dsh-connect-workbuddy 1.0.0

package/lib/index.js

@@ -0,0 +1,792 @@
+import { C as defaultDesktopAuthCandidates, D as workbuddyAccountId, E as parseWorkBuddyAuth, O as workbuddyOwnAuthPath, S as authFileName, T as defaultDesktopAuthPath, _ as WorkBuddyCatalog, a as readHostHeartbeat, b as WORKBUDDY_AUTH_FILE_ENV, c as WORKBUDDY_CONNECT_VERSION, d as parseCreditMultiplier, f as parseReasoning, g as FALLBACK_WORKBUDDY_MODELS, h as regionOf, i as processStartTimeMs, l as WorkBuddyUpstreamClient, m as prepareChatBody, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as parseUpstreamModel, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as classifyUpstreamError, v as deriveCatalog, w as defaultDesktopAuthDirs, x as WorkBuddyCredentialStore, y as WORKBUDDY_AUTH_FILENAME } from "./host-heartbeat-DHfQtrSf.js";
+import z from "@deepseek-ai/schemastery";
+import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { createProvider } from "@earendil-works/pi-ai";
+import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
+import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { createServer } from "node:http";
+import { Readable } from "node:stream";
+//#region src/adapter.ts
+/**
+* The `workbuddy` pi-ai provider: one loopback-backed adapter registered
+* into the Harness LLM seam, assembled from public `dsh-llm-pi-ai`
+* extension points.
+*
+* 参考：corrinehu/dsh-workbuddy-connect（MIT，Copyright (c) 2026 Corrine Hu）
+*   — pi-ai provider 的装配方式（createProvider + openAICompletionsApi +
+*     inert auth plane + 用 shim 的进程内 secret 作为 apiKey）由该项目实现；
+*   DSH 插件结构与 provider 注册的思路参照
+*     franksong2702/dsh-codex-connect（Apache-2.0），经其转引。
+* 改动：模型描述符补上 upstream 给出的多模态与推理档位信息（若有），
+*   供 DSH 的能力判断使用。
+*
+* @module dsh-connect-workbuddy/adapter
+*/
+/** Provider route this bundle owns. */
+const WORKBUDDY_PROVIDER = "workbuddy";
+/** Provider idle ceiling while one stream read is outstanding. */
+const WORKBUDDY_STREAM_IDLE_TIMEOUT_MS = 3e5;
+/**
+* Image-request budgets at the dsh-llm-pi-ai defaults; the profile type made
+* them required in 0.1.1-rc.2.
+*/
+const REQUEST_IMAGE_BUDGETS = {
+	maxRequestImageBytes: 20971520,
+	requestImagePixelBudget: 4194304,
+	requestImageMaxBytes: 1048576
+};
+/**
+* Inert pi-ai auth plane. The workbuddy route authenticates only through the
+* shim shared secret resolved per request by `resolveApiKey`, so pi-ai's own
+* credential lifecycle and ambient discovery must never manufacture a
+* credential for it. `PiAiAdapterOptions.auth` is required since 0.1.1-rc.2;
+* every ambient question here answers "nothing stored, nothing set".
+*/
+const INERT_AUTH = {
+	credentials: {
+		async read() {},
+		async list() {
+			return [];
+		},
+		async modify() {
+			throw new Error("dsh-connect-workbuddy: the workbuddy route has no pi-ai credential lifecycle");
+		},
+		async delete() {}
+	},
+	authContext: {
+		async env() {},
+		async fileExists() {
+			return false;
+		}
+	}
+};
+/** No per-token pricing is knowable for a subscription quota; report zero. */
+const NO_COST = {
+	input: 0,
+	output: 0,
+	cacheRead: 0,
+	cacheWrite: 0
+};
+const THINKING_LEVELS = [
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+/** pi-ai input modalities: images only when WorkBuddy advertises them. */
+function workBuddyModelInput(info) {
+	return info.multimodal === true ? ["text", "image"] : ["text"];
+}
+/** Map only levels advertised by WorkBuddy; undeclared DSH levels stay unavailable. */
+function workBuddyThinkingLevelMap(info) {
+	const supported = info.reasoning?.supportedEfforts?.filter((effort) => THINKING_LEVELS.includes(effort));
+	if (supported === void 0 || supported.length === 0) return void 0;
+	const map = Object.fromEntries(THINKING_LEVELS.map((level) => [level, supported.includes(level) ? level : null]));
+	if (info.reasoning?.canDisableThinking !== true) map.off = null;
+	return map;
+}
+/** Build one pi-ai model descriptor pointing at the loopback shim. */
+function toPiModel(info, baseUrl) {
+	const thinkingLevelMap = workBuddyThinkingLevelMap(info);
+	return {
+		id: info.id,
+		name: info.name,
+		api: "openai-completions",
+		provider: WORKBUDDY_PROVIDER,
+		baseUrl,
+		input: workBuddyModelInput(info),
+		cost: NO_COST,
+		contextWindow: info.contextWindow,
+		maxTokens: info.maxTokens,
+		reasoning: thinkingLevelMap !== void 0,
+		...thinkingLevelMap === void 0 ? {} : { thinkingLevelMap },
+		compat: { supportsReasoningEffort: thinkingLevelMap !== void 0 }
+	};
+}
+/**
+* Assemble the adapter. The provider's `getModels` reads the live catalog,
+* and every model's `baseUrl` is re-resolved per read so the shim's
+* ephemeral port applies from the first snapshot after startup.
+*/
+function createWorkBuddyAdapter(options) {
+	const { shim, store, catalog, resolveAttachments } = options;
+	const buildModels = () => {
+		const baseUrl = `${shim.baseUrl()}/v1`;
+		return catalog.current().map((info) => toPiModel(info, baseUrl));
+	};
+	const provider = {
+		...createProvider({
+			id: WORKBUDDY_PROVIDER,
+			name: "WorkBuddy",
+			auth: { apiKey: {
+				name: "WorkBuddy OAuth bearer token",
+				async resolve({ credential }) {
+					const apiKey = credential?.key;
+					return apiKey === void 0 || apiKey.length === 0 ? void 0 : {
+						auth: { apiKey },
+						source: "WorkBuddy"
+					};
+				}
+			} },
+			models: buildModels(),
+			api: openAICompletionsApi()
+		}),
+		getModels: () => buildModels()
+	};
+	const profile = {
+		provider: WORKBUDDY_PROVIDER,
+		displayName: "WorkBuddy",
+		streamIdleTimeoutMs: WORKBUDDY_STREAM_IDLE_TIMEOUT_MS,
+		retryPolicy: resolveRetryPolicy(void 0, "dsh-connect-workbuddy retryPolicy"),
+		configuredMaxTokens: /* @__PURE__ */ new Map(),
+		...REQUEST_IMAGE_BUDGETS,
+		piProvider: provider
+	};
+	let profiles = /* @__PURE__ */ new Map([[WORKBUDDY_PROVIDER, profile]]);
+	return {
+		adapter: new PiAiAdapter({
+			profiles: () => profiles,
+			auth: INERT_AUTH,
+			resolveApiKey: async () => shim.token(),
+			...resolveAttachments === void 0 ? {} : { resolveAttachments }
+		}),
+		invalidate: () => {
+			profiles = /* @__PURE__ */ new Map([[WORKBUDDY_PROVIDER, profile]]);
+		}
+	};
+}
+//#endregion
+//#region src/shim.ts
+/**
+* Loopback OpenAI-compatible endpoint. The pi-ai provider points here; the
+* shim applies the WorkBuddy wire quirks (forced streaming, string
+* `tool_choice`, CLI-shaped headers) and forwards to the real upstream.
+* It binds 127.0.0.1 only and never serves another interface.
+*
+* 参考：corrinehu/dsh-workbuddy-connect（MIT，Copyright (c) 2026 Corrine Hu）
+*   — 入站加固的四重校验（Host 必须回环、Origin 必须回环、chat POST 必须
+*     JSON、bearer 必须匹配进程内随机 secret）、常量时间比对、
+*     随机端口绑定、body 上限、上游错误分类到 HTTP 状态码的映射，
+*     均由该项目设计并验证。
+* 改动：无。安全相关代码不做「改善」，原样沿用。
+
+* @module dsh-connect-workbuddy/shim
+*/
+const REQUEST_BODY_LIMIT = 67108864;
+/** Loopback hostnames the shim's own in-process client uses. */
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+/** Strip the optional :port from a Host header value, IPv6-bracket aware. */
+function hostnameOfHost(host) {
+	let hostname = host.trim().toLowerCase();
+	if (hostname.startsWith("[")) {
+		const end = hostname.indexOf("]");
+		return end === -1 ? hostname : hostname.slice(0, end + 1);
+	}
+	const colon = hostname.lastIndexOf(":");
+	if (colon !== -1 && /^\d+$/.test(hostname.slice(colon + 1))) hostname = hostname.slice(0, colon);
+	return hostname;
+}
+/**
+* The request's Host header must name the loopback interface. A DNS-rebinding
+* page (attacker domain re-resolved to 127.0.0.1) sends its own domain in
+* Host, so this check drops those before any routing happens.
+*/
+function hostIsLoopback(host) {
+	if (host === void 0 || host.trim() === "") return false;
+	return LOOPBACK_HOSTS.has(hostnameOfHost(host));
+}
+/**
+* A browser-sent Origin (present header) must be loopback. Non-browser
+* clients (the plugin's own fetch calls) send no Origin at all and pass.
+*/
+function originIsLoopback(origin) {
+	if (origin === void 0 || origin.trim() === "") return true;
+	try {
+		const { hostname } = new URL(origin);
+		return LOOPBACK_HOSTS.has(hostname) || hostname === "::1";
+	} catch {
+		return false;
+	}
+}
+/** Chat-completion POSTs must carry a JSON body type (simple-request CSRF drops here). */
+function isJsonContentType(req) {
+	const type = req.headers["content-type"];
+	return typeof type === "string" && type.trim().toLowerCase().startsWith("application/json");
+}
+/** HTTP status each upstream failure class surfaces as. */
+const KIND_STATUS = {
+	hard_credit: 402,
+	soft_rate: 429,
+	session_dead: 401,
+	not_found: 502,
+	server: 502,
+	client: 400
+};
+function writeJson(res, status, body) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"Content-Type": "application/json",
+		"Content-Length": Buffer.byteLength(payload)
+	});
+	res.end(payload);
+}
+function writeOpenAIError(res, status, kind, message) {
+	writeJson(res, status, { error: {
+		message,
+		type: kind,
+		code: kind
+	} });
+}
+/** Read a request body with a size cap; over-limit bodies fail the request. */
+function readBody(req) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let size = 0;
+		req.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > REQUEST_BODY_LIMIT) {
+				reject(/* @__PURE__ */ new Error("request body too large"));
+				req.destroy();
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("end", () => resolve(Buffer.concat(chunks)));
+		req.on("error", reject);
+	});
+}
+/**
+* Start the loopback endpoint. Requests must carry the shim's shared secret;
+* the loopback bind alone is not a trust boundary.
+*/
+function createWorkBuddyShim(options) {
+	const { store, client, catalog } = options;
+	const logger = options.logger;
+	const SHARED_SECRET = randomBytes(32).toString("base64url");
+	/** Constant-time bearer check; absent or mismatched bearers are rejected. */
+	function bearerOk(req) {
+		const header = req.headers.authorization;
+		if (typeof header !== "string") return false;
+		const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+		if (match === null) return false;
+		const presented = match[1];
+		const expected = SHARED_SECRET;
+		const a = Buffer.from(presented);
+		const b = Buffer.from(expected);
+		if (a.length !== b.length) return false;
+		return timingSafeEqual(a, b);
+	}
+	const server = createServer((req, res) => {
+		handle(req, res);
+	});
+	const ready = new Promise((resolve, reject) => {
+		server.once("listening", () => resolve());
+		server.once("error", reject);
+	});
+	server.listen(0, "127.0.0.1");
+	const baseUrl = () => {
+		const address = server.address();
+		if (address === null || typeof address === "string") throw new Error("workbuddy shim has no listening address");
+		return `http://127.0.0.1:${address.port}`;
+	};
+	async function handle(req, res) {
+		try {
+			if (!hostIsLoopback(req.headers.host)) {
+				writeOpenAIError(res, 403, "host_not_allowed", "Host header must name the loopback interface");
+				return;
+			}
+			if (!originIsLoopback(req.headers.origin)) {
+				writeOpenAIError(res, 403, "origin_not_allowed", "Origin must be a loopback origin");
+				return;
+			}
+			if (!bearerOk(req)) {
+				writeOpenAIError(res, 401, "unauthorized", "missing or invalid Authorization bearer");
+				return;
+			}
+			const url = req.url ?? "/";
+			if (req.method === "GET" && (url === "/healthz" || url === "/healthz/")) {
+				writeJson(res, 200, { ok: true });
+				return;
+			}
+			if (req.method === "GET" && (url === "/v1/models" || url === "/v1/models/")) {
+				writeJson(res, 200, {
+					object: "list",
+					data: catalog.current().map((model) => ({
+						id: model.id,
+						object: "model",
+						created: 0,
+						owned_by: "workbuddy"
+					}))
+				});
+				return;
+			}
+			if (req.method === "POST" && (url === "/v1/chat/completions" || url === "/v1/chat/completions/")) {
+				await chatCompletions(req, res);
+				return;
+			}
+			writeOpenAIError(res, 404, "not_found", `no such route: ${req.method} ${url}`);
+		} catch (error) {
+			if (!res.headersSent) writeOpenAIError(res, 500, "internal", String(error));
+			else res.end();
+		}
+	}
+	async function chatCompletions(req, res) {
+		if (!isJsonContentType(req)) {
+			writeOpenAIError(res, 415, "unsupported_media_type", "Content-Type must be application/json");
+			return;
+		}
+		let credential;
+		try {
+			credential = await store.resolve();
+		} catch (error) {
+			writeOpenAIError(res, 401, "not_signed_in", String(error));
+			return;
+		}
+		const raw = (await readBody(req)).toString("utf8");
+		const prepared = prepareChatBody(raw);
+		const controller = new AbortController();
+		req.on("close", () => controller.abort());
+		const result = await client.chatStream(credential, prepared, controller.signal);
+		if (!result.ok) {
+			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status}): ${result.message.slice(0, 400)}`);
+			return;
+		}
+		res.writeHead(200, {
+			"Content-Type": "text/event-stream",
+			"Cache-Control": "no-cache",
+			"Connection": "keep-alive",
+			"X-Accel-Buffering": "no"
+		});
+		let sawDone = false;
+		const body = Readable.fromWeb(result.response.body);
+		body.on("data", (chunk) => {
+			if (chunk.includes("[DONE]")) sawDone = true;
+		});
+		body.on("error", (error) => {
+			logger?.warn("dsh-connect-workbuddy: upstream stream failed mid-flight", error);
+			if (!sawDone && res.writable) res.end("data: [DONE]\n\n");
+		});
+		body.pipe(res);
+	}
+	return {
+		ready,
+		baseUrl,
+		token: () => SHARED_SECRET,
+		close: () => new Promise((resolve, reject) => {
+			server.close(() => resolve());
+			server.closeAllConnections();
+			server.once("error", reject);
+		})
+	};
+}
+//#endregion
+//#region src/status-paths.ts
+/**
+* Node-free constants and types shared by the Host and browser halves.
+*
+* 参考：dingminhua/dsh-connect-trae（MIT，Copyright (c) 2026 LaoDing）
+*   — 「3 条同源只读路由（usage / models:refresh / accounts:refresh）+ 一份
+*     与浏览器共享的 node-free 类型定义」的 host↔client 桥梁形态来自该项目
+*     （其 `status-paths.ts` 亦如此，并注明沿用
+*     corrinehu/dsh-workbuddy-connect 的 status-route 模式）。
+* 改动：路由路径改用本插件 id；类型字段按 WorkBuddy 上游实际给出的能力
+*   （积分倍率、多模态、推理档位）调整，不保留 trae 的 1M 变体字段。
+*
+* @module dsh-connect-workbuddy/status-paths
+*/
+/** Plugin-owned usage endpoint consumed by its browser half. */
+const WORKBUDDY_USAGE_PATH = "/plugins/dsh-connect-workbuddy/usage";
+/** Plugin-owned live model refresh endpoint. */
+const WORKBUDDY_MODELS_REFRESH_PATH = "/plugins/dsh-connect-workbuddy/models/refresh";
+/** Plugin-owned local account rescan endpoint. */
+const WORKBUDDY_ACCOUNTS_REFRESH_PATH = "/plugins/dsh-connect-workbuddy/accounts/refresh";
+/** Plugin-owned daily check-in action endpoint. */
+const WORKBUDDY_CHECKIN_PATH = "/plugins/dsh-connect-workbuddy/checkin";
+//#endregion
+//#region src/web-status.ts
+/** Redact token-like content before it crosses to the browser. */
+function safeMessage(error) {
+	return (error instanceof Error ? error.message : String(error)).replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]").slice(0, 500);
+}
+function json(res, status, body) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"Content-Type": "application/json",
+		"Content-Length": Buffer.byteLength(payload)
+	});
+	res.end(payload);
+}
+/** Loopback browser origins only; other devices are refused until trusted origins exist. */
+function loopbackOrigin(req) {
+	const origin = req.headers.origin;
+	if (origin === void 0) return true;
+	try {
+		const { hostname } = new URL(origin);
+		return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+	} catch {
+		return false;
+	}
+}
+/** Map the credit answer to the card's compact document. */
+function toCredits(answer) {
+	return {
+		total: answer.total,
+		packages: answer.packages.map((pack) => ({
+			packageName: pack.packageName,
+			remain: pack.remain,
+			size: pack.size,
+			monthly: pack.monthly,
+			...pack.refreshAtMs === void 0 ? {} : { cycleRefreshMs: pack.refreshAtMs },
+			...pack.expiresAtMs === void 0 ? {} : { expiresAtMs: pack.expiresAtMs }
+		})),
+		expiringSoon: answer.expiringSoon,
+		...answer.nearestExpiryMs === void 0 ? {} : { nearestExpiryMs: answer.nearestExpiryMs }
+	};
+}
+/** Project a model into the card's row, dropping empty optional fields. */
+function toWebModel(model, budgets) {
+	return {
+		id: model.id,
+		name: model.name,
+		contextWindow: model.contextWindow > 2e5 ? Math.min(model.contextWindow, budgets[model.id] ?? 2e5) : model.contextWindow,
+		nativeContextWindow: model.contextWindow,
+		maxTokens: model.maxTokens,
+		...model.creditMultiplier === void 0 ? {} : { creditMultiplier: model.creditMultiplier },
+		...model.multimodal === void 0 ? {} : { multimodal: model.multimodal },
+		...model.reasoning === void 0 ? {} : { reasoning: {
+			...model.reasoning.supportedEfforts === void 0 ? {} : { supportedEfforts: [...model.reasoning.supportedEfforts] },
+			...model.reasoning.defaultEffort === void 0 ? {} : { defaultEffort: model.reasoning.defaultEffort }
+		} }
+	};
+}
+/** Project a store account into the card's token-free account row. */
+function toWebAccount(account) {
+	return {
+		id: account.id,
+		accountName: account.accountName,
+		...account.uin === void 0 ? {} : { uin: account.uin },
+		domain: account.domain,
+		source: account.source,
+		tokenExpiresAtMs: account.tokenExpiresAtMs,
+		selected: account.selected
+	};
+}
+/**
+* Assemble the card's usage document. Sign-in state is read-only; credit is a
+* live billing answer whose failure degrades to `creditsError` rather than
+* failing the whole document.
+*/
+async function workBuddyWebStatus(deps) {
+	const accounts = await deps.store.accounts();
+	if ((await deps.store.status()).state !== "signed-out" && accounts.length === 0) return {
+		status: "signed-out",
+		accounts: []
+	};
+	let credential;
+	try {
+		credential = await deps.store.resolve();
+	} catch (error) {
+		return {
+			status: "signed-out",
+			accounts: accounts.map(toWebAccount),
+			message: safeMessage(error)
+		};
+	}
+	const account = {
+		accountId: accounts.find((account) => account.selected)?.id ?? "",
+		accountName: credential.nickname ?? credential.uin ?? credential.uid,
+		...credential.uin === void 0 ? {} : { uin: credential.uin },
+		...credential.domain === "" ? {} : { domain: credential.domain },
+		source: credential.source,
+		tokenExpiresAtMs: credential.expiresAtMs,
+		accounts: accounts.map(toWebAccount),
+		models: deps.displayModels().map((model) => toWebModel(model, deps.contextBudgets())),
+		enabledModelIds: [...deps.enabledModelIds()],
+		imageModelIds: [...deps.imageModelIds()]
+	};
+	const [creditsResult, checkinResult] = await Promise.allSettled([deps.client.fetchCredits(credential), deps.client.fetchCheckinStatus(credential)]);
+	return {
+		status: "signed-in",
+		...account,
+		...creditsResult.status === "fulfilled" ? { credits: toCredits(creditsResult.value) } : { creditsError: safeMessage(creditsResult.reason) },
+		...checkinResult.status === "fulfilled" ? { checkin: checkinResult.value } : { checkinError: safeMessage(checkinResult.reason) }
+	};
+}
+/**
+* Mount the read-only routes on a context where `webServer` is available.
+* The caller uses `ctx.inject(['webServer'], ...)`, so Desktop startup order
+* cannot make this registration disappear.
+*/
+function registerWorkBuddyStatusRoute(ctx, deps) {
+	ctx.effect(() => {
+		const disposeUsage = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_USAGE_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "GET") {
+					json(res, 405, { error: "method not allowed" });
+					return;
+				}
+				if (!loopbackOrigin(req)) {
+					json(res, 403, { error: "origin-not-trusted" });
+					return;
+				}
+				try {
+					json(res, 200, await workBuddyWebStatus(deps));
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
+		const disposeAccounts = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_ACCOUNTS_REFRESH_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				try {
+					json(res, 200, { accounts: (await deps.store.accounts()).map(toWebAccount) });
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
+		const disposeCheckin = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_CHECKIN_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				try {
+					const credential = await deps.store.resolve();
+					const current = await deps.client.fetchCheckinStatus(credential);
+					if (!current.active) return json(res, 409, { error: "check-in activity is not active" });
+					if (current.todayCheckedIn) return json(res, 200, {
+						alreadyCheckedIn: true,
+						checkin: current
+					});
+					json(res, 200, {
+						alreadyCheckedIn: false,
+						claim: await deps.client.claimDailyCheckin(credential),
+						checkin: await deps.client.fetchCheckinStatus(credential)
+					});
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
+		const disposeRefresh = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_MODELS_REFRESH_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (deps.discoverModels === void 0) return json(res, 503, { error: "model refresh unavailable" });
+				try {
+					json(res, 200, { models: (await deps.discoverModels()).map((model) => toWebModel(model, deps.contextBudgets())) });
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
+		return () => {
+			disposeRefresh();
+			disposeCheckin();
+			disposeAccounts();
+			disposeUsage();
+		};
+	}, "dsh-connect-workbuddy: Web status route");
+}
+//#endregion
+//#region src/index.ts
+/** Stable Cordis plugin name. */
+const name = "dsh-connect-workbuddy";
+/** The model registry required before the provider can register. */
+const inject = ["llm"];
+/** Settings namespace for the plugin configuration card. */
+const WORKBUDDY_SETTINGS_NS = settingsNamespace("workbuddy");
+const modelConfig = z.object({
+	id: z.string().required(),
+	name: z.string().required(),
+	contextWindow: z.number().step(1).min(1),
+	maxTokens: z.number().step(1).min(1)
+});
+const Config = z.object({
+	authFile: z.string().description("WorkBuddy desktop auth file (defaults to the app's own location)"),
+	accountId: z.string().description("Selected local WorkBuddy account id (never a token)"),
+	lastCatalog: z.array(modelConfig).description("Last refreshed WorkBuddy model directory shown by the plugin card"),
+	enabledModelIds: z.array(z.string()).default([]).description("WorkBuddy model ids the user enabled"),
+	imageModelIds: z.array(z.string()).default([]).description("WorkBuddy model ids the user opted into image input"),
+	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Local DSH context budget per WorkBuddy model")
+});
+/**
+* Start the loopback endpoint, register the `workbuddy` provider, and
+* refresh the model catalog from the upstream once credentials allow it.
+* The static fallback catalog serves from the first moment, so an offline
+* upstream never leaves the provider empty.
+*/
+function apply(ctx, config) {
+	const client = new WorkBuddyUpstreamClient();
+	const store = new WorkBuddyCredentialStore({
+		...config.authFile === void 0 ? {} : { desktopPath: config.authFile },
+		refresh: (credential) => client.refreshToken(credential)
+	});
+	if (config.accountId !== void 0) store.selectAccount(config.accountId);
+	const catalog = new WorkBuddyCatalog();
+	const shim = createWorkBuddyShim({
+		store,
+		client,
+		catalog,
+		logger: ctx.logger
+	});
+	const enabledSet = (value) => new Set(value.enabledModelIds ?? []);
+	const imageSet = (value) => new Set(value.imageModelIds ?? []);
+	const withImageSelection = (models, images) => models.map((model) => ({
+		...model,
+		...images.has(model.id) ? { multimodal: true } : { multimodal: false }
+	}));
+	const configuredModels = (value) => withImageSelection(deriveCatalog(value.lastCatalog?.length ? value.lastCatalog : FALLBACK_WORKBUDDY_MODELS, enabledSet(value), value.contextBudgets ?? {}), imageSet(value));
+	const displayModels = (value) => value.lastCatalog?.length ? value.lastCatalog : FALLBACK_WORKBUDDY_MODELS;
+	let current = () => config;
+	const discoverModels = async (signal) => {
+		const credential = await store.resolve();
+		return client.fetchModels(credential, signal);
+	};
+	ctx.inject(["webServer"], (webCtx) => registerWorkBuddyStatusRoute(webCtx, {
+		store,
+		client,
+		displayModels: () => displayModels(current()),
+		enabledModelIds: () => current().enabledModelIds ?? [],
+		imageModelIds: () => current().imageModelIds ?? [],
+		contextBudgets: () => current().contextBudgets ?? {},
+		discoverModels
+	}));
+	installSettingsSection(ctx, WORKBUDDY_SETTINGS_NS, Config, config, {
+		setSource(source) {
+			current = source;
+		},
+		onChange() {
+			const next = current();
+			store.setDesktopPath(next.authFile);
+			store.selectAccount(next.accountId);
+			catalog.set(configuredModels(next));
+			invalidateCatalog();
+		}
+	});
+	let stopped = false;
+	let invalidateCatalog = () => {};
+	ctx.effect(() => () => {
+		stopped = true;
+		shim.close();
+		clearHostHeartbeat();
+	});
+	/**
+	* Prefer an account with usable credit. Every account yields the same
+	* catalog, but an account at zero credit fails each chat request, so the
+	* default must not land there.
+	*/
+	const selectPreferredCreditAccount = async () => {
+		try {
+			const accounts = await store.accounts();
+			const scored = [];
+			for (const account of accounts) try {
+				store.selectAccount(account.id);
+				const credential = await store.resolve();
+				const credits = await client.fetchCredits(credential);
+				scored.push({
+					id: account.id,
+					credits: credits.total
+				});
+			} catch (error) {
+				ctx.logger.warn(`dsh-connect-workbuddy: account ${account.id} unavailable for default selection`, error);
+			}
+			scored.sort((a, b) => b.credits - a.credits);
+			store.setPreferAccountIds(scored.filter((item) => item.credits > 0).map((item) => item.id));
+			store.selectAccount(current().accountId);
+		} catch (error) {
+			ctx.logger.warn("dsh-connect-workbuddy: default account selection failed; continuing", error);
+		}
+	};
+	shim.ready.then(async () => {
+		if (stopped) return;
+		let invalidate;
+		try {
+			const workbuddy = createWorkBuddyAdapter({
+				shim,
+				store,
+				catalog,
+				resolveAttachments: () => ctx.get("attachments")
+			});
+			invalidate = workbuddy.invalidate;
+			invalidateCatalog = () => {
+				workbuddy.invalidate();
+			};
+			let releaseAdapter;
+			let releaseDirectory;
+			try {
+				releaseAdapter = ctx.llm.registerAdapter([WORKBUDDY_PROVIDER], workbuddy.adapter);
+				releaseDirectory = ctx.llm.registerConfigurableProviders([{
+					provider: WORKBUDDY_PROVIDER,
+					displayName: "WorkBuddy",
+					settingsNs: WORKBUDDY_SETTINGS_NS,
+					settingsPath: [],
+					declared: false
+				}]);
+			} finally {
+				if (releaseAdapter === void 0 || releaseDirectory === void 0) {
+					releaseAdapter?.();
+					releaseDirectory?.();
+				}
+			}
+			try {
+				ctx.effect(() => () => {
+					releaseAdapter?.();
+					releaseDirectory?.();
+				});
+			} catch {
+				releaseAdapter?.();
+				releaseDirectory?.();
+			}
+			ctx.llm.registerModelDiscovery(WORKBUDDY_SETTINGS_NS, async (request) => {
+				if (request.provider !== "workbuddy") return [];
+				return withImageSelection(deriveCatalog(await discoverModels(request.signal), enabledSet(current()), current().contextBudgets ?? {}), imageSet(current())).map((model) => ({
+					id: model.id,
+					name: model.name,
+					contextWindow: model.contextWindow,
+					maxTokens: model.maxTokens,
+					inputModalities: workBuddyModelInput(model)
+				}));
+			});
+			writeHostHeartbeat();
+		} catch (error) {
+			ctx.logger.error("dsh-connect-workbuddy: provider registration failed", error);
+			return;
+		}
+		await selectPreferredCreditAccount();
+		if (stopped) return;
+		(async () => {
+			try {
+				const credential = await store.resolve();
+				if (stopped) return;
+				const models = await client.fetchModels(credential);
+				if (stopped) return;
+				catalog.set(withImageSelection(deriveCatalog(models, enabledSet(current()), current().contextBudgets ?? {}), imageSet(current())));
+				invalidate?.();
+			} catch (error) {
+				ctx.logger.warn("dsh-connect-workbuddy: dynamic model catalog unavailable; serving the static fallback list", error);
+			}
+		})();
+	}).catch((error) => {
+		ctx.logger.error("dsh-connect-workbuddy: loopback endpoint failed to start; provider not registered", error);
+	});
+}
+//#endregion
+export { Config, FALLBACK_WORKBUDDY_MODELS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialStore, WorkBuddyUpstreamClient, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, inject, isHeartbeatProcessAlive, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionOf, registerWorkBuddyStatusRoute, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };