dsh-connect-workbuddy 2.0.4 → 2.0.5

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 2.0.5 (2026-09-22)
+
+### Fixes
+
+- **「跟随 App 当前登录」清除后不再被旧版 `accountId` 顶掉，且清除结果在卡片上可见**（issue #11 的缺陷 1；其症状属实，但所声称的机制与严重性不准确——见下方「核查」）。
+
+  - **空字符串哨兵现在显式终止旧值回退**。`selectAccountFor()`（由 `applySelection` 内联逻辑提升为导出纯函数）按顺序判定：`accounts.<region> === ""` → 无选择（跟随 App）；具体 id → 该区域的显式选择；键不存在 → 回退到所属区域的旧版 `accountId`。此前 `""` 走的是「值已存在」分支并被 `selectAccount('')` 归一化为 `undefined`，结果碰巧正确，但语义靠下游兜底；任何一处偏离（下游不再归一化、或增加新的读取方）都会让旧账号复活。现在哨兵在源头终止回退，并有测试锁定。
+  - **启动时的旧值归属（attribution）跳过被显式清除的区域**（`legacyAttributionRegion()`）。该 pass 在启动后异步运行：跳过被清除的区域，既避免把用户刚丢弃的选择重新绑回，也保证**另一个区域仍有机会认领同一个 id**（用 `continue` 而非 `break`，否则国际版的迁移会被国内版的清除顺手打断）。
+  - **卡片新增区域状态行**：显示该区域当前是「使用保存的账号」还是「跟随 App 当前登录」，清除后先显示确认文案。这是 issue #11 里真正属于产品缺陷的那一半——清除后回退到的默认账号**通常正是刚被清掉的那个账号**（用户当初就是在 App 登录状态下选它的），因此清除成功与清除无效在界面上完全同形。此前 `usage` 文档也没有任何字段能区分二者。
+  - **设置写入改为「写入后回读校验」，失败时明确报错**（Windows 上尤其重要，见下）。`settingsScope.set()` 的 promise resolve **并不代表值已落盘**：设置文档 `settings.yaml` 靠「写临时文件 + rename 覆盖」替换，而 `@deepseek-ai/dsh-atomic-write` 对 `EPERM`/`EBUSY`/`EACCES` 的重试**只在 `win32` 生效**——Windows 上杀毒软件、OneDrive 等同步盘或编辑器会短暂锁住该文件。重试耗尽后，失败以「不成功的响应」回到客户端，而设置 scope 的 `mutate()` 对此**只是重新加载 Host 状态然后正常返回**，所以调用方的 `await` 会成功、文档却没变。新增 `writeAccountSlot()` 与 `writeRegionModels()`：写入后把值读回，读不回即抛 `WorkBuddySettingsWriteError`。对三处写入的影响：
+    - **清除账号**：只有确认落盘才显示「已清除」，失败则显示错误并说明原选择仍生效——否则会给出一个被旧选择默默反驳的假确认，比不提示更糟；
+    - **切换账号**：同样校验。静默丢弃会让下拉框显示一个账号、实际计费另一个；
+    - **保存模型**：尤其要紧——保存成功会**丢弃草稿**，若写入没落盘就丢，用户唯一的副本就没了，却还被告知「已保存」。校验比对回读的 `lastCatalog` id 序列（不能只看「槽位存在」，截断/残缺的写入同样要检出）。
+
+  **核查**：报告的根因链在 HEAD 上不成立，逐条复现如下。**注意措辞更正**：2.0.5 初稿曾断言「清除本来就生效」，该结论只在 Host 侧成立；在 Windows 上写入可能被静默丢弃，因此报告的「点了没反应」在那里是真实存在的，只是机制与报告所述不同（不是 `accountId` 顶掉，而是写入没落盘）。回读校验修复的正是后者。
+
+  | 报告的主张 | 实测结果 |
+  |---|---|
+  | `clearAccount()` 只写区域槽位，旧 `accountId` 会持续顶掉清除结果 | 清除后该区域立即跟随 App 默认；三种变体（旧账号≠当前登录、旧账号＝当前登录、启动归属与清除竞争）均通过 |
+  | `effectiveAccountFor()` 在哨兵值上不提前返回，因此旧值继续生效 | 该分支返回 `""`，经 `selectAccount('')` 归一化为 `undefined`，**不会**回退到 `accountId`——返回值虽然「不提前」，但结果正确 |
+  | 启动迁移块会把区域重新绑回旧账号 | 迁移块只在启动时运行一次，且 `applySelection` 走同一个 `effectiveAccountFor`，同样被哨兵挡住 |
+  | `""` 与「未设置」在 schema 层不可区分 | `""` 与键缺失**是可区分的**：`z.object({cn: z.string()})` 对 `{cn: ''}` 保留空串、对 `{}` 保留缺键；`Object.hasOwn` 亦为真。不可区分的只有**语义**，不是 schema |
+  | （报告未提及）写入可能根本不生效 | **成立，且与平台相关**：见上一条。空串本身在 YAML 里能正确往返（写成 `cn: ""`），所以哨兵语义没问题；丢的是**整次写入** |
+
+  因此本版本不按报告的建议去「清除旧字段」——旧字段是**两个区域共享的**迁移来源，清掉它会让另一侧失去迁移依据；正确的做法是让哨兵赢（已实现），并把无法观测的状态暴露给界面（已实现），再加上对「写入没生效」的显式检测。
+
+### Tests
+
+测试总数 142 → 173（新增 31 例，**全套 173 通过**）。
+
+> 关于 `host-heartbeat.spec.ts` 的 `processStartTimeMs`：在受限沙箱下该例会失败
+> （`processStartTimeMs` 需要执行 `ps`，被沙箱以 `EPERM` 拒绝 → 返回 `undefined`）。
+> 放开文件策略后 `ps` 可用，**5/5 通过**。该例与本次改动无关——两次运行用同一份
+> 源码，差异只来自沙箱能否执行 `ps`。
+
+- `settings-integration.spec.ts` 新增 15 例：`selectAccountFor` 的 6 例（显式选择优先、旧值只归属本区域、哨兵终止回退、清除与未配置可区分、两区域同时清除、清除一侧不影响另一侧）；`legacyAttributionRegion` 的 6 例（归属、跳过已清除区域、跳过但继续扫描另一区域、账号已消失、无旧字段、跨区域共享 id）；另有 3 例走真实 settings 链路 —— 清除后旧字段仍在但选不中、**重启后**已清除区域不被重新归属、以及清除前后经 usage 路由可见 `selectionExplicit` 翻转（账号名不变，这正是报告里「看起来没反应」的场景）。
+- `client-account-selection.spec.ts` 新增 13 例（新文件）：`configuredAccountsOf` 的容错读取；`writeAccountSlot` 的保存与「保留另一区域」、哨兵写成 `""` 而非删键、**锁文件导致的静默未落盘必须抛错**、错误携带字段名、**不把「键缺失」误判为清除成功**、正常落盘不误报、回读与卡片读取同源（scope 的 flush 默认 `sync`，落盘后同步可见，故不会误失败）；`writeRegionModels` 的保存与区域保留、**静默未落盘必须抛错**、目录被截断也要检出（不能只看「槽位存在」）、错误字段名、正常落盘不误报。
+- `auth.spec.ts` 新增 1 例：`hasExplicitSelection()` 在未选择/已选择/选择失效/哨兵清除四种状态下的取值。
+- `web-status.spec.ts` 新增 2 例：signed-in 与两个 signed-out 分支都携带 `selectionExplicit`。
+
+每条新增守卫都用「删掉对应实现即失败」逐一验证过：移除哨兵判断会挂 5 例，移除归属跳过会挂 2 例，把 `selectionExplicit` 写死为 `true` 会挂 3 例，把账号回读校验换成「相信 resolve」会挂 3 例，去掉模型保存的回读校验会挂 3 例。
+
+### Docs
+
+- `README.md` / `README.en.md` 的「已知限制 / Known limitations」补充：旧版 `accountId` 只作用于所属区域、且该区域被显式清除后不再生效；卡片状态行用于分辨清除是否生效；**Windows 上设置文件被占用会导致账号改动无法保存**，此时卡片报错且原选择保持生效。
+
 ## 2.0.4 (2026-09-21)
 
 ### Fixes

package/README.en.md

@@ -116,6 +116,8 @@ Marketplace screenshots and GitHub README badges are two separate mechanisms:
 - The plugin depends on WorkBuddy client endpoints (not an official public API), so a WorkBuddy update may require adjustments.
 - **Account switching** relies on the historical auth files the WorkBuddy desktop app leaves behind (the app's own backups), not an official multi-account API. Following the app's current sign-in remains the default; switching is an explicit opt-in, and historical credentials can be invalidated by the app's cleanup or sign-out.
   - If an explicitly selected account disappears locally (the app replaced its login or cleaned up its backups), the plugin does **not** silently switch to another account — that would bill a different account. The card says the saved account no longer exists; pick an account again, or use "Follow the app's sign-in" to clear the saved choice. **Signing in again in the desktop app will not fix this**: the credentials are fine, it is the saved account id that no longer matches.
+  - Users upgrading from before 2.0.0 may still carry the old top-level `accountId` (the migration source). It applies only to its own region and **stops applying once that region is explicitly cleared (`accounts.<region> = ""`)** — otherwise the account you cleared would be silently restored at the next startup. The card shows whether a region is "using the saved account" or "following the app's current sign-in": the restored default is usually the very account you just cleared, so without that line there is no way to tell a successful clear from a no-op.
+- **On Windows, an account change may fail to save while `settings.yaml` is held open.** DSH updates that file by writing a temp file and replacing the target; an antivirus scanner, a sync client (OneDrive), or an open editor can lock it briefly, and once the replacement retries are exhausted the failed write does **not** make `set()` reject. The plugin therefore reads the value back after writing: it shows "cleared" **only once the write is confirmed on disk**, and on failure it reports the error and keeps your previous choice (never a false confirmation that the old selection silently contradicts). Close whatever holds the file and retry.
 - Windows and Linux credential paths are derived from platform conventions and are not verified on real hardware; set `WORKBUDDY_AUTH_FILE` if yours lives elsewhere.
 
 ## Disclaimer

package/README.md

@@ -124,6 +124,8 @@ dsh plugin --profile desktop add /Users/dmh2002/DshProject/dsh-connect-workbuddy
 - 依赖 WorkBuddy 客户端接口（非官方开放 API），WorkBuddy 更新后插件可能需要随之调整。
 - **账号切换**基于 WorkBuddy 桌面端留下的历史 auth 文件（App 自身的备份产物），并非官方多账号 API。默认行为仍是跟随 App 当前登录；切换账号是显式选项，且历史凭据可能因 App 清理或退出登录而失效。
   - 显式选择的账号若在本机消失（App 更换登录或清理备份文件），插件**不会**静默改选其他账号——那样会让账单落到另一个账号上。卡片会明确说明「保存的账号已不存在」，此时重新选择一个账号，或点「跟随 App 当前登录」清除该选择即可恢复。**重新登录桌面端 App 无法修复这种状态**：凭据本身是好的，失效的只是保存下来的账号标识。
+  - 从 2.0.0 之前的版本升级而来的用户，设置里可能仍留有旧版的顶层 `accountId`（迁移来源）。它只作用于其所属区域，且**该区域被显式清除（`accounts.<区域> = ""`）后即不再生效**——否则清除掉的账号会在下次启动时被静默恢复。卡片会显示每个区域当前是「使用保存的账号」还是「跟随 App 当前登录」：清除后回到的默认账号往往与刚清掉的账号是同一个，没有这行提示就无法分辨清除是否生效。
+- **Windows：设置文件 `settings.yaml` 被占用时，账号改动可能无法保存**。DSH 用「写临时文件 + 覆盖替换」的方式更新该文件，而杀毒软件、OneDrive 等同步盘或正在打开该文件的编辑器会短暂锁住它；重试耗尽后，写入失败**不会**让 `set()` 报错。插件因此会在写入后回读校验：**确认落盘才显示「已清除」**，失败则给出明确错误并保留原来的选择（不会显示一个旧选择默默反驳的假确认）。遇到该提示时，关闭占用该文件的程序后重试即可。
 - Windows / Linux 的凭据默认路径为按平台约定推导，未经真机验证；必要时可通过环境变量 `WORKBUDDY_AUTH_FILE` 指定实际位置。
 
 ## 免责声明

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { T as WorkBuddyUpstreamClient, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-CPIHUxKL.js";
+import { T as WorkBuddyUpstreamClient, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-BOrNj3pY.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -57,6 +57,92 @@ window.__ModuleLoader__.load({
 			};
 		}
 		//#endregion
+		//#region src/client/account-selection.ts
+		/**
+		* A settings write that did not take effect.
+		*
+		* Distinct from a rejected `set()`: this is thrown when the write reported
+		* success and the value is nonetheless absent from the document.
+		*/
+		var WorkBuddySettingsWriteError = class extends Error {
+			/** The settings field that did not land. */
+			field;
+			constructor(field) {
+				super(`workbuddy: settings field "${field}" was not persisted by the settings write`);
+				this.name = "WorkBuddySettingsWriteError";
+				this.field = field;
+			}
+		};
+		/** Read the per-region account selections out of the settings snapshot. */
+		function configuredAccountsOf(configured) {
+			const accounts = configured?.accounts;
+			return typeof accounts === "object" && accounts !== null ? accounts : {};
+		}
+		/**
+		* Write one region's account slot, then confirm the value actually landed.
+		*
+		* `settingsScope.set()` resolving is NOT proof that anything was stored. The
+		* Host's document is `settings.yaml`, replaced by writing a temp file and
+		* renaming it over the target; on Windows an antivirus scanner, a sync client
+		* (OneDrive, Dropbox), or an open editor can hold the file briefly.
+		* `@deepseek-ai/dsh-atomic-write` retries `EPERM` / `EBUSY` / `EACCES` a
+		* bounded number of times and those retries exist only for `win32` — and once
+		* they are exhausted the failure reaches the client as an unsuccessful
+		* response, which the settings scope handles by reloading Host state and
+		* merely RETURNING. The caller's `await` therefore succeeds while the document
+		* is unchanged.
+		*
+		* Reading the field back is the only reliable check, and it is what the
+		* official plugin cards do (`CardForm.store()` compares the user layer against
+		* the value it wrote). Failing loudly matters most on Clear: a false success
+		* would flip the card to "following the app's sign-in" while the old selection
+		* keeps running — the exact confusion that state line exists to remove.
+		*
+		* @param scope - the bound settings scope for this plugin's namespace.
+		* @param region - the region whose slot is written; the other is preserved.
+		* @param value - the account id to save, or `''` to clear the region.
+		* @throws {WorkBuddySettingsWriteError} when the value is readable back as
+		*   something else — i.e. the write silently did not persist.
+		*/
+		async function writeAccountSlot(scope, region, value) {
+			const accounts = configuredAccountsOf(scope.getSnapshot().value);
+			await scope.set("accounts", {
+				...accounts,
+				[region]: value
+			});
+			if (configuredAccountsOf(scope.getSnapshot().value)[region] !== value) throw new WorkBuddySettingsWriteError("accounts");
+		}
+		/**
+		* Write one region's saved model state, then confirm it actually landed.
+		*
+		* The same silent-failure mode as {@link writeAccountSlot} applies to EVERY
+		* settings write, not just the account slot. It matters here for a different
+		* reason: a successful save discards the user's draft, so a write that did not
+		* persist makes the card throw away unsaved edits while claiming they were
+		* saved — unrecoverable, since the drafts are the only copy.
+		*
+		* Verification compares the round-tripped `lastCatalog` ids, which is the part
+		* of the payload that is both user-visible and cheap to compare; the selection
+		* fields ride along in the same object and cannot land separately.
+		*
+		* @param scope - the bound settings scope for this plugin's namespace.
+		* @param region - the region whose model slot is written.
+		* @param payload - the complete next state for that region's slot.
+		* @throws {WorkBuddySettingsWriteError} when the catalog does not read back.
+		*/
+		async function writeRegionModels(scope, region, payload) {
+			const configured = scope.getSnapshot().value?.regions;
+			const regions = typeof configured === "object" && configured !== null ? configured : {};
+			await scope.set("regions", {
+				...regions,
+				[region]: payload
+			});
+			const landed = scope.getSnapshot().value?.regions?.[region];
+			const written = payload.lastCatalog.map((model) => model.id);
+			const stored = landed?.lastCatalog?.map((model) => model.id);
+			if (!(stored !== void 0 && stored.length === written.length && stored.every((id, index) => id === written[index]))) throw new WorkBuddySettingsWriteError("regions");
+		}
+		//#endregion
 		//#region src/client/icon.ts
 		/**
 		* Plugin icon (LD brand logo, 64px) shared across the LaoDing plugin family.
@@ -117,7 +203,10 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-usage-account-copy{display:flex;flex-direction:column;gap:3px;min-width:0}
 .dsm-workbuddy-usage-expiry{padding-left:19px;color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px}
 .dsm-workbuddy-usage-hint{padding-left:19px;color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px}
-.dsm-workbuddy-account-picker{display:block}
+.dsm-workbuddy-account-picker{display:flex;flex-direction:column;gap:8px}
+.dsm-workbuddy-account-state{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px}
+.dsm-workbuddy-account-state:empty{display:none}
+.dsm-workbuddy-account-error{color:var(--dsw-alias-state-error-primary,#ef4444);font-size:12px;line-height:18px;white-space:pre-line}
 .dsm-workbuddy-usage-select-wrap{position:relative}
 .dsm-workbuddy-usage-select{appearance:none;width:100%;font:inherit;padding:10px 34px 10px 12px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:10px;color:var(--dsw-alias-label-primary,#e6e6e6);background:var(--dsw-alias-bg-layer-3,#2a2c33);cursor:pointer;transition:border-color .15s,box-shadow .15s}
 .dsm-workbuddy-usage-select:focus-visible{outline:none;border-color:var(--dsw-alias-brand-primary,#5686fe);box-shadow:0 0 0 3px rgba(86,134,254,.22)}
@@ -255,26 +344,30 @@ window.__ModuleLoader__.load({
 		function dotStyle(status) {
 			return { background: status === "signed-in" ? "var(--dsw-alias-state-success-primary, #22a06b)" : status === "error" ? "var(--dsw-alias-state-error-primary, #d92d20)" : "var(--dsw-alias-label-dimmed, #9aa0a6)" };
 		}
-		/** Read the per-region account selections out of the settings snapshot. */
-		function configuredAccountsOf(configured) {
-			const accounts = configured?.accounts;
-			return typeof accounts === "object" && accounts !== null ? accounts : {};
-		}
 		/** Render WorkBuddy sign-in state, credits, and model selection as one card. */
 		function WorkBuddyCard({ t, settingsScope }) {
 			if (t === void 0) throw new Error("WorkBuddy plugin card requires its translation function");
 			const [open, setOpen] = (0, react.useState)(false);
 			/** The region whose tab is on screen; each tab is its own provider stack. */
 			const [activeRegion, setActiveRegion] = (0, react.useState)("cn");
-			/** Last-known usage per region, so tab dots survive tab switches. */
+			/**
+			* Last-known usage per region, so tab dots survive tab switches.
+			*
+			* The placeholder carries `selectionExplicit: false` because that is the
+			* state the plugin documents as the default before any choice is saved. It
+			* is never rendered: the account picker and its state line only appear once
+			* a real fetch has populated `accounts`.
+			*/
 			const [statusByRegion, setStatusByRegion] = (0, react.useState)({
 				cn: {
 					status: "signed-out",
-					accounts: []
+					accounts: [],
+					selectionExplicit: false
 				},
 				global: {
 					status: "signed-out",
-					accounts: []
+					accounts: [],
+					selectionExplicit: false
 				}
 			});
 			const [busy, setBusy] = (0, react.useState)(false);
@@ -286,6 +379,10 @@ window.__ModuleLoader__.load({
 			/** Save failure surfaced next to the buttons; cleared by the next attempt. */
 			const [saveError, setSaveError] = (0, react.useState)(void 0);
 			const [switchingAccount, setSwitchingAccount] = (0, react.useState)(false);
+			/** Set right after a CONFIRMED Clear so the dropped choice is stated. */
+			const [accountNote, setAccountNote] = (0, react.useState)(void 0);
+			/** A refused account write (silently unpersisted settings on a locked file). */
+			const [accountError, setAccountError] = (0, react.useState)(void 0);
 			const [checkingIn, setCheckingIn] = (0, react.useState)(false);
 			const [checkinActionError, setCheckinActionError] = (0, react.useState)(void 0);
 			const mounted = (0, react.useRef)(true);
@@ -338,7 +435,8 @@ window.__ModuleLoader__.load({
 			]);
 			const status = statusByRegion[activeRegion] ?? {
 				status: "signed-out",
-				accounts: []
+				accounts: [],
+				selectionExplicit: false
 			};
 			(0, react.useEffect)(() => {
 				if (!open || status.status !== "signed-in") return;
@@ -387,13 +485,13 @@ window.__ModuleLoader__.load({
 			const switchAccount = async (accountId) => {
 				if (settingsScope === void 0) return;
 				setSwitchingAccount(true);
+				setAccountNote(void 0);
+				setAccountError(void 0);
 				try {
-					const configuredAccounts = configuredAccountsOf(settingsScope.getSnapshot().value);
-					await settingsScope.set("accounts", {
-						...configuredAccounts,
-						[activeRegion]: accountId
-					});
+					await writeAccountSlot(settingsScope, activeRegion, accountId);
 					await refreshUsage(activeRegion);
+				} catch (error) {
+					if (mounted.current) setAccountError(error instanceof Error ? error.message : t("row.requestFailed"));
 				} finally {
 					if (mounted.current) setSwitchingAccount(false);
 				}
@@ -402,18 +500,29 @@ window.__ModuleLoader__.load({
 			* Drop the explicit choice so the region returns to its documented default:
 			* follow whatever the WorkBuddy app is currently signed in as. The empty
 			* string is the settings-level sentinel for "no explicit selection" (the
-			* store normalizes it away); the account id itself is never written here.
+			* store normalizes it away, and the host's legacy attribution treats it as a
+			* deliberate clear rather than an unset key); the account id itself is never
+			* written here.
+			*
+			* The confirmation is only shown once the write is CONFIRMED. That matters
+			* twice over: the restored default is usually the very account that was
+			* saved, so the state line is the only feedback the user gets — and on
+			* Windows the atomic replace of `settings.yaml` can fail outright (locked by
+			* an antivirus scanner or a sync client), in which case claiming "cleared"
+			* would be a lie that the old selection silently contradicts.
 			*/
 			const clearAccount = async () => {
 				if (settingsScope === void 0) return;
 				setSwitchingAccount(true);
+				setAccountError(void 0);
 				try {
-					const configuredAccounts = configuredAccountsOf(settingsScope.getSnapshot().value);
-					await settingsScope.set("accounts", {
-						...configuredAccounts,
-						[activeRegion]: ""
-					});
+					await writeAccountSlot(settingsScope, activeRegion, "");
 					await refreshUsage(activeRegion);
+					if (mounted.current) setAccountNote("cleared");
+				} catch (error) {
+					if (!mounted.current) return;
+					setAccountNote(void 0);
+					setAccountError(error instanceof Error ? error.message : t("row.requestFailed"));
 				} finally {
 					if (mounted.current) setSwitchingAccount(false);
 				}
@@ -542,15 +651,11 @@ window.__ModuleLoader__.load({
 				setSaving(true);
 				setSaveError(void 0);
 				try {
-					const configuredRegions = configured?.regions;
-					await settingsScope.set("regions", {
-						...typeof configuredRegions === "object" && configuredRegions !== null ? configuredRegions : {},
-						[status.region]: {
-							lastCatalog: visibleModels.map(toPersistedWorkBuddyModel),
-							enabledModelIds: [...activeEnabledIds],
-							imageModelIds: [...activeImageIds],
-							contextBudgets: activeContextBudgets
-						}
+					await writeRegionModels(settingsScope, status.region, {
+						lastCatalog: visibleModels.map(toPersistedWorkBuddyModel),
+						enabledModelIds: [...activeEnabledIds],
+						imageModelIds: [...activeImageIds],
+						contextBudgets: activeContextBudgets
 					});
 					discardModels();
 					await refreshUsage(activeRegion);
@@ -564,6 +669,11 @@ window.__ModuleLoader__.load({
 			const label = status.status === "signed-in" ? t("row.signedIn", { accountName: status.accountName }) : status.status === "error" ? t("row.requestFailed") : t("row.signedOut");
 			/** The saved choice no longer matches a local sign-in (tokens are fine). */
 			const selectionLost = status.status === "signed-out" && status.selectionLost === true;
+			/**
+			* Whether this region runs a saved choice, per the Host. `undefined` only on
+			* the error branch, which renders no picker and therefore no state line.
+			*/
+			const selectionExplicit = status.status === "error" ? void 0 : status.selectionExplicit;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
 				className: `dsm-plugin-card${open ? " dsm-plugin-card-open" : ""}`,
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
@@ -615,6 +725,8 @@ window.__ModuleLoader__.load({
 										className: `dsm-workbuddy-tab${region === activeRegion ? " dsm-workbuddy-tab-active" : ""}`,
 										onClick: () => {
 											setActiveRegion(region);
+											setAccountNote(void 0);
+											setAccountError(void 0);
 										},
 										children: [regionStatus === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 											"aria-hidden": "true",
@@ -668,33 +780,46 @@ window.__ModuleLoader__.load({
 							status.status !== "error" && status.accounts.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 								className: "dsm-workbuddy-account-picker",
 								"aria-label": t("row.accountsTitle"),
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-									className: "dsm-workbuddy-usage-select-wrap",
-									children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
-										className: "dsm-workbuddy-usage-select",
-										value: status.accounts.find((account) => account.selected)?.id ?? "",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "dsm-workbuddy-usage-select-wrap",
+										children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+											className: "dsm-workbuddy-usage-select",
+											value: status.accounts.find((account) => account.selected)?.id ?? "",
+											disabled: switchingAccount || settingsScope?.getSnapshot().writable !== true,
+											onChange: (event) => {
+												switchAccount(event.currentTarget.value);
+											},
+											children: [status.accounts.some((account) => account.selected) ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+												value: "",
+												disabled: true,
+												children: t("row.accountNoneInEffect")
+											}), status.accounts.map((account) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("option", {
+												value: account.id,
+												children: [account.accountName, account.domain === "" ? "" : ` · ${account.domain}`]
+											}, account.id))]
+										})
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsm-btn dsm-btn-outline",
 										disabled: switchingAccount || settingsScope?.getSnapshot().writable !== true,
-										onChange: (event) => {
-											switchAccount(event.currentTarget.value);
+										onClick: () => {
+											clearAccount();
 										},
-										children: [status.accounts.some((account) => account.selected) ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-											value: "",
-											disabled: true,
-											children: t("row.accountNoneInEffect")
-										}), status.accounts.map((account) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("option", {
-											value: account.id,
-											children: [account.accountName, account.domain === "" ? "" : ` · ${account.domain}`]
-										}, account.id))]
+										children: t("row.accountsFollowApp")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-account-state",
+										role: "status",
+										children: accountNote === "cleared" ? t("row.accountsCleared") : selectionExplicit === false ? t("row.accountsFollowingApp") : selectionExplicit === true ? t("row.accountsSavedChoice") : ""
+									}),
+									accountError === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-account-error",
+										role: "alert",
+										children: t("row.accountsWriteFailed", { message: accountError })
 									})
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									type: "button",
-									className: "dsm-btn dsm-btn-outline",
-									disabled: switchingAccount || settingsScope?.getSnapshot().writable !== true,
-									onClick: () => {
-										clearAccount();
-									},
-									children: t("row.accountsFollowApp")
-								})]
+								]
 							}) : null,
 							status.status === "signed-in" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
 								status.credits === void 0 ? null : (() => {
@@ -975,6 +1100,10 @@ window.__ModuleLoader__.load({
 			"row.accountsScanning": "Detecting…",
 			"row.accountsFollowApp": "Follow the app's sign-in",
 			"row.accountNoneInEffect": "No account in effect",
+			"row.accountsSavedChoice": "Using the account saved for this region.",
+			"row.accountsFollowingApp": "Following the app's current sign-in — no account is saved for this region.",
+			"row.accountsCleared": "Saved choice cleared. This region follows the app's current sign-in again.",
+			"row.accountsWriteFailed": "The account change was not saved: {message} — the settings file could not be updated (on Windows it may be locked by an antivirus scanner or a sync client). Your previous choice is still in effect; close whatever holds settings.yaml and try again.",
 			"row.selectionLostHint": "The saved account no longer exists locally.",
 			"row.selectionLostMessage": "The account saved for this region is no longer among the local sign-ins (WorkBuddy replaced its login or cleaned up backups). Your other sign-ins are fine — pick one above, or choose \"Follow the app's sign-in\" to clear the saved choice. Signing in again in the desktop app will not fix this.",
 			"row.modelsTitle": "Models",
@@ -1027,6 +1156,10 @@ window.__ModuleLoader__.load({
 			"row.accountsScanning": "正在检测…",
 			"row.accountsFollowApp": "跟随 App 当前登录",
 			"row.accountNoneInEffect": "当前没有生效的账号",
+			"row.accountsSavedChoice": "正在使用该区域保存的账号。",
+			"row.accountsFollowingApp": "正在跟随 App 当前登录——该区域没有保存账号。",
+			"row.accountsCleared": "已清除保存的选择，该区域重新跟随 App 当前登录。",
+			"row.accountsWriteFailed": "账号改动未保存：{message} —— 设置文件写入失败（Windows 上可能被杀毒软件或同步盘占用）。当前仍是原来保存的选择，请先关闭占用 settings.yaml 的程序再重试。",
 			"row.selectionLostHint": "已保存的账号在本机已不存在。",
 			"row.selectionLostMessage": "该区域保存的账号已不在本机登录列表中（WorkBuddy 更换了登录或清理了备份文件）。本机其他登录仍然可用——请在上方选择一个，或点「跟随 App 当前登录」清除已保存的选择。重新登录桌面端 App 无法修复此问题。",
 			"row.modelsTitle": "模型",

package/lib/{host-heartbeat-CPIHUxKL.js → host-heartbeat-BOrNj3pY.js}

@@ -931,6 +931,19 @@ var WorkBuddyCredentialStore = class {
 	selectedAccountId() {
 		return this.accountId;
 	}
+	/**
+	* Whether the region runs a SAVED choice rather than the documented default.
+	*
+	* `false` means "follow the app's current sign-in", which is also what the
+	* card's Clear action restores. The two states can resolve to the very same
+	* account — an upgraded user whose pre-split `accountId` happens to be the
+	* app's current sign-in clears the choice and sees no change at all — so the
+	* card cannot infer this from the account list alone. It reports the state
+	* here so clearing is observable instead of looking like a dead button.
+	*/
+	hasExplicitSelection() {
+		return this.accountId !== void 0;
+	}
 	/** The auth-file path candidates, in probe order. */
 	resolveDesktopCandidates() {
 		const fromEnv = process.env[WORKBUDDY_AUTH_FILE_ENV];
@@ -1451,7 +1464,7 @@ var WorkBuddyCatalog = class {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "2.0.4";
+const WORKBUDDY_CONNECT_VERSION = "2.0.5";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -187,6 +187,17 @@ declare class WorkBuddyCredentialStore {
   selectAccount(accountId: string | undefined): void;
   /** Selected account id, for diagnostics and route assembly. */
   selectedAccountId(): string | undefined;
+  /**
+   * Whether the region runs a SAVED choice rather than the documented default.
+   *
+   * `false` means "follow the app's current sign-in", which is also what the
+   * card's Clear action restores. The two states can resolve to the very same
+   * account — an upgraded user whose pre-split `accountId` happens to be the
+   * app's current sign-in clears the choice and sees no change at all — so the
+   * card cannot infer this from the account list alone. It reports the state
+   * here so clearing is observable instead of looking like a dead button.
+   */
+  hasExplicitSelection(): boolean;
   /** The auth-file path candidates, in probe order. */
   private resolveDesktopCandidates;
   /** The resolved desktop auth-file path, for diagnostics. */
@@ -766,6 +777,11 @@ type WorkBuddyWebUsage =
  * sign-in again), versus nothing usable was found at all (sign in in the
  * desktop app). Only the latter makes the "sign in again" hint truthful —
  * re-signing in does not repair an orphaned id.
+ *
+ * `selectionExplicit` answers a question the account list cannot: whether
+ * the region runs a saved choice at all. Clearing restores the default, and
+ * when the default resolves to the same account the card would otherwise
+ * look unchanged — the "clear did nothing" report.
  */
 {
   status: 'signed-out';
@@ -773,6 +789,8 @@ type WorkBuddyWebUsage =
   message?: string;
   /** The persisted account id matches no local account. */
   selectionLost?: boolean;
+  /** A saved per-region choice is in effect (false = following the app). */
+  selectionExplicit: boolean;
 } | {
   status: 'signed-in';
   accountId: string;
@@ -783,6 +801,8 @@ type WorkBuddyWebUsage =
   region: WorkBuddyWebRegion;
   source?: 'desktop' | 'dsh';
   tokenExpiresAtMs: number;
+  /** A saved per-region choice is in effect (false = following the app). */
+  selectionExplicit: boolean;
   accounts: readonly WorkBuddyWebAccount[];
   models: readonly WorkBuddyWebModel[];
   enabledModelIds: readonly string[];
@@ -898,6 +918,47 @@ declare const Config: z<Config>;
  * picks.
  */
 declare function regionStateOf(config: Config, region: WorkBuddyRegion): WorkBuddyRegionState;
+/**
+ * The account id a region should select, or `undefined` for the documented
+ * default: follow whatever the WorkBuddy app is currently signed in as.
+ *
+ * Three inputs decide it, and the ORDER is the whole point:
+ *
+ * 1. `accounts[region] === ''` — the Clear sentinel. It means "the user
+ *    dropped this region's choice", which is the opposite of the key being
+ *    absent ("never configured"). It therefore terminates the lookup: falling
+ *    through to the legacy `accountId` here would re-bind the very account the
+ *    user just dropped, and would do it after clearing appeared to succeed.
+ * 2. `accounts[region]` set to a real id — an explicit per-region choice.
+ * 3. absent key, with the pre-split `accountId` belonging to this region —
+ *    the legacy migration, attributed once at startup from the local scan.
+ *
+ * `legacyAccountRegion` is resolved asynchronously after the first
+ * `applySelection` pass, so this is a pure function of it rather than a
+ * closure over the stores: the same call answers both the early pass (no
+ * attribution yet) and every later one.
+ */
+declare function selectAccountFor(region: WorkBuddyRegion, value: Config, legacyAccountRegion: WorkBuddyRegion | undefined): string | undefined;
+/** Whether a region carries the Clear sentinel rather than a saved choice. */
+declare function regionCleared(value: Config, region: WorkBuddyRegion): boolean;
+/**
+ * Which region owns the pre-split `accountId`, or `undefined` when it cannot
+ * be attributed (the field is absent, or the account is gone from every local
+ * sign-in list).
+ *
+ * Regions the user explicitly cleared are skipped, even when the saved account
+ * IS among their local sign-ins. `selectAccountFor` already refuses to fall
+ * back for a cleared region, so this cannot change what runs — but it keeps the
+ * attribution honest about its own decision: the region that owns this id is
+ * not the one the user just told the plugin to stop pinning, so the other
+ * region must get the chance to claim it.
+ *
+ * `accountsFor` is injected so the sequential, stop-at-first-match scan is
+ * testable without a filesystem.
+ */
+declare function legacyAttributionRegion(value: Config, accountsFor: (region: WorkBuddyRegion) => Promise<readonly {
+  id: string;
+}[]>): Promise<WorkBuddyRegion | undefined>;
 /**
  * Start both regions' loopback endpoints, register the `workbuddy` (CN) and
  * `workbuddy-global` (international) providers, and refresh each region's
@@ -907,4 +968,4 @@ declare function regionStateOf(config: Config, region: WorkBuddyRegion): WorkBud
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyReasoning, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyWebAccount, type WorkBuddyWebCheckin, type WorkBuddyWebCredits, type WorkBuddyWebModel, type WorkBuddyWebPackage, type WorkBuddyWebRegion, type WorkBuddyWebUsage, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyReasoning, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyWebAccount, type WorkBuddyWebCheckin, type WorkBuddyWebCredits, type WorkBuddyWebModel, type WorkBuddyWebPackage, type WorkBuddyWebRegion, type WorkBuddyWebUsage, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionCleared, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, selectAccountFor, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as prepareChatBody, C as workbuddyAccountId, D as parseCreditMultiplier, E as classifyUpstreamError, O as parseReasoning, S as parseWorkBuddyAuth, T as WorkBuddyUpstreamClient, _ as authFileName, a as readHostHeartbeat, b as defaultDesktopAuthPath, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, i as processStartTimeMs, j as regionOf, k as parseUpstreamModel, l as FALLBACK_WORKBUDDY_MODELS, m as WORKBUDDY_AUTH_FILENAME, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-CPIHUxKL.js";
+import { A as prepareChatBody, C as workbuddyAccountId, D as parseCreditMultiplier, E as classifyUpstreamError, O as parseReasoning, S as parseWorkBuddyAuth, T as WorkBuddyUpstreamClient, _ as authFileName, a as readHostHeartbeat, b as defaultDesktopAuthPath, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, i as processStartTimeMs, j as regionOf, k as parseUpstreamModel, l as FALLBACK_WORKBUDDY_MODELS, m as WORKBUDDY_AUTH_FILENAME, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-BOrNj3pY.js";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createProvider } from "@earendil-works/pi-ai";
@@ -561,9 +561,12 @@ function toWebAccount(account) {
 async function workBuddyWebStatus(deps, region) {
 	const store = deps.store(region);
 	const accounts = await store.accounts();
-	if ((await store.status()).state !== "signed-out" && accounts.length === 0) return {
+	const authStatus = await store.status();
+	const selectionExplicit = store.hasExplicitSelection();
+	if (authStatus.state !== "signed-out" && accounts.length === 0) return {
 		status: "signed-out",
-		accounts: []
+		accounts: [],
+		selectionExplicit
 	};
 	let credential;
 	try {
@@ -573,6 +576,7 @@ async function workBuddyWebStatus(deps, region) {
 			status: "signed-out",
 			accounts: accounts.map(toWebAccount),
 			message: safeMessage(error),
+			selectionExplicit,
 			...await store.selectionLost() ? { selectionLost: true } : {}
 		};
 	}
@@ -584,6 +588,7 @@ async function workBuddyWebStatus(deps, region) {
 		region,
 		source: credential.source,
 		tokenExpiresAtMs: credential.expiresAtMs,
+		selectionExplicit,
 		accounts: accounts.map(toWebAccount),
 		models: deps.displayModels(region).map((model) => toWebModel(model, deps.contextBudgets(region))),
 		enabledModelIds: [...deps.enabledModelIds(region)],
@@ -759,6 +764,59 @@ function regionStateOf(config, region) {
 /** Every region, in card tab order. */
 const REGION_KEYS = ["cn", "global"];
 /**
+* The account id a region should select, or `undefined` for the documented
+* default: follow whatever the WorkBuddy app is currently signed in as.
+*
+* Three inputs decide it, and the ORDER is the whole point:
+*
+* 1. `accounts[region] === ''` — the Clear sentinel. It means "the user
+*    dropped this region's choice", which is the opposite of the key being
+*    absent ("never configured"). It therefore terminates the lookup: falling
+*    through to the legacy `accountId` here would re-bind the very account the
+*    user just dropped, and would do it after clearing appeared to succeed.
+* 2. `accounts[region]` set to a real id — an explicit per-region choice.
+* 3. absent key, with the pre-split `accountId` belonging to this region —
+*    the legacy migration, attributed once at startup from the local scan.
+*
+* `legacyAccountRegion` is resolved asynchronously after the first
+* `applySelection` pass, so this is a pure function of it rather than a
+* closure over the stores: the same call answers both the early pass (no
+* attribution yet) and every later one.
+*/
+function selectAccountFor(region, value, legacyAccountRegion) {
+	const configured = value.accounts?.[region];
+	if (configured === "") return void 0;
+	if (configured !== void 0) return configured;
+	return legacyAccountRegion === region ? value.accountId : void 0;
+}
+/** Whether a region carries the Clear sentinel rather than a saved choice. */
+function regionCleared(value, region) {
+	return value.accounts?.[region] === "";
+}
+/**
+* Which region owns the pre-split `accountId`, or `undefined` when it cannot
+* be attributed (the field is absent, or the account is gone from every local
+* sign-in list).
+*
+* Regions the user explicitly cleared are skipped, even when the saved account
+* IS among their local sign-ins. `selectAccountFor` already refuses to fall
+* back for a cleared region, so this cannot change what runs — but it keeps the
+* attribution honest about its own decision: the region that owns this id is
+* not the one the user just told the plugin to stop pinning, so the other
+* region must get the chance to claim it.
+*
+* `accountsFor` is injected so the sequential, stop-at-first-match scan is
+* testable without a filesystem.
+*/
+async function legacyAttributionRegion(value, accountsFor) {
+	const id = value.accountId;
+	if (id === void 0) return void 0;
+	for (const region of REGION_KEYS) {
+		if (regionCleared(value, region)) continue;
+		if ((await accountsFor(region)).some((account) => account.id === id)) return region;
+	}
+}
+/**
 * Start both regions' loopback endpoints, register the `workbuddy` (CN) and
 * `workbuddy-global` (international) providers, and refresh each region's
 * model catalog from the upstream once that region's credentials allow it.
@@ -808,11 +866,7 @@ function apply(ctx, config) {
 	* a selection that belongs to the other side of the split.
 	*/
 	let legacyAccountRegion;
-	const effectiveAccountFor = (region, value) => {
-		const explicit = value.accounts?.[region];
-		if (explicit !== void 0) return explicit;
-		return legacyAccountRegion === region ? value.accountId : void 0;
-	};
+	const effectiveAccountFor = (region, value) => selectAccountFor(region, value, legacyAccountRegion);
 	const discoverModels = async (region, signal) => {
 		const credential = await stacks[region].store.resolve();
 		return client.fetchModels(credential, signal);
@@ -845,14 +899,11 @@ function apply(ctx, config) {
 	});
 	applySelection(config);
 	(async () => {
-		const id = current().accountId;
-		if (id === void 0) return;
 		try {
-			for (const region of REGION_KEYS) if ((await stacks[region].store.accounts()).some((account) => account.id === id)) {
-				legacyAccountRegion = region;
-				applySelection(current());
-				return;
-			}
+			const region = await legacyAttributionRegion(current(), async (candidate) => stacks[candidate].store.accounts());
+			if (region === void 0) return;
+			legacyAccountRegion = region;
+			applySelection(current());
 		} catch {}
 	})();
 	let stopped = false;
@@ -950,4 +1001,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialStore, WorkBuddyUpstreamClient, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialStore, WorkBuddyUpstreamClient, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionCleared, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, selectAccountFor, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "Connect locally signed-in WorkBuddy models to DeepSeek Harness with a read-only credits overview and model management.",
-  "version": "2.0.4",
+  "version": "2.0.5",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",