
 }
 /**
@@ -5972,6 +6298,35 @@ function registerPoolStatusRoute(ctx, deps) {
 				}
 			}
 		});
+		/**
+		* Re-fetch the upstream model catalog.
+		*
+		* Its own route, distinct from the account rescan, because that is the
+		* distinction users were missing: a model list that had fallen back to the
+		* static table could not be recovered from the card AT ALL — "detect
+		* accounts again" only re-read the desktop snapshots, so the only way back
+		* to the full roster was restarting DSH.
+		*
+		* POST only, loopback origin only. Returns the resulting roster size per
+		* region so the card can confirm the refresh actually changed something.
+		*/
+		const disposeCatalogRefresh = ctx.webServer.register({
+			kind: "exact",
+			path: POOL_CATALOG_REFRESH_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (deps.refreshCatalog === void 0) return json(res, 503, { error: "catalog refresh is not available in this build" });
+				try {
+					json(res, 200, {
+						ok: true,
+						...await deps.refreshCatalog()
+					});
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
 		const disposeRescan = ctx.webServer.register({
 			kind: "exact",
 			path: POOL_RESCAN_PATH,
@@ -6169,6 +6524,7 @@ function registerPoolStatusRoute(ctx, deps) {
 			disposeAutomationRun();
 			disposeCreditReserve();
 			disposeAccountIgnore();
+			disposeCatalogRefresh();
 			disposeCheckin();
 			disposeAccountDisable();
 			disposeModelsSave();
@@ -6537,6 +6893,51 @@ function apply(ctx, config = {}) {
 		core.pool.applyIgnored(ignoredAccounts.map((entry) => entry.id));
 	};
 	/**
+	* Fetch and install the model catalog for both regions.
+	*
+	* Each region is isolated AND independently retried: they are separate
+	* gateways on separate hosts, so one being unreachable must not degrade the
+	* other. The failure this exists for is a startup network hiccup — several
+	* components reporting `fetch failed` inside the same second, with the next
+	* request succeeding 0.7s later — which used to cost the user their model
+	* list for the whole session, with no way back short of a DSH restart.
+	*
+	* Returns what each region ended up with, so the card can confirm a manual
+	* refresh actually changed something.
+	*/
+	const seedCatalog = async () => {
+		const accounts = await core.pool.scan();
+		const regions = {};
+		for (const region of ["cn", "global"]) try {
+			const credential = accounts.find((account) => regionOf(account.credential.domain) === region)?.credential;
+			if (credential === void 0) {
+				ctx.logger.info?.(`dsh-workbuddy-xdpool: no ${region} account yet; keeping the static ${region} catalog`);
+				regions[region] = {
+					source: "fallback",
+					models: core.catalogs[region].current().length
+				};
+				continue;
+			}
+			const models = await core.client.fetchModels(credential);
+			core.catalogs[region].updateFromUpstream(models);
+			ctx.logger.info?.(`dsh-workbuddy-xdpool: ${region} catalog seeded with ${models.length} model(s)`);
+			regions[region] = {
+				source: "live",
+				models: models.length
+			};
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			core.catalogs[region].noteFetchFailure(message);
+			ctx.logger.warn(`dsh-workbuddy-xdpool: ${region} model catalog unavailable; using static fallback`, error);
+			regions[region] = {
+				source: core.catalogs[region].currentSource(),
+				models: core.catalogs[region].current().length,
+				error: message
+			};
+		}
+		return { regions };
+	};
+	/**
 	* Invalidate the provider snapshot so the picker re-reads the catalog.
 	*
 	* Seeded with a no-op and reassigned once the adapters exist. The settings
@@ -6741,7 +7142,12 @@ function apply(ctx, config = {}) {
 			refreshIgnored();
 			if (!ignored) await core.pool.scan();
 		},
-		ignoredAccounts: () => ignoredAccounts
+		ignoredAccounts: () => ignoredAccounts,
+		refreshCatalog: async () => {
+			const result = await seedCatalog();
+			invalidateCatalog();
+			return result;
+		}
 	}));
 	api = {
 		...core,
@@ -6752,6 +7158,8 @@ function apply(ctx, config = {}) {
 		async rescan() {
 			const accounts = await core.pool.scan();
 			ctx.logger.info?.(`dsh-workbuddy-xdpool: discovered ${accounts.length} account(s)`);
+			await seedCatalog();
+			invalidateCatalog();
 			return accounts.length;
 		},
 		async status(includeCredits = false) {
@@ -6852,19 +7260,7 @@ function apply(ctx, config = {}) {
 			ctx.logger.warn("dsh-workbuddy-xdpool: account discovery failed", error);
 		});
 		(async () => {
-			const accounts = await core.pool.scan();
-			for (const region of ["cn", "global"]) try {
-				const credential = accounts.find((account) => regionOf(account.credential.domain) === region)?.credential;
-				if (credential === void 0) {
-					ctx.logger.info?.(`dsh-workbuddy-xdpool: no ${region} account yet; keeping the static ${region} catalog`);
-					continue;
-				}
-				const models = await core.client.fetchModels(credential);
-				core.catalogs[region].updateFromUpstream(models);
-				ctx.logger.info?.(`dsh-workbuddy-xdpool: ${region} catalog seeded with ${models.length} model(s)`);
-			} catch (error) {
-				ctx.logger.warn(`dsh-workbuddy-xdpool: ${region} model catalog unavailable; using static fallback`, error);
-			}
+			await seedCatalog();
 			invalidateCatalog();
 		})().catch((error) => {
 			ctx.logger.warn("dsh-workbuddy-xdpool: account catalog seed failed", error);