@huai_xin/dsh-workbuddy 0.1.16 → 0.1.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huai_xin/dsh-workbuddy",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "WorkBuddy model provider for DeepSeek Harness (international + China deployments)",
   "type": "module",
   "main": "./src/index.js",
@@ -22,7 +22,7 @@
     "README.md"
   ],
   "scripts": {
-    "test": "node test/unit/plugin.mjs && node test/unit/api.mjs && node test/unit/client.mjs && node test/unit/region-order.mjs && node test/unit/catalog.mjs && node test/unit/catalog-cache.mjs && node test/unit/official-list.mjs && node test/unit/model-prefs.mjs && node test/unit/availability.mjs && node test/unit/adapter.mjs",
+    "test": "node test/unit/plugin.mjs && node test/unit/api.mjs && node test/unit/client.mjs && node test/unit/region-order.mjs && node test/unit/catalog.mjs && node test/unit/catalog-cache.mjs && node test/unit/official-list.mjs && node test/unit/model-prefs.mjs && node test/unit/availability.mjs && node test/unit/auth.mjs && node test/unit/adapter.mjs",
     "smoke": "node test/live/smoke.mjs"
   },
   "keywords": [

package/src/adapter.js

@@ -18,7 +18,7 @@ import { writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
-import { readToken, refreshRegion } from './auth.js'
+import { accountIdOf, readToken, refreshRegion } from './auth.js'
 import { unusableModelIds, readAvailability, writeAvailability } from './availability.js'
 import { fetchModelEntries } from './catalog.js'
 import { readCatalogCache, writeCatalogCache } from './catalog-cache.js'
@@ -409,6 +409,9 @@ export class WorkBuddyAdapter {
    * `resolveModel` still answers for ids the session already knows.
    */
   async models() {
+    // Remember which account these verdicts belong to: the ledger and the imported
+    // list are per-account, the catalog itself is shared.
+    this.accountId = await accountIdOf(this.ctx, this.region)
     const fresh = this.catalog !== undefined && Date.now() - this.catalogAt < CATALOG_TTL_MS
     if (fresh) return this.catalog
     let loaded
@@ -419,7 +422,7 @@ export class WorkBuddyAdapter {
     }
     // An imported account list wins over whatever the sources claim: it is the
     // one thing that reflects what this account may actually pick.
-    const imported = readOfficialList(this.region.id)
+    const imported = readOfficialList(this.region.id, this.accountId)
     if (loaded.entries.length > 0) {
       const applied = applyOfficialList(loaded.entries, imported)
       this.catalog = applied.entries
@@ -474,7 +477,7 @@ export class WorkBuddyAdapter {
    * model id. The panel groups by these; the picker hides `dead` ones.
    */
   availability() {
-    return readAvailability(this.region.id).models
+    return readAvailability(this.region.id, this.accountId).models
   }
 
   /**
@@ -487,7 +490,7 @@ export class WorkBuddyAdapter {
   rememberUnusable(model, code, detail) {
     const text = String(detail)
     if (/11102|service info not found/i.test(text)) {
-      writeAvailability(this.region.id, [{ id: model, state: 'dead', detail: '模型不存在（11102 service info not found）', at: Date.now() }])
+      writeAvailability(this.region.id, [{ id: model, state: 'dead', detail: '模型不存在（11102 service info not found）', at: Date.now() }], this.accountId)
       this.invalidateCatalog()
       // The verdict feeds the default on/off state, so the picker has to re-read.
       notifyModelTopology(this.ctx)
@@ -495,7 +498,7 @@ export class WorkBuddyAdapter {
     }
     if (/11158|is not allowed for user type/i.test(text)) {
       const type = /user type \[([^\]]{0,40})\]/i.exec(text)?.[1] ?? ''
-      writeAvailability(this.region.id, [{ id: model, state: 'denied', detail: `账号无权限（11158${type.length > 0 ? `，用户类型 ${type}` : ''}）`, at: Date.now() }])
+      writeAvailability(this.region.id, [{ id: model, state: 'denied', detail: `账号无权限（11158${type.length > 0 ? `，用户类型 ${type}` : ''}）`, at: Date.now() }], this.accountId)
       this.invalidateCatalog()
       notifyModelTopology(this.ctx)
     }

package/src/api.js

@@ -14,7 +14,7 @@ import { readFileSync, statSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { fileURLToPath } from 'node:url'
 
-import { beginLogin, pendingLogins, readMeta, readToken, refreshRegion, regionStatus } from './auth.js'
+import { accountIdOf, beginLogin, logoutRegion, pendingLogins, readMeta, readToken, refreshRegion, regionStatus } from './auth.js'
 import { invalidateBusy, fetchBusyLevels } from './busy.js'
 import { SWEEP_MIN_INTERVAL_MS, availabilitySummary, readAvailability, runSweep, sweepDue, unusableModelIds } from './availability.js'
 import { claimDailyCheckin, fetchCheckinStatus, fetchCredits } from './credits.js'
@@ -239,8 +239,9 @@ export function registerWorkbuddyApi(ctx, adapters, options = {}) {
             notifyModelTopology(ctx)
           }
           const models = await adapter.models()
-          const ledger = readAvailability(region.id)
-          const imported = readOfficialList(region.id)
+          const account = await accountIdOf(ctx, region)
+  const ledger = readAvailability(region.id, account)
+          const imported = readOfficialList(region.id, account)
           const prefs = readPrefs(region.id)
           const dead = unusableModelIds(region.id)
           sendJson(res, 200, {
@@ -463,7 +464,7 @@ export function registerWorkbuddyApi(ctx, adapters, options = {}) {
         }
         const adapter = adapters[region.id]
         if (method === 'GET') {
-          const list = readOfficialList(region.id)
+          const list = readOfficialList(region.id, await accountIdOf(ctx, region))
           sendJson(res, 200, {
             region: region.id,
             ids: list?.ids ?? [],
@@ -483,7 +484,7 @@ export function registerWorkbuddyApi(ctx, adapters, options = {}) {
             return
           }
           const source = typeof body.from === 'string' && body.from.length > 0 ? body.from : 'web-session'
-          const result = writeOfficialList(region.id, body.models, { from: source })
+          const result = writeOfficialList(region.id, body.models, { from: source, account: await accountIdOf(ctx, region) })
           adapter?.invalidateCatalog()
           const models = adapter === undefined ? [] : await adapter.models()
           notifyModelTopology(ctx)
@@ -549,9 +550,9 @@ export function registerWorkbuddyApi(ctx, adapters, options = {}) {
           return
         }
         if (path.endsWith('/logout')) {
-          await ctx.credentials.unset(region.tokenRef)
-          await ctx.credentials.unset(region.metaRef)
+          await logoutRegion(ctx, region)
           adapters[region.id]?.invalidateCatalog()
+          notifyModelTopology(ctx)
           sendJson(res, 200, await statePayload(ctx, adapters))
           return
         }

package/src/auth.js

@@ -44,6 +44,40 @@ const CODE_TOKEN_NOT_READY = 11217
 /** One in-flight login per region, so a repeated command reports instead of forking a second flow. */
 export const pendingLogins = new Map()
 
+/**
+ * Account generations, one per region.
+ *
+ * Every asynchronous path that later writes credentials or a catalog compares the
+ * generation it started under with the current one. Logging out or switching accounts
+ * bumps it, so a slow refresh, a background login poll, or a delayed catalog response
+ * that started before the switch can no longer resurrect the previous account.
+ */
+const generations = new Map()
+
+export function authGeneration(region) {
+  return generations.get(region.id) ?? 0
+}
+
+/** Invalidate in-flight work for this region and drop any pending login. */
+export function bumpAuthGeneration(region) {
+  generations.set(region.id, authGeneration(region) + 1)
+  pendingLogins.delete(region.id)
+  return authGeneration(region)
+}
+
+/**
+ * Log out: invalidate in-flight work first, then delete the stored credentials.
+ *
+ * The order matters — a refresh that returns after the deletion would otherwise write
+ * the old account straight back, which is exactly the bug this replaces.
+ */
+export async function logoutRegion(ctx, region) {
+  bumpAuthGeneration(region)
+  await ctx.credentials.unset(region.tokenRef)
+  await ctx.credentials.unset(region.metaRef)
+  ctx.logger.info(`[workbuddy] ${region.id}: 已退出登录，凭据已删除`)
+}
+
 function authHeaders(region, extra = {}) {
   return { 'X-Domain': region.apiDomain, 'User-Agent': region.userAgent, ...extra }
 }
@@ -169,6 +203,7 @@ export async function readToken(ctx, region) {
  * Failures are logged, never thrown: a stale token must not break the plugin.
  */
 export async function refreshRegion(ctx, region, options = {}) {
+  const generation = authGeneration(region)
   const meta = await readMeta(ctx, region)
   if (meta === undefined || typeof meta.refreshToken !== 'string' || meta.refreshToken.length === 0) {
     return { refreshed: false, reason: '未登录' }
@@ -194,6 +229,12 @@ export async function refreshRegion(ctx, region, options = {}) {
   const data = responseData(json) ?? {}
   const nextAccess = readString(data, 'accessToken')
   if (nextAccess.length === 0) return { refreshed: false, reason: '续期响应为空' }
+  // Logging out or switching accounts while the refresh was in flight invalidates this
+  // result: writing it would put the old account back.
+  if (authGeneration(region) !== generation) {
+    ctx.logger.info(`[workbuddy] ${region.id}: 续期结果已过期（期间退出或切换账号），不写回`)
+    return { refreshed: false, reason: '账号已切换' }
+  }
 
   const now = Date.now()
   const nextRefresh = readString(data, 'refreshToken')
@@ -220,25 +261,62 @@ export async function beginLogin(ctx, region, options = {}) {
   const existing = pendingLogins.get(region.id)
   if (existing !== undefined) return { started: false, url: existing.url, pending: true }
 
-  const { state, authUrl } = await fetchAuthState(region)
-  const decorated = decorateAuthUrl(authUrl, region)
-  pendingLogins.set(region.id, { url: decorated, startedAt: Date.now() })
-  if (options.open !== false) openInBrowser(decorated)
+  // Claimed before the request goes out: two concurrent calls would otherwise both
+  // start a flow, and the first to fail would delete the second one's pending entry.
+  const generation = authGeneration(region)
+  pendingLogins.set(region.id, { url: '', startedAt: Date.now() })
+  let authUrl
+  let state
+  try {
+    const fetched = await fetchAuthState(region)
+    state = fetched.state
+    authUrl = decorateAuthUrl(fetched.authUrl, region)
+    pendingLogins.set(region.id, { url: authUrl, startedAt: Date.now() })
+  } catch (error) {
+    pendingLogins.delete(region.id)
+    throw error
+  }
+  if (options.open !== false) openInBrowser(authUrl)
 
   void (async () => {
     try {
       const token = await pollAuthToken(region, state)
+      if (authGeneration(region) !== generation) {
+        ctx.logger.info(`[workbuddy] ${region.id}: 登录结果已过期（期间退出或切换账号），不写回`)
+        return
+      }
       const account = await fetchAccount(region, token, state)
+      if (authGeneration(region) !== generation) {
+        ctx.logger.info(`[workbuddy] ${region.id}: 登录结果已过期（期间退出或切换账号），不写回`)
+        return
+      }
       const stored = await storeCredential(ctx, region, token, account)
       ctx.logger.info(`[workbuddy] ${region.id}: 已登录 ${stored.nickname || stored.uid || '(未知)'}`)
       await options.onSuccess?.(stored)
     } catch (error) {
       ctx.logger.warn(`[workbuddy] ${region.id}: 登录失败 — ${error instanceof Error ? error.message : String(error)}`)
     } finally {
-      pendingLogins.delete(region.id)
+      // Only clear the entry this flow created; a newer flow owns its own.
+      if (authGeneration(region) === generation) pendingLogins.delete(region.id)
     }
   })()
-  return { started: true, url: decorated, pending: false }
+  return { started: true, url: authUrl, pending: false }
+}
+
+/**
+ * A stable identity for the logged-in account.
+ *
+ * Per-account records (availability verdicts, imported model lists) use it so one
+ * account's entitlements do not leak into another's. The catalog itself stays shared:
+ * which models a deployment offers is not an account fact.
+ */
+export async function accountIdOf(ctx, region) {
+  const meta = await readMeta(ctx, region)
+  const uid = meta?.uid
+  if (typeof uid === 'string' && uid.length > 0) return uid
+  if (typeof uid === 'number') return String(uid)
+  const nickname = typeof meta?.nickname === 'string' ? meta.nickname.trim() : ''
+  return nickname.length > 0 ? `nick:${nickname}` : undefined
 }
 
 /** One-line account summary for the command and the panel. */

package/src/availability.js

@@ -32,7 +32,7 @@ import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 
-import { readToken } from './auth.js'
+import { accountIdOf, readToken } from './auth.js'
 import { chatRoutes } from './regions.js'
 
 const LEDGER_VERSION = 1
@@ -210,16 +210,19 @@ export async function probeModel(ctx, region, id, options = {}) {
 export const SWEEP_MIN_INTERVAL_MS = 24 * 3600_000
 
 /** Whether a sweep may run now; `manual` callers skip this check. */
-export function sweepDue(regionId, minIntervalMs = SWEEP_MIN_INTERVAL_MS, now = Date.now()) {
-  const last = readAvailability(regionId).lastSweepAt
+export function sweepDue(regionId, minIntervalMs = SWEEP_MIN_INTERVAL_MS, now = Date.now(), account) {
+  const last = readAvailability(regionId, account).lastSweepAt
   return { due: now - last >= minIntervalMs, lastSweepAt: last }
 }
 
 /** Probe a list of ids, a few at a time, and persist every verdict. */
 export async function runSweep(ctx, region, ids, options = {}) {
   const interval = options.minIntervalMs ?? SWEEP_MIN_INTERVAL_MS
+  // Verdicts describe one account's entitlements, so the sweep is scoped to whoever is
+  // logged in now: a new account starts from an empty ledger and gets its own probes.
+  const account = await accountIdOf(ctx, region)
   if (options.manual !== true) {
-    const due = sweepDue(region.id, interval)
+    const due = sweepDue(region.id, interval, Date.now(), account)
     if (due.due !== true) return { skipped: true, reason: 'interval', lastSweepAt: due.lastSweepAt, results: [] }
   }
   const token = await readToken(ctx, region)
@@ -236,32 +239,48 @@ export async function runSweep(ctx, region, ids, options = {}) {
     }
   }
   await Promise.all(Array.from({ length: Math.min(concurrency, ids.length) }, () => worker()))
-  if (results.length > 0) writeAvailability(region.id, results)
-  markSwept(region.id)
-  return { skipped: false, results }
+  if (results.length > 0) writeAvailability(region.id, results, account)
+  markSwept(region.id, account)
+  return { skipped: false, results, account }
 }
 
 /** @returns {{ savedAt: number, lastSweepAt: number, models: Map<string, {state: string, detail: string, at: number}> }} */
-export function readAvailability(regionId) {
+/** Read the ledger as stored (no account filtering). */
+function readLedger(regionId) {
   try {
     const parsed = JSON.parse(readFileSync(ledgerPath(regionId), 'utf8'))
     if (parsed?.version !== LEDGER_VERSION || typeof parsed.models !== 'object' || parsed.models === null) {
-      return { savedAt: 0, lastSweepAt: 0, models: new Map() }
+      return { account: undefined, savedAt: 0, lastSweepAt: 0, models: new Map() }
     }
     return {
+      account: typeof parsed.account === 'string' && parsed.account.length > 0 ? parsed.account : undefined,
       savedAt: typeof parsed.savedAt === 'number' ? parsed.savedAt : 0,
       lastSweepAt: typeof parsed.lastSweepAt === 'number' ? parsed.lastSweepAt : 0,
       models: new Map(Object.entries(parsed.models))
     }
   } catch {
+    return { account: undefined, savedAt: 0, lastSweepAt: 0, models: new Map() }
+  }
+}
+
+/**
+ * @param regionId deployment id
+ * @param account when given, a ledger recorded for another account reads as empty
+ * @returns {{ savedAt: number, lastSweepAt: number, models: Map<string, {state: string, detail: string, at: number}> }}
+ */
+export function readAvailability(regionId, account) {
+  const ledger = readLedger(regionId)
+  if (account !== undefined && ledger.account !== undefined && ledger.account !== account) {
     return { savedAt: 0, lastSweepAt: 0, models: new Map() }
   }
+  return { savedAt: ledger.savedAt, lastSweepAt: ledger.lastSweepAt, models: ledger.models }
 }
 
 function store(regionId, ledger, now) {
   mkdirSync(ledgerDir(), { recursive: true })
   writeFileSync(ledgerPath(regionId), JSON.stringify({
     version: LEDGER_VERSION,
+    ...(ledger.account === undefined ? {} : { account: ledger.account }),
     savedAt: now,
     lastSweepAt: ledger.lastSweepAt,
     models: Object.fromEntries(ledger.models)
@@ -269,10 +288,18 @@ function store(regionId, ledger, now) {
 }
 
 /** Merge verdicts by id (a fresh verdict always wins) and store them. */
-export function writeAvailability(regionId, results) {
+export function writeAvailability(regionId, results, account) {
   try {
-    const ledger = readAvailability(regionId)
+    const ledger = readLedger(regionId)
     const now = Date.now()
+    // A verdict describes one account's entitlements. Writing a different account's
+    // results into the same ledger is what made a new login inherit the previous
+    // account's `denied` marks for twelve hours, so a different account starts clean.
+    if (account !== undefined && ledger.account !== account) {
+      ledger.account = account
+      ledger.models = new Map()
+      ledger.lastSweepAt = 0
+    }
     for (const result of results) {
       if (typeof result?.id !== 'string' || result.id.length === 0) continue
       ledger.models.set(result.id, {
@@ -290,9 +317,10 @@ export function writeAvailability(regionId, results) {
 }
 
 /** Record that a full sweep just ran, which is what the daily limit reads. */
-function markSwept(regionId) {
+function markSwept(regionId, account) {
   try {
-    const ledger = readAvailability(regionId)
+    const ledger = readLedger(regionId)
+    if (account !== undefined && ledger.account !== undefined && ledger.account !== account) return false
     ledger.lastSweepAt = Date.now()
     store(regionId, ledger, Date.now())
     return true
@@ -302,9 +330,9 @@ function markSwept(regionId) {
 }
 
 /** Ids the ledger considers unusable, within the verdict's TTL. */
-export function unusableModelIds(regionId, now = Date.now()) {
+export function unusableModelIds(regionId, now = Date.now(), account) {
   const unusable = new Set()
-  for (const [id, entry] of readAvailability(regionId).models) {
+  for (const [id, entry] of readAvailability(regionId, account).models) {
     if (!UNUSABLE_STATES.has(entry?.state)) continue
     if (typeof entry.at !== 'number' || now - entry.at > AVAILABILITY_TTL_MS) continue
     unusable.add(id)
@@ -313,9 +341,9 @@ export function unusableModelIds(regionId, now = Date.now()) {
 }
 
 /** Kept for callers that only care about delisted models. */
-export function deadModelIds(regionId, now = Date.now()) {
+export function deadModelIds(regionId, now = Date.now(), account) {
   const dead = new Set()
-  for (const [id, entry] of readAvailability(regionId).models) {
+  for (const [id, entry] of readAvailability(regionId, account).models) {
     if (entry?.state !== 'dead') continue
     if (typeof entry.at !== 'number' || now - entry.at > AVAILABILITY_TTL_MS) continue
     dead.add(id)
@@ -324,8 +352,8 @@ export function deadModelIds(regionId, now = Date.now()) {
 }
 
 /** One-line summary for the panel and the command. */
-export function availabilitySummary(regionId) {
-  const ledger = readAvailability(regionId)
+export function availabilitySummary(regionId, account) {
+  const ledger = readAvailability(regionId, account)
   const counts = new Map()
   for (const entry of ledger.models.values()) {
     const state = String(entry?.state ?? 'error')

package/src/catalog-cache.js

@@ -27,7 +27,7 @@
  */
 
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
-import { homedir, tmpdir } from 'node:os'
+import { homedir } from 'node:os'
 import { join } from 'node:path'
 
 import { isCatalogModelId, keepModel, withConsistentEfforts } from './catalog.js'
@@ -143,7 +143,9 @@ export function writeCatalogCache(regionId, source, entries) {
 
     const dir = cacheDir()
     mkdirSync(dir, { recursive: true })
-    const staging = join(tmpdir(), `dsh-workbuddy-catalog-${regionId}-${process.pid}.json`)
+    // Staged inside the target directory: a temp file on another volume makes the
+    // rename below fail with EXDEV, and by then the current file has already been moved.
+    const staging = join(dir, `.catalog-${regionId}-${process.pid}.json`)
     writeFileSync(staging, JSON.stringify({
       version: CACHE_VERSION,
       savedAt: now,

package/src/index.js

@@ -17,7 +17,7 @@ import { randomUUID } from 'node:crypto'
 
 import { WorkBuddyAdapter } from './adapter.js'
 import { registerWorkbuddyApi } from './api.js'
-import { REFRESH_BOOT_DELAY_MS, REFRESH_INTERVAL_MS, beginLogin, refreshRegion, regionStatus } from './auth.js'
+import { REFRESH_BOOT_DELAY_MS, REFRESH_INTERVAL_MS, beginLogin, logoutRegion, refreshRegion, regionStatus } from './auth.js'
 import { runSweep, sweepDue } from './availability.js'
 import { claimDailyCheckin, runAutoClaim } from './credits.js'
 import { msUntilNextMidnight } from './http.js'
@@ -53,8 +53,12 @@ async function executeCommand(ctx, adapters, invocation) {
     for (const region of regions) {
       try {
         const result = await beginLogin(ctx, region, {
-          onSuccess: () => {
+          onSuccess: async () => {
             adapters[region.id]?.invalidateCatalog()
+            // The availability ledger belongs to the account, so a new login starts with
+            // no verdicts: probe this account once, which is how "which models can this
+            // account use" gets answered (the catalog itself stays shared).
+            void probeAccount(region)
             // A fresh account usually has today's check-in waiting.
             void claimDailyCheckin(ctx, region).then(async (outcome) => {
               if (outcome.claimed) ctx.logger.info(`[workbuddy] ${region.id}: 登录后签到成功，获得 ${outcome.credit ?? 0} 积分`)
@@ -74,9 +78,9 @@ async function executeCommand(ctx, adapters, invocation) {
   if (verb === 'logout') {
     const lines = []
     for (const region of regions) {
-      await ctx.credentials.unset(region.tokenRef)
-      await ctx.credentials.unset(region.metaRef)
+      await logoutRegion(ctx, region)
       adapters[region.id]?.invalidateCatalog()
+      notifyModelTopology(ctx)
       lines.push(`${region.label}：凭据已清除`)
     }
     return { kind: 'success', text: lines.join('\n') }
@@ -241,6 +245,24 @@ export function apply(ctx) {
   // run every time the panel opens (its probe never generates), the
   // international one once a day (its probe costs a token per model).
   const AVAILABILITY_BOOT_DELAY_MS = 45_000
+  /** Probe every model once for the account that just logged in. */
+  const probeAccount = async (region) => {
+    const adapter = adapters[region.id]
+    if (adapter === undefined) return
+    try {
+      adapter.invalidateCatalog()
+      const entries = await adapter.models()
+      if (entries.length === 0) return
+      const result = await runSweep(ctx, region, entries.map((entry) => entry.id), { manual: true })
+      if (result.skipped === true) return
+      const counts = new Map()
+      for (const verdict of result.results) counts.set(verdict.state, (counts.get(verdict.state) ?? 0) + 1)
+      ctx.logger.info(`[workbuddy] ${region.id}: 登录后可用性检测完成 ${result.results.length} 个 — ${[...counts.entries()].map(([state, count]) => `${state} ${count}`).join(' / ')}`)
+      notifyModelTopology(ctx)
+    } catch (error) {
+      ctx.logger.warn(`[workbuddy] ${region.id}: 登录后可用性检测失败 — ${error instanceof Error ? error.message : String(error)}`)
+    }
+  }
   const availabilityTimer = setTimeout(() => {
     for (const id of REGION_IDS) {
       const region = REGIONS[id]

package/src/model-prefs.js

@@ -18,7 +18,7 @@
  */
 
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
-import { homedir, tmpdir } from 'node:os'
+import { homedir } from 'node:os'
 import { join } from 'node:path'
 
 const PREFS_VERSION = 1
@@ -54,7 +54,8 @@ export function readPrefs(regionId) {
 function write(regionId, prefs) {
   try {
     mkdirSync(prefsDir(), { recursive: true })
-    const staging = join(tmpdir(), `dsh-workbuddy-enabled-${regionId}-${process.pid}.json`)
+    // Staged in the target directory so the rename cannot fail with EXDEV.
+    const staging = join(prefsDir(), `.enabled-${regionId}-${process.pid}.json`)
     writeFileSync(staging, JSON.stringify({
       version: PREFS_VERSION,
       updatedAt: Date.now(),

package/src/official-list.js

@@ -26,7 +26,7 @@
  */
 
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
-import { homedir, tmpdir } from 'node:os'
+import { homedir } from 'node:os'
 import { join } from 'node:path'
 
 import { entryFromMeta, isAdvertisableId } from './catalog.js'
@@ -58,10 +58,13 @@ function normalizeItem(item) {
 }
 
 /** @returns {{ ids: string[], entries: object[], importedAt: number, from: string } | undefined} */
-export function readOfficialList(regionId) {
+export function readOfficialList(regionId, account) {
   try {
     const parsed = JSON.parse(readFileSync(listPath(regionId), 'utf8'))
     if (parsed?.version !== LIST_VERSION || !Array.isArray(parsed.ids)) return undefined
+    // An imported list is one account's entitlements; another account must not inherit
+    // it, or a freshly logged-in account would show the previous account's models.
+    if (account !== undefined && typeof parsed.account === 'string' && parsed.account !== account) return undefined
     const ids = parsed.ids.filter((id) => typeof id === 'string' && id.length > 0)
     if (ids.length === 0) return undefined
     const entries = Array.isArray(parsed.entries) ? parsed.entries : []
@@ -109,9 +112,11 @@ export function writeOfficialList(regionId, models, options = {}) {
     const ids = [...byId.keys()]
     const entries = ids.filter((id) => byId.get(id).rich).map((id) => byId.get(id).entry)
     mkdirSync(listDir(), { recursive: true })
-    const staging = join(tmpdir(), `dsh-workbuddy-official-${regionId}-${process.pid}.json`)
+    // Staged in the target directory so the rename cannot fail with EXDEV.
+    const staging = join(listDir(), `.official-${regionId}-${process.pid}.json`)
     writeFileSync(staging, JSON.stringify({
       version: LIST_VERSION,
+      ...(typeof options.account === 'string' && options.account.length > 0 ? { account: options.account } : {}),
       importedAt: Date.now(),
       from: typeof options.from === 'string' && options.from.length > 0 ? options.from : 'import',
       ids,