dsh-connect-workbuddy 2.0.1 → 2.0.2

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 2.0.2 (2026-09-15)
+
+### Fixes
+
+- **修复「同一账号多个凭据文件时选中已失效的那一个」，导致积分/签到/模型全部返回 openresty HTML 401**。此前按**存储的 `expiresAt` 最大**来挑选凭据，但 `expiresAt` 描述的是「签发时有效期有多长」，**不代表上游仍然接受** —— 上游吊销 token 时不会同步改写该字段，于是一个早已失效的备份文件可以声称比真实可用的文件**更晚过期**，从而永远被选中。
+
+  - **实测复现**：本机某账号有 8 个凭据文件，其中 `2026-07-08` 的备份声称 `2027-07-06` 过期（最远），而真正可用的当前登录文件只到 `2026-11-14`。旧逻辑因此始终选中那个 07-08 的死文件，三个端点（`get-user-resource` / `checkin-activity-status` / `models`）全部返回 `401 Authorization Required` + `openresty`。
+  - **改用 `auth.lastRefreshTime` 作为新鲜度判据**：这是上游自己的签发时间，是唯一可靠的信号。新增 `WorkBuddyCredential.lastRefreshAtMs` 字段并在解析时读入；`preferred()`、多账号去重、以及插件自有副本的合并**三处**统一改用新的 `isFresher()` 比较器。
+  - **排序优先级**：① live 文件 `workbuddy-desktop.info`（应用当前登录）→ ② `lastRefreshAtMs` 较新者 → ③ `expiresAtMs`（仅作为文档缺失该字段时的回退，保证比较是全序的）。
+  - **实测验证**：切换判据后，本机 11 个账号选中的凭据**全部返回 200**（此前 `老丁`、`LaoDing` 等均命中死文件）。
+  - 插件自有刷新副本（无 `lastRefreshTime`）不参与签发时间比较：它只在**确实更长寿**时取代桌面端备份，且**永不顶替 live 登录**。
+
+- **上游返回 HTML 401 时给出可执行的提示**，不再原样抛出 HTML 片段。识别 openresty / APISIX 的鉴权拒绝，改为提示「凭据已被上游网关拒绝，通常说明选中的是旧登录留下的失效凭据；请重新登录 WorkBuddy 桌面端后在卡片中选择该账号，可运行 `dsh-connect-workbuddy doctor` 查看全部凭据」。非鉴权类的非 JSON 响应（如 502 网关错误）保持原有的通用提示。
+
+### Tests
+
+- `auth.spec.ts` 新增 4 例：**备份之间**按签发时间而非存储过期时间选择（回归锚点，旧逻辑下必失败）、文档缺失 `lastRefreshTime` 时回退到过期时间、`auth.lastRefreshTime` 的正确解析、缺失该字段时保持 `undefined`。
+- `upstream.spec.ts` 新增 2 例：网关 HTML 401 被转写为可执行提示（且不泄漏 `<html>`）、非鉴权类的非 JSON 失败仍保留通用提示。
+- 全套 **126 个测试通过**。
+
 ## 2.0.1 (2026-09-15)
 
 ### Fixes

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { T as WorkBuddyUpstreamClient, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-DjNRPvQf.js";
+import { T as WorkBuddyUpstreamClient, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-CaS5Koaw.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/{host-heartbeat-DjNRPvQf.js → host-heartbeat-CaS5Koaw.js}

@@ -221,12 +221,27 @@ function normalizeToolChoice(obj) {
 	}
 	delete obj["tool_choice"];
 }
+/**
+* Gateway (openresty/APISIX) rejection of a token it no longer accepts.
+*
+* The business APIs answer JSON; an edge rejection answers an HTML error page
+* instead. A 401 that is not JSON therefore means the credential was refused
+* before routing — almost always a revoked/expired token rather than a bug in
+* the request. Detected from the body so a proxy's own error page (which would
+* also be HTML) is still described accurately.
+*/
+function isGatewayAuthRejection(status, text) {
+	if (status !== 401 && status !== 403) return false;
+	const lower = text.toLowerCase();
+	return lower.includes("openresty") || lower.includes("apisix") || lower.includes("authorization required");
+}
 async function readEnvelope(response) {
 	const text = await response.text();
 	let parsed;
 	try {
 		parsed = JSON.parse(text);
 	} catch {
+		if (isGatewayAuthRejection(response.status, text)) throw new Error(`workbuddy: the signed-in credential was rejected by the upstream gateway (http ${response.status}). The stored token is no longer accepted — most likely a stale credential file from an earlier sign-in was selected. Re-sign in to the WorkBuddy desktop app, then pick that account in the plugin card. Run \`dsh-connect-workbuddy doctor\` to list every discovered credential.`);
 		throw new Error(`workbuddy upstream returned non-JSON (http ${response.status}): ${text.slice(0, 160)}`);
 	}
 	if (typeof parsed !== "object" || parsed === null) throw new Error(`workbuddy upstream returned an unexpected document (http ${response.status})`);
@@ -673,6 +688,7 @@ function parseWorkBuddyAuth(text, filePath) {
 	if (accessToken === "") return void 0;
 	const expiresAtMs = typeof auth["expiresAt"] === "number" ? expiryToMs(auth["expiresAt"]) : 0;
 	const refreshExpiresAtMs = typeof auth["refreshExpiresAt"] === "number" ? expiryToMs(auth["refreshExpiresAt"]) : void 0;
+	const lastRefreshAtMs = typeof auth["lastRefreshTime"] === "number" ? expiryToMs(auth["lastRefreshTime"]) : void 0;
 	const enterpriseId = optionalString(identity["enterpriseId"]);
 	const nickname = optionalString(identity["nickname"]);
 	const uin = optionalString(identity["uin"]);
@@ -686,6 +702,7 @@ function parseWorkBuddyAuth(text, filePath) {
 		...enterpriseId === void 0 ? {} : { enterpriseId },
 		...nickname === void 0 ? {} : { nickname },
 		...uin === void 0 ? {} : { uin },
+		...lastRefreshAtMs === void 0 ? {} : { lastRefreshAtMs },
 		source: "desktop",
 		filePath
 	};
@@ -704,6 +721,32 @@ function fileRank(path) {
 	return authFileName(path) === WORKBUDDY_LIVE_FILENAME ? 0 : 1;
 }
 /**
+* Whether `candidate` is a better pick than `incumbent` for the same account.
+*
+* Ordering, strongest signal first:
+*
+* 1. the live `workbuddy-desktop.info` (the app's current sign-in);
+* 2. the most recent `lastRefreshAtMs` — the upstream's own issuance time;
+* 3. `expiresAtMs`, only as a fallback for documents that omit the field.
+*
+* Step 2 is what makes this correct. `expiresAt` describes how long the token
+* was VALID FOR at issue time, not whether it is still accepted: a revoked
+* backup keeps a far-future `expiresAt` (2027 in the observed case) and would
+* otherwise outrank the working live credential, which is exactly how a
+* signed-in account turned into an upstream HTML 401.
+*/
+function isFresher(candidate, incumbent) {
+	const rankDiff = fileRank(candidate.filePath) - fileRank(incumbent.filePath);
+	if (rankDiff !== 0) return rankDiff < 0;
+	const candidateRefresh = candidate.lastRefreshAtMs;
+	const incumbentRefresh = incumbent.lastRefreshAtMs;
+	if (candidateRefresh !== void 0 && incumbentRefresh !== void 0) {
+		if (candidateRefresh !== incumbentRefresh) return candidateRefresh > incumbentRefresh;
+	} else if (candidateRefresh !== void 0) return true;
+	else if (incumbentRefresh !== void 0) return false;
+	return candidate.expiresAtMs > incumbent.expiresAtMs;
+}
+/**
 * Filename of a path regardless of the host separator: Windows paths use `\`
 * and this helper must keep working when a Windows path is compared on a
 * POSIX host (e.g. tests injecting a Windows-style auth dir).
@@ -906,13 +949,14 @@ var WorkBuddyCredentialStore = class {
 				byId.set(id, credential);
 				continue;
 			}
-			if (fileRank(credential.filePath) < fileRank(existing.filePath) || fileRank(credential.filePath) === fileRank(existing.filePath) && credential.expiresAtMs > existing.expiresAtMs) byId.set(id, credential);
+			if (isFresher(credential, existing)) byId.set(id, credential);
 		}
 		for (const own of await this.readOwns()) {
 			if (!this.matchesRegion(own.domain)) continue;
 			const id = workbuddyAccountId(own);
 			const existing = byId.get(id);
-			if (existing === void 0 || own.expiresAtMs > existing.expiresAtMs) byId.set(id, own);
+			if (existing === void 0) byId.set(id, own);
+			else if (fileRank(existing.filePath) !== 0 && own.expiresAtMs > existing.expiresAtMs) byId.set(id, own);
 		}
 		return [...byId.values()];
 	}
@@ -925,11 +969,7 @@ var WorkBuddyCredentialStore = class {
 	*/
 	preferred(credentials) {
 		if (credentials.length === 0) return void 0;
-		return credentials.reduce((best, credential) => {
-			if (fileRank(credential.filePath) < fileRank(best.filePath)) return credential;
-			if (fileRank(credential.filePath) === fileRank(best.filePath) && credential.expiresAtMs > best.expiresAtMs) return credential;
-			return best;
-		});
+		return credentials.reduce((best, credential) => isFresher(credential, best) ? credential : best);
 	}
 	/** Token-free account list for the plugin card. */
 	async accounts() {
@@ -1330,7 +1370,7 @@ var WorkBuddyCatalog = class {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "2.0.1";
+const WORKBUDDY_CONNECT_VERSION = "2.0.2";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -19,6 +19,17 @@ interface WorkBuddyCredential {
   source: 'desktop' | 'dsh';
   /** Absolute path of the auth file this credential was read from. */
   filePath: string;
+  /**
+   * Epoch ms the upstream last issued this token (`auth.lastRefreshTime`).
+   *
+   * This is the ONLY trustworthy freshness signal. `expiresAtMs` cannot be
+   * used for ranking: when the upstream revokes a token it leaves the stored
+   * `expiresAt` untouched, so a long-dead backup can claim a LATER expiry than
+   * the live sign-in (observed on a real machine — a 2026-07-08 backup claimed
+   * 2027-07-06 while the live file expired 2026-11-14, and only the live file
+   * was accepted). Undefined when the document omits the field.
+   */
+  lastRefreshAtMs?: number;
 }
 /** Read-only sign-in summary for status and doctor output. */
 interface WorkBuddyAuthStatus {

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as prepareChatBody, C as workbuddyAccountId, D as parseCreditMultiplier, E as classifyUpstreamError, O as parseReasoning, S as parseWorkBuddyAuth, T as WorkBuddyUpstreamClient, _ as authFileName, a as readHostHeartbeat, b as defaultDesktopAuthPath, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, i as processStartTimeMs, j as regionOf, k as parseUpstreamModel, l as FALLBACK_WORKBUDDY_MODELS, m as WORKBUDDY_AUTH_FILENAME, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-DjNRPvQf.js";
+import { A as prepareChatBody, C as workbuddyAccountId, D as parseCreditMultiplier, E as classifyUpstreamError, O as parseReasoning, S as parseWorkBuddyAuth, T as WorkBuddyUpstreamClient, _ as authFileName, a as readHostHeartbeat, b as defaultDesktopAuthPath, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, i as processStartTimeMs, j as regionOf, k as parseUpstreamModel, l as FALLBACK_WORKBUDDY_MODELS, m as WORKBUDDY_AUTH_FILENAME, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-CaS5Koaw.js";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createProvider } from "@earendil-works/pi-ai";

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "Connect locally signed-in WorkBuddy models to DeepSeek Harness with a read-only credits overview and model management.",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",