dsh-connect-workbuddy 2.0.12 → 2.0.14

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 2.0.14 (2026-09-23)
+
+### Bug Fixes
+
+- **保存国内版 / 国际版信息时，总有一个区域的配置被清掉**（用户实报：「我保存国际版信息和国内版信息，总会丢失一个」）。这是 2.0.13 那条「活引用被展开成函数」缺陷的**客户端侧同源路径**——服务端（`__save`）那次只修了一半，浏览器侧一直在按错误的方式读同一个值。
+
+  - **根因**：`regions` / `accounts` 被声明为 `asVolatile(...)`，schemastery 会把这类字段解析成 `{ get(): T }` **活引用**——**这一步发生在 schemastery 内部**（由 schema 的 `meta.volatile` 驱动），因此与 DSH 版本无关：0.1.5 与 0.1.7 上，浏览器侧看到的解析值**都是**活引用。
+  - 而活引用**仍然是 `typeof === "object"`**。卡片的每一次写入都是「读出当前区域映射 → 展开 → 覆盖自己那一格」，用来保住**另一个**区域。两处读法都栽在这一点上：
+    - `src/client/account-selection.ts` 的 `fieldSnapshotOf()`：`{ ...活引用, [region]: slot }` 得到 `{ get: <函数>, [region]: slot }` —— **另一个区域被整个丢掉**，同时还把引用函数写进了文档。
+    - `src/status-paths.ts` 的 `regionsMapOf()`：它检查「是对象且不是数组」就把值当成区域映射返回，而活引用**恰好满足**这个判断。于是映射里每一次查表都是 `undefined`——`regionEnabledOf()` 读出的开关状态**永远是「开」**（这正是该函数注释里警告过的那个历史症状），`nextRegionEnabled()` 的合并基座也变成 `{ get: <函数> }`，**开关一次就丢掉另一个区域**。
+  - **修法**。三条独立缺陷，缺一条症状就仍在：
+    1. **读法**：`fieldSnapshotOf()` 与 `regionsMapOf()` 都先 `unwrapVolatileDeep()` 再使用。该 helper 原本只存在于 Host 入口，浏览器侧取不到，因此**移入 `src/status-paths.ts`**——那个模块本来就是 host↔client 的无 node 依赖桥梁——并由 `src/index.ts` 继续对外导出，**公共 API 不变**。
+    2. **写入顺序**：`writeField()` 改为 **Host 端点优先**。两个写入方的语义**并不相同**，而这一点恰恰会删数据：
+       - `__save` 在 Host 进程内把提交的区域合并进该字段的**权威值**，保留其余区域；
+       - `scope.set(field, next)` 是把**整个字段**交给 settings 服务，而这个字段是客户端**从浏览器的镜像**自己合并出来的——Host 在这条路径上**不做任何服务端合并**，因此客户端给什么就**原样成为**什么。
+
+       而镜像**不更新**由端点完成的写入（`contextBudgets` 处早已注明这一滞后），在此前受影响的 0.1.7 部署上该命名空间的镜像更是长期陈旧。于是从镜像构造的合并结果是 `{ [本次区域]: slot }`——**兄弟区域全部缺失**——而 `scope.set` 把它原样存下，区域就此消失。这正是「我保存了国内版，国际版的信息就没有了」。也解释了用户机器上的**混合状态**：`accounts` 两个区域都在（写入时镜像恰好是新的），而 `regions` 少了一个。
+    3. **镜像回写**：`__save` 现在**返回它实际存下的那个字段**，客户端据此刷新镜像；此前客户端会用**自己那份陈旧镜像重新合并**再 `scope.set` 回去，**反而把 Host 刚保住兄弟区域的合并结果覆盖掉**。老版本 Host 只回 `{ok:true}`，此时该刷新自动跳过。
+  - **回归测试**（新增 `tests/volatile-scope.spec.ts`，9 例）：整个套件此前只用**普通对象**模拟 `getSnapshot().value`，而线上真实的形状是活引用——**受影响的路径从未被测过**。新用例按真实形状构造 scope，并**按真实写入路径**建模（Host 端点在服务端合并并回传结果、镜像滞后、`scope.set` 原样存储），断言两个区域在每种交替顺序下都存活、且文档里绝不出现引用函数。另有一例断言客户端镜像的是 **Host 答回的权威值**，而不是它自己重新合并的结果。
+  - **变异验证**（分别撤销每一处）：`fieldSnapshotOf` 解包 → **5 例红**；`regionsMapOf` 解包 → **2 例红**；镜像回写改回「从自身镜像重合并」→ **仍会删掉兄弟区域**。三处修复各自必需。
+
+  > 更正两次：① 2.0.13 的说明里我写过「对单 region 写入足够」——**那是错的**，每条写入路径都要靠这次读取来保住另一个区域。② 2.0.14 发布前我判断「读法」是唯一根因——**也不完整**，还有上述第 2、3 条写入路径缺陷。二者均在此订正。
+
+### Tests
+
+- 332 → 341（新增 9 例：活引用形状下的双区域写入、开关回归，以及「Host 端点为权威、镜像不得删掉兄弟区域」的写入路径回归）。
+
+## 2.0.13 (2026-09-23)
+
+### Bug Fixes
+
+- **上下文预算（或任何 regions/accounts 字段）保存失败：`settings mutate … must contain only JSON-compatible data (found a function at $.ops[0].value.get)`**（用户实报）。这是把「易失标记一生效」那条缺陷（2.0.12 修的）的**另一条受害者路径**补上了。
+
+  - **根因**：`__save` 端点（卡片保存的 Host 兜底路径）在合并时直接读取 `row.value[field]`，而 `row.value` 是 settings 服务解析后的 config——某 volatile 字段（`regions` / `accounts`）在那里是一个 `{ get(): T }` **活引用**。`{ ...这种对象 }` 展开后变成 `{ get: <函数> }`，于是 `settings.mutate` 的严格 JSON 兼容校验拒绝它，报 `found a function at $.ops[0].value.get`。保存**完全失败**（不是静默失败，而是直接报错），因为真实保存流程里 `scope.set()` 被判为未落盘后回退到了这个端点。
+  - **修法**：`__save` 在合并前先 `unwrapVolatileDeep(row.value?.[field])` 把活引用剥净，让 `mutate` 收到的 payload 只含 JSON 兼容数据。`unwrapVolatileDeep` 是 2.0.12 为 `installSection` 引入的同一 helper，这里复用。
+  - **回归测试**（`tests/web-status.spec.ts`）：构造一个 resolved config 含 `{ get() }` 活引用的 settings 服务，经真实 `__save` 路由请求，断言 `mutate` 收到的是一个能通过 JSON 往返的 payload（无函数），且上下文预算字段完好。**变异验证**：把 `unwrapVolatileDeep` 那行去掉，该用例立即变红。
+
+  > 说明：`__save` 会先把 `row.value[field]` 解包、再用「浅展开 + incoming 覆盖」合并到该字段。对单 region 写入（本次场景）足够；若日后要一次写多个 region 槽位，应改为深合并——届时再扩。
+
+### Tests
+
+- 331 → 332（新增 1 例：live-reference 配置下的 `__save` 保存回归）。
+
 ## 2.0.12 (2026-09-23)
 
 ### Features

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { O as workbuddyOwnAuthPath, T as legacyWorkbuddyOwnAuthPath, W as findWorkbuddyAppExecutable, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, g as WORKBUDDY_AUTH_FILE_ENV, j as WorkBuddyUpstreamClient, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, x as defaultDesktopAuthDirs, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-ChtMu37E.js";
+import { O as workbuddyOwnAuthPath, T as legacyWorkbuddyOwnAuthPath, W as findWorkbuddyAppExecutable, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, g as WORKBUDDY_AUTH_FILE_ENV, j as WorkBuddyUpstreamClient, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, x as defaultDesktopAuthDirs, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-SQNmYRNj.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -47,10 +47,18 @@ window.__ModuleLoader__.load({
 		* project — the lookup then read `section['cn']` (absent), so the card's
 		* checkbox reported `true` forever and clicking it appeared to do nothing even
 		* though the write succeeded.
+		*
+		* The resolved section delivers `regions` as a `{get(): T}` LIVE reference, and
+		* a live reference is `typeof === 'object'` and not an array — so it passes a
+		* naive object check and gets returned as if it were the map. Every lookup on
+		* it is then `undefined`: the enabled flag reads back as "on" forever (the very
+		* symptom described above), and a merge that spreads this map silently drops
+		* the region it was not editing. Unwrap before narrowing.
 		*/
 		function regionsMapOf(value) {
-			if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
-			const record = value;
+			const unwrapped = unwrapVolatileDeep(value);
+			if (typeof unwrapped !== "object" || unwrapped === null || Array.isArray(unwrapped)) return {};
+			const record = unwrapped;
 			const nested = record["regions"];
 			if (typeof nested === "object" && nested !== null && !Array.isArray(nested)) return nested;
 			return record;
@@ -118,9 +126,60 @@ window.__ModuleLoader__.load({
 				contextWindow: nativeContextWindow
 			};
 		}
+		/**
+		* Deep copy of a settings value with every `{get(): T}` live reference replaced
+		* by the value it resolves to.
+		*
+		* `regions` and `accounts` are declared `asVolatile(...)`, and schemastery
+		* resolves a volatile field to a live reference. That resolution happens in
+		* schemastery itself, driven by the schema's `meta.volatile`, so it is
+		* independent of the DSH line — the resolved section looks like this to the
+		* browser half on BOTH 0.1.5 and 0.1.7.
+		*
+		* A live reference is still `typeof === 'object'`, so `{ ...reference }` does
+		* NOT read the field: it produces `{ get: <function> }`. Any caller that
+		* spreads the resolved field to preserve its siblings — the card's
+		* "write one region, keep the other" merge — would otherwise DROP every
+		* sibling and leak a function into the document. Both halves therefore unwrap
+		* before touching a resolved field.
+		*
+		* Lives here, not in the Host entry, because the browser half needs it too and
+		* this module is the node-free bridge between the two.
+		*
+		* Non-reference values are recursed into so a nested volatile field is caught
+		* too — arrays and objects are rebuilt rather than mutated, so the caller's
+		* value is never touched.
+		*/
+		function unwrapVolatileDeep(value) {
+			if (value === null || typeof value !== "object") return value;
+			if (typeof value.get === "function") return unwrapVolatileDeep(value.get());
+			if (Array.isArray(value)) return value.map((entry) => unwrapVolatileDeep(entry));
+			const source = value;
+			const out = {};
+			for (const key of Object.keys(source)) out[key] = unwrapVolatileDeep(source[key]);
+			return out;
+		}
 		//#endregion
 		//#region src/client/account-selection.ts
 		/**
+		* Verified writes of the per-region account slot.
+		*
+		* 参考：DSH 自带插件卡片（`@deepseek-ai/dsh-client-ui-settings-plugins`
+		*   的 `CardForm.store()`）— 「写入后回读用户层并与写入值比对」这一校验形态，
+		*   是本模块 `writeAccountSlot()` 的出发点。
+		* 改动：针对账号槽位重写而非照搬 —— 回读的是**解析后的 section**而非 user 层
+		*   （Host 的 legacy 归属也读它，两者必须同源），并用精确比较区分 `''`（哨兵清除）
+		*   与 `undefined`（键缺失），因为后者会让区域重新回退到旧版 `accountId`。
+		*
+		* Kept out of `WorkBuddyCard.tsx` — and free of any browser-only import — so
+		* the write contract can be unit-tested directly. The card is a `.tsx`
+		* component whose module graph pulls DSH's browser packages, which cannot load
+		* in the Node test environment; the check below is exactly the part that must
+		* not go untested.
+		*
+		* @module dsh-connect-workbuddy/client/account-selection
+		*/
+		/**
 		* A settings write that did not take effect.
 		*
 		* Distinct from a rejected `set()`: this is thrown when the write reported
@@ -135,9 +194,22 @@ window.__ModuleLoader__.load({
 				this.field = field;
 			}
 		};
-		/** Read one settings field's current object value from the scope snapshot. */
+		/**
+		* Read one settings field's current object value from the scope snapshot.
+		*
+		* The snapshot holds the RESOLVED section, where a volatile field
+		* (`regions` / `accounts`) is a `{get(): T}` LIVE reference rather than the
+		* plain object it resembles. Unwrapping first is not cosmetic: a live reference
+		* is still `typeof === 'object'`, so without this the caller spreads it into
+		* `{ get: <function> }` — which DROPS every sibling key (the other region) and
+		* leaks a reference function into the document.
+		*
+		* That was the "saving the international region loses the domestic one" report:
+		* every write here preserves the region it is not touching by spreading this
+		* value, so reading it wrong silently deleted the untouched region.
+		*/
 		function fieldSnapshotOf(scope, field) {
-			const value = scope.getSnapshot().value?.[field];
+			const value = unwrapVolatileDeep(scope.getSnapshot().value?.[field]);
 			return typeof value === "object" && value !== null ? value : {};
 		}
 		/**
@@ -167,17 +239,32 @@ window.__ModuleLoader__.load({
 				const reason = `${String(detail.errorName ?? "")} ${String(detail.error ?? "")}`.trim();
 				throw new WorkBuddySettingsWriteError(field, `Host save refused: ${reason === "" ? String(detail.error) : reason}`);
 			}
+			return (await response.json().catch(() => void 0))?.value;
 		}
 		/**
 		* Write one volatile field, then confirm the value actually landed.
 		*
-		* The bound settings scope is the official path and is tried FIRST: it keeps
-		* the browser mirror in sync, and it is the only writer needed on hosts whose
-		* ConfigForm is healthy. On the affected DSH 0.1.7 deployment that scope
-		* settles without delivering anything — its `set()` resolves `false` while the
-		* Host's own mutate is perfectly healthy (proven by a direct in-Host probe) —
-		* so a write that does not read back falls through to the plugin's Host
-		* endpoint, which performs the mutate inside the Host process.
+		* ORDER MATTERS, and getting it wrong DELETES DATA. The two writers do not have
+		* the same semantics:
+		*
+		* - The Host save endpoint merges the posted region into the field's
+		*   AUTHORITATIVE value inside the Host process, preserving every other region.
+		* - `scope.set(field, next)` hands the settings service the WHOLE field, merged
+		*   on the CLIENT out of the browser mirror. The Host performs no server-side
+		*   merge on this path, so whatever the client built REPLACES the field.
+		*
+		* The mirror is not a reliable merge base: a write made through the Host
+		* endpoint does not update it (that lag is documented on `contextBudgets`
+		* below), and on the affected 0.1.7 deployment the mirror for this namespace
+		* stays stale outright. Building the merge from it therefore produced
+		* `{ [region]: slot }` with every SIBLING region missing — and `scope.set`
+		* stores that verbatim, deleting them. That was the report "I saved the
+		* domestic region and the international one was gone": `accounts` survived
+		* (written while the mirror happened to be fresh) while `regions` lost a slot.
+		*
+		* So the Host endpoint goes FIRST — it is the only writer that cannot delete a
+		* sibling. `scope.set` is then attempted purely as a mirror refresh, and only
+		* when it delivers is the write considered done without the endpoint.
 		*
 		* `landed` decides whether a value read back from the scope is the value that
 		* was written; it is per-field because `''` (a cleared account slot) and an
@@ -187,6 +274,16 @@ window.__ModuleLoader__.load({
 		* @throws {WorkBuddySettingsWriteError} when neither path persists the value.
 		*/
 		async function writeField(scope, field, region, value, landed) {
+			let hostError;
+			try {
+				const authoritative = await saveViaHostEndpoint(field, region, value);
+				if (authoritative !== void 0) try {
+					await scope.set(field, authoritative);
+				} catch {}
+				return;
+			} catch (error) {
+				hostError = error;
+			}
 			let scopeDelivered = false;
 			try {
 				scopeDelivered = await scope.set(field, {
@@ -197,7 +294,7 @@ window.__ModuleLoader__.load({
 				scopeDelivered = false;
 			}
 			if (scopeDelivered && landed(fieldSnapshotOf(scope, field)[region])) return;
-			await saveViaHostEndpoint(field, region, value);
+			throw hostError instanceof Error ? hostError : new WorkBuddySettingsWriteError(field, "neither the Host save endpoint nor the settings scope persisted the value");
 		}
 		/**
 		* Write one region's account slot, then confirm the value actually landed.

package/lib/{host-heartbeat-ChtMu37E.js → host-heartbeat-SQNmYRNj.js}

@@ -2208,7 +2208,7 @@ var WorkBuddyCatalog = class {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "2.0.12";
+const WORKBUDDY_CONNECT_VERSION = "2.0.14";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -1247,7 +1247,6 @@ interface WorkBuddyWebAccount {
   tokenExpiresAtMs: number;
   selected: boolean;
 }
-type WorkBuddyWebPackage = WorkBuddyWebCreditPackage;
 /**
  * One probed candidate path and why it yielded no account.
  *
@@ -1366,6 +1365,31 @@ type WorkBuddyWebUsage =
   status: 'error';
   message: string;
 };
+/**
+ * Deep copy of a settings value with every `{get(): T}` live reference replaced
+ * by the value it resolves to.
+ *
+ * `regions` and `accounts` are declared `asVolatile(...)`, and schemastery
+ * resolves a volatile field to a live reference. That resolution happens in
+ * schemastery itself, driven by the schema's `meta.volatile`, so it is
+ * independent of the DSH line — the resolved section looks like this to the
+ * browser half on BOTH 0.1.5 and 0.1.7.
+ *
+ * A live reference is still `typeof === 'object'`, so `{ ...reference }` does
+ * NOT read the field: it produces `{ get: <function> }`. Any caller that
+ * spreads the resolved field to preserve its siblings — the card's
+ * "write one region, keep the other" merge — would otherwise DROP every
+ * sibling and leak a function into the document. Both halves therefore unwrap
+ * before touching a resolved field.
+ *
+ * Lives here, not in the Host entry, because the browser half needs it too and
+ * this module is the node-free bridge between the two.
+ *
+ * Non-reference values are recursed into so a nested volatile field is caught
+ * too — arrays and objects are rebuilt rather than mutated, so the caller's
+ * value is never touched.
+ */
+declare function unwrapVolatileDeep<T>(value: T): T;
 //#endregion
 //#region src/web-status.d.ts
 /** Constructor dependencies. */
@@ -1524,11 +1548,12 @@ declare function asVolatile<T>(schema: z<T>): z<T>;
  * live references, and every field it validated threw. The namespace never
  * registered, so the card's settings silently disappeared.
  *
- * Non-reference values are recursed into so a nested volatile field is caught
- * too — arrays are rebuilt rather than mutated, so the caller's config object is
- * never touched.
+ * The implementation now lives in the node-free host<->client bridge, because
+ * the browser half needs the SAME unwrap before it spreads a resolved field —
+ * spreading a live reference is `{get: <function>}`, which drops every sibling
+ * region. It is imported and re-exported from here so the Host entry keeps
+ * exposing it as part of its public API.
  */
-declare function unwrapVolatileDeep<T>(value: T): T;
 declare const Config: z<Config>;
 /**
  * One region's saved model state. A config written before the region split has
@@ -1599,4 +1624,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, type WorkBuddyWebAccount, type WorkBuddyWebCheckin, type WorkBuddyWebCredits, type WorkBuddyWebModel, type WorkBuddyWebPackage, type WorkBuddyWebRegion, type WorkBuddyWebSearchPath, type WorkBuddyWebUsage, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nextRegionEnabled, nextRegionSlots, openEncryptedField, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nextRegionEnabled, nextRegionSlots, openEncryptedField, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as WorkBuddyCredentialRejectedError, B as clearAtRestKeyCache, C as hasEncryptedCredentialFields, D as workbuddyAccountId, E as parseWorkBuddyAuth, F as parseReasoning, G as isEncryptedFieldWrapper, H as deriveAtRestKeyId, I as parseUpstreamModel, J as macosNestedAppBundles, K as isWorkbuddyBundle, L as prepareChatBody, M as classifyUpstreamError, N as isCredentialRejectedError, O as workbuddyOwnAuthPath, P as parseCreditMultiplier, R as regionOf, S as defaultDesktopAuthPath, T as legacyWorkbuddyOwnAuthPath, U as fetchAtRestKeyPayload, V as deriveAtRestKey, W as findWorkbuddyAppExecutable, X as readAtRestKey, Y as openEncryptedField, Z as workbuddyAppExecutableCandidates, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WORKBUDDY_AUTH_FILE_ENV, h as WORKBUDDY_AUTH_FILENAME, i as processStartTimeMs, j as WorkBuddyUpstreamClient, k as CREDENTIAL_REJECTED_CODE, l as FALLBACK_WORKBUDDY_MODELS, m as ENCRYPTED_CREDENTIAL_CODE, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, q as macosBundleExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as WorkBuddyEncryptedCredentialError, w as isEncryptedCredentialError, x as defaultDesktopAuthDirs, y as authFileName, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-ChtMu37E.js";
+import { A as WorkBuddyCredentialRejectedError, B as clearAtRestKeyCache, C as hasEncryptedCredentialFields, D as workbuddyAccountId, E as parseWorkBuddyAuth, F as parseReasoning, G as isEncryptedFieldWrapper, H as deriveAtRestKeyId, I as parseUpstreamModel, J as macosNestedAppBundles, K as isWorkbuddyBundle, L as prepareChatBody, M as classifyUpstreamError, N as isCredentialRejectedError, O as workbuddyOwnAuthPath, P as parseCreditMultiplier, R as regionOf, S as defaultDesktopAuthPath, T as legacyWorkbuddyOwnAuthPath, U as fetchAtRestKeyPayload, V as deriveAtRestKey, W as findWorkbuddyAppExecutable, X as readAtRestKey, Y as openEncryptedField, Z as workbuddyAppExecutableCandidates, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WORKBUDDY_AUTH_FILE_ENV, h as WORKBUDDY_AUTH_FILENAME, i as processStartTimeMs, j as WorkBuddyUpstreamClient, k as CREDENTIAL_REJECTED_CODE, l as FALLBACK_WORKBUDDY_MODELS, m as ENCRYPTED_CREDENTIAL_CODE, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, q as macosBundleExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as WorkBuddyEncryptedCredentialError, w as isEncryptedCredentialError, x as defaultDesktopAuthDirs, y as authFileName, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-SQNmYRNj.js";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createProvider } from "@earendil-works/pi-ai";
@@ -544,10 +544,18 @@ function regionOfStatusUrl(url) {
 * project — the lookup then read `section['cn']` (absent), so the card's
 * checkbox reported `true` forever and clicking it appeared to do nothing even
 * though the write succeeded.
+*
+* The resolved section delivers `regions` as a `{get(): T}` LIVE reference, and
+* a live reference is `typeof === 'object'` and not an array — so it passes a
+* naive object check and gets returned as if it were the map. Every lookup on
+* it is then `undefined`: the enabled flag reads back as "on" forever (the very
+* symptom described above), and a merge that spreads this map silently drops
+* the region it was not editing. Unwrap before narrowing.
 */
 function regionsMapOf(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
-	const record = value;
+	const unwrapped = unwrapVolatileDeep(value);
+	if (typeof unwrapped !== "object" || unwrapped === null || Array.isArray(unwrapped)) return {};
+	const record = unwrapped;
 	const nested = record["regions"];
 	if (typeof nested === "object" && nested !== null && !Array.isArray(nested)) return nested;
 	return record;
@@ -615,6 +623,39 @@ function toPersistedWorkBuddyModel(model) {
 		contextWindow: nativeContextWindow
 	};
 }
+/**
+* Deep copy of a settings value with every `{get(): T}` live reference replaced
+* by the value it resolves to.
+*
+* `regions` and `accounts` are declared `asVolatile(...)`, and schemastery
+* resolves a volatile field to a live reference. That resolution happens in
+* schemastery itself, driven by the schema's `meta.volatile`, so it is
+* independent of the DSH line — the resolved section looks like this to the
+* browser half on BOTH 0.1.5 and 0.1.7.
+*
+* A live reference is still `typeof === 'object'`, so `{ ...reference }` does
+* NOT read the field: it produces `{ get: <function> }`. Any caller that
+* spreads the resolved field to preserve its siblings — the card's
+* "write one region, keep the other" merge — would otherwise DROP every
+* sibling and leak a function into the document. Both halves therefore unwrap
+* before touching a resolved field.
+*
+* Lives here, not in the Host entry, because the browser half needs it too and
+* this module is the node-free bridge between the two.
+*
+* Non-reference values are recursed into so a nested volatile field is caught
+* too — arrays and objects are rebuilt rather than mutated, so the caller's
+* value is never touched.
+*/
+function unwrapVolatileDeep(value) {
+	if (value === null || typeof value !== "object") return value;
+	if (typeof value.get === "function") return unwrapVolatileDeep(value.get());
+	if (Array.isArray(value)) return value.map((entry) => unwrapVolatileDeep(entry));
+	const source = value;
+	const out = {};
+	for (const key of Object.keys(source)) out[key] = unwrapVolatileDeep(source[key]);
+	return out;
+}
 //#endregion
 //#region src/web-status.ts
 /** Redact token-like content before it crosses to the browser. */
@@ -916,7 +957,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 					if (field !== "regions" && field !== "accounts") return json(res, 400, { error: "field must be regions or accounts" });
 					const row = settings.describe().find((r) => String(r.ns).includes("workbuddy"));
 					if (row === void 0) return json(res, 503, { error: "workbuddy namespace missing from describe()" });
-					const current = row.value?.[field] ?? {};
+					const current = unwrapVolatileDeep(row.value?.[field] ?? {});
 					const incoming = body.value ?? {};
 					const merged = {
 						...current,
@@ -927,7 +968,10 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						path: [field],
 						value: merged
 					}], void 0);
-					return json(res, 200, { ok: true });
+					return json(res, 200, {
+						ok: true,
+						value: merged
+					});
 				} catch (error) {
 					const err = error;
 					return json(res, 500, {
@@ -1011,19 +1055,12 @@ function unwrapVolatile(value) {
 * live references, and every field it validated threw. The namespace never
 * registered, so the card's settings silently disappeared.
 *
-* Non-reference values are recursed into so a nested volatile field is caught
-* too — arrays are rebuilt rather than mutated, so the caller's config object is
-* never touched.
+* The implementation now lives in the node-free host<->client bridge, because
+* the browser half needs the SAME unwrap before it spreads a resolved field —
+* spreading a live reference is `{get: <function>}`, which drops every sibling
+* region. It is imported and re-exported from here so the Host entry keeps
+* exposing it as part of its public API.
 */
-function unwrapVolatileDeep(value) {
-	if (value === null || typeof value !== "object") return value;
-	if (typeof value.get === "function") return unwrapVolatileDeep(value.get());
-	if (Array.isArray(value)) return value.map((entry) => unwrapVolatileDeep(entry));
-	const source = value;
-	const out = {};
-	for (const key of Object.keys(source)) out[key] = unwrapVolatileDeep(source[key]);
-	return out;
-}
 const Config = z.object({
 	authFile: asVolatile(z.string().description("WorkBuddy desktop auth file (defaults to the app's own location)")),
 	accountId: z.string().description("Deprecated: pre-split account selector, attributed to its own region"),

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "Connect locally signed-in WorkBuddy models to DeepSeek Harness with a read-only credits overview and model management.",
-  "version": "2.0.12",
+  "version": "2.0.14",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",