dsh-connect-trae 3.0.0 → 3.3.0

package/lib/index.js

@@ -4,11 +4,11 @@ import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completio
 import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { readFile, rm, stat } from "node:fs/promises";
-import { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createDecipheriv, createHash, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
 import { dirname, join } from "node:path";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
-import { cpus, homedir, hostname, release } from "node:os";
+import { cpus, homedir, hostname, release, userInfo } from "node:os";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
 import { execFile } from "node:child_process";
@@ -452,6 +452,213 @@ function createTraeAdapter(options) {
 	};
 }
 //#endregion
+//#region src/status-paths.ts
+/** Plugin-owned usage endpoint consumed by its browser half. */
+const TRAE_USAGE_PATH = "/plugins/dsh-connect-trae/usage";
+/** Plugin-owned live model refresh endpoint. */
+const TRAE_MODELS_REFRESH_PATH = "/plugins/dsh-connect-trae/models/refresh";
+/**
+* Plugin-owned availability probe: POST the model ids to test, get one verdict
+* per model. Unlike every read-only sibling this route SPENDS quota — a real
+* (minimal) chat call per model — so it is user-initiated only, and the card
+* labels the button as consuming a small amount.
+*/
+const TRAE_MODELS_TEST_PATH = "/plugins/dsh-connect-trae/models/test";
+/** Plugin-owned local account rescan endpoint. */
+const TRAE_ACCOUNTS_REFRESH_PATH = "/plugins/dsh-connect-trae/accounts/refresh";
+/**
+* General balance of EVERY account in a region, for the composer panel's table.
+*
+* Separate from the usage route on purpose: the usage document backs the
+* 5-minute readout, and multiplying its upstream reads by the account count
+* would charge a healthy account for something it never looks at — the same
+* principle that keeps `creditAlternatives` firing only when a balance hits
+* zero. This one is paid when the panel is actually opened, which is the only
+* place the table is shown.
+*/
+const TRAE_ACCOUNT_CREDITS_PATH = "/plugins/dsh-connect-trae/account-credits";
+/**
+* Per-account status (check-in / credits / subscription) for the account table.
+*
+* Each row of the account table reads its OWN state through this route — a CN
+* row carries its check-in state and balance, an ai row its subscription.
+* POST with the accountId in the body: one upstream read per account, paid
+* only when the table is actually shown.
+*/
+const TRAE_ACCOUNT_STATUS_PATH = "/plugins/dsh-connect-trae/account-status";
+/**
+* Plugin-owned daily check-in claim endpoint. POST, loopback-only, and the only
+* route in this plugin that changes upstream account state. The accountId in
+* the body names WHICH account to claim for, so the button can sit in each
+* account row.
+*/
+const TRAE_CHECKIN_PATH = "/plugins/dsh-connect-trae/checkin";
+/** Query parameter naming the region a card request addresses. */
+const TRAE_REGION_PARAM = "region";
+/** Every region, in card tab order. */
+const TRAE_REGIONS = ["cn", "ai"];
+/**
+* Address one region's status route. The two regions are separate provider
+* stacks; every card request carries the region whose tab the user is on.
+*/
+function withTraeRegion(path, region) {
+	return `${path}?${TRAE_REGION_PARAM}=${region}`;
+}
+/**
+* Read the region parameter off a status-route URL. Absent means the domestic
+* tab (`cn`); a present-but-unknown value returns undefined so the route can
+* answer 400 instead of guessing.
+*/
+function regionOfTraeStatusUrl(url) {
+	const at = url.indexOf("?");
+	const value = at === -1 ? null : new URLSearchParams(url.slice(at + 1)).get(TRAE_REGION_PARAM);
+	if (value === null || value === "") return "cn";
+	return TRAE_REGIONS.includes(value) ? value : void 0;
+}
+/**
+* Peel ONE `{get(): T}` live reference, the shape DSH 0.1.7 delivers a
+* volatile-marked settings field as (see {@link unwrapVolatileDeep}).
+*/
+function unwrapVolatile(value) {
+	if (value !== null && typeof value === "object" && typeof value.get === "function") return value.get();
+	return value;
+}
+/**
+* Deep copy of a value with every `{get(): T}` live reference replaced by the
+* value it resolves to.
+*
+* DSH 0.1.7 hands volatile-marked fields back as live references, and a live
+* reference is still `typeof === 'object'` — so it passes a naive object check
+* and every lookup on it is `undefined`. Worse, spreading one (`{ ...ref }`)
+* does NOT read the field: it produces `{ get: <function> }`. Any merge that
+* spreads a resolved field to preserve its siblings — the card's "write one
+* region, keep the other" write, or the account map's spread — would otherwise
+* DROP every sibling and leak a function into the document.
+*
+* Both halves therefore unwrap before touching a resolved field. This lives in
+* the node-free host↔client bridge because the browser half needs it too.
+*
+* Non-reference values are recursed into so a nested volatile field is caught
+* as well; arrays and objects are rebuilt rather than mutated, so the caller's
+* value is never touched.
+*/
+function unwrapVolatileDeep(value) {
+	if (value === null || typeof value !== "object") return value;
+	if (typeof value.get === "function") return unwrapVolatileDeep(value.get());
+	if (Array.isArray(value)) return value.map((entry) => unwrapVolatileDeep(entry));
+	const source = value;
+	const out = {};
+	for (const key of Object.keys(source)) out[key] = unwrapVolatileDeep(source[key]);
+	return out;
+}
+/**
+* Read the per-region account selections out of a settings value.
+*
+* SHARED because `accounts` now has TWO writers: the card, and the composer
+* panel's account table (2.14.0). Two writers of one field must use one merge
+* rule, or they drift — and the rule is not obvious.
+*
+* Deep-unwraps first: on DSH 0.1.7 a volatile field arrives as a `{get(): T}`
+* live reference, which passes the `typeof === 'object'` check and would be
+* returned as if it were the map. Every lookup on it is then `undefined`, and
+* the merge (`{ ...configured, [region]: id }`) would spread a reference into
+* `{get: <function>}` — dropping the other region's selection and leaking a
+* function into the settings document.
+*/
+function configuredAccountsOf(configured) {
+	const accounts = unwrapVolatileDeep(configured)?.accounts;
+	return typeof accounts === "object" && accounts !== null ? accounts : {};
+}
+/**
+* Whether the host-side "follow the Trae app's sign-in" switch is on (issue
+* #29). Absent reads as OFF, so an existing configuration keeps the strict
+* bind it shipped with and the switch is an opt-in — the same opt-out
+* semantics as {@link regionEnabledOf}, for the same reason: a config written
+* before this field existed cannot ask for behavior it never declared.
+*
+* Reads the whole settings section (or the bare field); deep-unwraps first
+* because on DSH 0.1.7 a volatile field arrives as a `{get(): T}` live
+* reference, whose `typeof === 'object'` would otherwise pass a naive check.
+*/
+function followAppLoginEnabled(configured) {
+	return unwrapVolatileDeep(configured)?.followAppLogin === true;
+}
+/**
+* Build the next `regions` settings value for the card's save. The write
+* targets ONLY the signed-in account's region slot; every other region's slot
+* is carried over untouched, so switching accounts never clobbers the other
+* region's picks. Tolerates any stored shape (absent, non-object) by starting
+* from an empty document.
+*/
+function nextRegionSlots(regions, region, slot) {
+	const unwrapped = unwrapVolatileDeep(regions);
+	return {
+		...typeof unwrapped === "object" && unwrapped !== null && !Array.isArray(unwrapped) ? unwrapped : {},
+		[region]: slot
+	};
+}
+/**
+* Narrow a settings value to the `regions` map. Accepts EITHER the whole
+* settings section (`{ regions: {...}, ... }`) or the `regions` map itself, and
+* unwraps the former. This tolerance is deliberate: passing the whole section
+* where the map was expected was a real shipped bug — the lookup then read
+* `section['cn']` (absent), so the card's checkbox reported `true` forever and
+* clicking it appeared to do nothing even though the write succeeded.
+*
+* Unwraps live references first: on DSH 0.1.7 the `regions` field arrives as a
+* `{get(): T}` reference, which passes the `typeof === 'object'` check below
+* and would otherwise be returned as if it were the map — making every region
+* read back as absent (and the enabled flag read as "on" forever).
+*/
+function regionsMapOf(value) {
+	const unwrapped = unwrapVolatileDeep(value);
+	if (typeof unwrapped !== "object" || unwrapped === null || Array.isArray(unwrapped)) return {};
+	const record = unwrapped;
+	const nested = record["regions"];
+	if (typeof nested === "object" && nested !== null && !Array.isArray(nested)) return nested;
+	return record;
+}
+/** One region's stored slot as a plain object; any other shape reads as empty. */
+function regionSlotOf(value, region) {
+	const slot = unwrapVolatile(regionsMapOf(value)[region]);
+	return typeof slot === "object" && slot !== null && !Array.isArray(slot) ? slot : {};
+}
+/**
+* Whether one region's provider is switched on. Opt-out semantics: only an
+* explicit `false` disables it, so a config written before this switch existed
+* (and the pre-region-split flat fields, which never carry `enabled`) keep both
+* providers running exactly as before. The Host reads the same rule through
+* `regionStateOf`, so card and Host can never disagree about a region's state.
+*
+* `value` may be the whole settings section or the `regions` map (see
+* {@link regionsMapOf}).
+*/
+function regionEnabledOf(value, region) {
+	return regionSlotOf(value, region)["enabled"] !== false;
+}
+/**
+* Build the next `regions` settings value for a provider on/off toggle. ONLY
+* the target region's `enabled` flag changes: every other field of that slot
+* (its directory, selection, image opt-ins, context budgets) and every other
+* region's slot are carried over verbatim, so switching a provider off never
+* discards the user's model picks and switching it back on restores them.
+*
+* This is deliberately separate from {@link nextRegionSlots}: that helper
+* writes a whole slot from a signed-in tab's draft, while this one must work
+* for a region that is signed OUT — which is precisely the region a user wants
+* to switch off (no international install, no international account).
+*
+* `value` may be the whole settings section or the `regions` map; the RETURN
+* value is always the `regions` map, i.e. exactly what `settingsScope.set(
+* 'regions', ...)` needs.
+*/
+function nextRegionEnabled(value, region, enabled) {
+	return nextRegionSlots(regionsMapOf(value), region, {
+		...regionSlotOf(value, region),
+		enabled
+	});
+}
+//#endregion
 //#region src/decrypt.ts
 const TRAE_AUTH_STORAGE_KEY = "iCubeAuthInfo://icube.cloudide";
 const SALT_A = Uint8Array.from([
@@ -1171,13 +1378,52 @@ var TraeCredentialStore = class {
 		return this.edition === "auto" ? all.filter((candidate) => candidate.source === "desktop" || candidate.edition === cliEdition) : all.filter((candidate) => candidate.edition === this.edition && (candidate.source === "desktop" || candidate.edition === cliEdition));
 	}
 	/**
-	* Deterministic default when no account is explicitly selected: the first
-	* discovered account. This is NOT credit-seeking — it never reorders accounts
-	* to find one with general credits. The plugin bills exactly the account the
-	* user selected, or the first account when nothing has been selected yet.
+	* Deterministic default when no account is explicitly selected: the account
+	* the Trae desktop app is signed in to RIGHT NOW, else the first discovered
+	* one. This is NOT credit-seeking — it never reorders accounts to find one
+	* with general credits. The plugin bills exactly the account the user
+	* selected, the app's current sign-in when nothing has been selected, and
+	* only then the first account.
+	*
+	* The app's live sign-in outranks the plugin's own refreshed copies (issue
+	* #29): after the user switches accounts in Trae, the desktop storage file
+	* holds the NEW login while the plugin's copy of the old one still resolves,
+	* so a bare `credentials[0]` kept defaulting to a sign-in the app has
+	* abandoned — and `dsh-connect-workbuddy`, whose `preferred()` ranks the live
+	* file first, followed the app instead. Ordering only: the VALUE behind an
+	* account id is still whichever copy expires later (`readAll`), so a refresh
+	* the plugin performed is never discarded by this preference.
 	*/
 	preferred(credentials) {
-		return credentials[0];
+		return credentials.find((credential) => credential.source === "desktop") ?? credentials[0];
+	}
+	/**
+	* The account the Trae app is signed in to right now, when that differs from
+	* the account this store is bound to (issue #29).
+	*
+	* This is a READ, not a rebind: `current()` keeps resolving the bound
+	* account verbatim so billing never moves without a decision — the store
+	* only reports the mismatch, and the card (hint row) or the host (follow
+	* switch) turns it into a settings write the user can see and undo. Absent
+	* when nothing is live, when the live account IS the bound one, or when the
+	* binding itself already fell through to the live account.
+	*/
+	async liveLogin() {
+		if (this.accountId === void 0 || this.accountId === "") return void 0;
+		const credentials = await this.readAll();
+		const live = this.preferred(credentials);
+		if (live === void 0) return void 0;
+		const liveId = traeAccountId(live);
+		if (liveId === this.accountId) return void 0;
+		return {
+			id: liveId,
+			accountName: live.accountName ?? (live.userId || `${live.edition} account`),
+			edition: live.edition,
+			region: regionOfCredential(live),
+			source: live.source,
+			tokenExpiresAtMs: live.expiresAtMs,
+			selected: false
+		};
 	}
 	async accounts() {
 		const credentials = await this.readAll();
@@ -1401,26 +1647,35 @@ var TraeCredentialStore = class {
 };
 //#endregion
 //#region src/refresh.ts
-const REFRESH_CONTRACT = {
+/** Path of the current token-exchange endpoint, relative to the credential host. */
+const TRAE_EXCHANGE_TOKEN_PATH = "/trae/api/v3/oauth/ExchangeToken";
+/** Path of the superseded endpoint; only reachable as the fallback. */
+const TRAE_LEGACY_EXCHANGE_TOKEN_PATH = "/cloudide/api/v3/trae/oauth/ExchangeToken";
+/** Shared desktop ClientID; the current contract also uses it for `cn` / `sg`. */
+const DESKTOP_CLIENT_ID = "ono9krqynydwx5";
+/** SOLO ClientID; every SOLO package uses it, CN and international alike. */
+const SOLO_CLIENT_ID = "en1oxy7wnw8j9n";
+/** The current contract: `/trae/api/v3`, per-edition ClientID, always proofed. */
+const CURRENT_CONTRACT = {
 	cn: {
-		path: "/cloudide/api/v3/trae/oauth/ExchangeToken",
-		clientId: "ono9krqynydwx5",
-		deviceInfo: false
+		path: TRAE_EXCHANGE_TOKEN_PATH,
+		clientId: DESKTOP_CLIENT_ID,
+		platformCode: "IDE_PC"
 	},
 	sg: {
-		path: "/cloudide/api/v3/trae/oauth/ExchangeToken",
-		clientId: "ono9krqynydwx5",
-		deviceInfo: false
+		path: TRAE_EXCHANGE_TOKEN_PATH,
+		clientId: DESKTOP_CLIENT_ID,
+		platformCode: "IDE_PC"
 	},
 	solo: {
-		path: "/cloudide/api/v3/trae/oauth/ExchangeToken",
-		clientId: "ono9krqynydwx5",
-		deviceInfo: false
+		path: TRAE_EXCHANGE_TOKEN_PATH,
+		clientId: SOLO_CLIENT_ID,
+		platformCode: "SOLO_PC"
 	},
 	"solo-sg": {
-		path: "/trae/api/v3/oauth/ExchangeToken",
-		clientId: "en1oxy7wnw8j9n",
-		deviceInfo: true
+		path: TRAE_EXCHANGE_TOKEN_PATH,
+		clientId: SOLO_CLIENT_ID,
+		platformCode: "SOLO_PC"
 	}
 };
 function normalizeHost(host) {
@@ -1428,49 +1683,173 @@ function normalizeHost(host) {
 	if (value === "") throw new Error("Trae refresh host is missing");
 	return value.replace(/\/$/, "");
 }
+/** `OSInfo` value the official client sends (a bare platform word). */
+function osInfo(platform = process.platform) {
+	return platform === "darwin" ? "mac" : platform === "win32" ? "windows" : platform;
+}
 /**
-* Exchange a refresh token for a fresh access token, following the calling
-* edition's verified contract. `device` is only used by editions whose
-* official client sends a DeviceInfo body; when it cannot be resolved the
-* field is omitted rather than sent empty.
+* Build the exact string the official client signs.
+*
+* The separator is a NEWLINE, not a space: the shipped bundle joins the six
+* fields with `.join("\n")`. This is load-bearing rather than cosmetic — a
+* space-joined message of identical fields is rejected with `20403 Token device
+* not match`, which is indistinguishable from a wrong key and sends debugging
+* in entirely the wrong direction.
 */
-async function refreshTraeCredential(credential, signal, device) {
-	const contract = REFRESH_CONTRACT[credential.edition];
-	if (contract === void 0) throw new Error(`Trae ${credential.edition} refresh contract is not verified`);
-	if (credential.refreshToken === void 0) throw new Error("Trae refresh token is missing");
-	const body = {
-		ClientID: contract.clientId,
-		ClientSecret: "-",
-		RefreshToken: credential.refreshToken,
-		UserID: credential.userId
+function traeDeviceProofMessage(input) {
+	return [
+		"POST",
+		input.path,
+		input.clientId,
+		input.refreshToken,
+		String(input.timestamp),
+		input.nonce
+	].join("\n");
+}
+/**
+* Sign a device proof with the install's own private key.
+*
+* `timestamp`/`nonce` are injectable so tests can pin a deterministic signature;
+* the defaults are the whole-second timestamp and 16 random bytes the official
+* client uses.
+*/
+function signTraeDeviceProof(input) {
+	const timestamp = input.timestamp ?? Math.floor(Date.now() / 1e3);
+	const nonce = input.nonce ?? randomBytes(16).toString("hex");
+	const message = traeDeviceProofMessage({
+		path: input.path,
+		clientId: input.clientId,
+		refreshToken: input.refreshToken,
+		timestamp,
+		nonce
+	});
+	return {
+		Signature: sign("sha256", Buffer.from(message), input.privateKeyPEM).toString("base64"),
+		Timestamp: timestamp,
+		Nonce: nonce
 	};
-	if (contract.deviceInfo && device !== void 0) body["DeviceInfo"] = {
+}
+/** The `DeviceInfo` block the current contract sends. */
+function traeDeviceInfoBody(contract, device, platform) {
+	const os = osInfo(platform);
+	return {
 		DeviceID: device.deviceId,
 		MachineID: device.machineId,
-		PlatformCode: credential.edition === "solo-sg" ? "SOLO_PC" : "TRAE",
+		PlatformCode: contract.platformCode,
 		DeviceType: "PC",
-		DeviceName: hostname()
+		...device.deviceName === void 0 ? {} : { DeviceName: device.deviceName },
+		...device.deviceModel === void 0 ? {} : { DeviceModel: device.deviceModel },
+		...device.appVersion === void 0 ? {} : { ClientVersion: device.appVersion },
+		...device.deviceKeyPair === void 0 ? {} : { DevicePublicKey: device.deviceKeyPair.publicKeyPEM },
+		...device.deviceBrand === void 0 ? {} : { DeviceBrand: device.deviceBrand },
+		...device.deviceCpu === void 0 ? {} : { DeviceCPU: device.deviceCpu },
+		OSInfo: os,
+		OSVersion: device.osVersion ?? `${os} ${hostname()}`
 	};
-	const response = await fetch(`${normalizeHost(credential.host)}${contract.path}`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(body),
-		signal: signal ?? AbortSignal.timeout(3e4)
-	});
-	if (!response.ok) throw new Error(`Trae token refresh failed (http ${response.status})`);
-	const result = (await response.json()).Result;
+}
+/** The current contract's complete request body. */
+function currentBody(credential, contract, device) {
+	return {
+		ClientID: contract.clientId,
+		ClientSecret: "",
+		RefreshToken: credential.refreshToken,
+		DeviceInfo: traeDeviceInfoBody(contract, device),
+		DeviceProof: signTraeDeviceProof({
+			path: contract.path,
+			clientId: contract.clientId,
+			refreshToken: credential.refreshToken ?? "",
+			privateKeyPEM: device.deviceKeyPair.privateKeyPEM
+		}),
+		...device.appVersion === void 0 ? {} : { IDEVersion: device.appVersion }
+	};
+}
+/**
+* The superseded shape, kept as a fallback for installs the current contract
+* cannot serve: a machine whose `storage.json` carries no device keypair (an
+* older install that has never refreshed on the new contract, or a CLI-only
+* home) has nothing to sign a proof with.
+*
+* The ClientID split is the SAME one the current contract uses, and that is not
+* a coincidence — it is enforced by the OAuth CLIENT, not by the endpoint: a
+* SOLO-package refresh token is refused by the DESKTOP client with `10101
+* refresh token is not matched to the client`, and vice versa, on this path
+* exactly as on the current one. Verified 2026-10-11 across all four editions:
+* each answers 200 here with its own ClientID and 400 with the other one.
+*
+* The pre-3.1.0 code hardcoded the desktop ClientID on this path, which is why
+* an international SOLO account had no working fallback at all.
+*/
+function legacyBody(credential, clientId) {
+	return {
+		ClientID: clientId,
+		ClientSecret: "-",
+		RefreshToken: credential.refreshToken,
+		UserID: credential.userId
+	};
+}
+/** Parse one ExchangeToken response into an outcome, or throw with the reason. */
+function outcomeOf(payload, label) {
+	const result = payload.Result;
 	const accessToken = typeof result?.["Token"] === "string" ? result["Token"] : "";
-	if (accessToken === "") throw new Error("Trae token refresh returned no token");
+	if (accessToken === "") throw new Error(`${label} returned no token`);
 	const expiry = result?.["TokenExpireAt"];
 	const expiresAtMs = typeof expiry === "number" ? expiry : typeof expiry === "string" ? Date.parse(expiry) : NaN;
-	if (!Number.isFinite(expiresAtMs)) throw new Error("Trae token refresh returned an invalid expiry");
+	if (!Number.isFinite(expiresAtMs)) throw new Error(`${label} returned an invalid expiry`);
 	const refreshToken = typeof result?.["RefreshToken"] === "string" && result["RefreshToken"] !== "" ? result["RefreshToken"] : void 0;
+	const refreshExpiry = result?.["RefreshExpireAt"];
+	const parsedRefreshExpiry = typeof refreshExpiry === "string" ? Date.parse(refreshExpiry) : NaN;
+	const refreshExpiresAtMs = typeof refreshExpiry === "number" && Number.isFinite(refreshExpiry) && refreshExpiry > 0 ? refreshExpiry : Number.isFinite(parsedRefreshExpiry) ? parsedRefreshExpiry : void 0;
 	return {
 		accessToken,
 		...refreshToken === void 0 ? {} : { refreshToken },
-		expiresAtMs
+		expiresAtMs,
+		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs }
 	};
 }
+/** POST one refresh body and parse it, labelling failures with the path tried. */
+async function postExchangeToken(host, path, body, signal, label) {
+	const response = await fetch(`${normalizeHost(host)}${path}`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body),
+		signal: signal ?? AbortSignal.timeout(3e4)
+	});
+	if (!response.ok) throw new Error(`${label} failed (http ${response.status})`);
+	return outcomeOf(await response.json(), label);
+}
+/**
+* Exchange a refresh token for a fresh access token.
+*
+* The CURRENT contract is attempted first whenever it is possible at all — it is
+* what the shipped clients use. It needs the install's device keypair; without
+* one there is nothing to sign, so the request is skipped rather than sent to be
+* rejected with `20405`.
+*
+* The SUPERSEDED contract is then tried as a fallback, which is what keeps older
+* installs and CLI-only machines working; it carries no device block but the
+* SAME per-edition ClientID, because that split belongs to the OAuth client
+* rather than to the endpoint (see {@link legacyBody}). When both are impossible
+* or both fail, the error names every attempt so a "sign in again" verdict is
+* diagnosable rather than mysterious.
+*/
+async function refreshTraeCredential(credential, signal, device) {
+	const contract = CURRENT_CONTRACT[credential.edition];
+	if (contract === void 0) throw new Error(`Trae ${credential.edition} refresh contract is not verified`);
+	if (credential.refreshToken === void 0) throw new Error("Trae refresh token is missing");
+	const attempts = [];
+	if (device?.deviceKeyPair === void 0) attempts.push(`${contract.path}: no device keypair in this install's storage`);
+	else try {
+		return await postExchangeToken(credential.host, contract.path, currentBody(credential, contract, device), signal, "Trae token refresh");
+	} catch (error) {
+		attempts.push(`${contract.path}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	try {
+		return await postExchangeToken(credential.host, TRAE_LEGACY_EXCHANGE_TOKEN_PATH, legacyBody(credential, contract.clientId), signal, "Trae token refresh (legacy)");
+	} catch (error) {
+		attempts.push(`${TRAE_LEGACY_EXCHANGE_TOKEN_PATH}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	throw new Error(`Trae token refresh failed — ${attempts.join("; ")}`);
+}
 //#endregion
 //#region src/identity.ts
 function nonEmpty(value) {
@@ -1481,6 +1860,33 @@ function deviceCenterId(storage) {
 	const ids = Object.keys(storage).filter((key) => key.startsWith(prefix)).map((key) => key.slice(25)).filter(Boolean);
 	return ids.length === 1 ? ids[0] : void 0;
 }
+/**
+* Read the install's device keypair out of `storage.json`.
+*
+* Tolerant on purpose: an older install (or one that has never refreshed on the
+* new contract) simply has no keypair, and the caller must still be able to
+* resolve an identity for the chat/usage paths — only a refresh then degrades.
+* A malformed entry is treated as absent rather than failing the read.
+*/
+function deviceKeyPairOf(storage) {
+	const key = Object.keys(storage).find((name) => name.startsWith("iCubeAuthInfo://icube-dc:"));
+	if (key === void 0) return void 0;
+	const encoded = storage[key];
+	if (typeof encoded !== "string" || encoded.trim() === "") return void 0;
+	try {
+		const plaintext = parseTraeAuthValue(encoded);
+		if (typeof plaintext !== "object" || plaintext === null || Array.isArray(plaintext)) return void 0;
+		const value = plaintext;
+		const privateKeyPEM = nonEmpty(value["privateKeyPEM"]);
+		const publicKeyPEM = nonEmpty(value["publicKeyPEM"]);
+		return privateKeyPEM === void 0 || publicKeyPEM === void 0 ? void 0 : {
+			privateKeyPEM,
+			publicKeyPEM
+		};
+	} catch {
+		return;
+	}
+}
 /** Read stable identity from Trae-owned files without generating impersonated IDs. */
 async function readTraeIdentity(candidate, options = {}) {
 	const platform = options.platform ?? process.platform;
@@ -1519,6 +1925,15 @@ async function readTraeIdentity(candidate, options = {}) {
 	const deviceBrand = platform === "darwin" ? nonEmpty(env["TRAE_DEVICE_BRAND"]) : void 0;
 	const deviceCpu = cpus()[0]?.model.split(" ")[0];
 	const osVersion = `${platform === "darwin" ? "macOS" : platform === "win32" ? "Windows" : platform} ${release()}`;
+	const deviceName = (() => {
+		try {
+			return nonEmpty(userInfo().username);
+		} catch {
+			return;
+		}
+	})();
+	const deviceModel = nonEmpty(env["TRAE_DEVICE_MODEL"]);
+	const deviceKeyPair = deviceKeyPairOf(storage);
 	return {
 		edition: candidate.edition,
 		machineId,
@@ -1527,6 +1942,9 @@ async function readTraeIdentity(candidate, options = {}) {
 		...buildVersion === void 0 ? {} : { buildVersion },
 		...deviceBrand === void 0 ? {} : { deviceBrand },
 		...deviceCpu === void 0 ? {} : { deviceCpu },
+		...deviceName === void 0 ? {} : { deviceName },
+		...deviceModel === void 0 ? {} : { deviceModel },
+		...deviceKeyPair === void 0 ? {} : { deviceKeyPair },
 		osVersion,
 		platform
 	};
@@ -3685,6 +4103,21 @@ const TRAE_PAY_BASE = "https://api.trae.cn";
 function asNumber(value) {
 	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
+/**
+* Normalize an upstream epoch to milliseconds.
+*
+* The pack's `end_time` arrives in SECONDS while {@link TraeUsagePack.endTimeMs}
+* names milliseconds. Measured against a live CN account: `1788340660` is
+* 2026-09-02, and reading it as milliseconds would place the pack in 1970 — a
+* date that sorts ahead of every real one and reads as "long expired". The
+* magnitude test is the same one `auth.ts` applies to stored expiry fields, so
+* an upstream that ever switches to milliseconds is passed through instead of
+* being multiplied into the year 57000.
+*/
+function epochToMs(value) {
+	if (value === void 0 || !Number.isFinite(value) || value <= 0) return 0;
+	return value > 0xe8d4a51000 ? value : value * 1e3;
+}
 function parseUsageSnapshot(payload) {
 	const summaryRaw = payload["usage_summary"];
 	const summary = {
@@ -3708,7 +4141,7 @@ function parseUsageSnapshot(payload) {
 		packs.push({
 			displayDesc: typeof pack["display_desc"] === "string" ? pack["display_desc"] : "",
 			entitlementId: typeof base?.["entitlement_id"] === "string" ? base["entitlement_id"] : "",
-			endTimeMs: asNumber(base?.["end_time"]) ?? 0,
+			endTimeMs: epochToMs(asNumber(base?.["end_time"])),
 			currency: asNumber(base?.["currency"]) ?? 0,
 			...availableEndpoint === void 0 ? {} : { availableEndpoint },
 			...creditsLimit === void 0 ? {} : { creditsLimit },
@@ -3927,170 +4360,6 @@ var TraeUsageClient = class {
 	}
 };
 //#endregion
-//#region src/status-paths.ts
-/** Plugin-owned usage endpoint consumed by its browser half. */
-const TRAE_USAGE_PATH = "/plugins/dsh-connect-trae/usage";
-/** Plugin-owned live model refresh endpoint. */
-const TRAE_MODELS_REFRESH_PATH = "/plugins/dsh-connect-trae/models/refresh";
-/**
-* Plugin-owned availability probe: POST the model ids to test, get one verdict
-* per model. Unlike every read-only sibling this route SPENDS quota — a real
-* (minimal) chat call per model — so it is user-initiated only, and the card
-* labels the button as consuming a small amount.
-*/
-const TRAE_MODELS_TEST_PATH = "/plugins/dsh-connect-trae/models/test";
-/** Plugin-owned local account rescan endpoint. */
-const TRAE_ACCOUNTS_REFRESH_PATH = "/plugins/dsh-connect-trae/accounts/refresh";
-/**
-* General balance of EVERY account in a region, for the composer panel's table.
-*
-* Separate from the usage route on purpose: the usage document backs the
-* 5-minute readout, and multiplying its upstream reads by the account count
-* would charge a healthy account for something it never looks at — the same
-* principle that keeps `creditAlternatives` firing only when a balance hits
-* zero. This one is paid when the panel is actually opened, which is the only
-* place the table is shown.
-*/
-const TRAE_ACCOUNT_CREDITS_PATH = "/plugins/dsh-connect-trae/account-credits";
-/**
-* Plugin-owned daily check-in claim endpoint. POST, loopback-only, and the only
-* route in this plugin that changes upstream account state.
-*/
-const TRAE_CHECKIN_PATH = "/plugins/dsh-connect-trae/checkin";
-/** Query parameter naming the region a card request addresses. */
-const TRAE_REGION_PARAM = "region";
-/** Every region, in card tab order. */
-const TRAE_REGIONS = ["cn", "ai"];
-/**
-* Address one region's status route. The two regions are separate provider
-* stacks; every card request carries the region whose tab the user is on.
-*/
-function withTraeRegion(path, region) {
-	return `${path}?${TRAE_REGION_PARAM}=${region}`;
-}
-/**
-* Read the region parameter off a status-route URL. Absent means the domestic
-* tab (`cn`); a present-but-unknown value returns undefined so the route can
-* answer 400 instead of guessing.
-*/
-function regionOfTraeStatusUrl(url) {
-	const at = url.indexOf("?");
-	const value = at === -1 ? null : new URLSearchParams(url.slice(at + 1)).get(TRAE_REGION_PARAM);
-	if (value === null || value === "") return "cn";
-	return TRAE_REGIONS.includes(value) ? value : void 0;
-}
-/**
-* Peel ONE `{get(): T}` live reference, the shape DSH 0.1.7 delivers a
-* volatile-marked settings field as (see {@link unwrapVolatileDeep}).
-*/
-function unwrapVolatile(value) {
-	if (value !== null && typeof value === "object" && typeof value.get === "function") return value.get();
-	return value;
-}
-/**
-* Deep copy of a value with every `{get(): T}` live reference replaced by the
-* value it resolves to.
-*
-* DSH 0.1.7 hands volatile-marked fields back as live references, and a live
-* reference is still `typeof === 'object'` — so it passes a naive object check
-* and every lookup on it is `undefined`. Worse, spreading one (`{ ...ref }`)
-* does NOT read the field: it produces `{ get: <function> }`. Any merge that
-* spreads a resolved field to preserve its siblings — the card's "write one
-* region, keep the other" write, or the account map's spread — would otherwise
-* DROP every sibling and leak a function into the document.
-*
-* Both halves therefore unwrap before touching a resolved field. This lives in
-* the node-free host↔client bridge because the browser half needs it too.
-*
-* Non-reference values are recursed into so a nested volatile field is caught
-* as well; arrays and objects are rebuilt rather than mutated, so the caller's
-* value is never touched.
-*/
-function unwrapVolatileDeep(value) {
-	if (value === null || typeof value !== "object") return value;
-	if (typeof value.get === "function") return unwrapVolatileDeep(value.get());
-	if (Array.isArray(value)) return value.map((entry) => unwrapVolatileDeep(entry));
-	const source = value;
-	const out = {};
-	for (const key of Object.keys(source)) out[key] = unwrapVolatileDeep(source[key]);
-	return out;
-}
-/**
-* Build the next `regions` settings value for the card's save. The write
-* targets ONLY the signed-in account's region slot; every other region's slot
-* is carried over untouched, so switching accounts never clobbers the other
-* region's picks. Tolerates any stored shape (absent, non-object) by starting
-* from an empty document.
-*/
-function nextRegionSlots(regions, region, slot) {
-	const unwrapped = unwrapVolatileDeep(regions);
-	return {
-		...typeof unwrapped === "object" && unwrapped !== null && !Array.isArray(unwrapped) ? unwrapped : {},
-		[region]: slot
-	};
-}
-/**
-* Narrow a settings value to the `regions` map. Accepts EITHER the whole
-* settings section (`{ regions: {...}, ... }`) or the `regions` map itself, and
-* unwraps the former. This tolerance is deliberate: passing the whole section
-* where the map was expected was a real shipped bug — the lookup then read
-* `section['cn']` (absent), so the card's checkbox reported `true` forever and
-* clicking it appeared to do nothing even though the write succeeded.
-*
-* Unwraps live references first: on DSH 0.1.7 the `regions` field arrives as a
-* `{get(): T}` reference, which passes the `typeof === 'object'` check below
-* and would otherwise be returned as if it were the map — making every region
-* read back as absent (and the enabled flag read as "on" forever).
-*/
-function regionsMapOf(value) {
-	const unwrapped = unwrapVolatileDeep(value);
-	if (typeof unwrapped !== "object" || unwrapped === null || Array.isArray(unwrapped)) return {};
-	const record = unwrapped;
-	const nested = record["regions"];
-	if (typeof nested === "object" && nested !== null && !Array.isArray(nested)) return nested;
-	return record;
-}
-/** One region's stored slot as a plain object; any other shape reads as empty. */
-function regionSlotOf(value, region) {
-	const slot = unwrapVolatile(regionsMapOf(value)[region]);
-	return typeof slot === "object" && slot !== null && !Array.isArray(slot) ? slot : {};
-}
-/**
-* Whether one region's provider is switched on. Opt-out semantics: only an
-* explicit `false` disables it, so a config written before this switch existed
-* (and the pre-region-split flat fields, which never carry `enabled`) keep both
-* providers running exactly as before. The Host reads the same rule through
-* `regionStateOf`, so card and Host can never disagree about a region's state.
-*
-* `value` may be the whole settings section or the `regions` map (see
-* {@link regionsMapOf}).
-*/
-function regionEnabledOf(value, region) {
-	return regionSlotOf(value, region)["enabled"] !== false;
-}
-/**
-* Build the next `regions` settings value for a provider on/off toggle. ONLY
-* the target region's `enabled` flag changes: every other field of that slot
-* (its directory, selection, image opt-ins, context budgets) and every other
-* region's slot are carried over verbatim, so switching a provider off never
-* discards the user's model picks and switching it back on restores them.
-*
-* This is deliberately separate from {@link nextRegionSlots}: that helper
-* writes a whole slot from a signed-in tab's draft, while this one must work
-* for a region that is signed OUT — which is precisely the region a user wants
-* to switch off (no international install, no international account).
-*
-* `value` may be the whole settings section or the `regions` map; the RETURN
-* value is always the `regions` map, i.e. exactly what `settingsScope.set(
-* 'regions', ...)` needs.
-*/
-function nextRegionEnabled(value, region, enabled) {
-	return nextRegionSlots(regionsMapOf(value), region, {
-		...regionSlotOf(value, region),
-		enabled
-	});
-}
-//#endregion
 //#region src/web-status.ts
 /**
 * The upstream's business code for "该设备今日已参与签到" — this DEVICE already
@@ -4149,6 +4418,32 @@ async function readModelTestBody(req) {
 	}
 	return ids;
 }
+/**
+* Read the accountId a per-account route needs from a POST body. A bounded,
+* single-string reader — the same families of guards the model-test body uses,
+* because the claim route here is a state-changing endpoint.
+*/
+async function readAccountBody(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = chunk;
+		size += buffer.byteLength;
+		if (size > 16384) throw new Error("request body too large");
+		chunks.push(buffer);
+	}
+	const text = Buffer.concat(chunks).toString("utf8").trim();
+	if (text === "") throw new Error("empty body");
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new Error("invalid JSON body");
+	}
+	const accountId = typeof parsed === "object" && parsed !== null ? parsed["accountId"] : void 0;
+	if (typeof accountId !== "string" || accountId.trim() === "") throw new Error("body must carry an accountId string");
+	return accountId.trim();
+}
 /** Loopback browser origins only; other devices are refused until trusted origins exist. */
 function loopbackOrigin(req) {
 	const origin = req.headers.origin;
@@ -4174,7 +4469,8 @@ function toCredits(snapshot) {
 	const accounts = snapshot.packs.map((pack) => ({
 		displayDesc: pack.displayDesc,
 		remain: credit(Math.max(0, (pack.creditsLimit ?? 0) - (pack.consumedCredits ?? 0))),
-		size: pack.creditsLimit ?? 0
+		size: pack.creditsLimit ?? 0,
+		...typeof pack.endTimeMs === "number" && Number.isFinite(pack.endTimeMs) && pack.endTimeMs > 0 ? { expiresAtMs: pack.endTimeMs } : {}
 	}));
 	const remaining = (endpoint) => snapshot.packs.filter((pack) => pack.availableEndpoint === endpoint).reduce((sum, pack) => credit(sum + Math.max(0, (pack.creditsLimit ?? 0) - (pack.consumedCredits ?? 0))), 0);
 	return {
@@ -4233,6 +4529,10 @@ async function traeWebUsage(deps, region) {
 			message: safeMessage(error)
 		};
 	}
+	let appLogin;
+	try {
+		appLogin = await deps.liveLogin?.(region);
+	} catch {}
 	const account = {
 		accountId: accounts.find((item) => item.selected)?.id ?? "",
 		accountName: credential.accountName ?? credential.userId,
@@ -4240,6 +4540,7 @@ async function traeWebUsage(deps, region) {
 		region,
 		enabled,
 		accounts,
+		...appLogin === void 0 ? {} : { appLogin },
 		models: deps.displayModels(region).map((model) => ({
 			...model,
 			...model.input === void 0 ? {} : { input: [...model.input] }
@@ -4395,6 +4696,33 @@ function registerTraeUsageRoute(ctx, deps) {
 				}
 			}
 		});
+		/**
+		* Per-account status for one row of the card's account table (CN:
+		* check-in + balances; ai: subscription). Read-only, one upstream call per
+		* account, fetched once per table render. `accountId` rides in the query
+		* (a GET, like every other read-only sibling). Absent `accountStateOf`
+		* the route answers 503 so the table degrades to bare rows.
+		*/
+		const disposeAccountStatus = ctx.webServer.register({
+			kind: "exact",
+			path: TRAE_ACCOUNT_STATUS_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (deps.accountStateOf === void 0) return json(res, 503, { error: "account status unavailable" });
+				const region = requestRegion(req, res);
+				if (region === void 0) return;
+				const accountId = new URL(req.url ?? "/", "http://localhost").searchParams.get("accountId");
+				if (accountId === null || accountId.trim() === "") return json(res, 400, { error: "missing accountId" });
+				try {
+					const state = await deps.accountStateOf(region, accountId);
+					if (state === void 0) return json(res, 404, { error: "unknown account" });
+					json(res, 200, state);
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
 		const disposeAccounts = ctx.webServer.register({
 			kind: "exact",
 			path: TRAE_ACCOUNTS_REFRESH_PATH,
@@ -4490,6 +4818,27 @@ function registerTraeUsageRoute(ctx, deps) {
 				if (region === void 0) return;
 				if (region !== "cn") return json(res, 404, { error: "check-in is not available for the international region" });
 				try {
+					let accountId;
+					try {
+						accountId = await readAccountBody(req);
+					} catch {
+						accountId = void 0;
+					}
+					if (accountId !== void 0) {
+						if (deps.claimCheckinOf === void 0) return json(res, 503, { error: "check-in by account unavailable" });
+						const outcome = await deps.claimCheckinOf(region, accountId);
+						if (outcome === void 0) return json(res, 404, { error: "unknown account" });
+						const { claim, checkin: after } = outcome;
+						const deviceClaimed = claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED;
+						return json(res, 200, {
+							claimed: claim.claimed,
+							alreadyCheckedIn: after.checkedIn,
+							...deviceClaimed ? { deviceCheckedIn: true } : {},
+							code: claim.code,
+							message: claim.message,
+							checkin: toCheckin(after)
+						});
+					}
 					const client = deps.client(region);
 					const current = await client.checkinStatus();
 					if (!current.enabled) return json(res, 409, { error: "check-in is not enabled for this account" });
@@ -4529,6 +4878,7 @@ function registerTraeUsageRoute(ctx, deps) {
 			disposeModelsTest();
 			disposeAccounts();
 			disposeAccountCredits();
+			disposeAccountStatus();
 			disposeUsage();
 		};
 	}, "dsh-connect-trae: Web usage route");
@@ -4837,6 +5187,7 @@ const Config = z.object({
 	]).default("auto").description("Trae edition hint")),
 	accountId: z.string().description("Deprecated: pre-split account selector, attributed to its own region"),
 	showPointsInMainUi: asVolatile(z.boolean().default(false).description("在输入框工具栏显示积分读数「Trae CN · <数值>」（仅当选中的模型属于本插件时出现，可点击查看账号与积分明细）")),
+	followAppLogin: asVolatile(z.boolean().default(false).description("跟随 Trae 桌面端当前登录账号换绑（打开后每次配置生效时重绑到 App 现在登录的账号）")),
 	accounts: asVolatile(accountSelectionConfig.description("Per-region account selections, keyed cn | ai")),
 	regions: asVolatile(z.dict(regionStateConfig).default({}).description("Per-region model directory and selection, keyed cn | ai")),
 	lastCatalog: z.array(modelConfig).description("Deprecated: pre-region-split CN model directory"),
@@ -4949,16 +5300,27 @@ function apply(ctx, config) {
 			}], hint ?? (region === "ai" ? "solo-sg" : "cn"));
 		};
 		/**
-		* Resolution failures degrade to omitting DeviceInfo (its being required
-		* is unverified, docs/INTL_SG_EVIDENCE.md §5) rather than failing the
-		* refresh.
+		* The current refresh contract signs a DeviceProof with the install's own
+		* registered keypair, so every field the server reads must come from the
+		* SAME installation the credential belongs to.
+		*
+		* Resolution failures leave `deviceKeyPair` absent, and the refresh then
+		* degrades to the superseded contract instead of sending an unsigned
+		* request the server answers with `20405 Device proof required`.
 		*/
 		const refreshDeviceSafe = async () => {
 			try {
 				const value = await identity();
 				return {
 					deviceId: value.deviceId,
-					machineId: value.machineId
+					machineId: value.machineId,
+					...value.deviceName === void 0 ? {} : { deviceName: value.deviceName },
+					...value.deviceModel === void 0 ? {} : { deviceModel: value.deviceModel },
+					...value.deviceBrand === void 0 ? {} : { deviceBrand: value.deviceBrand },
+					...value.deviceCpu === void 0 ? {} : { deviceCpu: value.deviceCpu },
+					...value.osVersion === void 0 ? {} : { osVersion: value.osVersion },
+					...value.appVersion === void 0 ? {} : { appVersion: value.appVersion },
+					...value.deviceKeyPair === void 0 ? {} : { deviceKeyPair: value.deviceKeyPair }
 				};
 			} catch {
 				return;
@@ -5016,16 +5378,17 @@ function apply(ctx, config) {
 				ctx.logger.warn("dsh-connect-trae: Raw gateway unavailable; continuing with native SOLO tool-call channel", error);
 			}
 		})();
+		const usageClient = new TraeUsageClient({
+			credential: () => store.resolve(),
+			deviceId: async () => (await identity()).deviceId
+		});
 		stacks[region] = {
 			region,
 			store,
 			catalog,
 			shim,
 			delegating,
-			usageClient: new TraeUsageClient({
-				credential: () => store.resolve(),
-				deviceId: async () => (await identity()).deviceId
-			}),
+			usageClient,
 			/**
 			* Credit balance of one named account, WITHOUT rebinding the store
 			* (issue #25). The card asks this only after it saw the bound account
@@ -5042,6 +5405,39 @@ function apply(ctx, config) {
 				if (credential === void 0) return void 0;
 				return toCredits(await new TraeUsageClient({ credential: async () => credential }).snapshot());
 			},
+			accountStateOf: async (accountId) => {
+				const state = { id: accountId };
+				const selectedCredential = await store.current();
+				const client = selectedCredential !== void 0 && traeAccountId(selectedCredential) === accountId ? usageClient : (() => {
+					const credential = store.credentialOf(accountId);
+					return new TraeUsageClient({
+						credential: async () => credential,
+						deviceId: async () => (await identity()).deviceId
+					});
+				})();
+				if (region === "ai") {
+					state.payStatus = await client.payStatus();
+					return state;
+				}
+				const [snapshot, checkin] = await Promise.allSettled([client.snapshot(), client.checkinStatus()]);
+				if (snapshot.status === "fulfilled") state.credits = toCredits(snapshot.value);
+				if (checkin.status === "fulfilled") state.checkin = toCheckin(checkin.value);
+				return state;
+			},
+			claimCheckinOf: async (accountId) => {
+				const selectedCredential = await store.current();
+				const client = selectedCredential !== void 0 && traeAccountId(selectedCredential) === accountId ? usageClient : (() => {
+					const credential = store.credentialOf(accountId);
+					return new TraeUsageClient({
+						credential: async () => credential,
+						deviceId: async () => (await identity()).deviceId
+					});
+				})();
+				return {
+					claim: await client.claimCheckin(),
+					checkin: await client.checkinStatus()
+				};
+			},
 			discoverModels: async (signal) => {
 				const merged = mergeTraeModelSources(await withDirectoryRetry(() => remoteCatalog.fetchModels(signal)), await solo.fetchModels(signal));
 				wire.callableKeys.clear();
@@ -5092,6 +5488,49 @@ function apply(ctx, config) {
 			rawDiagnostic: () => rawDiagnostic()
 		};
 	}
+	/**
+	* The app's current sign-in when it differs from the bound account (issue
+	* #29). Pure read: the store resolves the bound account verbatim, so billing
+	* never moves from here — the card's hint and the follow switch below are
+	* the only writers.
+	*/
+	const liveLoginOf = async (region) => {
+		try {
+			const live = await stacks[region].store.liveLogin();
+			if (live === void 0 || live.region !== region) return void 0;
+			return {
+				id: live.id,
+				accountName: live.accountName,
+				edition: live.edition,
+				region: live.region
+			};
+		} catch {
+			return;
+		}
+	};
+	/**
+	* Persist `accounts.<region>` = the app's live sign-in and rebind the store
+	* (issue #29). The ONE Host-side path that moves the binding, driven by the
+	* follow switch in {@link maybeFollowAppLogin}; the card's one-click hint
+	* goes through its own settings write instead (one writer per path). Returns
+	* the applied login so the caller can report what moved.
+	*
+	* The write goes through `settings.update` (the volatile write gate), not a
+	* direct config mutation: `apply()` receives a snapshot, and the settings
+	* event (`loader/volatile-update`) is what re-runs `applySelection` with the
+	* updated document — the same channel every card write already uses.
+	*/
+	const followAppLogin = async (region) => {
+		const live = await liveLoginOf(region);
+		if (live === void 0 || writeSettings === void 0) return void 0;
+		const configured = configuredAccountsOf(current());
+		if (configured[region] === live.id) return live;
+		await writeSettings({ accounts: {
+			...configured,
+			[region]: live.id
+		} });
+		return live;
+	};
 	ctx.inject(["webServer"], (webCtx) => registerTraeUsageRoute(webCtx, {
 		store: (region) => stacks[region].store,
 		client: (region) => stacks[region].usageClient,
@@ -5101,7 +5540,10 @@ function apply(ctx, config) {
 		discoverModels: (region, signal) => stacks[region].discoverModels(signal),
 		probeModels: (region, ids) => stacks[region].probeModels(ids),
 		rawDiagnostic: (region) => stacks[region].rawDiagnostic(),
-		creditsOfAccount: (region, accountId) => stacks[region].creditsOfAccount(accountId)
+		creditsOfAccount: (region, accountId) => stacks[region].creditsOfAccount(accountId),
+		accountStateOf: (region, accountId) => stacks[region].accountStateOf(accountId),
+		claimCheckinOf: (region, accountId) => stacks[region].claimCheckinOf(accountId),
+		liveLogin: (region) => liveLoginOf(region)
 	}));
 	/**
 	* Live registration handles per region, filled once the shim is listening.
@@ -5157,13 +5599,59 @@ function apply(ctx, config) {
 			}
 		} catch {}
 	})();
+	let writeSettings;
 	ctx.inject(["settings"], (settingsCtx) => {
 		const settings = settingsCtx.settings;
 		ctx.effect(() => settings.configure({ auto: true }, ctx.fiber));
+		writeSettings = async (patch) => {
+			const revision = () => settings.describe().find((entry) => entry.ns === settingsNs)?.revision;
+			const conflict = (error) => typeof error === "object" && error !== null && error.code === "SETTINGS_CONFLICT";
+			try {
+				await settings.update(settingsNs, patch, revision());
+			} catch (error) {
+				if (!conflict(error)) throw error;
+				await settings.update(settingsNs, patch, revision());
+			}
+		};
+		ctx.effect(() => () => {
+			writeSettings = void 0;
+		});
 	});
 	ctx.on("loader/volatile-update", () => {
 		applySelection(current());
+		maybeFollowAppLogin();
 	});
+	/**
+	* Follow the app's sign-in on every settings change when the switch is ON
+	* (issue #29). Runs AFTER `applySelection` so this pass binds the previous
+	* document, reads the app's live login against it, and — if they differ —
+	* writes `accounts.<region>` once; that write emits `volatile-update` again,
+	* which re-runs `applySelection` on the NEW document. The loop terminates on
+	* its own the moment `liveLogin()` reports no mismatch (the second pass binds
+	* the live account, so `preferred` and `current` agree). The guard below
+	* additionally forbids two writes in flight, so a stuck mismatch can never
+	* turn into a write storm: the next settings change retries from scratch.
+	*
+	* The switch reads FALSE for an existing config (see {@link Config}), so a
+	* user who never opted in never gets a rebind — the card's one-click hint is
+	* their path instead.
+	*/
+	let followInFlight = false;
+	const maybeFollowAppLogin = async () => {
+		if (followInFlight || !followAppLoginEnabled(current())) return;
+		followInFlight = true;
+		try {
+			for (const region of REGION_KEYS) {
+				if (!regionEnabled(current(), region)) continue;
+				await followAppLogin(region);
+			}
+		} catch (error) {
+			ctx.logger.warn("dsh-connect-trae: follow-app-login rebind skipped", error);
+		} finally {
+			followInFlight = false;
+		}
+	};
+	maybeFollowAppLogin();
 	let stopped = false;
 	ctx.effect(() => () => {
 		stopped = true;
@@ -5245,4 +5733,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, REGION_GATEWAYS, SseDecoder, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, TraeCatalog, TraeCredentialStore, TraeDelegatingUpstreamClient, TraeFallbackUpstreamClient, TraeGatedUpstreamClient, TraeRawCapabilityController, TraeRawCapabilityState, TraeRawChatUpstreamClient, TraeSoloBridge, TraeSoloRemoteCatalogClient, TraeSoloUpstreamClient, TraeUsageClient, UnconfiguredTraeUpstreamClient, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, createTraeAdapter, createTraeRawGateway, createTraeShim, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, discoveredCatalog, fallbackModelsFor, hashTraeRawChatArg, identityHeaders, inject, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withTraeRegion };
+export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, REGION_GATEWAYS, SseDecoder, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, TraeCatalog, TraeCredentialStore, TraeDelegatingUpstreamClient, TraeFallbackUpstreamClient, TraeGatedUpstreamClient, TraeRawCapabilityController, TraeRawCapabilityState, TraeRawChatUpstreamClient, TraeSoloBridge, TraeSoloRemoteCatalogClient, TraeSoloUpstreamClient, TraeUsageClient, UnconfiguredTraeUpstreamClient, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, discoveredCatalog, fallbackModelsFor, followAppLoginEnabled, hashTraeRawChatArg, identityHeaders, inject, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withTraeRegion };