dsh-connect-workbuddy 2.0.3 → 2.0.5

package/CHANGELOG.md

@@ -1,5 +1,83 @@
 # Changelog
 
+## 2.0.5 (2026-09-22)
+
+### Fixes
+
+- **「跟随 App 当前登录」清除后不再被旧版 `accountId` 顶掉，且清除结果在卡片上可见**（issue #11 的缺陷 1；其症状属实，但所声称的机制与严重性不准确——见下方「核查」）。
+
+  - **空字符串哨兵现在显式终止旧值回退**。`selectAccountFor()`（由 `applySelection` 内联逻辑提升为导出纯函数）按顺序判定：`accounts.<region> === ""` → 无选择（跟随 App）；具体 id → 该区域的显式选择；键不存在 → 回退到所属区域的旧版 `accountId`。此前 `""` 走的是「值已存在」分支并被 `selectAccount('')` 归一化为 `undefined`，结果碰巧正确，但语义靠下游兜底；任何一处偏离（下游不再归一化、或增加新的读取方）都会让旧账号复活。现在哨兵在源头终止回退，并有测试锁定。
+  - **启动时的旧值归属（attribution）跳过被显式清除的区域**（`legacyAttributionRegion()`）。该 pass 在启动后异步运行：跳过被清除的区域，既避免把用户刚丢弃的选择重新绑回，也保证**另一个区域仍有机会认领同一个 id**（用 `continue` 而非 `break`，否则国际版的迁移会被国内版的清除顺手打断）。
+  - **卡片新增区域状态行**：显示该区域当前是「使用保存的账号」还是「跟随 App 当前登录」，清除后先显示确认文案。这是 issue #11 里真正属于产品缺陷的那一半——清除后回退到的默认账号**通常正是刚被清掉的那个账号**（用户当初就是在 App 登录状态下选它的），因此清除成功与清除无效在界面上完全同形。此前 `usage` 文档也没有任何字段能区分二者。
+  - **设置写入改为「写入后回读校验」，失败时明确报错**（Windows 上尤其重要，见下）。`settingsScope.set()` 的 promise resolve **并不代表值已落盘**：设置文档 `settings.yaml` 靠「写临时文件 + rename 覆盖」替换，而 `@deepseek-ai/dsh-atomic-write` 对 `EPERM`/`EBUSY`/`EACCES` 的重试**只在 `win32` 生效**——Windows 上杀毒软件、OneDrive 等同步盘或编辑器会短暂锁住该文件。重试耗尽后，失败以「不成功的响应」回到客户端，而设置 scope 的 `mutate()` 对此**只是重新加载 Host 状态然后正常返回**，所以调用方的 `await` 会成功、文档却没变。新增 `writeAccountSlot()` 与 `writeRegionModels()`：写入后把值读回，读不回即抛 `WorkBuddySettingsWriteError`。对三处写入的影响：
+    - **清除账号**：只有确认落盘才显示「已清除」，失败则显示错误并说明原选择仍生效——否则会给出一个被旧选择默默反驳的假确认，比不提示更糟；
+    - **切换账号**：同样校验。静默丢弃会让下拉框显示一个账号、实际计费另一个；
+    - **保存模型**：尤其要紧——保存成功会**丢弃草稿**，若写入没落盘就丢，用户唯一的副本就没了，却还被告知「已保存」。校验比对回读的 `lastCatalog` id 序列（不能只看「槽位存在」，截断/残缺的写入同样要检出）。
+
+  **核查**：报告的根因链在 HEAD 上不成立，逐条复现如下。**注意措辞更正**：2.0.5 初稿曾断言「清除本来就生效」，该结论只在 Host 侧成立；在 Windows 上写入可能被静默丢弃，因此报告的「点了没反应」在那里是真实存在的，只是机制与报告所述不同（不是 `accountId` 顶掉，而是写入没落盘）。回读校验修复的正是后者。
+
+  | 报告的主张 | 实测结果 |
+  |---|---|
+  | `clearAccount()` 只写区域槽位，旧 `accountId` 会持续顶掉清除结果 | 清除后该区域立即跟随 App 默认；三种变体（旧账号≠当前登录、旧账号＝当前登录、启动归属与清除竞争）均通过 |
+  | `effectiveAccountFor()` 在哨兵值上不提前返回，因此旧值继续生效 | 该分支返回 `""`，经 `selectAccount('')` 归一化为 `undefined`，**不会**回退到 `accountId`——返回值虽然「不提前」，但结果正确 |
+  | 启动迁移块会把区域重新绑回旧账号 | 迁移块只在启动时运行一次，且 `applySelection` 走同一个 `effectiveAccountFor`，同样被哨兵挡住 |
+  | `""` 与「未设置」在 schema 层不可区分 | `""` 与键缺失**是可区分的**：`z.object({cn: z.string()})` 对 `{cn: ''}` 保留空串、对 `{}` 保留缺键；`Object.hasOwn` 亦为真。不可区分的只有**语义**，不是 schema |
+  | （报告未提及）写入可能根本不生效 | **成立，且与平台相关**：见上一条。空串本身在 YAML 里能正确往返（写成 `cn: ""`），所以哨兵语义没问题；丢的是**整次写入** |
+
+  因此本版本不按报告的建议去「清除旧字段」——旧字段是**两个区域共享的**迁移来源，清掉它会让另一侧失去迁移依据；正确的做法是让哨兵赢（已实现），并把无法观测的状态暴露给界面（已实现），再加上对「写入没生效」的显式检测。
+
+### Tests
+
+测试总数 142 → 173（新增 31 例，**全套 173 通过**）。
+
+> 关于 `host-heartbeat.spec.ts` 的 `processStartTimeMs`：在受限沙箱下该例会失败
+> （`processStartTimeMs` 需要执行 `ps`，被沙箱以 `EPERM` 拒绝 → 返回 `undefined`）。
+> 放开文件策略后 `ps` 可用，**5/5 通过**。该例与本次改动无关——两次运行用同一份
+> 源码，差异只来自沙箱能否执行 `ps`。
+
+- `settings-integration.spec.ts` 新增 15 例：`selectAccountFor` 的 6 例（显式选择优先、旧值只归属本区域、哨兵终止回退、清除与未配置可区分、两区域同时清除、清除一侧不影响另一侧）；`legacyAttributionRegion` 的 6 例（归属、跳过已清除区域、跳过但继续扫描另一区域、账号已消失、无旧字段、跨区域共享 id）；另有 3 例走真实 settings 链路 —— 清除后旧字段仍在但选不中、**重启后**已清除区域不被重新归属、以及清除前后经 usage 路由可见 `selectionExplicit` 翻转（账号名不变，这正是报告里「看起来没反应」的场景）。
+- `client-account-selection.spec.ts` 新增 13 例（新文件）：`configuredAccountsOf` 的容错读取；`writeAccountSlot` 的保存与「保留另一区域」、哨兵写成 `""` 而非删键、**锁文件导致的静默未落盘必须抛错**、错误携带字段名、**不把「键缺失」误判为清除成功**、正常落盘不误报、回读与卡片读取同源（scope 的 flush 默认 `sync`，落盘后同步可见，故不会误失败）；`writeRegionModels` 的保存与区域保留、**静默未落盘必须抛错**、目录被截断也要检出（不能只看「槽位存在」）、错误字段名、正常落盘不误报。
+- `auth.spec.ts` 新增 1 例：`hasExplicitSelection()` 在未选择/已选择/选择失效/哨兵清除四种状态下的取值。
+- `web-status.spec.ts` 新增 2 例：signed-in 与两个 signed-out 分支都携带 `selectionExplicit`。
+
+每条新增守卫都用「删掉对应实现即失败」逐一验证过：移除哨兵判断会挂 5 例，移除归属跳过会挂 2 例，把 `selectionExplicit` 写死为 `true` 会挂 3 例，把账号回读校验换成「相信 resolve」会挂 3 例，去掉模型保存的回读校验会挂 3 例。
+
+### Docs
+
+- `README.md` / `README.en.md` 的「已知限制 / Known limitations」补充：旧版 `accountId` 只作用于所属区域、且该区域被显式清除后不再生效；卡片状态行用于分辨清除是否生效；**Windows 上设置文件被占用会导致账号改动无法保存**，此时卡片报错且原选择保持生效。
+
+## 2.0.4 (2026-09-21)
+
+### Fixes
+
+- **修复「保存的账号在本机消失后，界面自相矛盾」**（issue #10 的缺陷 3；其症状属实，但其声称的机制与严重性不准确）。显式选择的账号若在本机不再存在（WorkBuddy 更换登录或清理备份文件——`current()` 的注释早已点名这个成因），同一个状态下四条读取路径给出两种说法：
+
+  | 路径 | 修复前 | 修复后 |
+  |---|---|---|
+  | `accounts()` | 靠对象同一性比较**仍标记一个账号为 selected** | 无人生效时不标记任何行 |
+  | `current()` | 返回 `undefined`（拒绝计费，刻意不回退） | 不变（账单安全语义保留） |
+  | `status()` | `signed-out` | 不变 |
+  | 卡片下拉框 | `value` 取 signed-in 分支才有的 `accountId` → `''` → **空白**（选项仍在） | 显示「当前没有生效的账号」占位项 |
+
+  - **根因**：`accounts()` 与 `current()` 对「id 失配」的口径不一致。卡片渲染前者、计费走后者，于是面板同时出现「下拉框选中 Alpha」「状态栏未登录」「提示去桌面端登录一次」——而用户明明已登录，那句提示还把人指向唯一无法修复该问题的操作。commit `1279234` 移除 `current()` 的回退（`?? this.preferred()`）以避免账单落到别的账号，本修复保留该决定，只消除显示层矛盾。
+  - **`accounts()` 不再报告幽灵选中**：显式选择失配时不再回退到对象同一性比较（原写法依赖 `preferred()` 返回同一数组元素，能工作但语义脆弱）；未显式选择时仍如实标出正在跟随的默认账号。
+  - **新增 `selectionLost`**：usage 文档的 `signed-out` 分支新增该可选字段，区分「保存的选择已失效（凭据是好的，请重选或清除）」与「本机确实没有登录（去桌面端登录）」。仅前者为真时才显示新的说明文案，后者保留原文案。
+  - **卡片下拉框改从账号列表取选中值**（原先取 signed-in 文档的 `accountId`）。这是同一类问题的第二处：当保存的账号**仍然有效**、只是 token 过期且刷新失败时，`resolve()` 同样抛错，下拉框也会变空白——用户的完整选择看起来像消失了。现在由账号列表这一个来源决定，并以此区分「没有任何账号生效」与「已登录」。
+  - **新增「跟随 App 当前登录」按钮**：清除该区域的显式选择，回到文档承诺的默认行为。清除写入空字符串哨兵值，`selectAccount('')` 归一化为 `undefined`；此前空字符串会像任何失配 id 一样永久卡死（即「没有清除路径」）。
+  - **`rescanAccounts()` 不再写入选中的账号**：原先只要 `accounts()` 报告的选中项与保存值不同就回写设置，导致两点危害——无显式选择时把「跟随 App 登录」的默认行为固化成一个永久绑定（此后 App 换登录不再跟随，与 `README`/`DESIGN` 承诺不符），以及保存的 id 失配时静默把区域改绑到**另一个账号**（正是严格不回退规则要防的静默改选）。「重新检测」现在只重读，选择权归下拉框与清除按钮。
+
+### Tests
+
+测试总数 131 → 142（新增 11 例）：
+
+- `auth.spec.ts` 新增 7 例：失配选择不标记任何账号、未显式选择仍标出默认账号、有效选择在刷新失败时保持可见、`selectionLost` 的三种取值（无选择/有效选择/失配）、无本机登录时不报 `selectionLost`、空字符串哨兵恢复默认、以及区域隔离（一个区域失配不影响另一区域）。
+- `web-status.spec.ts` 新增 3 例：orphaned 选择标记 `selectionLost` 且保留账号列表、真正的未登录不标记、signed-in 文档不含该字段。
+- `settings-integration.spec.ts` 新增 1 例：空字符串哨兵经真实的 `settings.update` 链路写入后仍为 `''`，且两个 provider 继续正常服务。
+
+### Docs
+
+- `README.md` / `README.en.md` 的「已知限制 / Known limitations」补充账号失效后的表现与恢复方式，并说明重新登录桌面端无法修复该状态。
+
 ## 2.0.2 (2026-09-15)
 
 ### Fixes

package/README.en.md

@@ -115,6 +115,9 @@ Marketplace screenshots and GitHub README badges are two separate mechanisms:
 
 - The plugin depends on WorkBuddy client endpoints (not an official public API), so a WorkBuddy update may require adjustments.
 - **Account switching** relies on the historical auth files the WorkBuddy desktop app leaves behind (the app's own backups), not an official multi-account API. Following the app's current sign-in remains the default; switching is an explicit opt-in, and historical credentials can be invalidated by the app's cleanup or sign-out.
+  - If an explicitly selected account disappears locally (the app replaced its login or cleaned up its backups), the plugin does **not** silently switch to another account — that would bill a different account. The card says the saved account no longer exists; pick an account again, or use "Follow the app's sign-in" to clear the saved choice. **Signing in again in the desktop app will not fix this**: the credentials are fine, it is the saved account id that no longer matches.
+  - Users upgrading from before 2.0.0 may still carry the old top-level `accountId` (the migration source). It applies only to its own region and **stops applying once that region is explicitly cleared (`accounts.<region> = ""`)** — otherwise the account you cleared would be silently restored at the next startup. The card shows whether a region is "using the saved account" or "following the app's current sign-in": the restored default is usually the very account you just cleared, so without that line there is no way to tell a successful clear from a no-op.
+- **On Windows, an account change may fail to save while `settings.yaml` is held open.** DSH updates that file by writing a temp file and replacing the target; an antivirus scanner, a sync client (OneDrive), or an open editor can lock it briefly, and once the replacement retries are exhausted the failed write does **not** make `set()` reject. The plugin therefore reads the value back after writing: it shows "cleared" **only once the write is confirmed on disk**, and on failure it reports the error and keeps your previous choice (never a false confirmation that the old selection silently contradicts). Close whatever holds the file and retry.
 - Windows and Linux credential paths are derived from platform conventions and are not verified on real hardware; set `WORKBUDDY_AUTH_FILE` if yours lives elsewhere.
 
 ## Disclaimer

package/README.md

@@ -123,6 +123,9 @@ dsh plugin --profile desktop add /Users/dmh2002/DshProject/dsh-connect-workbuddy
 
 - 依赖 WorkBuddy 客户端接口（非官方开放 API），WorkBuddy 更新后插件可能需要随之调整。
 - **账号切换**基于 WorkBuddy 桌面端留下的历史 auth 文件（App 自身的备份产物），并非官方多账号 API。默认行为仍是跟随 App 当前登录；切换账号是显式选项，且历史凭据可能因 App 清理或退出登录而失效。
+  - 显式选择的账号若在本机消失（App 更换登录或清理备份文件），插件**不会**静默改选其他账号——那样会让账单落到另一个账号上。卡片会明确说明「保存的账号已不存在」，此时重新选择一个账号，或点「跟随 App 当前登录」清除该选择即可恢复。**重新登录桌面端 App 无法修复这种状态**：凭据本身是好的，失效的只是保存下来的账号标识。
+  - 从 2.0.0 之前的版本升级而来的用户，设置里可能仍留有旧版的顶层 `accountId`（迁移来源）。它只作用于其所属区域，且**该区域被显式清除（`accounts.<区域> = ""`）后即不再生效**——否则清除掉的账号会在下次启动时被静默恢复。卡片会显示每个区域当前是「使用保存的账号」还是「跟随 App 当前登录」：清除后回到的默认账号往往与刚清掉的账号是同一个，没有这行提示就无法分辨清除是否生效。
+- **Windows：设置文件 `settings.yaml` 被占用时，账号改动可能无法保存**。DSH 用「写临时文件 + 覆盖替换」的方式更新该文件，而杀毒软件、OneDrive 等同步盘或正在打开该文件的编辑器会短暂锁住它；重试耗尽后，写入失败**不会**让 `set()` 报错。插件因此会在写入后回读校验：**确认落盘才显示「已清除」**，失败则给出明确错误并保留原来的选择（不会显示一个旧选择默默反驳的假确认）。遇到该提示时，关闭占用该文件的程序后重试即可。
 - Windows / Linux 的凭据默认路径为按平台约定推导，未经真机验证；必要时可通过环境变量 `WORKBUDDY_AUTH_FILE` 指定实际位置。
 
 ## 免责声明

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { T as WorkBuddyUpstreamClient, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-CYeVuoJE.js";
+import { T as WorkBuddyUpstreamClient, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-BOrNj3pY.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -57,6 +57,92 @@ window.__ModuleLoader__.load({
 			};
 		}
 		//#endregion
+		//#region src/client/account-selection.ts
+		/**
+		* A settings write that did not take effect.
+		*
+		* Distinct from a rejected `set()`: this is thrown when the write reported
+		* success and the value is nonetheless absent from the document.
+		*/
+		var WorkBuddySettingsWriteError = class extends Error {
+			/** The settings field that did not land. */
+			field;
+			constructor(field) {
+				super(`workbuddy: settings field "${field}" was not persisted by the settings write`);
+				this.name = "WorkBuddySettingsWriteError";
+				this.field = field;
+			}
+		};
+		/** Read the per-region account selections out of the settings snapshot. */
+		function configuredAccountsOf(configured) {
+			const accounts = configured?.accounts;
+			return typeof accounts === "object" && accounts !== null ? accounts : {};
+		}
+		/**
+		* Write one region's account slot, then confirm the value actually landed.
+		*
+		* `settingsScope.set()` resolving is NOT proof that anything was stored. The
+		* Host's document is `settings.yaml`, replaced by writing a temp file and
+		* renaming it over the target; on Windows an antivirus scanner, a sync client
+		* (OneDrive, Dropbox), or an open editor can hold the file briefly.
+		* `@deepseek-ai/dsh-atomic-write` retries `EPERM` / `EBUSY` / `EACCES` a
+		* bounded number of times and those retries exist only for `win32` — and once
+		* they are exhausted the failure reaches the client as an unsuccessful
+		* response, which the settings scope handles by reloading Host state and
+		* merely RETURNING. The caller's `await` therefore succeeds while the document
+		* is unchanged.
+		*
+		* Reading the field back is the only reliable check, and it is what the
+		* official plugin cards do (`CardForm.store()` compares the user layer against
+		* the value it wrote). Failing loudly matters most on Clear: a false success
+		* would flip the card to "following the app's sign-in" while the old selection
+		* keeps running — the exact confusion that state line exists to remove.
+		*
+		* @param scope - the bound settings scope for this plugin's namespace.
+		* @param region - the region whose slot is written; the other is preserved.
+		* @param value - the account id to save, or `''` to clear the region.
+		* @throws {WorkBuddySettingsWriteError} when the value is readable back as
+		*   something else — i.e. the write silently did not persist.
+		*/
+		async function writeAccountSlot(scope, region, value) {
+			const accounts = configuredAccountsOf(scope.getSnapshot().value);
+			await scope.set("accounts", {
+				...accounts,
+				[region]: value
+			});
+			if (configuredAccountsOf(scope.getSnapshot().value)[region] !== value) throw new WorkBuddySettingsWriteError("accounts");
+		}
+		/**
+		* Write one region's saved model state, then confirm it actually landed.
+		*
+		* The same silent-failure mode as {@link writeAccountSlot} applies to EVERY
+		* settings write, not just the account slot. It matters here for a different
+		* reason: a successful save discards the user's draft, so a write that did not
+		* persist makes the card throw away unsaved edits while claiming they were
+		* saved — unrecoverable, since the drafts are the only copy.
+		*
+		* Verification compares the round-tripped `lastCatalog` ids, which is the part
+		* of the payload that is both user-visible and cheap to compare; the selection
+		* fields ride along in the same object and cannot land separately.
+		*
+		* @param scope - the bound settings scope for this plugin's namespace.
+		* @param region - the region whose model slot is written.
+		* @param payload - the complete next state for that region's slot.
+		* @throws {WorkBuddySettingsWriteError} when the catalog does not read back.
+		*/
+		async function writeRegionModels(scope, region, payload) {
+			const configured = scope.getSnapshot().value?.regions;
+			const regions = typeof configured === "object" && configured !== null ? configured : {};
+			await scope.set("regions", {
+				...regions,
+				[region]: payload
+			});
+			const landed = scope.getSnapshot().value?.regions?.[region];
+			const written = payload.lastCatalog.map((model) => model.id);
+			const stored = landed?.lastCatalog?.map((model) => model.id);
+			if (!(stored !== void 0 && stored.length === written.length && stored.every((id, index) => id === written[index]))) throw new WorkBuddySettingsWriteError("regions");
+		}
+		//#endregion
 		//#region src/client/icon.ts
 		/**
 		* Plugin icon (LD brand logo, 64px) shared across the LaoDing plugin family.
@@ -117,7 +203,10 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-usage-account-copy{display:flex;flex-direction:column;gap:3px;min-width:0}
 .dsm-workbuddy-usage-expiry{padding-left:19px;color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px}
 .dsm-workbuddy-usage-hint{padding-left:19px;color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px}
-.dsm-workbuddy-account-picker{display:block}
+.dsm-workbuddy-account-picker{display:flex;flex-direction:column;gap:8px}
+.dsm-workbuddy-account-state{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px}
+.dsm-workbuddy-account-state:empty{display:none}
+.dsm-workbuddy-account-error{color:var(--dsw-alias-state-error-primary,#ef4444);font-size:12px;line-height:18px;white-space:pre-line}
 .dsm-workbuddy-usage-select-wrap{position:relative}
 .dsm-workbuddy-usage-select{appearance:none;width:100%;font:inherit;padding:10px 34px 10px 12px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:10px;color:var(--dsw-alias-label-primary,#e6e6e6);background:var(--dsw-alias-bg-layer-3,#2a2c33);cursor:pointer;transition:border-color .15s,box-shadow .15s}
 .dsm-workbuddy-usage-select:focus-visible{outline:none;border-color:var(--dsw-alias-brand-primary,#5686fe);box-shadow:0 0 0 3px rgba(86,134,254,.22)}
@@ -255,26 +344,30 @@ window.__ModuleLoader__.load({
 		function dotStyle(status) {
 			return { background: status === "signed-in" ? "var(--dsw-alias-state-success-primary, #22a06b)" : status === "error" ? "var(--dsw-alias-state-error-primary, #d92d20)" : "var(--dsw-alias-label-dimmed, #9aa0a6)" };
 		}
-		/** Read the per-region account selections out of the settings snapshot. */
-		function configuredAccountsOf(configured) {
-			const accounts = configured?.accounts;
-			return typeof accounts === "object" && accounts !== null ? accounts : {};
-		}
 		/** Render WorkBuddy sign-in state, credits, and model selection as one card. */
 		function WorkBuddyCard({ t, settingsScope }) {
 			if (t === void 0) throw new Error("WorkBuddy plugin card requires its translation function");
 			const [open, setOpen] = (0, react.useState)(false);
 			/** The region whose tab is on screen; each tab is its own provider stack. */
 			const [activeRegion, setActiveRegion] = (0, react.useState)("cn");
-			/** Last-known usage per region, so tab dots survive tab switches. */
+			/**
+			* Last-known usage per region, so tab dots survive tab switches.
+			*
+			* The placeholder carries `selectionExplicit: false` because that is the
+			* state the plugin documents as the default before any choice is saved. It
+			* is never rendered: the account picker and its state line only appear once
+			* a real fetch has populated `accounts`.
+			*/
 			const [statusByRegion, setStatusByRegion] = (0, react.useState)({
 				cn: {
 					status: "signed-out",
-					accounts: []
+					accounts: [],
+					selectionExplicit: false
 				},
 				global: {
 					status: "signed-out",
-					accounts: []
+					accounts: [],
+					selectionExplicit: false
 				}
 			});
 			const [busy, setBusy] = (0, react.useState)(false);
@@ -286,6 +379,10 @@ window.__ModuleLoader__.load({
 			/** Save failure surfaced next to the buttons; cleared by the next attempt. */
 			const [saveError, setSaveError] = (0, react.useState)(void 0);
 			const [switchingAccount, setSwitchingAccount] = (0, react.useState)(false);
+			/** Set right after a CONFIRMED Clear so the dropped choice is stated. */
+			const [accountNote, setAccountNote] = (0, react.useState)(void 0);
+			/** A refused account write (silently unpersisted settings on a locked file). */
+			const [accountError, setAccountError] = (0, react.useState)(void 0);
 			const [checkingIn, setCheckingIn] = (0, react.useState)(false);
 			const [checkinActionError, setCheckinActionError] = (0, react.useState)(void 0);
 			const mounted = (0, react.useRef)(true);
@@ -338,7 +435,8 @@ window.__ModuleLoader__.load({
 			]);
 			const status = statusByRegion[activeRegion] ?? {
 				status: "signed-out",
-				accounts: []
+				accounts: [],
+				selectionExplicit: false
 			};
 			(0, react.useEffect)(() => {
 				if (!open || status.status !== "signed-in") return;
@@ -356,6 +454,19 @@ window.__ModuleLoader__.load({
 				refreshUsage,
 				status.status
 			]);
+			/**
+			* Re-detect the local sign-ins and refresh the panel.
+			*
+			* This deliberately writes NO account selection. It used to persist whatever
+			* row the store reported as "selected" whenever that differed from the saved
+			* value, which had two harmful effects: with no explicit choice it turned the
+			* documented default (follow the app's current sign-in) into a permanent
+			* explicit binding — so a later sign-in in the app was no longer followed —
+			* and with an orphaned saved id it silently re-bound the region to a
+			* different account, which is the silent switch that the strict
+			* no-fallback rule exists to prevent. Re-detecting and re-picking are
+			* separate actions now; the picker and Clear button own the selection.
+			*/
 			const rescanAccounts = async () => {
 				setBusy(true);
 				try {
@@ -366,13 +477,6 @@ window.__ModuleLoader__.load({
 					});
 					const body = await response.json();
 					if (!response.ok || !Array.isArray(body.accounts)) throw new Error(`HTTP ${response.status}`);
-					const selected = body.accounts.find((account) => account.selected)?.id;
-					const configuredAccounts = configuredAccountsOf(settingsScope?.getSnapshot().value);
-					const configuredId = configuredAccounts[activeRegion];
-					if (selected !== void 0 && selected !== configuredId && settingsScope?.getSnapshot().writable === true) await settingsScope.set("accounts", {
-						...configuredAccounts,
-						[activeRegion]: selected
-					});
 					await refreshUsage(activeRegion);
 				} finally {
 					if (mounted.current) setBusy(false);
@@ -381,13 +485,44 @@ window.__ModuleLoader__.load({
 			const switchAccount = async (accountId) => {
 				if (settingsScope === void 0) return;
 				setSwitchingAccount(true);
+				setAccountNote(void 0);
+				setAccountError(void 0);
 				try {
-					const configuredAccounts = configuredAccountsOf(settingsScope.getSnapshot().value);
-					await settingsScope.set("accounts", {
-						...configuredAccounts,
-						[activeRegion]: accountId
-					});
+					await writeAccountSlot(settingsScope, activeRegion, accountId);
+					await refreshUsage(activeRegion);
+				} catch (error) {
+					if (mounted.current) setAccountError(error instanceof Error ? error.message : t("row.requestFailed"));
+				} finally {
+					if (mounted.current) setSwitchingAccount(false);
+				}
+			};
+			/**
+			* Drop the explicit choice so the region returns to its documented default:
+			* follow whatever the WorkBuddy app is currently signed in as. The empty
+			* string is the settings-level sentinel for "no explicit selection" (the
+			* store normalizes it away, and the host's legacy attribution treats it as a
+			* deliberate clear rather than an unset key); the account id itself is never
+			* written here.
+			*
+			* The confirmation is only shown once the write is CONFIRMED. That matters
+			* twice over: the restored default is usually the very account that was
+			* saved, so the state line is the only feedback the user gets — and on
+			* Windows the atomic replace of `settings.yaml` can fail outright (locked by
+			* an antivirus scanner or a sync client), in which case claiming "cleared"
+			* would be a lie that the old selection silently contradicts.
+			*/
+			const clearAccount = async () => {
+				if (settingsScope === void 0) return;
+				setSwitchingAccount(true);
+				setAccountError(void 0);
+				try {
+					await writeAccountSlot(settingsScope, activeRegion, "");
 					await refreshUsage(activeRegion);
+					if (mounted.current) setAccountNote("cleared");
+				} catch (error) {
+					if (!mounted.current) return;
+					setAccountNote(void 0);
+					setAccountError(error instanceof Error ? error.message : t("row.requestFailed"));
 				} finally {
 					if (mounted.current) setSwitchingAccount(false);
 				}
@@ -516,15 +651,11 @@ window.__ModuleLoader__.load({
 				setSaving(true);
 				setSaveError(void 0);
 				try {
-					const configuredRegions = configured?.regions;
-					await settingsScope.set("regions", {
-						...typeof configuredRegions === "object" && configuredRegions !== null ? configuredRegions : {},
-						[status.region]: {
-							lastCatalog: visibleModels.map(toPersistedWorkBuddyModel),
-							enabledModelIds: [...activeEnabledIds],
-							imageModelIds: [...activeImageIds],
-							contextBudgets: activeContextBudgets
-						}
+					await writeRegionModels(settingsScope, status.region, {
+						lastCatalog: visibleModels.map(toPersistedWorkBuddyModel),
+						enabledModelIds: [...activeEnabledIds],
+						imageModelIds: [...activeImageIds],
+						contextBudgets: activeContextBudgets
 					});
 					discardModels();
 					await refreshUsage(activeRegion);
@@ -536,6 +667,13 @@ window.__ModuleLoader__.load({
 			};
 			const title = t("row.title");
 			const label = status.status === "signed-in" ? t("row.signedIn", { accountName: status.accountName }) : status.status === "error" ? t("row.requestFailed") : t("row.signedOut");
+			/** The saved choice no longer matches a local sign-in (tokens are fine). */
+			const selectionLost = status.status === "signed-out" && status.selectionLost === true;
+			/**
+			* Whether this region runs a saved choice, per the Host. `undefined` only on
+			* the error branch, which renders no picker and therefore no state line.
+			*/
+			const selectionExplicit = status.status === "error" ? void 0 : status.selectionExplicit;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
 				className: `dsm-plugin-card${open ? " dsm-plugin-card-open" : ""}`,
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
@@ -587,6 +725,8 @@ window.__ModuleLoader__.load({
 										className: `dsm-workbuddy-tab${region === activeRegion ? " dsm-workbuddy-tab-active" : ""}`,
 										onClick: () => {
 											setActiveRegion(region);
+											setAccountNote(void 0);
+											setAccountError(void 0);
 										},
 										children: [regionStatus === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 											"aria-hidden": "true",
@@ -621,6 +761,10 @@ window.__ModuleLoader__.load({
 										status.status === "error" || status.status === "signed-in" && status.creditsError !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 											className: "dsm-workbuddy-usage-hint",
 											children: t("row.reloginHint")
+										}) : null,
+										selectionLost ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "dsm-workbuddy-usage-hint",
+											children: t("row.selectionLostHint")
 										}) : null
 									]
 								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
@@ -633,24 +777,49 @@ window.__ModuleLoader__.load({
 									children: busy ? t("row.accountsScanning") : t("row.accountsRescan")
 								})]
 							}),
-							status.status !== "error" && status.accounts.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("section", {
+							status.status !== "error" && status.accounts.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 								className: "dsm-workbuddy-account-picker",
 								"aria-label": t("row.accountsTitle"),
-								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-									className: "dsm-workbuddy-usage-select-wrap",
-									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("select", {
-										className: "dsm-workbuddy-usage-select",
-										value: status.status === "signed-in" ? status.accountId : "",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "dsm-workbuddy-usage-select-wrap",
+										children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+											className: "dsm-workbuddy-usage-select",
+											value: status.accounts.find((account) => account.selected)?.id ?? "",
+											disabled: switchingAccount || settingsScope?.getSnapshot().writable !== true,
+											onChange: (event) => {
+												switchAccount(event.currentTarget.value);
+											},
+											children: [status.accounts.some((account) => account.selected) ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+												value: "",
+												disabled: true,
+												children: t("row.accountNoneInEffect")
+											}), status.accounts.map((account) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("option", {
+												value: account.id,
+												children: [account.accountName, account.domain === "" ? "" : ` · ${account.domain}`]
+											}, account.id))]
+										})
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsm-btn dsm-btn-outline",
 										disabled: switchingAccount || settingsScope?.getSnapshot().writable !== true,
-										onChange: (event) => {
-											switchAccount(event.currentTarget.value);
+										onClick: () => {
+											clearAccount();
 										},
-										children: status.accounts.map((account) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("option", {
-											value: account.id,
-											children: [account.accountName, account.domain === "" ? "" : ` · ${account.domain}`]
-										}, account.id))
+										children: t("row.accountsFollowApp")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-account-state",
+										role: "status",
+										children: accountNote === "cleared" ? t("row.accountsCleared") : selectionExplicit === false ? t("row.accountsFollowingApp") : selectionExplicit === true ? t("row.accountsSavedChoice") : ""
+									}),
+									accountError === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-account-error",
+										role: "alert",
+										children: t("row.accountsWriteFailed", { message: accountError })
 									})
-								})
+								]
 							}) : null,
 							status.status === "signed-in" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
 								status.credits === void 0 ? null : (() => {
@@ -876,7 +1045,7 @@ window.__ModuleLoader__.load({
 							] }) : null,
 							status.status === "signed-out" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 								className: "dsm-workbuddy-usage-text",
-								children: status.message ?? t("row.signedOutHint")
+								children: selectionLost ? t("row.selectionLostMessage") : status.message ?? t("row.signedOutHint")
 							}) : null,
 							status.status === "error" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 								className: "dsm-workbuddy-usage-error",
@@ -929,6 +1098,14 @@ window.__ModuleLoader__.load({
 			"row.accountsHint": "Choose from locally detected sign-ins. Tokens are never shown or saved in DSH settings.",
 			"row.accountsRescan": "Detect accounts again",
 			"row.accountsScanning": "Detecting…",
+			"row.accountsFollowApp": "Follow the app's sign-in",
+			"row.accountNoneInEffect": "No account in effect",
+			"row.accountsSavedChoice": "Using the account saved for this region.",
+			"row.accountsFollowingApp": "Following the app's current sign-in — no account is saved for this region.",
+			"row.accountsCleared": "Saved choice cleared. This region follows the app's current sign-in again.",
+			"row.accountsWriteFailed": "The account change was not saved: {message} — the settings file could not be updated (on Windows it may be locked by an antivirus scanner or a sync client). Your previous choice is still in effect; close whatever holds settings.yaml and try again.",
+			"row.selectionLostHint": "The saved account no longer exists locally.",
+			"row.selectionLostMessage": "The account saved for this region is no longer among the local sign-ins (WorkBuddy replaced its login or cleaned up backups). Your other sign-ins are fine — pick one above, or choose \"Follow the app's sign-in\" to clear the saved choice. Signing in again in the desktop app will not fix this.",
 			"row.modelsTitle": "Models",
 			"row.modelsSummary": "{count} enabled",
 			"row.modelsRefresh": "Refresh from WorkBuddy",
@@ -977,6 +1154,14 @@ window.__ModuleLoader__.load({
 			"row.accountsHint": "选择本机检测到的登录账号；Token 不会显示，也不会保存到 DSH 设置。",
 			"row.accountsRescan": "重新检测账号",
 			"row.accountsScanning": "正在检测…",
+			"row.accountsFollowApp": "跟随 App 当前登录",
+			"row.accountNoneInEffect": "当前没有生效的账号",
+			"row.accountsSavedChoice": "正在使用该区域保存的账号。",
+			"row.accountsFollowingApp": "正在跟随 App 当前登录——该区域没有保存账号。",
+			"row.accountsCleared": "已清除保存的选择，该区域重新跟随 App 当前登录。",
+			"row.accountsWriteFailed": "账号改动未保存：{message} —— 设置文件写入失败（Windows 上可能被杀毒软件或同步盘占用）。当前仍是原来保存的选择，请先关闭占用 settings.yaml 的程序再重试。",
+			"row.selectionLostHint": "已保存的账号在本机已不存在。",
+			"row.selectionLostMessage": "该区域保存的账号已不在本机登录列表中（WorkBuddy 更换了登录或清理了备份文件）。本机其他登录仍然可用——请在上方选择一个，或点「跟随 App 当前登录」清除已保存的选择。重新登录桌面端 App 无法修复此问题。",
 			"row.modelsTitle": "模型",
 			"row.modelsSummary": "已启用 {count} 个",
 			"row.modelsRefresh": "从 WorkBuddy 刷新",

package/lib/{host-heartbeat-CYeVuoJE.js → host-heartbeat-BOrNj3pY.js}

@@ -914,15 +914,36 @@ var WorkBuddyCredentialStore = class {
 		this.desktopPathOverride = path;
 		this.inflight = void 0;
 	}
-	/** Select an account by id; tokens stay outside settings. */
+	/**
+	* Select an account by id; tokens stay outside settings.
+	*
+	* The empty string is the settings-level sentinel for "no explicit
+	* selection" (the card's Clear action writes it), so it is normalized here
+	* rather than being kept as an id that can never match an account. Every
+	* caller therefore gets the documented default — follow the app's current
+	* sign-in — instead of a dead selection.
+	*/
 	selectAccount(accountId) {
-		this.accountId = accountId;
+		this.accountId = accountId === "" ? void 0 : accountId;
 		this.inflight = void 0;
 	}
 	/** Selected account id, for diagnostics and route assembly. */
 	selectedAccountId() {
 		return this.accountId;
 	}
+	/**
+	* Whether the region runs a SAVED choice rather than the documented default.
+	*
+	* `false` means "follow the app's current sign-in", which is also what the
+	* card's Clear action restores. The two states can resolve to the very same
+	* account — an upgraded user whose pre-split `accountId` happens to be the
+	* app's current sign-in clears the choice and sees no change at all — so the
+	* card cannot infer this from the account list alone. It reports the state
+	* here so clearing is observable instead of looking like a dead button.
+	*/
+	hasExplicitSelection() {
+		return this.accountId !== void 0;
+	}
 	/** The auth-file path candidates, in probe order. */
 	resolveDesktopCandidates() {
 		const fromEnv = process.env[WORKBUDDY_AUTH_FILE_ENV];
@@ -1014,11 +1035,25 @@ var WorkBuddyCredentialStore = class {
 		if (credentials.length === 0) return void 0;
 		return credentials.reduce((best, credential) => isFresher(credential, best) ? credential : best);
 	}
-	/** Token-free account list for the plugin card. */
+	/**
+	* Token-free account list for the plugin card.
+	*
+	* `selected` answers one question only: which row is the account the plugin
+	* is actually going to use? That is exactly what {@link current} decides, so
+	* the two must never disagree — the card renders this list while the shim
+	* bills through `current()`, and a row marked "selected" that `current()`
+	* refuses to use is what made the dropdown look healthy while every request
+	* failed with 401.
+	*
+	* So an explicit selection that matches NO local account marks nothing as
+	* selected (no silent fallback to a different account — see {@link current}).
+	* The implicit default is marked only when nothing was explicitly chosen.
+	*/
 	async accounts() {
 		const credentials = await this.readAll();
 		if (credentials.length === 0) return [];
-		const selectedExists = this.accountId !== void 0 && credentials.some((credential) => workbuddyAccountId(credential) === this.accountId);
+		const hasExplicitSelection = this.accountId !== void 0;
+		const selectedExists = hasExplicitSelection && credentials.some((credential) => workbuddyAccountId(credential) === this.accountId);
 		const defaultSelected = this.preferred(credentials);
 		return credentials.map((credential) => {
 			const id = workbuddyAccountId(credential);
@@ -1030,10 +1065,26 @@ var WorkBuddyCredentialStore = class {
 				source: credential.source,
 				tokenExpiresAtMs: credential.expiresAtMs,
 				filePath: credential.filePath,
-				selected: selectedExists ? id === this.accountId : credential === defaultSelected
+				selected: selectedExists ? id === this.accountId : !hasExplicitSelection && credential === defaultSelected
 			};
 		});
 	}
+	/**
+	* Whether a persisted selection exists that matches no local account, while
+	* other local sign-ins ARE available to choose from.
+	*
+	* The card uses this to explain the state honestly (the account is signed in,
+	* but the SAVED choice is gone) instead of showing the generic "sign in
+	* again" hint, which misdirects: the token is usually perfectly healthy and
+	* signing in again does not repair an orphaned id. When no local sign-in is
+	* available at all, that hint IS accurate and this returns false.
+	*/
+	async selectionLost() {
+		if (this.accountId === void 0) return false;
+		const credentials = await this.readAll();
+		if (credentials.length === 0) return false;
+		return !credentials.some((credential) => workbuddyAccountId(credential) === this.accountId);
+	}
 	/** The freshest stored credential for the current selection, no refresh. */
 	async current() {
 		const credentials = await this.readAll();
@@ -1413,7 +1464,7 @@ var WorkBuddyCatalog = class {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "2.0.3";
+const WORKBUDDY_CONNECT_VERSION = "2.0.5";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -175,10 +175,29 @@ declare class WorkBuddyCredentialStore {
   private ownCandidates;
   /** Repoint the desktop file or directory; applies on the next read. */
   setDesktopPath(path: string | undefined): void;
-  /** Select an account by id; tokens stay outside settings. */
+  /**
+   * Select an account by id; tokens stay outside settings.
+   *
+   * The empty string is the settings-level sentinel for "no explicit
+   * selection" (the card's Clear action writes it), so it is normalized here
+   * rather than being kept as an id that can never match an account. Every
+   * caller therefore gets the documented default — follow the app's current
+   * sign-in — instead of a dead selection.
+   */
   selectAccount(accountId: string | undefined): void;
   /** Selected account id, for diagnostics and route assembly. */
   selectedAccountId(): string | undefined;
+  /**
+   * Whether the region runs a SAVED choice rather than the documented default.
+   *
+   * `false` means "follow the app's current sign-in", which is also what the
+   * card's Clear action restores. The two states can resolve to the very same
+   * account — an upgraded user whose pre-split `accountId` happens to be the
+   * app's current sign-in clears the choice and sees no change at all — so the
+   * card cannot infer this from the account list alone. It reports the state
+   * here so clearing is observable instead of looking like a dead button.
+   */
+  hasExplicitSelection(): boolean;
   /** The auth-file path candidates, in probe order. */
   private resolveDesktopCandidates;
   /** The resolved desktop auth-file path, for diagnostics. */
@@ -215,8 +234,32 @@ declare class WorkBuddyCredentialStore {
    * remaining credit.
    */
   private preferred;
-  /** Token-free account list for the plugin card. */
+  /**
+   * Token-free account list for the plugin card.
+   *
+   * `selected` answers one question only: which row is the account the plugin
+   * is actually going to use? That is exactly what {@link current} decides, so
+   * the two must never disagree — the card renders this list while the shim
+   * bills through `current()`, and a row marked "selected" that `current()`
+   * refuses to use is what made the dropdown look healthy while every request
+   * failed with 401.
+   *
+   * So an explicit selection that matches NO local account marks nothing as
+   * selected (no silent fallback to a different account — see {@link current}).
+   * The implicit default is marked only when nothing was explicitly chosen.
+   */
   accounts(): Promise<WorkBuddyAccountChoice[]>;
+  /**
+   * Whether a persisted selection exists that matches no local account, while
+   * other local sign-ins ARE available to choose from.
+   *
+   * The card uses this to explain the state honestly (the account is signed in,
+   * but the SAVED choice is gone) instead of showing the generic "sign in
+   * again" hint, which misdirects: the token is usually perfectly healthy and
+   * signing in again does not repair an orphaned id. When no local sign-in is
+   * available at all, that hint IS accurate and this returns false.
+   */
+  selectionLost(): Promise<boolean>;
   /** The freshest stored credential for the current selection, no refresh. */
   current(): Promise<WorkBuddyCredential | undefined>;
   /** The credential to send upstream: {@link current}, refreshed on demand. */
@@ -725,10 +768,29 @@ type WorkBuddyWebPackage = WorkBuddyWebCreditPackage;
  */
 type WorkBuddyWebRegion = 'cn' | 'global';
 /** The JSON document the plugin card renders. */
-type WorkBuddyWebUsage = {
+type WorkBuddyWebUsage =
+/**
+ * Not usable right now. `accounts` is still populated so the picker can
+ * offer a way out, and `selectionLost` separates the two very different
+ * reasons this happens: local sign-ins exist but the SAVED choice no longer
+ * matches any of them (re-select it, or clear it to follow the app's current
+ * sign-in again), versus nothing usable was found at all (sign in in the
+ * desktop app). Only the latter makes the "sign in again" hint truthful —
+ * re-signing in does not repair an orphaned id.
+ *
+ * `selectionExplicit` answers a question the account list cannot: whether
+ * the region runs a saved choice at all. Clearing restores the default, and
+ * when the default resolves to the same account the card would otherwise
+ * look unchanged — the "clear did nothing" report.
+ */
+{
   status: 'signed-out';
   accounts: readonly WorkBuddyWebAccount[];
   message?: string;
+  /** The persisted account id matches no local account. */
+  selectionLost?: boolean;
+  /** A saved per-region choice is in effect (false = following the app). */
+  selectionExplicit: boolean;
 } | {
   status: 'signed-in';
   accountId: string;
@@ -739,6 +801,8 @@ type WorkBuddyWebUsage = {
   region: WorkBuddyWebRegion;
   source?: 'desktop' | 'dsh';
   tokenExpiresAtMs: number;
+  /** A saved per-region choice is in effect (false = following the app). */
+  selectionExplicit: boolean;
   accounts: readonly WorkBuddyWebAccount[];
   models: readonly WorkBuddyWebModel[];
   enabledModelIds: readonly string[];
@@ -854,6 +918,47 @@ declare const Config: z<Config>;
  * picks.
  */
 declare function regionStateOf(config: Config, region: WorkBuddyRegion): WorkBuddyRegionState;
+/**
+ * The account id a region should select, or `undefined` for the documented
+ * default: follow whatever the WorkBuddy app is currently signed in as.
+ *
+ * Three inputs decide it, and the ORDER is the whole point:
+ *
+ * 1. `accounts[region] === ''` — the Clear sentinel. It means "the user
+ *    dropped this region's choice", which is the opposite of the key being
+ *    absent ("never configured"). It therefore terminates the lookup: falling
+ *    through to the legacy `accountId` here would re-bind the very account the
+ *    user just dropped, and would do it after clearing appeared to succeed.
+ * 2. `accounts[region]` set to a real id — an explicit per-region choice.
+ * 3. absent key, with the pre-split `accountId` belonging to this region —
+ *    the legacy migration, attributed once at startup from the local scan.
+ *
+ * `legacyAccountRegion` is resolved asynchronously after the first
+ * `applySelection` pass, so this is a pure function of it rather than a
+ * closure over the stores: the same call answers both the early pass (no
+ * attribution yet) and every later one.
+ */
+declare function selectAccountFor(region: WorkBuddyRegion, value: Config, legacyAccountRegion: WorkBuddyRegion | undefined): string | undefined;
+/** Whether a region carries the Clear sentinel rather than a saved choice. */
+declare function regionCleared(value: Config, region: WorkBuddyRegion): boolean;
+/**
+ * Which region owns the pre-split `accountId`, or `undefined` when it cannot
+ * be attributed (the field is absent, or the account is gone from every local
+ * sign-in list).
+ *
+ * Regions the user explicitly cleared are skipped, even when the saved account
+ * IS among their local sign-ins. `selectAccountFor` already refuses to fall
+ * back for a cleared region, so this cannot change what runs — but it keeps the
+ * attribution honest about its own decision: the region that owns this id is
+ * not the one the user just told the plugin to stop pinning, so the other
+ * region must get the chance to claim it.
+ *
+ * `accountsFor` is injected so the sequential, stop-at-first-match scan is
+ * testable without a filesystem.
+ */
+declare function legacyAttributionRegion(value: Config, accountsFor: (region: WorkBuddyRegion) => Promise<readonly {
+  id: string;
+}[]>): Promise<WorkBuddyRegion | undefined>;
 /**
  * Start both regions' loopback endpoints, register the `workbuddy` (CN) and
  * `workbuddy-global` (international) providers, and refresh each region's
@@ -863,4 +968,4 @@ declare function regionStateOf(config: Config, region: WorkBuddyRegion): WorkBud
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyReasoning, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyWebAccount, type WorkBuddyWebCheckin, type WorkBuddyWebCredits, type WorkBuddyWebModel, type WorkBuddyWebPackage, type WorkBuddyWebRegion, type WorkBuddyWebUsage, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyReasoning, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyWebAccount, type WorkBuddyWebCheckin, type WorkBuddyWebCredits, type WorkBuddyWebModel, type WorkBuddyWebPackage, type WorkBuddyWebRegion, type WorkBuddyWebUsage, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionCleared, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, selectAccountFor, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as prepareChatBody, C as workbuddyAccountId, D as parseCreditMultiplier, E as classifyUpstreamError, O as parseReasoning, S as parseWorkBuddyAuth, T as WorkBuddyUpstreamClient, _ as authFileName, a as readHostHeartbeat, b as defaultDesktopAuthPath, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, i as processStartTimeMs, j as regionOf, k as parseUpstreamModel, l as FALLBACK_WORKBUDDY_MODELS, m as WORKBUDDY_AUTH_FILENAME, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-CYeVuoJE.js";
+import { A as prepareChatBody, C as workbuddyAccountId, D as parseCreditMultiplier, E as classifyUpstreamError, O as parseReasoning, S as parseWorkBuddyAuth, T as WorkBuddyUpstreamClient, _ as authFileName, a as readHostHeartbeat, b as defaultDesktopAuthPath, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, i as processStartTimeMs, j as regionOf, k as parseUpstreamModel, l as FALLBACK_WORKBUDDY_MODELS, m as WORKBUDDY_AUTH_FILENAME, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-BOrNj3pY.js";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createProvider } from "@earendil-works/pi-ai";
@@ -561,9 +561,12 @@ function toWebAccount(account) {
 async function workBuddyWebStatus(deps, region) {
 	const store = deps.store(region);
 	const accounts = await store.accounts();
-	if ((await store.status()).state !== "signed-out" && accounts.length === 0) return {
+	const authStatus = await store.status();
+	const selectionExplicit = store.hasExplicitSelection();
+	if (authStatus.state !== "signed-out" && accounts.length === 0) return {
 		status: "signed-out",
-		accounts: []
+		accounts: [],
+		selectionExplicit
 	};
 	let credential;
 	try {
@@ -572,7 +575,9 @@ async function workBuddyWebStatus(deps, region) {
 		return {
 			status: "signed-out",
 			accounts: accounts.map(toWebAccount),
-			message: safeMessage(error)
+			message: safeMessage(error),
+			selectionExplicit,
+			...await store.selectionLost() ? { selectionLost: true } : {}
 		};
 	}
 	const account = {
@@ -583,6 +588,7 @@ async function workBuddyWebStatus(deps, region) {
 		region,
 		source: credential.source,
 		tokenExpiresAtMs: credential.expiresAtMs,
+		selectionExplicit,
 		accounts: accounts.map(toWebAccount),
 		models: deps.displayModels(region).map((model) => toWebModel(model, deps.contextBudgets(region))),
 		enabledModelIds: [...deps.enabledModelIds(region)],
@@ -758,6 +764,59 @@ function regionStateOf(config, region) {
 /** Every region, in card tab order. */
 const REGION_KEYS = ["cn", "global"];
 /**
+* The account id a region should select, or `undefined` for the documented
+* default: follow whatever the WorkBuddy app is currently signed in as.
+*
+* Three inputs decide it, and the ORDER is the whole point:
+*
+* 1. `accounts[region] === ''` — the Clear sentinel. It means "the user
+*    dropped this region's choice", which is the opposite of the key being
+*    absent ("never configured"). It therefore terminates the lookup: falling
+*    through to the legacy `accountId` here would re-bind the very account the
+*    user just dropped, and would do it after clearing appeared to succeed.
+* 2. `accounts[region]` set to a real id — an explicit per-region choice.
+* 3. absent key, with the pre-split `accountId` belonging to this region —
+*    the legacy migration, attributed once at startup from the local scan.
+*
+* `legacyAccountRegion` is resolved asynchronously after the first
+* `applySelection` pass, so this is a pure function of it rather than a
+* closure over the stores: the same call answers both the early pass (no
+* attribution yet) and every later one.
+*/
+function selectAccountFor(region, value, legacyAccountRegion) {
+	const configured = value.accounts?.[region];
+	if (configured === "") return void 0;
+	if (configured !== void 0) return configured;
+	return legacyAccountRegion === region ? value.accountId : void 0;
+}
+/** Whether a region carries the Clear sentinel rather than a saved choice. */
+function regionCleared(value, region) {
+	return value.accounts?.[region] === "";
+}
+/**
+* Which region owns the pre-split `accountId`, or `undefined` when it cannot
+* be attributed (the field is absent, or the account is gone from every local
+* sign-in list).
+*
+* Regions the user explicitly cleared are skipped, even when the saved account
+* IS among their local sign-ins. `selectAccountFor` already refuses to fall
+* back for a cleared region, so this cannot change what runs — but it keeps the
+* attribution honest about its own decision: the region that owns this id is
+* not the one the user just told the plugin to stop pinning, so the other
+* region must get the chance to claim it.
+*
+* `accountsFor` is injected so the sequential, stop-at-first-match scan is
+* testable without a filesystem.
+*/
+async function legacyAttributionRegion(value, accountsFor) {
+	const id = value.accountId;
+	if (id === void 0) return void 0;
+	for (const region of REGION_KEYS) {
+		if (regionCleared(value, region)) continue;
+		if ((await accountsFor(region)).some((account) => account.id === id)) return region;
+	}
+}
+/**
 * Start both regions' loopback endpoints, register the `workbuddy` (CN) and
 * `workbuddy-global` (international) providers, and refresh each region's
 * model catalog from the upstream once that region's credentials allow it.
@@ -807,11 +866,7 @@ function apply(ctx, config) {
 	* a selection that belongs to the other side of the split.
 	*/
 	let legacyAccountRegion;
-	const effectiveAccountFor = (region, value) => {
-		const explicit = value.accounts?.[region];
-		if (explicit !== void 0) return explicit;
-		return legacyAccountRegion === region ? value.accountId : void 0;
-	};
+	const effectiveAccountFor = (region, value) => selectAccountFor(region, value, legacyAccountRegion);
 	const discoverModels = async (region, signal) => {
 		const credential = await stacks[region].store.resolve();
 		return client.fetchModels(credential, signal);
@@ -844,14 +899,11 @@ function apply(ctx, config) {
 	});
 	applySelection(config);
 	(async () => {
-		const id = current().accountId;
-		if (id === void 0) return;
 		try {
-			for (const region of REGION_KEYS) if ((await stacks[region].store.accounts()).some((account) => account.id === id)) {
-				legacyAccountRegion = region;
-				applySelection(current());
-				return;
-			}
+			const region = await legacyAttributionRegion(current(), async (candidate) => stacks[candidate].store.accounts());
+			if (region === void 0) return;
+			legacyAccountRegion = region;
+			applySelection(current());
 		} catch {}
 	})();
 	let stopped = false;
@@ -949,4 +1001,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialStore, WorkBuddyUpstreamClient, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialStore, WorkBuddyUpstreamClient, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionCleared, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, selectAccountFor, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "Connect locally signed-in WorkBuddy models to DeepSeek Harness with a read-only credits overview and model management.",
-  "version": "2.0.3",
+  "version": "2.0.5",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",