dsh-connect-workbuddy 2.0.11 → 2.0.13

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # Changelog
 
+## 2.0.13 (Unreleased)
+
+### Bug Fixes
+
+- **上下文预算（或任何 regions/accounts 字段）保存失败：`settings mutate … must contain only JSON-compatible data (found a function at $.ops[0].value.get)`**（用户实报）。这是把「易失标记一生效」那条缺陷（2.0.12 修的）的**另一条受害者路径**补上了。
+
+  - **根因**：`__save` 端点（卡片保存的 Host 兜底路径）在合并时直接读取 `row.value[field]`，而 `row.value` 是 settings 服务解析后的 config——某 volatile 字段（`regions` / `accounts`）在那里是一个 `{ get(): T }` **活引用**。`{ ...这种对象 }` 展开后变成 `{ get: <函数> }`，于是 `settings.mutate` 的严格 JSON 兼容校验拒绝它，报 `found a function at $.ops[0].value.get`。保存**完全失败**（不是静默失败，而是直接报错），因为真实保存流程里 `scope.set()` 被判为未落盘后回退到了这个端点。
+  - **修法**：`__save` 在合并前先 `unwrapVolatileDeep(row.value?.[field])` 把活引用剥净，让 `mutate` 收到的 payload 只含 JSON 兼容数据。`unwrapVolatileDeep` 是 2.0.12 为 `installSection` 引入的同一 helper，这里复用。
+  - **回归测试**（`tests/web-status.spec.ts`）：构造一个 resolved config 含 `{ get() }` 活引用的 settings 服务，经真实 `__save` 路由请求，断言 `mutate` 收到的是一个能通过 JSON 往返的 payload（无函数），且上下文预算字段完好。**变异验证**：把 `unwrapVolatileDeep` 那行去掉，该用例立即变红。
+
+  > 说明：`__save` 会先把 `row.value[field]` 解包、再用「浅展开 + incoming 覆盖」合并到该字段。对单 region 写入（本次场景）足够；若日后要一次写多个 region 槽位，应改为深合并——届时再扩。
+
+### Tests
+
+- 331 → 332（新增 1 例：live-reference 配置下的 `__save` 保存回归）。
+
+## 2.0.12 (2026-09-23)
+
+### Features
+
+- **支持 DSH 0.1.7 线，且同一个构建同时服务 0.1.5 与 0.1.7**（合并社区 PR #14，作者 [@qikairo7](https://github.com/qikairo7)）。这不是「多支持一个版本」的可选增强——**在 0.1.7 上插件此前根本装配不起来**。
+
+  - **根因：settings 服务换型，`installSection` 消失。** 0.1.5 的 `SettingsProvider` 提供 `installSection(owner, ns, schema, entry, hooks)`；0.1.7 换成 `SettingsForms`，该方法**整个移除**（我在 `dsh-settings` / `dsh-config-editor` / `dsh-client-ui-settings-plugins` 三个包的整份 tarball 里逐一确认无此符号，也未迁移到其他包），取而代之的是 `configure({auto}, owner)`。而插件此前**无保护地裸调用** `ctx.settings.installSection(...)`——`inject = ['llm','settings']` 两个服务在 0.1.7 上都存在，所以 `apply()` 会一路执行到那一行。实测（用一个行为等同 0.1.7 的 settings 服务装配）：
+
+    ```
+    apply() THREW -> ctx.settings.installSection is not a function
+    ```
+
+    即**整个插件装配失败**：两个 provider 都不注册，卡片与 Web 状态路由同样不存在。这与「某个功能坏掉」在用户侧都是「用不了」，但成因完全不同——**也因此「重新登录」「重装插件」一概无效**。现在改为按能力探测：有 `configure` 走 `configure`，否则回落 `installSection`。
+  - **易失字段必须显式声明（issue #13 在 0.1.7 线上的真正根因）。** 0.1.7 的 settings 写入门要求插件 schema 把可写字段标记为 volatile，否则**写入被直接拒绝**（`Plugin entry "workbuddy" has no volatile fields`），`scope.set()` 却正常 resolve——于是卡片回读校验抛 `settings field "regions" was not persisted`。新增 `asVolatile()`：运行时探测 `schema.volatile()`，**有则调用、无则退化为 identity no-op**。这一条是兼容易失的关键——`volatile()` 在 3.18.3 才出现，更早的版本上 `asVolatile()` 必须**原样返回**同一个 schema 对象（identity no-op），而不是手写 `meta.volatile = true`：后者会绕过 schemastery 自身的 `validateVolatileSchema` 校验，产出一个它自己都不认的 schema，因此**故意不那样做**。
+  - **0.1.7 以「活引用」交付配置值。** 0.1.7 把配置值以 `{get(): T}` 形式交给 `apply()`，不解包则 `config.regions`、`value.accounts[region]`、`config.authFile` 静默变成对象或 `undefined`——表现为「设置明明写了却读不到」。新增 `unwrapVolatile()` 并在所有读取路径上解包，同时监听 `loader/volatile-update` 在每次写入后重读选择。
+  - **客户端双线槽位。** 两条线声明的是**互不相交**的槽位集合（0.1.5 只有 `settings.plugin.item`；0.1.7 是插件管理器的 `plugins.bundle.config` / `plugins.row.config`）。卡片现在逐个注册且**各自独立 try/catch**——一个槽位在某一线上不存在时，不能把另一条线的注册一起带走。settings scope 也按能力获取：0.1.7 走 `configForms.get(ns)`（并从镜像里取 Host 实际服务的 namespace，插件可能挂在别的 entry id 下），0.1.5 回落 `settingsScope.bind()`。
+  - **折叠箭头改为纯 CSS。** 两线 primitives 的图标名不重叠（`…Outline14` vs `…OutlineRegular`），没有任何一个静态图标 import 能同时服务两边。
+
+### Bug Fixes
+
+- **CI 在 windows-latest 上红了 2 例**（2.0.11 引入，本仓库自身的缺陷）。新增的 darwin 候选断言写死了 POSIX 字面量（`expect(mac).toContain('/Applications/WorkBuddy.app/Contents/MacOS/Electron')`）。生产代码没问题——它用 `join` 拼路径；错的是**测试**：它断言的是「跑测试的机器是 POSIX」，而非「darwin 候选列表对不对」。Windows 上 `join` 产出反斜杠，于是必然失败，而 macOS 上恒绿——**这正是它能一路走到 CI 的原因**。改为全部经 `join` 构造期望值，并补一条回归守卫：候选路径不得**混用**分隔符（用字面量 `/` 拼接在 Windows 上会产出 `\Applications/WorkBuddy.app`，任何正确路径都不会长这样）。
+
+- **易失标记一生效，0.1.5 线的设置区就整个消失**（合并 PR #14 后由本仓库查出并修复的真缺陷）。`asVolatile()` 给字段打上 volatile 标记后，该字段的值会被包成 `{get(): T}` **活引用**。而 `installSection(owner, ns, schema, entry, hooks)` 的第 4 个参数 `entry` 会被服务**校验并 `structuredClone`**，于是拿到活引用时逐字段抛错：
+
+  ```
+  $.authFile expected string but got [object Object]
+  ```
+
+  结果是命名空间**注册不上**——卡片设置区静默消失（实测 13 个测试变红）。
+
+  - **为什么 PR14 与 CI 都没发现**：两边都把 schemastery 锁在 **3.18.2**，那里没有 `volatile()`，`asVolatile()` 退化为 identity no-op，**这条路径从未被执行过**。而 PR14 自己又把 schemastery 钉进 `dependencies: 3.18.4`——npm 用户会解析到嵌套的 3.18.4，`volatile()` 真正生效，**恰好走进没人测过的分支**。开发环境掩盖了用户环境的缺陷，这是本次最值得记取的教训。
+  - **修法**：新增 `unwrapVolatileDeep()`，在把 config 交给 settings 服务前**递归**剥掉全部活引用（既有的 `unwrapVolatile()` 只剥调用方读取的那一层，够普通读路径用，不够交给服务校验用）。数组会被重建而非就地改写，调用方的 config 对象不受影响。
+  - **顺带把 `asVolatile()` 导出**，让「有 `volatile()` 则打标记 / 没有则恒等 no-op」两条分支**在任何机器上都能被确定性地断言**；否则把钉住的版本一提，no-op 那条分支的覆盖就会静默消失（而这正是手写 `meta.volatile` 会绕过校验的那条防线）。
+
+### Tests
+
+测试总数 300 → 331。
+
+- **双 settings 形态兼容（新增 2 例，这是 PR14 缺的那块）**：PR14 只测了 0.1.5 形态——而它修的恰恰是 **0.1.7 分支**，这样的套件在 0.1.7 分支再次坏掉时**不会变红**，正是让本次缺陷穿过 CI 的原因。现在两条路径各有独立用例：0.1.7 形态（有 `configure`、**无** `installSection`）下必须装配成功、两个 provider 均注册、且确实走了 `configure({auto:true})`；0.1.5 形态下必须继续走 `installSection`（否则命名空间不会注册）。**变异验证**：把 `installSection` 改回无保护裸调用，第一条立即变红。
+- **活引用不得喂给 settings 服务（新增 3 例）**：`unwrapVolatileDeep()` 必须递归剥净（含嵌套与数组）、且不就地改写调用方对象；`installSection` 拿到的 entry 必须无活引用（断言注册结果与 `base` 形状，而不是断言内部调用，实现改动无法伪造）；两条 volatile 分支各自被确定性断言。**变异验证**：把 `installSection` 的 entry 改回原始 config，**13 个用例立即变红**。
+- **供应商开关的落盘校验（新增 5 例）**：`locked` scope 下必须抛错、错误须标明 `regions`、正常落盘须成功、整槽位其余字段须原样带过、槽位存在但 `enabled` 是错值也须判失败（浅检查会放过「开关没真的关掉」）。
+- **测试读取也走生产 helper**：新增 `readSettings()`——0.1.7 上 `settings.get()` 返回的同样是活引用，直接读 `doc.accounts.cn` 得到 `undefined`，那是**任何真实消费方都不会看到的形状**。断言统一经 `unwrapVolatileDeep()` 解包，避免测试在真实消费方看不见的形状上通过或失败。
+- 其余为 PR14 自带的兼容与槽位隔离用例，以及上一版的凭据修复用例，全部保留。
+
+**双版本验证**：同一份代码在 schemastery **3.18.4**（volatile 生效）与 **3.18.2**（no-op 分支）下**均为 326 通过**。
+
+- **供应商开关是唯一漏掉「落盘校验」的设置写入**（同批查出的第二处）。关掉某个区域的供应商时，卡片直接调 `settingsScope.set('regions', …)`，**没有**读回校验，也**没接上**插件自己的 Host 兜底端点——而账号选择与模型目录两处早就两者皆有。于是 0.1.7 上那个「`set()` 正常 resolve 但什么都没存」的 scope 会让开关**看起来生效、随后静默复原**，正是 issue #13 的同一类静默失败。现在开关改走 `writeRegionEnabled()`，与其余写入同一条「先 scope、没落盘再走 Host 端点」的路径，要么写进去、要么明确报错。
+
+  - 整槽位照旧原样带过（只改 `enabled`），用户的模型目录、勾选、图片开关与上下文预算不受影响。
+  - 回归测试用 `locked` scope（`set()` 正常 resolve、不落盘）钉住；**变异验证**：把它改回直接调 `scope.set()`，3 个用例立即变红。
+
+**同时把开发环境的 schemastery 提到 3.18.4**（`pnpm-workspace.yaml` 的 override）。此前它锁在 3.18.2，于是 CI 只覆盖 no-op 分支——**而用户实际拿到的是 3.18.4**（`dependencies` 钉住的那份嵌套副本）。开发环境与用户环境不一致，正是这个缺陷能同时躲过 PR 评审与 CI 的原因。代价是 no-op 分支不再由「装到的版本恰好很旧」顺带覆盖，因此 `asVolatile()` 改为导出，并用一条不依赖安装版本的用例把它钉死。
+
+### Docs
+
+- 本条目记录 0.1.7 的三项差异（settings 换型、易失声明、活引用）与其判定方式，供后续 DSH 升级时对照。
+
 ## 2.0.11 (2026-09-23)
 
 ### Bug Fixes

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { O as workbuddyOwnAuthPath, T as legacyWorkbuddyOwnAuthPath, W as findWorkbuddyAppExecutable, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, g as WORKBUDDY_AUTH_FILE_ENV, j as WorkBuddyUpstreamClient, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, x as defaultDesktopAuthDirs, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-BJdDmMSn.js";
+import { O as workbuddyOwnAuthPath, T as legacyWorkbuddyOwnAuthPath, W as findWorkbuddyAppExecutable, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, g as WORKBUDDY_AUTH_FILE_ENV, j as WorkBuddyUpstreamClient, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, x as defaultDesktopAuthDirs, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-FxHiaIn-.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -5,7 +5,6 @@ window.__ModuleLoader__.load({
 		var exports = module.exports;
 		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 		let react = require("react");
-		let _deepseek_ai_dsh_client_ui_primitives = require("@deepseek-ai/dsh-client-ui-primitives");
 		let react_jsx_runtime = require("react/jsx-runtime");
 		//#region src/status-paths.ts
 		/**
@@ -130,16 +129,75 @@ window.__ModuleLoader__.load({
 		var WorkBuddySettingsWriteError = class extends Error {
 			/** The settings field that did not land. */
 			field;
-			constructor(field) {
-				super(`workbuddy: settings field "${field}" was not persisted by the settings write`);
+			constructor(field, reason) {
+				super(`workbuddy: settings field "${field}" was not persisted by the settings write${reason === void 0 ? "" : `: ${reason}`}`);
 				this.name = "WorkBuddySettingsWriteError";
 				this.field = field;
 			}
 		};
-		/** Read the per-region account selections out of the settings snapshot. */
-		function configuredAccountsOf(configured) {
-			const accounts = configured?.accounts;
-			return typeof accounts === "object" && accounts !== null ? accounts : {};
+		/** Read one settings field's current object value from the scope snapshot. */
+		function fieldSnapshotOf(scope, field) {
+			const value = scope.getSnapshot().value?.[field];
+			return typeof value === "object" && value !== null ? value : {};
+		}
+		/**
+		* Fallback write: POST the field to the plugin's own Host endpoint.
+		*
+		* The endpoint handler runs the settings mutate inside the Host process and
+		* reports the raw refusal exception, so a failure here names its cause instead
+		* of arriving as a swallowed `ok:false`. It merges the posted region key into
+		* the field's live value, preserving the other region.
+		*/
+		async function saveViaHostEndpoint(field, region, value) {
+			let response;
+			try {
+				response = await fetch("/plugins/dsh-connect-workbuddy/__save", {
+					method: "POST",
+					headers: { "Content-Type": "application/json" },
+					body: JSON.stringify({
+						field,
+						value: { [region]: value }
+					})
+				});
+			} catch (error) {
+				throw new WorkBuddySettingsWriteError(field, `Host save endpoint unreachable: ${String(error)}`);
+			}
+			if (!response.ok) {
+				const detail = await response.json().catch(() => ({ error: `HTTP ${String(response.status)}` }));
+				const reason = `${String(detail.errorName ?? "")} ${String(detail.error ?? "")}`.trim();
+				throw new WorkBuddySettingsWriteError(field, `Host save refused: ${reason === "" ? String(detail.error) : reason}`);
+			}
+		}
+		/**
+		* Write one volatile field, then confirm the value actually landed.
+		*
+		* The bound settings scope is the official path and is tried FIRST: it keeps
+		* the browser mirror in sync, and it is the only writer needed on hosts whose
+		* ConfigForm is healthy. On the affected DSH 0.1.7 deployment that scope
+		* settles without delivering anything — its `set()` resolves `false` while the
+		* Host's own mutate is perfectly healthy (proven by a direct in-Host probe) —
+		* so a write that does not read back falls through to the plugin's Host
+		* endpoint, which performs the mutate inside the Host process.
+		*
+		* `landed` decides whether a value read back from the scope is the value that
+		* was written; it is per-field because `''` (a cleared account slot) and an
+		* absent key are different states, and a truncated model catalog must not pass
+		* a shallow "is anything there?" check.
+		*
+		* @throws {WorkBuddySettingsWriteError} when neither path persists the value.
+		*/
+		async function writeField(scope, field, region, value, landed) {
+			let scopeDelivered = false;
+			try {
+				scopeDelivered = await scope.set(field, {
+					...fieldSnapshotOf(scope, field),
+					[region]: value
+				}) !== false;
+			} catch {
+				scopeDelivered = false;
+			}
+			if (scopeDelivered && landed(fieldSnapshotOf(scope, field)[region])) return;
+			await saveViaHostEndpoint(field, region, value);
 		}
 		/**
 		* Write one region's account slot, then confirm the value actually landed.
@@ -168,12 +226,7 @@ window.__ModuleLoader__.load({
 		*   something else — i.e. the write silently did not persist.
 		*/
 		async function writeAccountSlot(scope, region, value) {
-			const accounts = configuredAccountsOf(scope.getSnapshot().value);
-			await scope.set("accounts", {
-				...accounts,
-				[region]: value
-			});
-			if (configuredAccountsOf(scope.getSnapshot().value)[region] !== value) throw new WorkBuddySettingsWriteError("accounts");
+			await writeField(scope, "accounts", region, value, (readBack) => readBack === value);
 		}
 		/**
 		* Write one region's saved model state, then confirm it actually landed.
@@ -194,16 +247,43 @@ window.__ModuleLoader__.load({
 		* @throws {WorkBuddySettingsWriteError} when the catalog does not read back.
 		*/
 		async function writeRegionModels(scope, region, payload) {
-			const configured = scope.getSnapshot().value?.regions;
-			const regions = typeof configured === "object" && configured !== null ? configured : {};
-			await scope.set("regions", {
-				...regions,
-				[region]: payload
-			});
-			const landed = scope.getSnapshot().value?.regions?.[region];
 			const written = payload.lastCatalog.map((model) => model.id);
-			const stored = landed?.lastCatalog?.map((model) => model.id);
-			if (!(stored !== void 0 && stored.length === written.length && stored.every((id, index) => id === written[index]))) throw new WorkBuddySettingsWriteError("regions");
+			await writeField(scope, "regions", region, payload, (readBack) => {
+				const stored = readBack?.lastCatalog?.map((model) => model.id);
+				return stored !== void 0 && stored.length === written.length && stored.every((id, index) => id === written[index]);
+			});
+		}
+		/**
+		* Switch one region's provider off or on, with the same landed-check as every
+		* other settings write.
+		*
+		* This exists because the toggle was the ONE write that still called
+		* `scope.set()` directly. On the affected 0.1.7 deployments that scope settles
+		* without storing anything, so flipping a provider off appeared to work and
+		* then silently reverted — the exact silent-failure mode
+		* {@link writeAccountSlot} and {@link writeRegionModels} were written to
+		* prevent for their own fields. Routing it through {@link writeField} gives it
+		* the same scope-first-then-Host-endpoint path, so the switch either lands or
+		* reports why it did not.
+		*
+		* The write carries the region's whole slot through untouched — only `enabled`
+		* changes — so the user's directory, model picks, image opt-ins and budgets
+		* survive the round trip. The Host withdraws or restores the provider route on
+		* the next `onChange`, which is what actually removes it from DSH's model
+		* picker.
+		*
+		* @param scope - the bound settings scope for this plugin's namespace.
+		* @param region - the region being switched.
+		* @param enabled - the desired state.
+		* @param slot - the region's COMPLETE next slot (the caller owns the snapshot
+		*   read and the whole-slot merge, so this stays a pure write).
+		* @throws {WorkBuddySettingsWriteError} when neither writer persists the value.
+		*/
+		async function writeRegionEnabled(scope, region, enabled, slot) {
+			await writeField(scope, "regions", region, slot, (readBack) => {
+				const stored = readBack;
+				return stored !== null && stored !== void 0 && stored["enabled"] === enabled;
+			});
 		}
 		//#endregion
 		//#region src/client/icon.ts
@@ -244,7 +324,11 @@ window.__ModuleLoader__.load({
 .dsm-plugin-card-head{flex-direction:column;flex:1;gap:4px;min-width:0;display:flex}
 .dsm-plugin-card-title{color:var(--dsw-alias-label-primary,#e6e6e6);font-size:15px;font-weight:600;line-height:1.4}
 .dsm-plugin-card-description{color:var(--dsw-alias-label-tertiary,#999);font-size:13px;line-height:1.5}
-.dsm-plugin-card-chevron{color:var(--dsw-alias-label-tertiary,#999);flex:none;display:inline-flex;transition:transform .16s}
+/* Pure-CSS caret: the host primitives' chevron icon names differ per DSH line
+   (0.1.5 Outline14 vs 0.1.7 OutlineRegular), so no static import can serve
+   both. A border caret in the plugin's own CSS is version-proof. */
+.dsm-plugin-card-chevron{color:var(--dsw-alias-label-tertiary,#999);flex:none;width:16px;height:16px;position:relative;transition:transform .16s}
+.dsm-plugin-card-chevron::before{content:"";display:block;position:absolute;left:4px;top:5px;width:7px;height:7px;border-right:1.6px solid currentColor;border-bottom:1.6px solid currentColor;transform:rotate(45deg)}
 .dsm-plugin-card-chevron-open{transform:rotate(180deg)}
 .dsm-plugin-card-body{border-top:1px solid var(--dsw-alias-border-l2,#36373b);margin:0 16px;padding:0 0 8px}
 .dsm-plugin-card-icon{width:32px;height:32px;flex:none;border-radius:7px}
@@ -605,9 +689,9 @@ window.__ModuleLoader__.load({
 			return { background: status === "signed-in" ? "var(--dsw-alias-state-success-primary, #22a06b)" : status === "error" ? "var(--dsw-alias-state-error-primary, #d92d20)" : "var(--dsw-alias-label-dimmed, #9aa0a6)" };
 		}
 		/** Render WorkBuddy sign-in state, credits, and model selection as one card. */
-		function WorkBuddyCard({ t, settingsScope }) {
+		function WorkBuddyCard({ t, settingsScope, view }) {
 			if (t === void 0) throw new Error("WorkBuddy plugin card requires its translation function");
-			const [open, setOpen] = (0, react.useState)(false);
+			const [open, setOpen] = (0, react.useState)(view === "page");
 			/** The region whose tab is on screen; each tab is its own provider stack. */
 			const [activeRegion, setActiveRegion] = (0, react.useState)("cn");
 			/**
@@ -776,12 +860,19 @@ window.__ModuleLoader__.load({
 			* directory, model picks, image opt-ins and budgets survive a round trip.
 			* The Host withdraws or restores the provider route on the next `onChange`,
 			* which is what actually removes it from DSH's model picker.
+			*
+			* Goes through `writeRegionEnabled` rather than calling `scope.set()`
+			* directly: on the affected 0.1.7 deployments that scope settles without
+			* storing anything, so a direct write appeared to succeed and then silently
+			* reverted. The helper adds the landed-check and the Host-endpoint fallback
+			* that every other settings write already had.
 			*/
 			const toggleRegion = async (item, enabled) => {
-				if (settingsScope === void 0 || settingsScope.getSnapshot().writable !== true) return;
+				if (settingsScope === void 0) return;
 				setTogglingRegion(item);
 				try {
-					await settingsScope.set("regions", nextRegionEnabled(settingsScope.getSnapshot().value, item, enabled));
+					const slot = nextRegionEnabled(settingsScope.getSnapshot().value, item, enabled)[item];
+					await writeRegionEnabled(settingsScope, item, enabled, typeof slot === "object" && slot !== null ? slot : {});
 				} finally {
 					if (mounted.current) setTogglingRegion(void 0);
 				}
@@ -854,13 +945,22 @@ window.__ModuleLoader__.load({
 			const activeEnabledIds = draft?.enabledIds ?? savedEnabledIds;
 			const savedImageIds = status.status === "signed-in" ? new Set(status.imageModelIds) : /* @__PURE__ */ new Set();
 			const activeImageIds = draft?.imageIds ?? savedImageIds;
-			const configured = settingsScope?.getSnapshot().value;
-			const configuredRegion = status.status === "signed-in" ? configured?.regions?.[status.region] : void 0;
-			const legacyContextBudgets = status.status === "signed-in" && status.region === "cn" ? configured?.contextBudgets : void 0;
-			const savedContextBudgetsSource = configuredRegion?.contextBudgets ?? legacyContextBudgets;
-			const savedContextBudgets = typeof savedContextBudgetsSource === "object" && savedContextBudgetsSource !== null ? savedContextBudgetsSource : {};
+			settingsScope?.getSnapshot().value;
+			const savedContextBudgets = status.status === "signed-in" ? status.contextBudgets ?? {} : {};
 			const activeContextBudgets = draft?.contextBudgets ?? savedContextBudgets;
 			const dirty = draft !== void 0;
+			/**
+			* Whether the card's inputs accept edits.
+			*
+			* Deliberately NOT the settings scope's own `writable` flag: on the affected
+			* DSH 0.1.7 deployment that flag stays false (the scope initialises it false
+			* and only raises it once its mirror loads as a Host-backed form), which left
+			* every input `disabled` — clicking them did nothing at all. Writes no longer
+			* depend on that flag: `writeField` tries the scope and falls back to the
+			* plugin's own Host endpoint, which performs the mutate in the Host process.
+			* A bound scope is therefore all that is required to accept an edit.
+			*/
+			const canWrite = settingsScope !== void 0;
 			const editDraft = (edit) => {
 				setDrafts((prev) => ({
 					...prev,
@@ -991,8 +1091,7 @@ window.__ModuleLoader__.load({
 						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							"aria-hidden": "true",
-							className: `dsm-plugin-card-chevron${open ? " dsm-plugin-card-chevron-open" : ""}`,
-							children: (0, react.createElement)(_deepseek_ai_dsh_client_ui_primitives.IconChevronDownOutline14, { size: 14 })
+							className: `dsm-plugin-card-chevron${open ? " dsm-plugin-card-chevron-open" : ""}`
 						})
 					]
 				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
@@ -1030,7 +1129,7 @@ window.__ModuleLoader__.load({
 											children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 												type: "checkbox",
 												checked: regionOnState,
-												disabled: togglingRegion === region || settingsScope?.getSnapshot().writable !== true,
+												disabled: togglingRegion === region || !canWrite,
 												"aria-label": t("row.tabSwitchAria", { region: region === "cn" ? t("row.tabCn") : t("row.tabGlobal") }),
 												onChange: (event) => {
 													toggleRegion(region, event.target.checked);
@@ -1094,7 +1193,7 @@ window.__ModuleLoader__.load({
 										children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
 											className: "dsm-workbuddy-usage-select",
 											value: status.accounts.find((account) => account.selected)?.id ?? "",
-											disabled: switchingAccount || settingsScope?.getSnapshot().writable !== true,
+											disabled: switchingAccount || !canWrite,
 											onChange: (event) => {
 												switchAccount(event.currentTarget.value);
 											},
@@ -1203,7 +1302,7 @@ window.__ModuleLoader__.load({
 										status.recovery?.usableAccount === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 											type: "button",
 											className: "dsm-btn dsm-btn-outline",
-											disabled: switchingAccount || settingsScope?.getSnapshot().writable !== true,
+											disabled: switchingAccount || !canWrite,
 											onClick: () => {
 												const target = status.recovery?.usableAccount;
 												if (target !== void 0) switchAccount(target.accountId);
@@ -1250,7 +1349,7 @@ window.__ModuleLoader__.load({
 															children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 																type: "checkbox",
 																checked: activeEnabledIds.has(model.id),
-																disabled: settingsScope?.getSnapshot().writable !== true || saving,
+																disabled: !canWrite || saving,
 																onChange: () => {
 																	toggleModel(model.id);
 																}
@@ -1275,7 +1374,7 @@ window.__ModuleLoader__.load({
 															children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 																type: "checkbox",
 																checked: activeImageIds.has(model.id),
-																disabled: settingsScope?.getSnapshot().writable !== true || saving,
+																disabled: !canWrite || saving,
 																onChange: () => {
 																	toggleImage(model.id);
 																}
@@ -1288,7 +1387,7 @@ window.__ModuleLoader__.load({
 																type: "radio",
 																name: `context-${model.id}`,
 																checked: (activeContextBudgets[model.id] ?? 2e5) === 2e5,
-																disabled: settingsScope?.getSnapshot().writable !== true || saving,
+																disabled: !canWrite || saving,
 																onChange: () => {
 																	setContextBudget(model.id, 2e5);
 																}
@@ -1296,7 +1395,7 @@ window.__ModuleLoader__.load({
 																type: "radio",
 																name: `context-${model.id}`,
 																checked: model.nativeContextWindow <= 2e5 || activeContextBudgets[model.id] === model.nativeContextWindow,
-																disabled: model.nativeContextWindow <= 2e5 || settingsScope?.getSnapshot().writable !== true || saving,
+																disabled: model.nativeContextWindow <= 2e5 || !canWrite || saving,
 																onChange: () => {
 																	setContextBudget(model.id, model.nativeContextWindow);
 																}
@@ -1544,12 +1643,17 @@ window.__ModuleLoader__.load({
 		//#region src/client/index.tsx
 		/** Stable browser-plugin name. */
 		const name = "dsh-connect-workbuddy-client";
-		/** Client services required by the Plugin configuration contribution. */
-		const inject = [
-			"slots",
-			"locale",
-			"settingsScope"
-		];
+		/**
+		* Client services required by the Plugin configuration contribution.
+		*
+		* Deliberately only the two services that exist on BOTH host lines. The
+		* settings surface differs by line — 0.1.5 provides `settingsScope`, 0.1.7
+		* replaces it with `configForms` — and Cordis' dependency gate is hard: any
+		* inject entry the running line does not provide keeps `apply` from ever
+		* running. Probing both via `ctx.get()` (which returns undefined, never
+		* throws, for an absent service) is what lets one build serve both lines.
+		*/
+		const inject = ["slots", "locale"];
 		/** Register card copy and the WorkBuddy card under Plugin configuration. */
 		function apply(ctx) {
 			try {
@@ -1559,16 +1663,36 @@ window.__ModuleLoader__.load({
 					en
 				}), "dsh-connect-workbuddy: settings copy");
 				const t = ctx.locale.bind(namespace);
-				const settingsScope = ctx.settingsScope.bind({ namespace: "workbuddy" });
-				ctx.slots.inject("settings.plugin.item", () => ctx.slots.register({
-					name: "settings.plugin.item",
-					key: "workbuddy",
-					priority: 30,
-					inject: () => ({
-						t,
-						settingsScope
-					})
-				}, WorkBuddyCard));
+				const softGet = (name) => ctx.get(name);
+				let settingsScope;
+				const forms = softGet("configForms");
+				const legacy = softGet("settingsScope");
+				if (forms !== void 0) {
+					let ns = "workbuddy";
+					try {
+						const served = (forms.describe().getSnapshot().view?.namespaces ?? []).find((entry) => entry.ns === "workbuddy" || /workbuddy/i.test(entry.ns));
+						if (served !== void 0) ns = served.ns;
+					} catch {}
+					settingsScope = forms.get(ns);
+				} else if (legacy !== void 0) settingsScope = legacy.bind({ namespace: "workbuddy" });
+				const registerCard = (slotName, key) => {
+					try {
+						ctx.slots.inject(slotName, () => ctx.slots.register({
+							name: slotName,
+							key,
+							priority: 30,
+							inject: () => settingsScope === void 0 ? { t } : {
+								t,
+								settingsScope
+							}
+						}, WorkBuddyCard));
+					} catch (error) {
+						console.error(`[dsh-connect-workbuddy] card slot "${slotName}" failed to register (host provider unaffected):`, error);
+					}
+				};
+				registerCard("plugins.bundle.config", "dsh-connect-workbuddy");
+				registerCard("plugins.row.config", "dsh-connect-workbuddy#dsh-connect-workbuddy");
+				registerCard("settings.plugin.item", "workbuddy");
 			} catch (error) {
 				console.error("[dsh-connect-workbuddy] client card failed to load (host provider unaffected):", error);
 			}

package/lib/{host-heartbeat-BJdDmMSn.js → host-heartbeat-FxHiaIn-.js}

@@ -2208,7 +2208,7 @@ var WorkBuddyCatalog = class {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "2.0.11";
+const WORKBUDDY_CONNECT_VERSION = "2.0.13";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -1345,6 +1345,23 @@ type WorkBuddyWebUsage =
   credentialRejected?: boolean;
   /** Present only alongside {@link credentialRejected}. */
   recovery?: WorkBuddyWebRecovery;
+  /**
+   * Diagnostic only: whether this Host build's Config carries the volatile
+   * markers dsh-settings requires before it will persist any field. Exposed
+   * so a save refusal can be attributed to the settings gate rather than
+   * guessed at.
+   */
+  diagVolatile?: {
+    regions: boolean;
+    accounts: boolean;
+    authFile: boolean;
+  };
+  /**
+   * The persisted per-region context budgets as the Host reads them. The
+   * browser settings mirror can lag a write made through the Host save
+   * endpoint, so the card renders these rather than a possibly-stale snapshot.
+   */
+  contextBudgets?: Record<string, number>;
 } | {
   status: 'error';
   message: string;
@@ -1475,6 +1492,43 @@ interface Config {
   /** @deprecated See {@link Config.lastCatalog}. */
   contextBudgets?: Record<string, WorkBuddyContextBudget>;
 }
+/**
+ * Mark a schema's field as volatile on the DSH lines that support it.
+ *
+ * `volatile()` exists from schemastery 3.18.3 (the DSH 0.1.7 line, which is the
+ * only line whose settings write gate reads the marker). Older pinning (3.18.2,
+ * the 0.1.5 line) has no such method, and the schema must stay byte-identical to
+ * the unmarked original there: hand-writing `meta.volatile = true` would bypass
+ * schemastery's own validateVolatileSchema checks and produce a schema no 0.1.5
+ * consumer understands — so on that line this degrades to an identity no-op.
+ *
+ * Exported so BOTH arms are testable on any machine. The capability is decided
+ * by whichever schemastery the dependency tree resolves, so without a seam the
+ * no-op arm would silently stop being exercised the moment the pinned version
+ * moved up — which is exactly how the volatile-path defect below went unseen.
+ */
+declare function asVolatile<T>(schema: z<T>): z<T>;
+/**
+ * Deep copy of a config value with every `{get(): T}` live reference replaced
+ * by the value it resolves to.
+ *
+ * {@link unwrapVolatile} only peels the ONE level a caller reads, which is all
+ * the ordinary read paths need. Handing a config object to a settings service
+ * is different: the service validates and `structuredClone`s the WHOLE object,
+ * so a reference surviving anywhere inside it fails schema validation with a
+ * message that names the field but not the cause —
+ * `$.authFile expected string but got [object Object]`.
+ *
+ * That is exactly what happened on the 0.1.5 line once volatile marking became
+ * active: `installSection` received the raw config, whose volatile fields were
+ * live references, and every field it validated threw. The namespace never
+ * registered, so the card's settings silently disappeared.
+ *
+ * Non-reference values are recursed into so a nested volatile field is caught
+ * too — arrays are rebuilt rather than mutated, so the caller's config object is
+ * never touched.
+ */
+declare function unwrapVolatileDeep<T>(value: T): T;
 declare const Config: z<Config>;
 /**
  * One region's saved model state. A config written before the region split has
@@ -1545,4 +1599,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, type WorkBuddyWebAccount, type WorkBuddyWebCheckin, type WorkBuddyWebCredits, type WorkBuddyWebModel, type WorkBuddyWebPackage, type WorkBuddyWebRegion, type WorkBuddyWebSearchPath, type WorkBuddyWebUsage, apply, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nextRegionEnabled, nextRegionSlots, openEncryptedField, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, type WorkBuddyWebAccount, type WorkBuddyWebCheckin, type WorkBuddyWebCredits, type WorkBuddyWebModel, type WorkBuddyWebPackage, type WorkBuddyWebRegion, type WorkBuddyWebSearchPath, type WorkBuddyWebUsage, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nextRegionEnabled, nextRegionSlots, openEncryptedField, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as WorkBuddyCredentialRejectedError, B as clearAtRestKeyCache, C as hasEncryptedCredentialFields, D as workbuddyAccountId, E as parseWorkBuddyAuth, F as parseReasoning, G as isEncryptedFieldWrapper, H as deriveAtRestKeyId, I as parseUpstreamModel, J as macosNestedAppBundles, K as isWorkbuddyBundle, L as prepareChatBody, M as classifyUpstreamError, N as isCredentialRejectedError, O as workbuddyOwnAuthPath, P as parseCreditMultiplier, R as regionOf, S as defaultDesktopAuthPath, T as legacyWorkbuddyOwnAuthPath, U as fetchAtRestKeyPayload, V as deriveAtRestKey, W as findWorkbuddyAppExecutable, X as readAtRestKey, Y as openEncryptedField, Z as workbuddyAppExecutableCandidates, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WORKBUDDY_AUTH_FILE_ENV, h as WORKBUDDY_AUTH_FILENAME, i as processStartTimeMs, j as WorkBuddyUpstreamClient, k as CREDENTIAL_REJECTED_CODE, l as FALLBACK_WORKBUDDY_MODELS, m as ENCRYPTED_CREDENTIAL_CODE, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, q as macosBundleExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as WorkBuddyEncryptedCredentialError, w as isEncryptedCredentialError, x as defaultDesktopAuthDirs, y as authFileName, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-BJdDmMSn.js";
+import { A as WorkBuddyCredentialRejectedError, B as clearAtRestKeyCache, C as hasEncryptedCredentialFields, D as workbuddyAccountId, E as parseWorkBuddyAuth, F as parseReasoning, G as isEncryptedFieldWrapper, H as deriveAtRestKeyId, I as parseUpstreamModel, J as macosNestedAppBundles, K as isWorkbuddyBundle, L as prepareChatBody, M as classifyUpstreamError, N as isCredentialRejectedError, O as workbuddyOwnAuthPath, P as parseCreditMultiplier, R as regionOf, S as defaultDesktopAuthPath, T as legacyWorkbuddyOwnAuthPath, U as fetchAtRestKeyPayload, V as deriveAtRestKey, W as findWorkbuddyAppExecutable, X as readAtRestKey, Y as openEncryptedField, Z as workbuddyAppExecutableCandidates, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WORKBUDDY_AUTH_FILE_ENV, h as WORKBUDDY_AUTH_FILENAME, i as processStartTimeMs, j as WorkBuddyUpstreamClient, k as CREDENTIAL_REJECTED_CODE, l as FALLBACK_WORKBUDDY_MODELS, m as ENCRYPTED_CREDENTIAL_CODE, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, q as macosBundleExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as WorkBuddyEncryptedCredentialError, w as isEncryptedCredentialError, x as defaultDesktopAuthDirs, y as authFileName, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-FxHiaIn-.js";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createProvider } from "@earendil-works/pi-ai";
@@ -715,6 +715,10 @@ async function searchedPaths(store) {
 		return {};
 	}
 }
+/** Reads schemastery's internal `meta.volatile` marker for one top-level field. */
+function volatileFlagOf(field) {
+	return Config.dict?.[field]?.meta?.volatile === true;
+}
 /**
 * Assemble one region's card document. `region` is the tab the card is on;
 * the region-scoped store already answers with only that region's accounts,
@@ -775,6 +779,12 @@ async function workBuddyWebStatus(deps, region) {
 	});
 	return {
 		status: "signed-in",
+		contextBudgets: Object.fromEntries(Object.entries(deps.contextBudgets(region)).filter(([, value]) => typeof value === "number")),
+		diagVolatile: {
+			regions: volatileFlagOf("regions"),
+			accounts: volatileFlagOf("accounts"),
+			authFile: volatileFlagOf("authFile")
+		},
 		...account,
 		...creditsResult.status === "fulfilled" ? { credits: toCredits(creditsResult.value) } : { creditsError: safeMessage(creditsResult.reason) },
 		...checkinResult.status === "fulfilled" ? { checkin: checkinResult.value } : { checkinError: safeMessage(checkinResult.reason) },
@@ -881,11 +891,59 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 				}
 			}
 		});
+		const disposeDiagWrite = ctx.webServer.register({
+			kind: "exact",
+			path: "/plugins/dsh-connect-workbuddy/__save",
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				const settings = ctx.get?.("settings");
+				if (settings === void 0) return json(res, 503, { error: "settings service unavailable to this fiber" });
+				try {
+					const body = await new Promise((resolve, reject) => {
+						const chunks = [];
+						req.on("data", (chunk) => chunks.push(chunk));
+						req.on("end", () => {
+							try {
+								resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+							} catch (e) {
+								reject(e);
+							}
+						});
+						req.on("error", reject);
+					});
+					const field = body.field;
+					if (field !== "regions" && field !== "accounts") return json(res, 400, { error: "field must be regions or accounts" });
+					const row = settings.describe().find((r) => String(r.ns).includes("workbuddy"));
+					if (row === void 0) return json(res, 503, { error: "workbuddy namespace missing from describe()" });
+					const current = unwrapVolatileDeep(row.value?.[field] ?? {});
+					const incoming = body.value ?? {};
+					const merged = {
+						...current,
+						...incoming
+					};
+					await settings.mutate(row.ns, [{
+						op: "set",
+						path: [field],
+						value: merged
+					}], void 0);
+					return json(res, 200, { ok: true });
+				} catch (error) {
+					const err = error;
+					return json(res, 500, {
+						ok: false,
+						errorName: err?.name ?? "unknown",
+						error: err?.message ?? String(error)
+					});
+				}
+			}
+		});
 		return () => {
 			disposeRefresh();
 			disposeCheckin();
 			disposeAccounts();
 			disposeUsage();
+			disposeDiagWrite();
 		};
 	}, "dsh-connect-workbuddy: Web status route");
 }
@@ -914,11 +972,63 @@ const accountSelectionConfig = z.object({
 	cn: z.string().description("Selected domestic (CN) account id (never a token)"),
 	global: z.string().description("Selected international account id (never a token)")
 });
+/**
+* Mark a schema's field as volatile on the DSH lines that support it.
+*
+* `volatile()` exists from schemastery 3.18.3 (the DSH 0.1.7 line, which is the
+* only line whose settings write gate reads the marker). Older pinning (3.18.2,
+* the 0.1.5 line) has no such method, and the schema must stay byte-identical to
+* the unmarked original there: hand-writing `meta.volatile = true` would bypass
+* schemastery's own validateVolatileSchema checks and produce a schema no 0.1.5
+* consumer understands — so on that line this degrades to an identity no-op.
+*
+* Exported so BOTH arms are testable on any machine. The capability is decided
+* by whichever schemastery the dependency tree resolves, so without a seam the
+* no-op arm would silently stop being exercised the moment the pinned version
+* moved up — which is exactly how the volatile-path defect below went unseen.
+*/
+function asVolatile(schema) {
+	if (typeof schema.volatile === "function") return schema.volatile();
+	return schema;
+}
+function unwrapVolatile(value) {
+	if (value !== null && typeof value === "object" && "get" in value && typeof value.get === "function") return value.get();
+	return value;
+}
+/**
+* Deep copy of a config value with every `{get(): T}` live reference replaced
+* by the value it resolves to.
+*
+* {@link unwrapVolatile} only peels the ONE level a caller reads, which is all
+* the ordinary read paths need. Handing a config object to a settings service
+* is different: the service validates and `structuredClone`s the WHOLE object,
+* so a reference surviving anywhere inside it fails schema validation with a
+* message that names the field but not the cause —
+* `$.authFile expected string but got [object Object]`.
+*
+* That is exactly what happened on the 0.1.5 line once volatile marking became
+* active: `installSection` received the raw config, whose volatile fields were
+* live references, and every field it validated threw. The namespace never
+* registered, so the card's settings silently disappeared.
+*
+* Non-reference values are recursed into so a nested volatile field is caught
+* too — arrays are rebuilt rather than mutated, so the caller's config object is
+* never touched.
+*/
+function unwrapVolatileDeep(value) {
+	if (value === null || typeof value !== "object") return value;
+	if (typeof value.get === "function") return unwrapVolatileDeep(value.get());
+	if (Array.isArray(value)) return value.map((entry) => unwrapVolatileDeep(entry));
+	const source = value;
+	const out = {};
+	for (const key of Object.keys(source)) out[key] = unwrapVolatileDeep(source[key]);
+	return out;
+}
 const Config = z.object({
-	authFile: z.string().description("WorkBuddy desktop auth file (defaults to the app's own location)"),
+	authFile: asVolatile(z.string().description("WorkBuddy desktop auth file (defaults to the app's own location)")),
 	accountId: z.string().description("Deprecated: pre-split account selector, attributed to its own region"),
-	accounts: accountSelectionConfig.description("Per-region account selections, keyed cn | global"),
-	regions: z.dict(regionStateConfig).default({}).description("Per-region model directory and selection, keyed cn | global"),
+	accounts: asVolatile(accountSelectionConfig.default({}).description("Per-region account selections, keyed cn | global")),
+	regions: asVolatile(z.dict(regionStateConfig).default({}).description("Per-region model directory and selection, keyed cn | global")),
 	lastCatalog: z.array(modelConfig).description("Deprecated: pre-region-split CN model directory"),
 	enabledModelIds: z.array(z.string()).default([]).description("Deprecated: pre-region-split CN selection"),
 	imageModelIds: z.array(z.string()).default([]).description("Deprecated: pre-region-split CN image opt-in"),
@@ -934,14 +1044,18 @@ const Config = z.object({
 * picks.
 */
 function regionStateOf(config, region) {
-	const stored = config.regions?.[region];
+	const stored = unwrapVolatile(config.regions)?.[region];
 	if (stored !== void 0) return stored;
 	if (region !== "cn") return {};
+	const lastCatalog = unwrapVolatile(config.lastCatalog);
+	const enabledModelIds = unwrapVolatile(config.enabledModelIds);
+	const imageModelIds = unwrapVolatile(config.imageModelIds);
+	const contextBudgets = unwrapVolatile(config.contextBudgets);
 	return {
-		...config.lastCatalog === void 0 ? {} : { lastCatalog: config.lastCatalog },
-		...config.enabledModelIds === void 0 ? {} : { enabledModelIds: config.enabledModelIds },
-		...config.imageModelIds === void 0 ? {} : { imageModelIds: config.imageModelIds },
-		...config.contextBudgets === void 0 ? {} : { contextBudgets: config.contextBudgets }
+		...lastCatalog === void 0 ? {} : { lastCatalog },
+		...enabledModelIds === void 0 ? {} : { enabledModelIds },
+		...imageModelIds === void 0 ? {} : { imageModelIds },
+		...contextBudgets === void 0 ? {} : { contextBudgets }
 	};
 }
 /**
@@ -978,14 +1092,15 @@ const REGION_KEYS = ["cn", "global"];
 * attribution yet) and every later one.
 */
 function selectAccountFor(region, value, legacyAccountRegion) {
-	const configured = value.accounts?.[region];
+	const configured = unwrapVolatile(value.accounts)?.[region];
 	if (configured === "") return void 0;
 	if (configured !== void 0) return configured;
-	return legacyAccountRegion === region ? value.accountId : void 0;
+	const accountId = unwrapVolatile(value.accountId);
+	return legacyAccountRegion === region ? accountId : void 0;
 }
 /** Whether a region carries the Clear sentinel rather than a saved choice. */
 function regionCleared(value, region) {
-	return value.accounts?.[region] === "";
+	return unwrapVolatile(value.accounts)?.[region] === "";
 }
 /**
 * Which region owns the pre-split `accountId`, or `undefined` when it cannot
@@ -1021,9 +1136,10 @@ function apply(ctx, config) {
 	const client = new WorkBuddyUpstreamClient();
 	const stacks = {};
 	for (const region of REGION_KEYS) {
+		const authFile = unwrapVolatile(config.authFile);
 		const store = new WorkBuddyCredentialStore({
 			region,
-			...config.authFile === void 0 ? {} : { desktopPath: config.authFile },
+			...authFile === void 0 ? {} : { desktopPath: authFile },
 			refresh: (credential) => client.refreshToken(credential)
 		});
 		const catalog = new WorkBuddyCatalog(region);
@@ -1071,8 +1187,9 @@ function apply(ctx, config) {
 	};
 	/** Push the current config into every region's store selection and catalog. */
 	const applySelection = (value) => {
+		const authFile = unwrapVolatile(value.authFile);
 		for (const region of REGION_KEYS) {
-			stacks[region].store.setDesktopPath(value.authFile);
+			stacks[region].store.setDesktopPath(authFile);
 			stacks[region].store.selectAccount(effectiveAccountFor(region, value));
 			stacks[region].catalog.set(configuredModels(value, region));
 		}
@@ -1153,13 +1270,26 @@ function apply(ctx, config) {
 			if (stacks[region].catalog.setRegionUsable(usable)) invalidateCatalog();
 		}
 	}));
-	ctx.settings.installSection(ctx, WORKBUDDY_SETTINGS_NS, Config, config, {
-		setSource(source) {
-			current = source;
-		},
-		onChange() {
-			applySelection(current());
+	ctx.inject(["settings"], (sctx) => {
+		const settings = sctx.settings;
+		if (typeof settings.configure === "function") {
+			settings.configure({ auto: true }, ctx.fiber);
+			return;
 		}
+		if (typeof settings.installSection === "function") {
+			const entry = unwrapVolatileDeep(config);
+			settings.installSection(ctx, WORKBUDDY_SETTINGS_NS, Config, entry, {
+				setSource(source) {
+					current = source;
+				},
+				onChange() {
+					applySelection(current());
+				}
+			});
+		}
+	});
+	ctx.on("loader/volatile-update", () => {
+		applySelection(current());
 	});
 	applySelection(config);
 	(async () => {
@@ -1270,4 +1400,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nextRegionEnabled, nextRegionSlots, openEncryptedField, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nextRegionEnabled, nextRegionSlots, openEncryptedField, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "Connect locally signed-in WorkBuddy models to DeepSeek Harness with a read-only credits overview and model management.",
-  "version": "2.0.11",
+  "version": "2.0.13",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",
@@ -32,6 +32,9 @@
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "3.18.4"
+  },
   "files": [
     "lib",
     "docs/assets",