dsh-connect-workbuddy 2.0.13 → 2.0.15

package/CHANGELOG.md

@@ -1,6 +1,62 @@
 # Changelog
 
-## 2.0.13 (Unreleased)
+## 2.0.15 (2026-09-24)
+
+### Bug Fixes
+
+- **不能正确取消（或启用）国际版 / 国内版区域开关**（用户实报：「我发现现在不能正确取消国际或者国内版本」）。**写入其实一直是成功的**——用户机器上的 `settings.yaml` 已经写着 `regions.global.enabled: false`——失败的是**开关控件没能反映这个事实**，所以看起来像「点了没用」。
+
+  - **根因（两处，都在读取侧）**：
+
+    1. **开关读的是浏览器镜像，而写入落在 Host。** 2.0.14 把设置写入改为 **Host 端点优先**（那是唯一不会删掉兄弟区域的写入方），而**端点写入不会更新浏览器的 settings 镜像**——这一滞后在本仓库别处早已注明。开关的勾选态却是从镜像读的：
+
+       ```tsx
+       checked={regionEnabledOf(settingsScope?.getSnapshot().value, region)}
+       ```
+
+       于是 Host 已经提交了 `enabled: false`，复选框**仍显示为开**。这同时解释了为什么此前「读法」与「写入顺序」两轮修复都没有暴露它：**写入一直是对的，错的是回显**。
+
+    2. **切换后不重新读取 Host。** `toggleRegion()` 写完就结束，从不重新拉取状态，因此新值根本没有机会进入卡片。
+
+  - **修法**：
+    - 开关改为**以 Host 的值为准**——Host 在状态载荷里已经送回它按自身 config 判定的 `enabled`（`deps.regionEnabled`）。镜像降级为**兜底**：老版本 Host 没这个字段、或状态尚未加载时，仍按存储文档渲染，而不是靠猜。两边用的是**同一条 opt-out 规则**（只有显式 `false` 才算关闭），因此两个来源不可能互相矛盾——只可能其中一个**过期**。
+    - `toggleRegion()` 在写入后 **`await refreshUsage(item)`**，重新读取 Host；失败时**显式报错**，而不是让开关静静地不动。
+    - 面板打开时**两个区域都拉取**，而不是只拉当前标签页。两个开关**始终**渲染在标签栏上，只拉当前区域会让另一个开关一直停在镜像兜底上——正是本次要摆脱的那个过期来源。
+
+  - **回归测试**（`tests/volatile-scope.spec.ts`，9 → 13 例）：断言 Host 已提交关闭而镜像仍说开时开关显示为**关**（反向同理）、Host 未应答时回落到镜像、以及兜底路径仍能容忍 `{get(): T}` 活引用（否则会退回「永远显示开」的老毛病）。**变异验证**：把读取改回「只看镜像」→ **2 例立即变红**。
+
+### Tests
+
+- 341 → 345（新增 4 例：区域开关以 Host 真值为准、镜像仅兜底）。
+
+## 2.0.14 (2026-09-23)
+
+### Bug Fixes
+
+- **保存国内版 / 国际版信息时，总有一个区域的配置被清掉**（用户实报：「我保存国际版信息和国内版信息，总会丢失一个」）。这是 2.0.13 那条「活引用被展开成函数」缺陷的**客户端侧同源路径**——服务端（`__save`）那次只修了一半，浏览器侧一直在按错误的方式读同一个值。
+
+  - **根因**：`regions` / `accounts` 被声明为 `asVolatile(...)`，schemastery 会把这类字段解析成 `{ get(): T }` **活引用**——**这一步发生在 schemastery 内部**（由 schema 的 `meta.volatile` 驱动），因此与 DSH 版本无关：0.1.5 与 0.1.7 上，浏览器侧看到的解析值**都是**活引用。
+  - 而活引用**仍然是 `typeof === "object"`**。卡片的每一次写入都是「读出当前区域映射 → 展开 → 覆盖自己那一格」，用来保住**另一个**区域。两处读法都栽在这一点上：
+    - `src/client/account-selection.ts` 的 `fieldSnapshotOf()`：`{ ...活引用, [region]: slot }` 得到 `{ get: <函数>, [region]: slot }` —— **另一个区域被整个丢掉**，同时还把引用函数写进了文档。
+    - `src/status-paths.ts` 的 `regionsMapOf()`：它检查「是对象且不是数组」就把值当成区域映射返回，而活引用**恰好满足**这个判断。于是映射里每一次查表都是 `undefined`——`regionEnabledOf()` 读出的开关状态**永远是「开」**（这正是该函数注释里警告过的那个历史症状），`nextRegionEnabled()` 的合并基座也变成 `{ get: <函数> }`，**开关一次就丢掉另一个区域**。
+  - **修法**。三条独立缺陷，缺一条症状就仍在：
+    1. **读法**：`fieldSnapshotOf()` 与 `regionsMapOf()` 都先 `unwrapVolatileDeep()` 再使用。该 helper 原本只存在于 Host 入口，浏览器侧取不到，因此**移入 `src/status-paths.ts`**——那个模块本来就是 host↔client 的无 node 依赖桥梁——并由 `src/index.ts` 继续对外导出，**公共 API 不变**。
+    2. **写入顺序**：`writeField()` 改为 **Host 端点优先**。两个写入方的语义**并不相同**，而这一点恰恰会删数据：
+       - `__save` 在 Host 进程内把提交的区域合并进该字段的**权威值**，保留其余区域；
+       - `scope.set(field, next)` 是把**整个字段**交给 settings 服务，而这个字段是客户端**从浏览器的镜像**自己合并出来的——Host 在这条路径上**不做任何服务端合并**，因此客户端给什么就**原样成为**什么。
+
+       而镜像**不更新**由端点完成的写入（`contextBudgets` 处早已注明这一滞后），在此前受影响的 0.1.7 部署上该命名空间的镜像更是长期陈旧。于是从镜像构造的合并结果是 `{ [本次区域]: slot }`——**兄弟区域全部缺失**——而 `scope.set` 把它原样存下，区域就此消失。这正是「我保存了国内版，国际版的信息就没有了」。也解释了用户机器上的**混合状态**：`accounts` 两个区域都在（写入时镜像恰好是新的），而 `regions` 少了一个。
+    3. **镜像回写**：`__save` 现在**返回它实际存下的那个字段**，客户端据此刷新镜像；此前客户端会用**自己那份陈旧镜像重新合并**再 `scope.set` 回去，**反而把 Host 刚保住兄弟区域的合并结果覆盖掉**。老版本 Host 只回 `{ok:true}`，此时该刷新自动跳过。
+  - **回归测试**（新增 `tests/volatile-scope.spec.ts`，9 例）：整个套件此前只用**普通对象**模拟 `getSnapshot().value`，而线上真实的形状是活引用——**受影响的路径从未被测过**。新用例按真实形状构造 scope，并**按真实写入路径**建模（Host 端点在服务端合并并回传结果、镜像滞后、`scope.set` 原样存储），断言两个区域在每种交替顺序下都存活、且文档里绝不出现引用函数。另有一例断言客户端镜像的是 **Host 答回的权威值**，而不是它自己重新合并的结果。
+  - **变异验证**（分别撤销每一处）：`fieldSnapshotOf` 解包 → **5 例红**；`regionsMapOf` 解包 → **2 例红**；镜像回写改回「从自身镜像重合并」→ **仍会删掉兄弟区域**。三处修复各自必需。
+
+  > 更正两次：① 2.0.13 的说明里我写过「对单 region 写入足够」——**那是错的**，每条写入路径都要靠这次读取来保住另一个区域。② 2.0.14 发布前我判断「读法」是唯一根因——**也不完整**，还有上述第 2、3 条写入路径缺陷。二者均在此订正。
+
+### Tests
+
+- 332 → 341（新增 9 例：活引用形状下的双区域写入、开关回归，以及「Host 端点为权威、镜像不得删掉兄弟区域」的写入路径回归）。
+
+## 2.0.13 (2026-09-23)
 
 ### Bug Fixes
 

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { O as workbuddyOwnAuthPath, T as legacyWorkbuddyOwnAuthPath, W as findWorkbuddyAppExecutable, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, g as WORKBUDDY_AUTH_FILE_ENV, j as WorkBuddyUpstreamClient, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, x as defaultDesktopAuthDirs, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-FxHiaIn-.js";
+import { O as workbuddyOwnAuthPath, T as legacyWorkbuddyOwnAuthPath, W as findWorkbuddyAppExecutable, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, g as WORKBUDDY_AUTH_FILE_ENV, j as WorkBuddyUpstreamClient, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, x as defaultDesktopAuthDirs, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-bvp_AX4w.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -47,10 +47,18 @@ window.__ModuleLoader__.load({
 		* project — the lookup then read `section['cn']` (absent), so the card's
 		* checkbox reported `true` forever and clicking it appeared to do nothing even
 		* though the write succeeded.
+		*
+		* The resolved section delivers `regions` as a `{get(): T}` LIVE reference, and
+		* a live reference is `typeof === 'object'` and not an array — so it passes a
+		* naive object check and gets returned as if it were the map. Every lookup on
+		* it is then `undefined`: the enabled flag reads back as "on" forever (the very
+		* symptom described above), and a merge that spreads this map silently drops
+		* the region it was not editing. Unwrap before narrowing.
 		*/
 		function regionsMapOf(value) {
-			if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
-			const record = value;
+			const unwrapped = unwrapVolatileDeep(value);
+			if (typeof unwrapped !== "object" || unwrapped === null || Array.isArray(unwrapped)) return {};
+			const record = unwrapped;
 			const nested = record["regions"];
 			if (typeof nested === "object" && nested !== null && !Array.isArray(nested)) return nested;
 			return record;
@@ -118,9 +126,60 @@ window.__ModuleLoader__.load({
 				contextWindow: nativeContextWindow
 			};
 		}
+		/**
+		* Deep copy of a settings value with every `{get(): T}` live reference replaced
+		* by the value it resolves to.
+		*
+		* `regions` and `accounts` are declared `asVolatile(...)`, and schemastery
+		* resolves a volatile field to a live reference. That resolution happens in
+		* schemastery itself, driven by the schema's `meta.volatile`, so it is
+		* independent of the DSH line — the resolved section looks like this to the
+		* browser half on BOTH 0.1.5 and 0.1.7.
+		*
+		* A live reference is still `typeof === 'object'`, so `{ ...reference }` does
+		* NOT read the field: it produces `{ get: <function> }`. Any caller that
+		* spreads the resolved field to preserve its siblings — the card's
+		* "write one region, keep the other" merge — would otherwise DROP every
+		* sibling and leak a function into the document. Both halves therefore unwrap
+		* before touching a resolved field.
+		*
+		* Lives here, not in the Host entry, because the browser half needs it too and
+		* this module is the node-free bridge between the two.
+		*
+		* Non-reference values are recursed into so a nested volatile field is caught
+		* too — arrays and objects are rebuilt rather than mutated, so the caller's
+		* value is never touched.
+		*/
+		function unwrapVolatileDeep(value) {
+			if (value === null || typeof value !== "object") return value;
+			if (typeof value.get === "function") return unwrapVolatileDeep(value.get());
+			if (Array.isArray(value)) return value.map((entry) => unwrapVolatileDeep(entry));
+			const source = value;
+			const out = {};
+			for (const key of Object.keys(source)) out[key] = unwrapVolatileDeep(source[key]);
+			return out;
+		}
 		//#endregion
 		//#region src/client/account-selection.ts
 		/**
+		* Verified writes of the per-region account slot.
+		*
+		* 参考：DSH 自带插件卡片（`@deepseek-ai/dsh-client-ui-settings-plugins`
+		*   的 `CardForm.store()`）— 「写入后回读用户层并与写入值比对」这一校验形态，
+		*   是本模块 `writeAccountSlot()` 的出发点。
+		* 改动：针对账号槽位重写而非照搬 —— 回读的是**解析后的 section**而非 user 层
+		*   （Host 的 legacy 归属也读它，两者必须同源），并用精确比较区分 `''`（哨兵清除）
+		*   与 `undefined`（键缺失），因为后者会让区域重新回退到旧版 `accountId`。
+		*
+		* Kept out of `WorkBuddyCard.tsx` — and free of any browser-only import — so
+		* the write contract can be unit-tested directly. The card is a `.tsx`
+		* component whose module graph pulls DSH's browser packages, which cannot load
+		* in the Node test environment; the check below is exactly the part that must
+		* not go untested.
+		*
+		* @module dsh-connect-workbuddy/client/account-selection
+		*/
+		/**
 		* A settings write that did not take effect.
 		*
 		* Distinct from a rejected `set()`: this is thrown when the write reported
@@ -135,9 +194,22 @@ window.__ModuleLoader__.load({
 				this.field = field;
 			}
 		};
-		/** Read one settings field's current object value from the scope snapshot. */
+		/**
+		* Read one settings field's current object value from the scope snapshot.
+		*
+		* The snapshot holds the RESOLVED section, where a volatile field
+		* (`regions` / `accounts`) is a `{get(): T}` LIVE reference rather than the
+		* plain object it resembles. Unwrapping first is not cosmetic: a live reference
+		* is still `typeof === 'object'`, so without this the caller spreads it into
+		* `{ get: <function> }` — which DROPS every sibling key (the other region) and
+		* leaks a reference function into the document.
+		*
+		* That was the "saving the international region loses the domestic one" report:
+		* every write here preserves the region it is not touching by spreading this
+		* value, so reading it wrong silently deleted the untouched region.
+		*/
 		function fieldSnapshotOf(scope, field) {
-			const value = scope.getSnapshot().value?.[field];
+			const value = unwrapVolatileDeep(scope.getSnapshot().value?.[field]);
 			return typeof value === "object" && value !== null ? value : {};
 		}
 		/**
@@ -167,17 +239,32 @@ window.__ModuleLoader__.load({
 				const reason = `${String(detail.errorName ?? "")} ${String(detail.error ?? "")}`.trim();
 				throw new WorkBuddySettingsWriteError(field, `Host save refused: ${reason === "" ? String(detail.error) : reason}`);
 			}
+			return (await response.json().catch(() => void 0))?.value;
 		}
 		/**
 		* Write one volatile field, then confirm the value actually landed.
 		*
-		* The bound settings scope is the official path and is tried FIRST: it keeps
-		* the browser mirror in sync, and it is the only writer needed on hosts whose
-		* ConfigForm is healthy. On the affected DSH 0.1.7 deployment that scope
-		* settles without delivering anything — its `set()` resolves `false` while the
-		* Host's own mutate is perfectly healthy (proven by a direct in-Host probe) —
-		* so a write that does not read back falls through to the plugin's Host
-		* endpoint, which performs the mutate inside the Host process.
+		* ORDER MATTERS, and getting it wrong DELETES DATA. The two writers do not have
+		* the same semantics:
+		*
+		* - The Host save endpoint merges the posted region into the field's
+		*   AUTHORITATIVE value inside the Host process, preserving every other region.
+		* - `scope.set(field, next)` hands the settings service the WHOLE field, merged
+		*   on the CLIENT out of the browser mirror. The Host performs no server-side
+		*   merge on this path, so whatever the client built REPLACES the field.
+		*
+		* The mirror is not a reliable merge base: a write made through the Host
+		* endpoint does not update it (that lag is documented on `contextBudgets`
+		* below), and on the affected 0.1.7 deployment the mirror for this namespace
+		* stays stale outright. Building the merge from it therefore produced
+		* `{ [region]: slot }` with every SIBLING region missing — and `scope.set`
+		* stores that verbatim, deleting them. That was the report "I saved the
+		* domestic region and the international one was gone": `accounts` survived
+		* (written while the mirror happened to be fresh) while `regions` lost a slot.
+		*
+		* So the Host endpoint goes FIRST — it is the only writer that cannot delete a
+		* sibling. `scope.set` is then attempted purely as a mirror refresh, and only
+		* when it delivers is the write considered done without the endpoint.
 		*
 		* `landed` decides whether a value read back from the scope is the value that
 		* was written; it is per-field because `''` (a cleared account slot) and an
@@ -187,6 +274,16 @@ window.__ModuleLoader__.load({
 		* @throws {WorkBuddySettingsWriteError} when neither path persists the value.
 		*/
 		async function writeField(scope, field, region, value, landed) {
+			let hostError;
+			try {
+				const authoritative = await saveViaHostEndpoint(field, region, value);
+				if (authoritative !== void 0) try {
+					await scope.set(field, authoritative);
+				} catch {}
+				return;
+			} catch (error) {
+				hostError = error;
+			}
 			let scopeDelivered = false;
 			try {
 				scopeDelivered = await scope.set(field, {
@@ -197,7 +294,7 @@ window.__ModuleLoader__.load({
 				scopeDelivered = false;
 			}
 			if (scopeDelivered && landed(fieldSnapshotOf(scope, field)[region])) return;
-			await saveViaHostEndpoint(field, region, value);
+			throw hostError instanceof Error ? hostError : new WorkBuddySettingsWriteError(field, "neither the Host save endpoint nor the settings scope persisted the value");
 		}
 		/**
 		* Write one region's account slot, then confirm the value actually landed.
@@ -768,7 +865,7 @@ window.__ModuleLoader__.load({
 			(0, react.useEffect)(() => {
 				if (!open) return;
 				const controller = new AbortController();
-				refreshUsage(activeRegion, controller.signal);
+				for (const region of WORKBUDDY_REGIONS) refreshUsage(region, controller.signal);
 				return () => {
 					controller.abort();
 				};
@@ -840,19 +937,29 @@ window.__ModuleLoader__.load({
 				}
 			};
 			/**
-			* Whether one region's provider is switched on, read off the SAME committed
-			* settings document the Host reads (`regionEnabledOf` mirrors the Host's
-			* `regionStateOf` opt-out rule: only an explicit `false` disables). Reading
-			* the stored value rather than echoing local state means a rejected write,
-			* another window's change, or a restart all converge on the truth.
+			* Whether one region's provider is switched on.
+			*
+			* The HOST's answer wins, because on this deployment it is the only writer
+			* that lands: the switch goes through the plugin's Host save endpoint (that
+			* endpoint is the only writer that cannot drop the sibling region), and a
+			* write made there does NOT update the browser settings mirror. Reading the
+			* mirror therefore left the checkbox stuck ON after a successful disable —
+			* "不能正确取消国际版/国内版" — even though `enabled: false` was already in
+			* settings.yaml. The Host sends the committed value it derives from its own
+			* config (`status.enabled`, see `deps.regionEnabled`), so the card renders
+			* that.
 			*
-			* The whole settings section is passed deliberately: `regionEnabledOf`
-			* accepts either it or the bare `regions` map, because passing the section
-			* where the map was expected was a shipped bug (the lookup read
-			* `section['cn']`, found nothing, and reported `true` forever — the checkbox
-			* stayed checked and clicking it appeared dead while the write succeeded).
+			* The mirror stays as the FALLBACK: a host that predates the field, or a
+			* status that has not loaded yet, still renders from the stored document
+			* rather than guessing. Both rules are the same opt-out rule (only an
+			* explicit `false` disables), so the two sources cannot disagree — only one
+			* of them can be stale.
 			*/
-			const regionOn = (item) => regionEnabledOf(settingsScope?.getSnapshot().value, item);
+			const regionOn = (item) => {
+				const fromHost = statusByRegion[item]?.enabled;
+				if (typeof fromHost === "boolean") return fromHost;
+				return regionEnabledOf(settingsScope?.getSnapshot().value, item);
+			};
 			const activeRegionOn = regionOn(activeRegion);
 			/**
 			* Switch one region's provider off or on. The write carries the region's
@@ -873,6 +980,9 @@ window.__ModuleLoader__.load({
 				try {
 					const slot = nextRegionEnabled(settingsScope.getSnapshot().value, item, enabled)[item];
 					await writeRegionEnabled(settingsScope, item, enabled, typeof slot === "object" && slot !== null ? slot : {});
+					await refreshUsage(item);
+				} catch (error) {
+					if (mounted.current) setAccountError(error instanceof Error ? error.message : t("row.requestFailed"));
 				} finally {
 					if (mounted.current) setTogglingRegion(void 0);
 				}

package/lib/{host-heartbeat-FxHiaIn-.js → host-heartbeat-bvp_AX4w.js}

@@ -2208,7 +2208,7 @@ var WorkBuddyCatalog = class {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "2.0.13";
+const WORKBUDDY_CONNECT_VERSION = "2.0.15";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -1247,7 +1247,6 @@ interface WorkBuddyWebAccount {
   tokenExpiresAtMs: number;
   selected: boolean;
 }
-type WorkBuddyWebPackage = WorkBuddyWebCreditPackage;
 /**
  * One probed candidate path and why it yielded no account.
  *
@@ -1366,6 +1365,31 @@ type WorkBuddyWebUsage =
   status: 'error';
   message: string;
 };
+/**
+ * Deep copy of a settings value with every `{get(): T}` live reference replaced
+ * by the value it resolves to.
+ *
+ * `regions` and `accounts` are declared `asVolatile(...)`, and schemastery
+ * resolves a volatile field to a live reference. That resolution happens in
+ * schemastery itself, driven by the schema's `meta.volatile`, so it is
+ * independent of the DSH line — the resolved section looks like this to the
+ * browser half on BOTH 0.1.5 and 0.1.7.
+ *
+ * A live reference is still `typeof === 'object'`, so `{ ...reference }` does
+ * NOT read the field: it produces `{ get: <function> }`. Any caller that
+ * spreads the resolved field to preserve its siblings — the card's
+ * "write one region, keep the other" merge — would otherwise DROP every
+ * sibling and leak a function into the document. Both halves therefore unwrap
+ * before touching a resolved field.
+ *
+ * Lives here, not in the Host entry, because the browser half needs it too and
+ * this module is the node-free bridge between the two.
+ *
+ * Non-reference values are recursed into so a nested volatile field is caught
+ * too — arrays and objects are rebuilt rather than mutated, so the caller's
+ * value is never touched.
+ */
+declare function unwrapVolatileDeep<T>(value: T): T;
 //#endregion
 //#region src/web-status.d.ts
 /** Constructor dependencies. */
@@ -1524,11 +1548,12 @@ declare function asVolatile<T>(schema: z<T>): z<T>;
  * live references, and every field it validated threw. The namespace never
  * registered, so the card's settings silently disappeared.
  *
- * Non-reference values are recursed into so a nested volatile field is caught
- * too — arrays are rebuilt rather than mutated, so the caller's config object is
- * never touched.
+ * The implementation now lives in the node-free host<->client bridge, because
+ * the browser half needs the SAME unwrap before it spreads a resolved field —
+ * spreading a live reference is `{get: <function>}`, which drops every sibling
+ * region. It is imported and re-exported from here so the Host entry keeps
+ * exposing it as part of its public API.
  */
-declare function unwrapVolatileDeep<T>(value: T): T;
 declare const Config: z<Config>;
 /**
  * One region's saved model state. A config written before the region split has
@@ -1599,4 +1624,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, type WorkBuddyWebAccount, type WorkBuddyWebCheckin, type WorkBuddyWebCredits, type WorkBuddyWebModel, type WorkBuddyWebPackage, type WorkBuddyWebRegion, type WorkBuddyWebSearchPath, type WorkBuddyWebUsage, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nextRegionEnabled, nextRegionSlots, openEncryptedField, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nextRegionEnabled, nextRegionSlots, openEncryptedField, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as WorkBuddyCredentialRejectedError, B as clearAtRestKeyCache, C as hasEncryptedCredentialFields, D as workbuddyAccountId, E as parseWorkBuddyAuth, F as parseReasoning, G as isEncryptedFieldWrapper, H as deriveAtRestKeyId, I as parseUpstreamModel, J as macosNestedAppBundles, K as isWorkbuddyBundle, L as prepareChatBody, M as classifyUpstreamError, N as isCredentialRejectedError, O as workbuddyOwnAuthPath, P as parseCreditMultiplier, R as regionOf, S as defaultDesktopAuthPath, T as legacyWorkbuddyOwnAuthPath, U as fetchAtRestKeyPayload, V as deriveAtRestKey, W as findWorkbuddyAppExecutable, X as readAtRestKey, Y as openEncryptedField, Z as workbuddyAppExecutableCandidates, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WORKBUDDY_AUTH_FILE_ENV, h as WORKBUDDY_AUTH_FILENAME, i as processStartTimeMs, j as WorkBuddyUpstreamClient, k as CREDENTIAL_REJECTED_CODE, l as FALLBACK_WORKBUDDY_MODELS, m as ENCRYPTED_CREDENTIAL_CODE, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, q as macosBundleExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as WorkBuddyEncryptedCredentialError, w as isEncryptedCredentialError, x as defaultDesktopAuthDirs, y as authFileName, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-FxHiaIn-.js";
+import { A as WorkBuddyCredentialRejectedError, B as clearAtRestKeyCache, C as hasEncryptedCredentialFields, D as workbuddyAccountId, E as parseWorkBuddyAuth, F as parseReasoning, G as isEncryptedFieldWrapper, H as deriveAtRestKeyId, I as parseUpstreamModel, J as macosNestedAppBundles, K as isWorkbuddyBundle, L as prepareChatBody, M as classifyUpstreamError, N as isCredentialRejectedError, O as workbuddyOwnAuthPath, P as parseCreditMultiplier, R as regionOf, S as defaultDesktopAuthPath, T as legacyWorkbuddyOwnAuthPath, U as fetchAtRestKeyPayload, V as deriveAtRestKey, W as findWorkbuddyAppExecutable, X as readAtRestKey, Y as openEncryptedField, Z as workbuddyAppExecutableCandidates, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WORKBUDDY_AUTH_FILE_ENV, h as WORKBUDDY_AUTH_FILENAME, i as processStartTimeMs, j as WorkBuddyUpstreamClient, k as CREDENTIAL_REJECTED_CODE, l as FALLBACK_WORKBUDDY_MODELS, m as ENCRYPTED_CREDENTIAL_CODE, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, q as macosBundleExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as WorkBuddyEncryptedCredentialError, w as isEncryptedCredentialError, x as defaultDesktopAuthDirs, y as authFileName, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-bvp_AX4w.js";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createProvider } from "@earendil-works/pi-ai";
@@ -544,10 +544,18 @@ function regionOfStatusUrl(url) {
 * project — the lookup then read `section['cn']` (absent), so the card's
 * checkbox reported `true` forever and clicking it appeared to do nothing even
 * though the write succeeded.
+*
+* The resolved section delivers `regions` as a `{get(): T}` LIVE reference, and
+* a live reference is `typeof === 'object'` and not an array — so it passes a
+* naive object check and gets returned as if it were the map. Every lookup on
+* it is then `undefined`: the enabled flag reads back as "on" forever (the very
+* symptom described above), and a merge that spreads this map silently drops
+* the region it was not editing. Unwrap before narrowing.
 */
 function regionsMapOf(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
-	const record = value;
+	const unwrapped = unwrapVolatileDeep(value);
+	if (typeof unwrapped !== "object" || unwrapped === null || Array.isArray(unwrapped)) return {};
+	const record = unwrapped;
 	const nested = record["regions"];
 	if (typeof nested === "object" && nested !== null && !Array.isArray(nested)) return nested;
 	return record;
@@ -615,6 +623,39 @@ function toPersistedWorkBuddyModel(model) {
 		contextWindow: nativeContextWindow
 	};
 }
+/**
+* Deep copy of a settings value with every `{get(): T}` live reference replaced
+* by the value it resolves to.
+*
+* `regions` and `accounts` are declared `asVolatile(...)`, and schemastery
+* resolves a volatile field to a live reference. That resolution happens in
+* schemastery itself, driven by the schema's `meta.volatile`, so it is
+* independent of the DSH line — the resolved section looks like this to the
+* browser half on BOTH 0.1.5 and 0.1.7.
+*
+* A live reference is still `typeof === 'object'`, so `{ ...reference }` does
+* NOT read the field: it produces `{ get: <function> }`. Any caller that
+* spreads the resolved field to preserve its siblings — the card's
+* "write one region, keep the other" merge — would otherwise DROP every
+* sibling and leak a function into the document. Both halves therefore unwrap
+* before touching a resolved field.
+*
+* Lives here, not in the Host entry, because the browser half needs it too and
+* this module is the node-free bridge between the two.
+*
+* Non-reference values are recursed into so a nested volatile field is caught
+* too — arrays and objects are rebuilt rather than mutated, so the caller's
+* value is never touched.
+*/
+function unwrapVolatileDeep(value) {
+	if (value === null || typeof value !== "object") return value;
+	if (typeof value.get === "function") return unwrapVolatileDeep(value.get());
+	if (Array.isArray(value)) return value.map((entry) => unwrapVolatileDeep(entry));
+	const source = value;
+	const out = {};
+	for (const key of Object.keys(source)) out[key] = unwrapVolatileDeep(source[key]);
+	return out;
+}
 //#endregion
 //#region src/web-status.ts
 /** Redact token-like content before it crosses to the browser. */
@@ -927,7 +968,10 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						path: [field],
 						value: merged
 					}], void 0);
-					return json(res, 200, { ok: true });
+					return json(res, 200, {
+						ok: true,
+						value: merged
+					});
 				} catch (error) {
 					const err = error;
 					return json(res, 500, {
@@ -1011,19 +1055,12 @@ function unwrapVolatile(value) {
 * live references, and every field it validated threw. The namespace never
 * registered, so the card's settings silently disappeared.
 *
-* Non-reference values are recursed into so a nested volatile field is caught
-* too — arrays are rebuilt rather than mutated, so the caller's config object is
-* never touched.
+* The implementation now lives in the node-free host<->client bridge, because
+* the browser half needs the SAME unwrap before it spreads a resolved field —
+* spreading a live reference is `{get: <function>}`, which drops every sibling
+* region. It is imported and re-exported from here so the Host entry keeps
+* exposing it as part of its public API.
 */
-function unwrapVolatileDeep(value) {
-	if (value === null || typeof value !== "object") return value;
-	if (typeof value.get === "function") return unwrapVolatileDeep(value.get());
-	if (Array.isArray(value)) return value.map((entry) => unwrapVolatileDeep(entry));
-	const source = value;
-	const out = {};
-	for (const key of Object.keys(source)) out[key] = unwrapVolatileDeep(source[key]);
-	return out;
-}
 const Config = z.object({
 	authFile: asVolatile(z.string().description("WorkBuddy desktop auth file (defaults to the app's own location)")),
 	accountId: z.string().description("Deprecated: pre-split account selector, attributed to its own region"),

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "Connect locally signed-in WorkBuddy models to DeepSeek Harness with a read-only credits overview and model management.",
-  "version": "2.0.13",
+  "version": "2.0.15",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",