dsh-connect-trae 3.9.2 → 3.10.1

package/lib/index.js

@@ -6,15 +6,15 @@ import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { readFile, rm, stat } from "node:fs/promises";
-import { createDecipheriv, createHash, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
+import { copyFile, readFile, rm, stat } from "node:fs/promises";
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { cpus, homedir, hostname, release, userInfo } from "node:os";
-import { createServer } from "node:http";
-import { Readable } from "node:stream";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { createServer } from "node:http";
+import { Readable } from "node:stream";
 //#region src/catalog.ts
 /**
 * Bootstrap catalog: identity only where current Trae metadata has not been
@@ -966,11 +966,6 @@ function regionOfCredential(credential) {
 }
 //#endregion
 //#region src/status-paths.ts
-/**
-* Node-free constants and types shared by the Host and browser halves.
-* Mirrors the `dsh-workbuddy-connect` status-route pattern so the plugin card
-* stays consistent with that project's external presentation.
-*/
 /** Plugin-owned usage endpoint consumed by its browser half. */
 const TRAE_USAGE_PATH = "/plugins/dsh-connect-trae/usage";
 /** Plugin-owned live model refresh endpoint. */
@@ -1038,7 +1033,7 @@ function poolActionOf(url) {
 	const at = url.indexOf("?");
 	if (at === -1) return void 0;
 	const value = new URLSearchParams(url.slice(at + 1)).get(TRAE_POOL_ACTION_PARAM);
-	return value === "checkin" || value === "test" || value === "remove" ? value : void 0;
+	return value === "checkin" || value === "test" || value === "remove" || value === "delete" ? value : void 0;
 }
 /**
 * Read the ONE account a per-row pool request addresses, from the QUERY string.
@@ -1579,6 +1574,54 @@ function decryptTraeStorageValue(encoded) {
 	if (!expected.equals(actual)) throw new Error("Trae auth integrity check failed");
 	return plaintext.toString("utf8");
 }
+/**
+* Re-encrypts one `iCubeAuthInfo` value the way Trae itself stores it.
+*
+* Needed only to rewrite the app's own `storage.json` after removing an account:
+* dropping a key from the plaintext JSON is useless unless the result is sealed
+* again with the same scheme, because Trae will fail to decrypt anything else.
+* The format is [6-byte header][32-byte random][AES-128-CBC ciphertext], where
+* the key/IV come from `sha512(sha512(random) || salt)` and the ciphertext holds
+* `sha512(body) || body`. A fresh random is drawn per call, so encrypting the
+* same plaintext twice yields different bytes — exactly like the app.
+*
+* `aes-private` (SALT_C ^ SALT_D) is supported because a value can be read in
+* that shape; the default matches every value observed in shipped storage files.
+*/
+function encryptTraeStorageValue(plaintext, type = "aes") {
+	const body = Buffer.from(plaintext, "utf8");
+	const digest = createHash("sha512").update(body).digest();
+	const random = randomBytes(32);
+	const salt = type === "aes-private" ? xor(SALT_C, SALT_D) : xor(SALT_A, SALT_B);
+	const first = createHash("sha512").update(random).digest();
+	const derived = createHash("sha512").update(Buffer.concat([first, salt])).digest();
+	const cipher = createCipheriv("aes-128-cbc", derived.subarray(0, 16), derived.subarray(16, 32));
+	const encrypted = Buffer.concat([cipher.update(Buffer.concat([digest, body])), cipher.final()]);
+	const header = type === "aes-private" ? Buffer.from([
+		18,
+		57,
+		32,
+		32,
+		2,
+		3
+	]) : Buffer.from([
+		116,
+		99,
+		5,
+		16,
+		0,
+		0
+	]);
+	return Buffer.concat([
+		header,
+		random,
+		encrypted
+	]).toString("base64");
+}
+/** The encryption family of an encoded value, for a byte-faithful rewrite. */
+function traeStorageValueType(encoded) {
+	return encryptionType(Buffer.from(encoded, "base64").subarray(0, 6));
+}
 function parseTraeAuthValue(value) {
 	const trimmed = value.trim();
 	if (trimmed === "") throw new Error("Trae auth value is empty");
@@ -1634,6 +1677,7 @@ function parseTraeCliToken(text) {
 }
 //#endregion
 //#region src/paths.ts
+/** The macOS app-support directory name each edition writes, per edition. */
 const APP_NAMES = {
 	cn: "Trae CN",
 	sg: "Trae",
@@ -1764,6 +1808,80 @@ function traeCliCandidates(platform = process.platform, home = homedir(), env =
 	return result;
 }
 //#endregion
+//#region src/trae-process.ts
+const run = promisify(execFile);
+/**
+* Why this exists at all: Trae keeps `storage.json` in memory and flushes it over
+* the file. Rewriting that file while the app runs is silently undone on its next
+* write — the account reappears and the user is told the deletion failed twice
+* for two different reasons. So the delete refuses while the matching app is up
+* and says which app to quit.
+*
+* This is a helper, never a gate on correctness: if the probe itself fails
+* (`ps` missing, sandbox denial) the answer is "nothing is running", and the
+* write proceeds. A false negative costs a retry; a false positive would block a
+* deletion that would have worked.
+*/
+const probeRunningTraeApps = async () => {
+	try {
+		if (process.platform === "darwin") {
+			const { stdout } = await run("ps", ["-Ao", "command"], { maxBuffer: 16777216 });
+			return traeEditionsInCommands(stdout, "Application Support");
+		}
+		if (process.platform === "linux") {
+			const { stdout } = await run("ps", ["-Ao", "args"], { maxBuffer: 16777216 });
+			return traeEditionsInCommands(stdout, ".config");
+		}
+		if (process.platform === "win32") {
+			const { stdout } = await run("tasklist", [
+				"/FO",
+				"CSV",
+				"/NH"
+			], { maxBuffer: 16777216 });
+			return /trae/i.test(stdout) ? /* @__PURE__ */ new Set([
+				"cn",
+				"sg",
+				"solo",
+				"solo-sg"
+			]) : /* @__PURE__ */ new Set();
+		}
+	} catch {}
+	return /* @__PURE__ */ new Set();
+};
+/**
+* Editions whose app-support directory appears in a process listing.
+*
+* The names are prefixes of each other (`Trae` vs `Trae CN`), so the match is
+* made longest-first at each occurrence and consumes the name it claimed. A
+* plain `includes('Trae')` would report the international app running whenever
+* only `Trae CN` was, and the delete would then refuse for the wrong edition.
+*/
+function traeEditionsInCommands(commands, supportDir) {
+	const running = /* @__PURE__ */ new Set();
+	const editions = [
+		"cn",
+		"sg",
+		"solo",
+		"solo-sg"
+	].map((edition) => ({
+		edition,
+		name: APP_NAMES[edition]
+	})).sort((a, b) => b.name.length - a.name.length);
+	const marker = `${supportDir}/`;
+	let cursor = commands.indexOf(marker);
+	while (cursor !== -1) {
+		let consumed = 0;
+		for (const { edition, name } of editions) {
+			if (!commands.startsWith(name, cursor + marker.length)) continue;
+			running.add(edition);
+			consumed = name.length;
+			break;
+		}
+		cursor = commands.indexOf(marker, cursor + marker.length + consumed);
+	}
+	return running;
+}
+//#endregion
 //#region src/auth.ts
 /** Host used for CLI tokens, which carry no host claim of their own. */
 const CLI_DEFAULT_HOST = "https://api.trae.cn";
@@ -1812,6 +1930,20 @@ function traeOwnAuthPath(region) {
 function legacyTraeOwnAuthPath() {
 	return join(resolveDshHome(), TRAE_AUTH_FILENAME);
 }
+/**
+* Where the "this copy was deleted on purpose" tombstones live.
+*
+* The store mirrors every local Trae login into its own copy on each refresh
+* (see `mirrorLocalLogins`). Without a tombstone the mirror would recreate a
+* copy the user just deleted on the very next poll — "delete" would look broken
+* again, which is the exact complaint this mechanism exists to fix. A tombstone
+* therefore suppresses the mirror for one account id, and is dropped as soon as
+* that id is no longer signed in to the app: a later sign-in is a NEW login and
+* is mirrored again.
+*/
+function traeDeletedAccountsPath(region) {
+	return join(resolveDshHome(), region === void 0 ? ".trae-deleted.json" : `${TRAE_OWN_PREFIX}.deleted.${region}.json`);
+}
 function optionalString(value) {
 	return typeof value === "string" && value !== "" ? value : void 0;
 }
@@ -1951,6 +2083,42 @@ async function writeOwn(path, credentials) {
 		dirMode: 448
 	});
 }
+/** The key Trae stores the per-user region map under, beside the login itself. */
+const TRAE_USERTAG_STORAGE_KEY = "iCubeAuthInfo://usertag";
+/**
+* Rewrites one Trae `storage.json` so it no longer carries the given login.
+*
+* Everything else in the document is preserved byte-for-byte at the JSON level:
+* only the auth value is dropped and the usertag map loses this one user. Both
+* the backup and the atomic write exist because this is the one operation in the
+* plugin that edits a file belonging to another application.
+*/
+async function eraseDesktopLogin(path, document, claims, encoded) {
+	const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+	try {
+		await copyFile(path, `${path}.dsh-backup-${stamp}`);
+	} catch {
+		return false;
+	}
+	const next = { ...document };
+	delete next[TRAE_AUTH_STORAGE_KEY];
+	const userTag = document[TRAE_USERTAG_STORAGE_KEY];
+	const userId = typeof claims["userId"] === "string" || typeof claims["userId"] === "number" ? String(claims["userId"]) : void 0;
+	if (userId !== void 0 && typeof userTag === "string") try {
+		const decoded = parseTraeAuthValue(userTag);
+		if (typeof decoded === "object" && decoded !== null && !Array.isArray(decoded)) {
+			const tags = { ...decoded };
+			delete tags[userId];
+			next[TRAE_USERTAG_STORAGE_KEY] = encryptTraeStorageValue(JSON.stringify(tags), traeStorageValueType(userTag));
+		}
+	} catch {}
+	try {
+		await writeFileAtomic(path, `${JSON.stringify(next, null, 2)}\n`, { mode: 384 });
+		return !(await readFile(path, "utf8")).includes(encoded);
+	} catch {
+		return false;
+	}
+}
 var TraeCredentialStore = class {
 	storagePathOverride;
 	edition;
@@ -1963,6 +2131,7 @@ var TraeCredentialStore = class {
 	legacyOwnPathExplicit;
 	refresh;
 	refreshMarginMs;
+	runningApps;
 	inflight;
 	/**
 	* In-flight refreshes of individual accounts, one per account id.
@@ -2007,6 +2176,7 @@ var TraeCredentialStore = class {
 		this.legacyOwnPathExplicit = options.legacyOwnPath;
 		this.refresh = options.refresh;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
+		this.runningApps = options.runningApps ?? probeRunningTraeApps;
 	}
 	/** Whether a credential's own claim belongs to this store's region. */
 	matchesRegion(credential) {
@@ -2040,6 +2210,93 @@ var TraeCredentialStore = class {
 			traeOwnAuthPath("ai")
 		];
 	}
+	/**
+	* Where the "deleted copy" tombstones live for this store.
+	*
+	* Derived from the store's own copy path, so a test that pins `ownPath` also
+	* pins the tombstones and can never touch the real `~/.dsh` file.
+	*/
+	deletedPath() {
+		if (this.ownPathExplicit !== void 0) return `${this.ownPathExplicit}.deleted`;
+		if (this.legacyOwnPathExplicit !== void 0) return `${this.legacyOwnPathExplicit}.deleted`;
+		return traeDeletedAccountsPath(this.region);
+	}
+	/**
+	* The account ids whose copy the user deleted on purpose.
+	*
+	* Read defensively: a missing, unreadable, or hand-edited file means "no
+	* tombstones", never a failing store — losing the list only re-mirrors an
+	* account, it never locks the user out.
+	*/
+	async readTombstones() {
+		const text = await readFile(this.deletedPath(), "utf8").catch(() => "");
+		if (text.trim() === "") return /* @__PURE__ */ new Set();
+		try {
+			const parsed = JSON.parse(text);
+			const ids = Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.ids) ? parsed.ids : [];
+			return new Set(ids.filter((id) => typeof id === "string" && TRAE_ACCOUNT_ID_RE.test(id)));
+		} catch {
+			return /* @__PURE__ */ new Set();
+		}
+	}
+	async writeTombstones(ids) {
+		const path = this.deletedPath();
+		await withFileLock(path, async () => {
+			await writeFileAtomic(path, `${JSON.stringify({
+				version: 1,
+				ids: [...ids]
+			}, null, 2)}\n`, {
+				mode: 384,
+				dirMode: 448
+			});
+		});
+	}
+	/**
+	* Copy every local Trae sign-in into this store's own file, once.
+	*
+	* The plugin presents COPIES, not the app's live login: the app has a single
+	* sign-in slot that the next Trae login overwrites, so an account could only
+	* ever be billed until the user switched apps. Keeping a copy per account is
+	* what makes a multi-account pool survive those switches.
+	*
+	* This runs on every `accounts()` read — the card's refresh, the pool's member
+	* read, the "detect accounts" press — and is additive:
+	*   - an account that already has a copy is left exactly as it is (the copy
+	*     may hold a token this plugin refreshed, which is fresher than the app's);
+	*   - an account the user DELETED stays deleted while it is still signed in to
+	*     the app, via a tombstone that is dropped once the app no longer holds it
+	*     (so a later sign-in is mirrored again).
+	*/
+	async mirrorLocalLogins() {
+		const { credentials: discovered } = await this.readDesktopAll();
+		const own = await this.readOwns();
+		const ownIds = new Set(own.map((credential) => traeAccountId(credential)));
+		const tombstones = await this.readTombstones();
+		const liveIds = new Set(discovered.map((credential) => traeAccountId(credential)));
+		let tombstonesChanged = false;
+		for (const id of [...tombstones]) {
+			if (liveIds.has(id)) continue;
+			tombstones.delete(id);
+			tombstonesChanged = true;
+		}
+		const missing = discovered.filter((credential) => this.matchesRegion(credential) && !ownIds.has(traeAccountId(credential)) && !tombstones.has(traeAccountId(credential)));
+		if (tombstonesChanged) await this.writeTombstones(tombstones);
+		if (missing.length === 0) return;
+		const ownPath = this.ownAuthPath();
+		await withFileLock(ownPath, async () => {
+			const existing = await readFile(ownPath, "utf8").then(parseOwn, () => []);
+			const byId = new Map(existing.map((credential) => [traeAccountId(credential), credential]));
+			for (const credential of missing) {
+				const id = traeAccountId(credential);
+				if (byId.has(id)) continue;
+				byId.set(id, {
+					...credential,
+					source: "dsh"
+				});
+			}
+			await writeOwn(ownPath, [...byId.values()]);
+		});
+	}
 	setSource(storagePath, edition = "auto", accountId) {
 		this.storagePathOverride = storagePath;
 		this.edition = edition;
@@ -2137,8 +2394,15 @@ var TraeCredentialStore = class {
 		return eligible.length > 0 ? eligible : discovered;
 	}
 	async accounts() {
+		await this.mirrorLocalLogins();
 		const discovered = await this.readAll();
-		const offered = this.offered(discovered);
+		const copyIds = /* @__PURE__ */ new Set();
+		for (const credential of await this.readOwns()) {
+			if (!this.matchesRegion(credential)) continue;
+			copyIds.add(traeAccountId(credential));
+		}
+		const visible = discovered.filter((credential) => copyIds.has(traeAccountId(credential)));
+		const offered = this.offered(visible);
 		const inUse = this.inUse(discovered, offered);
 		/**
 		* Never hide the account we are actually billing.
@@ -2159,7 +2423,7 @@ var TraeCredentialStore = class {
 			edition: credential.edition,
 			enterprise: isEnterpriseAccount(credential),
 			region: regionOfCredential(credential),
-			source: credential.source,
+			source: "dsh",
 			tokenExpiresAtMs: credential.expiresAtMs,
 			...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs: credential.refreshExpiresAtMs },
 			selected: inUseId !== void 0 && traeAccountId(credential) === inUseId
@@ -2269,6 +2533,21 @@ var TraeCredentialStore = class {
 		return (await this.readAll()).find((credential) => traeAccountId(credential) === accountId);
 	}
 	/**
+	* The PLUGIN'S OWN COPY of one account — never the Trae app's credential.
+	*
+	* {@link credentialOf} answers from the merged view (copies plus the app's
+	* logins) and prefers whichever is fresher. That is right for placing a
+	* request, but wrong for HANDING CREDENTIALS OUT: an export must carry the
+	* copies this plugin owns and refreshes, not whatever the app happens to have
+	* on disk. The two are normally identical — the copy is mirrored from the app
+	* — but only the copy is ours, and an account with no copy is not ours to
+	* export at all (undefined, no fallback to the app's login).
+	*/
+	async copyOf(accountId) {
+		if (accountId === "") return void 0;
+		return (await this.readOwns()).find((credential) => traeAccountId(credential) === accountId);
+	}
+	/**
 	* A SPECIFIC account's credential, refreshed when its access token is due.
 	*
 	* {@link credentialOf} is a pure lookup and hands back an expired token as-is,
@@ -2385,6 +2664,133 @@ var TraeCredentialStore = class {
 		}
 	}
 	/**
+	* Remove ONE account from the plugin-owned copy (per-region file, legacy
+	* single file), where this store can rewrite the shape it wrote.
+	*
+	* The desktop storage files are deliberately untouched: their credential is
+	* a Trae app login that only Trae can rewrite, so a plugin removing it would
+	* corrupt an application state it does not own. `deleteAccount` therefore
+	* only ever commits what this plugin persisted — the refreshed copy the
+	* store owns — and reports what it did.
+	*
+	* `stillSignedIn` is true when the SAME account id still resolves to a
+	* desktop storage copy, i.e. the account will keep appearing (from Trae's own
+	* login) even after the plugin's copy is gone. The card then shows the user
+	* where the account really lives instead of implying a deletion that did not
+	* take: the account is still signed in Trae, and Trae is the only writer that
+	* can remove it.
+	*
+	* @returns `{ deleted: boolean; stillSignedIn: boolean }` — `deleted` is
+	* whether a plugin-owned copy of this account was actually removed;
+	* `stillSignedIn` reports a TRAE-owned login that survives it.
+	*/
+	/**
+	* Erases this account's login from Trae's OWN storage files.
+	*
+	* Deleting only the plugin's copy of an account the app itself is signed in to
+	* changes nothing the user can see: the app keeps reporting the account, the
+	* row comes back on the next poll, and "delete" looks broken. The only real
+	* deletion therefore has to rewrite the app's `storage.json`, which means
+	* (a) re-encrypting the values that stay, with Trae's own scheme, and (b)
+	* refusing while that app runs — its in-memory state would be flushed back
+	* over the file and undo the edit.
+	*
+	* A backup of every rewritten file is left beside it (`.dsh-backup-<stamp>`),
+	* because signing a user's editor out is not something to do without a way back.
+	*/
+	async deleteDesktopLogins(accountId) {
+		const signedOut = [];
+		const blocked = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const candidate of this.candidates()) {
+			if (candidate.source !== "desktop" || seen.has(candidate.path)) continue;
+			seen.add(candidate.path);
+			const document = await readFile(candidate.path, "utf8").then((text) => JSON.parse(text)).catch(() => void 0);
+			if (document === void 0) continue;
+			const encoded = document[TRAE_AUTH_STORAGE_KEY];
+			if (typeof encoded !== "string") continue;
+			let claims;
+			try {
+				const parsed = parseTraeAuthValue(encoded);
+				if (typeof parsed !== "object" || parsed === null) continue;
+				claims = parsed;
+			} catch {
+				continue;
+			}
+			const credential = normalizeTraeCredential(claims, candidate.edition, "desktop");
+			if (credential === void 0 || traeAccountId(credential) !== accountId) continue;
+			if ((await this.runningApps().catch(() => /* @__PURE__ */ new Set())).has(candidate.edition)) {
+				blocked.push(candidate.edition);
+				continue;
+			}
+			if (await eraseDesktopLogin(candidate.path, document, claims, encoded)) signedOut.push(candidate.edition);
+			else blocked.push(candidate.edition);
+		}
+		return {
+			signedOut: [...new Set(signedOut)],
+			blocked: [...new Set(blocked)]
+		};
+	}
+	/**
+	* Delete this store's COPY of one account.
+	*
+	* What the plugin shows and bills is the copy, so that is the first thing
+	* "delete" removes. The copy alone is not enough: the same login usually also
+	* lives in the app's own `storage.json`, and the app keeps reporting it, so
+	* the delete then erases that login too (see `deleteDesktopLogins`, which
+	* refuses while the app runs and leaves a backup beside every file it
+	* rewrites).
+	*
+	* The catch is the mirror: `accounts()` recreates a copy from any local login
+	* that lacks one, so deleting the copy of an account still signed in to Trae
+	* would resurrect it on the next poll. A TOMBSTONE records the deletion for
+	* exactly that id; the mirror skips it while the app still holds the login and
+	* drops the tombstone once it does not, so signing in again later mirrors it
+	* again. That is why `stillSignedIn` is reported: it explains that the account
+	* still lives in Trae even though the plugin no longer shows it.
+	*
+	* @returns `{ deleted, stillSignedIn, hadCopy, signedOutApps, blockedApps }` —
+	* `deleted` is "this machine no longer carries the account anywhere" (true
+	* even when there was never a copy, so a ghost member can be cleared);
+	* `stillSignedIn` answers "is it still a live Trae login here?"; `hadCopy` is
+	* "did a file actually change?"; `signedOutApps` names the apps whose login
+	* was erased; `blockedApps` names the apps that were running, in which case
+	* nothing was erased and `deleted` is false.
+	*/
+	async deleteAccount(accountId) {
+		let mutated = false;
+		for (const path of this.ownCandidates()) {
+			const dropped = await withFileLock(path, async () => {
+				const existing = await readFile(path, "utf8").then(parseOwn, () => null);
+				if (existing === null || !existing.some((credential) => traeAccountId(credential) === accountId)) return false;
+				const next = existing.filter((credential) => traeAccountId(credential) !== accountId);
+				await writeOwn(path, next);
+				return true;
+			}).catch(() => false);
+			mutated = mutated || dropped;
+		}
+		const tombstones = await this.readTombstones();
+		if (!tombstones.has(accountId)) {
+			tombstones.add(accountId);
+			await this.writeTombstones(tombstones).catch(() => void 0);
+		}
+		if (this.accountId === accountId) {
+			this.accountId = void 0;
+			this.inflight = void 0;
+		}
+		const { signedOut, blocked } = await this.deleteDesktopLogins(accountId);
+		const stillInOwn = (await this.readOwns()).some((credential) => traeAccountId(credential) === accountId);
+		const { credentials: discovered } = await this.readDesktopAll();
+		const stillSignedIn = discovered.some((credential) => traeAccountId(credential) === accountId);
+		return {
+			deleted: !stillInOwn && !stillSignedIn,
+			stillSignedIn,
+			hadCopy: mutated || signedOut.length > 0,
+			signedOutApps: signedOut,
+			blockedApps: blocked
+		};
+	}
+	/**
 	* Every local credential of this store's region, deduplicated by account id.
 	* A region-scoped store sees only its own region's credentials: the other
 	* region's accounts are invisible to selection, refresh, and status alike,
@@ -4271,6 +4677,39 @@ async function bridgeTraeSoloStreamOrFail(response, model) {
 		response: bridgeTraeSource(opened.source, model)
 	};
 }
+/**
+* The startup wire map for one region's merged directory.
+*
+* EVERY row is registered, not only the ones whose wire config_name differs
+* from the display id. The runtime catalog is filtered by `enabledModelIds`, so
+* a pool that targets a model the user never enabled for chat would otherwise
+* reach the bridge with no catalog row AND no mapping — and the request would
+* carry the raw id under the DEFAULT function, which answers `4001 config_name
+* rejected` (Doubao-Seed-Code is served only by `solo_agent_remote`;
+* `solo_work_lite` rejects it). The identity mapping is what keeps the
+* discovered function alive for those ids.
+*
+* First row wins a display name: two directory ids can share one (`Seed-Code`),
+* and overwriting would answer with the later row's config_name. Ids are
+* unique, so `byId` needs no such guard.
+*/
+function wireTargetsOf(models) {
+	const byId = /* @__PURE__ */ new Map();
+	const byName = /* @__PURE__ */ new Map();
+	for (const model of models) {
+		const target = {
+			configName: model.wireConfigName ?? model.id,
+			...model.wireFunction === void 0 ? {} : { function: model.wireFunction }
+		};
+		byId.set(model.id, target);
+		const nameKey = model.name.trim().toLowerCase();
+		if (!byName.has(nameKey)) byName.set(nameKey, target);
+	}
+	return {
+		byId,
+		byName
+	};
+}
 /** Native SOLO client wrapper used by the loopback OpenAI adapter. */
 var TraeSoloBridge = class {
 	upstream;
@@ -4294,7 +4733,23 @@ var TraeSoloBridge = class {
 				...entry.wireFunction === void 0 ? {} : { function: entry.wireFunction }
 			};
 			const fromResolver = this.wireResolver?.(model) ?? this.wireResolver?.(entry?.name ?? "");
-			const target = fromCatalog ?? fromResolver;
+			/**
+			* The catalog row wins the config_name, but it may not know the function.
+			*
+			* A row persisted by an older build -- or one whose `wireFunction` the
+			* settings schema dropped -- carries the name mapping only, and asking
+			* without the function is a `4001 config_name rejected` for every model
+			* that a non-default function serves (`Doubao-Seed-Code` lives on
+			* `solo_agent_remote` alone). The resolver is built from the same
+			* directory, so borrowing its function is safe exactly when both sources
+			* agree on the wire config_name; a disagreement means the resolver found
+			* a different row and its function would be wrong.
+			*/
+			const sameWireConfig = fromCatalog !== void 0 && fromResolver !== void 0 && fromCatalog.configName.toLowerCase() === fromResolver.configName.toLowerCase();
+			const target = fromCatalog !== void 0 && fromCatalog.function === void 0 && sameWireConfig && fromResolver !== void 0 ? {
+				configName: fromCatalog.configName,
+				...fromResolver.function === void 0 ? {} : { function: fromResolver.function }
+			} : fromCatalog ?? fromResolver;
 			/**
 			* Last line of defence: the discovered row's own id.
 			*
@@ -6635,7 +7090,7 @@ async function traeWebPool(deps, panel) {
 		const credits = entry?.credits;
 		const checkin = checkinState[row.account.id];
 		const excludedBy = excludedById.get(row.account.id);
-		const accountName = row.account.accountName !== "" ? row.account.accountName : memberNames[row.account.id] ?? measured?.accountName ?? "";
+		const accountName = row.account.accountName !== "" ? row.account.accountName : memberNames[row.account.id] ?? measured?.accountName ?? row.account.id;
 		return {
 			accountId: row.account.id,
 			accountName,
@@ -6679,9 +7134,12 @@ async function traeWebPool(deps, panel) {
 		else if (ranked.every((row) => row.excludedBy !== void 0)) noCandidate = new Set(ranked.map((row) => row.excludedBy)).size === 1 ? ranked[0]?.excludedBy ?? "unusable" : "unusable";
 	}
 	const effectiveMemberAccountIds = effectiveMembersOf(rows.filter((row) => row.member).map((row) => row.account.id), new Set(members.map((member) => member.account.id)));
+	const copies = await deps.copiesOf?.(panel).catch(() => void 0);
 	return {
 		enabled: preferences.enabled === true,
 		checkinSupported: pool.checkin !== void 0 && regionOfPanel(panel) === "cn",
+		...deps.deleteAccountOf === void 0 ? {} : { deleteSupported: true },
+		...copies === void 0 ? {} : { copies },
 		...target.modelId === void 0 ? {} : { targetModelId: target.modelId },
 		targetModelSource: target.source,
 		probeInputTokens: Math.max(0, preferences.probeInputTokens ?? 0),
@@ -6878,7 +7336,7 @@ function registerTraeUsageRoute(ctx, deps) {
 						const records = [];
 						for (const account of await store.accounts()) {
 							if (!wanted.has(account.id)) continue;
-							const credential = await store.credentialOf(account.id).catch(() => void 0);
+							const credential = await store.copyOf(account.id).catch(() => void 0);
 							if (credential === void 0) continue;
 							records.push(traeTransferRecordOf(credential, {
 								auth: {
@@ -7091,6 +7549,19 @@ function registerTraeUsageRoute(ctx, deps) {
 					}
 					return;
 				}
+				if (action === "delete") {
+					if (accountId === void 0) return json(res, 400, { error: "delete needs an accountId" });
+					if (deps.deleteAccountOf === void 0) return json(res, 503, { error: "account deletion unavailable" });
+					try {
+						json(res, 200, {
+							accountId,
+							...await deps.deleteAccountOf(panel, accountId)
+						});
+					} catch (error) {
+						json(res, 500, { error: safeMessage(error) });
+					}
+					return;
+				}
 				/**
 				* Both remaining actions need a NON-EMPTY effective pool.
 				*
@@ -8116,6 +8587,23 @@ function apply(ctx, config) {
 		byId: /* @__PURE__ */ new Map(),
 		byName: /* @__PURE__ */ new Map()
 	};
+	/**
+	* Warm the wire map before anything spends quota.
+	*
+	* The bridge resolves a model's directory function from the wire map,
+	* falling back to the catalog row. Right after a restart neither may be
+	* populated yet — discovery only runs when the host refreshes its model list
+	* — and a probe sent without the function is answered `4001` for every model
+	* that a non-default function serves (`Doubao-Seed-Code` lives on
+	* `solo_agent_remote`). One discovery here is cheaper than telling the user
+	* that a working account is unavailable.
+	*/
+	const warmWireMap = async (panel) => {
+		if (wireState[panel].resolved) return;
+		try {
+			await stacks[panel].discoverModels();
+		} catch {}
+	};
 	const dropDeadModels = (rows, panel) => {
 		const wire = wireState[panel];
 		if (!wire.resolved) return rows;
@@ -8423,16 +8911,9 @@ function apply(ctx, config) {
 					wire.callableKeys.add(model.name.trim().toLowerCase());
 				}
 				wire.resolved = merged.length > 0;
-				wire.byId.clear();
-				wire.byName.clear();
-				for (const model of merged) if (model.wireConfigName !== void 0) {
-					const target = {
-						configName: model.wireConfigName,
-						...model.wireFunction === void 0 ? {} : { function: model.wireFunction }
-					};
-					wire.byId.set(model.id, target);
-					wire.byName.set(model.name.trim().toLowerCase(), target);
-				}
+				const wireTargets = wireTargetsOf(merged);
+				wire.byId = wireTargets.byId;
+				wire.byName = wireTargets.byName;
 				latestDiscovery.length = 0;
 				latestDiscovery.push(...merged);
 				return merged;
@@ -8470,6 +8951,18 @@ function apply(ctx, config) {
 			routeOf: (provider) => routeOfTraeProvider(provider) ?? "solo"
 		};
 	}
+	/**
+	* Mirror each region's Trae login into the plugin's OWN copy as soon as the
+	* plugin loads.
+	*
+	* `accounts()` performs the mirror, so a card read creates the copy — but only
+	* for the tab the user actually opens. Signing in to Trae and never opening
+	* the panel would leave the copy missing until the next visit, which reads as
+	* "the plugin never made a copy". This fire-and-forget pass makes the copies
+	* exist from start-up. Failures are swallowed on purpose: the next card read
+	* retries, and a read-only file system must not break the plugin load.
+	*/
+	for (const panel of TRAE_PANELS) stacks[panel].store.accounts().catch(() => void 0);
 	/** This panel's saved pool preferences, unwrapped and defaulted to OFF. */
 	const poolPreferencesOf = (panel) => unwrapVolatileDeep(regionStateOf(current(), panel).pool) ?? {};
 	/**
@@ -8767,6 +9260,7 @@ function apply(ctx, config) {
 		};
 		/** One account's row, through the same bridge and probe the batch uses. */
 		const testWith = async (target, modelId, probeInputTokens) => {
+			await warmWireMap(panel);
 			const [row] = await testAllAccounts([target], modelId, (chatFor, credential, id) => {
 				if (credential === void 0) return Promise.resolve({
 					id,
@@ -8817,6 +9311,7 @@ function apply(ctx, config) {
 				return state;
 			},
 			test: async (stored, modelId, onRow) => {
+				await warmWireMap(stored);
 				const probeInputTokens = probeInputTokensOf(stored);
 				const rows = await testAllAccounts(await poolTargetsOf(stored), modelId, (chatFor, credential, id) => {
 					if (credential === void 0) return Promise.resolve({
@@ -8897,9 +9392,17 @@ function apply(ctx, config) {
 		enabledModelIds: (panel) => regionStateOf(current(), panel).enabledModelIds ?? [],
 		regionEnabled: (panel) => regionEnabled(current(), panel),
 		discoverModels: (panel, signal) => stacks[panel].discoverModels(signal),
-		probeModels: (panel, ids) => stacks[panel].probeModels(ids),
+		probeModels: async (panel, ids) => {
+			await warmWireMap(panel);
+			return stacks[panel].probeModels(ids);
+		},
 		rawDiagnostic: (panel) => stacks[panel].rawDiagnostic(),
 		creditsOfAccount: (panel, accountId) => stacks[panel].creditsOfAccount(accountId),
+		deleteAccountOf: (panel, accountId) => stacks[panel].store.deleteAccount(accountId),
+		copiesOf: async (panel) => ({
+			path: stacks[panel].store.ownAuthPath(),
+			count: (await stacks[panel].store.accounts()).length
+		}),
 		accountStateOf: (panel, accountId) => stacks[panel].accountStateOf(accountId),
 		claimCheckinOf: (panel, accountId) => stacks[panel].claimCheckinOf(accountId),
 		liveLogin: (panel) => liveLoginOf(panel),
@@ -9158,4 +9661,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, MAX_PROBE_INPUT_TOKENS, REGION_GATEWAYS, SseDecoder, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_ENTERPRISE_PROVIDER, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PANELS, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_PROVIDER_IDS, TRAE_PROVIDER_ID_DISPLAY_NAMES, TRAE_PROVIDER_ROUTES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, TraeCatalog, TraeCredentialStore, TraeDelegatingUpstreamClient, TraeFallbackUpstreamClient, TraeGatedUpstreamClient, TraeRawCapabilityController, TraeRawCapabilityState, TraeRawChatUpstreamClient, TraeSoloBridge, TraeSoloRemoteCatalogClient, TraeSoloUpstreamClient, TraeUsageClient, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, describeTraeFailure, discoveredCatalog, displayNameOfTraeProvider, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, isEnterpriseAccount, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, panelOfKey, panelOfProvider, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, providerOfPanel, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfPanel, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, routeOfTraeProvider, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withContextAdaptation, withTraeRegion };
+export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, MAX_PROBE_INPUT_TOKENS, REGION_GATEWAYS, SseDecoder, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_ENTERPRISE_PROVIDER, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PANELS, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_PROVIDER_IDS, TRAE_PROVIDER_ID_DISPLAY_NAMES, TRAE_PROVIDER_ROUTES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, TraeCatalog, TraeCredentialStore, TraeDelegatingUpstreamClient, TraeFallbackUpstreamClient, TraeGatedUpstreamClient, TraeRawCapabilityController, TraeRawCapabilityState, TraeRawChatUpstreamClient, TraeSoloBridge, TraeSoloRemoteCatalogClient, TraeSoloUpstreamClient, TraeUsageClient, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, describeTraeFailure, discoveredCatalog, displayNameOfTraeProvider, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, isEnterpriseAccount, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, panelOfKey, panelOfProvider, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, providerOfPanel, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfPanel, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, routeOfTraeProvider, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, wireTargetsOf, withContextAdaptation, withTraeRegion };