dsh-connect-workbuddy 2.0.4 → 2.0.6

package/CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## 2.0.6 (2026-09-22)
+
+### Fixes
+
+- **没有账号的区域不再向模型选择器列出模型**（issue #12，报告者 `stephenyab`）。此前只有国内版账号的用户，模型选择器里会多出一整组 `WorkBuddy Global`（**恰好 20 个**，与 `FALLBACK_WORKBUDDY_MODELS_GLOBAL` 逐条一致）——这些模型一个都用不了：该区域连凭据都解析不出来，选中后 `store.resolve()` 必抛错，shim 一律回 `401 not_signed_in`。**选择器说可选、实际必失败**，对单区域用户是纯噪音。
+
+  - **根因**：静态 fallback 的初衷是「上游离线也不让 provider 空着」，但它无条件播种（`new WorkBuddyCatalog(region)` 即装载整份 fallback），而 `deriveCatalog` 的「空勾选 = 全量」又把整份放行；启动时的真实刷新对无账号区域必然失败、只留一条 `logger.warn`，fallback 便永久留存。DSH 宿主对凭据一无所知（`buildModelCatalog` 只过滤 `models.length > 0`），于是原样渲染。
+  - **修复**：`WorkBuddyCatalog` 新增「本区域是否有本机登录」状态（`setRegionUsable()` / `isRegionUsable()`），无账号时 `current()` 返回空数组 → 宿主的空分组过滤让该分组**直接消失**。**provider 本身照常注册**：它的设置卡片与账号选择器正是用户登录的入口，隐藏分组是目录层决定，不是注册层决定。
+  - **与 `set()` 的非空守卫分开**，没有放宽它：两者回答不同问题——`set()` 承载**上游真实答案**，永不允许为空；「本区域没有账号」是**合法的空状态**，且必须能跨刷新存活。合并二者会要么丢掉守卫、要么丢掉隐藏分组的能力。测试专门锁定这一点：区域不可用期间上游刷新仍会在内部恢复目录，账号一出现即可立即服务。
+  - **默认可用（宽松方向）**：`setRegionUsable` 由异步扫描调用，扫描尚未完成或失败时保持原状，因此**一次瞬时文件系统错误不会把正常区域清空**。
+  - **两个触发点覆盖登录后的恢复**：① 设置变更时重算（`applySelection` 之后）；② 卡片侧——usage 轮询与「重新检测账号」路由本就调用 `store.accounts()`，顺手上报可用性，所以用户登录桌面端后**无需重启**，模型自动出现。`setRegionUsable()` 返回值表明状态是否真的变化，未变化时不做多余的 adapter 失效。
+  - **对称覆盖两侧**：报告举的例子是「只有国内版账号 → 国际版多出 20 个」，反之亦然（只有国际版账号时国内版会多出 12 个），修复同时作用于两个区域。
+
+  **核查**：报告的根因链**逐条属实**，本版本按报告建议的方向（其「建议修复方向」第 1、2、3 条）实现。我们额外确认了它列出的两条实现约束确实成立——`catalog.ts` 的 `set([])` 会抛错（故另开一条状态而非放宽守卫）、空目录会让宿主过滤掉整个分组（故无需注销 provider），并验证了它在第 5 条提到但未展开的点：`routableProviders` 仍包含该 provider id，这与选择器过滤是两个独立概念，本次不改动。
+
+  **措辞说明**：`README` 此前写「两边模型同时出现在选择器里」——该表述自本版本起变为**有条件**（有账号才出现），中英文 README 与 2.0.0 的 CHANGELOG 条目均已就地更正，而不是留着一个已被推翻的说法。
+
+### Tests
+
+测试总数 173 → 179（新增 6 例）：
+
+- `tests/issue12-region-hiding.spec.ts` 新增 2 例（新文件，端到端复现报告者的环境）：CN-only 机器上 `workbuddy-global` **不再列出任何模型**，而 `workbuddy` 正常服务；同时断言 **provider 与可配置 provider 仍在册**（登录入口不能消失）。第 2 例覆盖恢复路径：登录国际版账号后经设置链路重算，模型**无需重启**即可用。
+- `catalog.spec.ts` 新增 4 例：默认可用（扫描未完成不误清空）、无账号后 `current()` 为空且 `isRegionUsable()` 为假、`setRegionUsable()` 的「无变化」返回值语义、以及**非空守卫与可用性标记互相独立**（区域不可用期间 `set()` 仍保有真实目录，账号出现即恢复）。
+
+每条新增守卫都用「删掉对应实现即失败」验证过：让 `current()` 忽略可用性标记会挂 5 例；移除 `applySelection` 的重算调用会挂 3 例（含一条端到端用例）。
+
+### Docs
+
+- `README.md` / `README.en.md`：双供应商一节的「两边模型同时出现」改为「**有账号的区域**其模型出现」，并说明无账号区域不列出、登录后自动恢复、provider 始终注册。
+- `CHANGELOG.md` 2.0.0 条目中同一处表述就地标注了 2.0.6 的收紧。
+
+## 2.0.5 (2026-09-22)
+
+### Fixes
+
+- **「跟随 App 当前登录」清除后不再被旧版 `accountId` 顶掉，且清除结果在卡片上可见**（issue #11 的缺陷 1；其症状属实，但所声称的机制与严重性不准确——见下方「核查」）。
+
+  - **空字符串哨兵现在显式终止旧值回退**。`selectAccountFor()`（由 `applySelection` 内联逻辑提升为导出纯函数）按顺序判定：`accounts.<region> === ""` → 无选择（跟随 App）；具体 id → 该区域的显式选择；键不存在 → 回退到所属区域的旧版 `accountId`。此前 `""` 走的是「值已存在」分支并被 `selectAccount('')` 归一化为 `undefined`，结果碰巧正确，但语义靠下游兜底；任何一处偏离（下游不再归一化、或增加新的读取方）都会让旧账号复活。现在哨兵在源头终止回退，并有测试锁定。
+  - **启动时的旧值归属（attribution）跳过被显式清除的区域**（`legacyAttributionRegion()`）。该 pass 在启动后异步运行：跳过被清除的区域，既避免把用户刚丢弃的选择重新绑回，也保证**另一个区域仍有机会认领同一个 id**（用 `continue` 而非 `break`，否则国际版的迁移会被国内版的清除顺手打断）。
+  - **卡片新增区域状态行**：显示该区域当前是「使用保存的账号」还是「跟随 App 当前登录」，清除后先显示确认文案。这是 issue #11 里真正属于产品缺陷的那一半——清除后回退到的默认账号**通常正是刚被清掉的那个账号**（用户当初就是在 App 登录状态下选它的），因此清除成功与清除无效在界面上完全同形。此前 `usage` 文档也没有任何字段能区分二者。
+  - **设置写入改为「写入后回读校验」，失败时明确报错**（Windows 上尤其重要，见下）。`settingsScope.set()` 的 promise resolve **并不代表值已落盘**：设置文档 `settings.yaml` 靠「写临时文件 + rename 覆盖」替换，而 `@deepseek-ai/dsh-atomic-write` 对 `EPERM`/`EBUSY`/`EACCES` 的重试**只在 `win32` 生效**——Windows 上杀毒软件、OneDrive 等同步盘或编辑器会短暂锁住该文件。重试耗尽后，失败以「不成功的响应」回到客户端，而设置 scope 的 `mutate()` 对此**只是重新加载 Host 状态然后正常返回**，所以调用方的 `await` 会成功、文档却没变。新增 `writeAccountSlot()` 与 `writeRegionModels()`：写入后把值读回，读不回即抛 `WorkBuddySettingsWriteError`。对三处写入的影响：
+    - **清除账号**：只有确认落盘才显示「已清除」，失败则显示错误并说明原选择仍生效——否则会给出一个被旧选择默默反驳的假确认，比不提示更糟；
+    - **切换账号**：同样校验。静默丢弃会让下拉框显示一个账号、实际计费另一个；
+    - **保存模型**：尤其要紧——保存成功会**丢弃草稿**，若写入没落盘就丢，用户唯一的副本就没了，却还被告知「已保存」。校验比对回读的 `lastCatalog` id 序列（不能只看「槽位存在」，截断/残缺的写入同样要检出）。
+
+  **核查**：报告的根因链在 HEAD 上不成立，逐条复现如下。**注意措辞更正**：2.0.5 初稿曾断言「清除本来就生效」，该结论只在 Host 侧成立；在 Windows 上写入可能被静默丢弃，因此报告的「点了没反应」在那里是真实存在的，只是机制与报告所述不同（不是 `accountId` 顶掉，而是写入没落盘）。回读校验修复的正是后者。
+
+  | 报告的主张 | 实测结果 |
+  |---|---|
+  | `clearAccount()` 只写区域槽位，旧 `accountId` 会持续顶掉清除结果 | 清除后该区域立即跟随 App 默认；三种变体（旧账号≠当前登录、旧账号＝当前登录、启动归属与清除竞争）均通过 |
+  | `effectiveAccountFor()` 在哨兵值上不提前返回，因此旧值继续生效 | 该分支返回 `""`，经 `selectAccount('')` 归一化为 `undefined`，**不会**回退到 `accountId`——返回值虽然「不提前」，但结果正确 |
+  | 启动迁移块会把区域重新绑回旧账号 | 迁移块只在启动时运行一次，且 `applySelection` 走同一个 `effectiveAccountFor`，同样被哨兵挡住 |
+  | `""` 与「未设置」在 schema 层不可区分 | `""` 与键缺失**是可区分的**：`z.object({cn: z.string()})` 对 `{cn: ''}` 保留空串、对 `{}` 保留缺键；`Object.hasOwn` 亦为真。不可区分的只有**语义**，不是 schema |
+  | （报告未提及）写入可能根本不生效 | **成立，且与平台相关**：见上一条。空串本身在 YAML 里能正确往返（写成 `cn: ""`），所以哨兵语义没问题；丢的是**整次写入** |
+
+  因此本版本不按报告的建议去「清除旧字段」——旧字段是**两个区域共享的**迁移来源，清掉它会让另一侧失去迁移依据；正确的做法是让哨兵赢（已实现），并把无法观测的状态暴露给界面（已实现），再加上对「写入没生效」的显式检测。
+
+### Tests
+
+测试总数 142 → 173（新增 31 例，**全套 173 通过**）。
+
+> 关于 `host-heartbeat.spec.ts` 的 `processStartTimeMs`：在受限沙箱下该例会失败
+> （`processStartTimeMs` 需要执行 `ps`，被沙箱以 `EPERM` 拒绝 → 返回 `undefined`）。
+> 放开文件策略后 `ps` 可用，**5/5 通过**。该例与本次改动无关——两次运行用同一份
+> 源码，差异只来自沙箱能否执行 `ps`。
+
+- `settings-integration.spec.ts` 新增 15 例：`selectAccountFor` 的 6 例（显式选择优先、旧值只归属本区域、哨兵终止回退、清除与未配置可区分、两区域同时清除、清除一侧不影响另一侧）；`legacyAttributionRegion` 的 6 例（归属、跳过已清除区域、跳过但继续扫描另一区域、账号已消失、无旧字段、跨区域共享 id）；另有 3 例走真实 settings 链路 —— 清除后旧字段仍在但选不中、**重启后**已清除区域不被重新归属、以及清除前后经 usage 路由可见 `selectionExplicit` 翻转（账号名不变，这正是报告里「看起来没反应」的场景）。
+- `client-account-selection.spec.ts` 新增 13 例（新文件）：`configuredAccountsOf` 的容错读取；`writeAccountSlot` 的保存与「保留另一区域」、哨兵写成 `""` 而非删键、**锁文件导致的静默未落盘必须抛错**、错误携带字段名、**不把「键缺失」误判为清除成功**、正常落盘不误报、回读与卡片读取同源（scope 的 flush 默认 `sync`，落盘后同步可见，故不会误失败）；`writeRegionModels` 的保存与区域保留、**静默未落盘必须抛错**、目录被截断也要检出（不能只看「槽位存在」）、错误字段名、正常落盘不误报。
+- `auth.spec.ts` 新增 1 例：`hasExplicitSelection()` 在未选择/已选择/选择失效/哨兵清除四种状态下的取值。
+- `web-status.spec.ts` 新增 2 例：signed-in 与两个 signed-out 分支都携带 `selectionExplicit`。
+
+每条新增守卫都用「删掉对应实现即失败」逐一验证过：移除哨兵判断会挂 5 例，移除归属跳过会挂 2 例，把 `selectionExplicit` 写死为 `true` 会挂 3 例，把账号回读校验换成「相信 resolve」会挂 3 例，去掉模型保存的回读校验会挂 3 例。
+
+### Docs
+
+- `README.md` / `README.en.md` 的「已知限制 / Known limitations」补充：旧版 `accountId` 只作用于所属区域、且该区域被显式清除后不再生效；卡片状态行用于分辨清除是否生效；**Windows 上设置文件被占用会导致账号改动无法保存**，此时卡片报错且原选择保持生效。
+
 ## 2.0.4 (2026-09-21)
 
 ### Fixes
@@ -85,7 +162,7 @@
 
 - **🆕 国内版与国际版拆分为两个并行供应商，可同时使用**——此前一个 provider 一次只能活一个区域（选哪个账号整个 `workbuddy` 就服务于哪个区域，切账号 = 翻转整个运行时目录）。现在两侧是两套完全独立的实例，**互不干扰**：
 
-  - **双 provider 注册**：国内版保持 `workbuddy`（老 id 不变，存量会话的默认模型与已保存选择全部继续有效），国际版新增 `workbuddy-global`（displayName `WorkBuddy Global`）。**两边模型同时出现在 DSH 模型选择器里**——不同会话 / 子代理可以各选一边，互不干扰。
+  - **双 provider 注册**：国内版保持 `workbuddy`（老 id 不变，存量会话的默认模型与已保存选择全部继续有效），国际版新增 `workbuddy-global`（displayName `WorkBuddy Global`）。两边模型同时出现在 DSH 模型选择器里——不同会话 / 子代理可以各选一边，互不干扰。（**2.0.6 起收紧**：没有账号的区域不再列出模型，理由见该版本 CHANGELOG 的 issue #12 一节。）
   - **每个区域一套完整运行时栈**：凭据 store、模型 catalog、回环 shim、adapter 各一份。store 按凭据域名过滤可见账号（`workbuddy.ai` → 国际版，其余 → 国内版），两个区域的账号可同时在线。
   - **插件卡片 tab 化**：设置卡片顶部新增「国内版 / 国际版」tab 栏（带各自登录状态圆点）。每个 tab 有独立的账号选择、积分概览、签到与模型管理；**切 tab 不丢另一侧未保存的草稿**（模型勾选 / 图片开关 / 上下文预算的草稿按区域隔离保存）。4 条卡片路由全部按 `?region=cn|global` 参数化。
   - **「减少刷新变化」**：一个 tab 里切账号、刷新模型、轮询积分，完全不触碰另一边的运行时目录——绑定另一边模型的进行中会话不受任何影响（单 provider 架构做不到这一点）。

package/README.en.md

@@ -21,7 +21,7 @@ A [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness) bund
 
 ## Features
 
-- **Dual parallel providers (CN + international)** — the CN side registers as the `workbuddy` provider (`GLM-5.3`, `DeepSeek-V4-Pro`, `Kimi-K3`, `MiniMax-M3`, `Hy3`, etc.), the international side as `workbuddy-global` (`GPT-5.6`, `Gemini-3.5-Flash`, `GLM-5.3`, `Kimi-K3`, etc.), and **both rosters appear in the DSH model picker simultaneously**: different sessions can each pick a side without interfering. Model names carry the upstream credit multiplier (e.g. `GLM-5.3 · x0.79`), matching WorkBuddy's own model menu.
+- **Dual parallel providers (CN + international)** — the CN side registers as the `workbuddy` provider (`GLM-5.3`, `DeepSeek-V4-Pro`, `Kimi-K3`, `MiniMax-M3`, `Hy3`, etc.), the international side as `workbuddy-global` (`GPT-5.6`, `Gemini-3.5-Flash`, `GLM-5.3`, `Kimi-K3`, etc.). **A region's models appear in the DSH model picker when that region has an account**: with accounts on both sides, both rosters are selectable at once, and different sessions can each pick a side without interfering. **A region with no local sign-in lists no models** — it cannot serve a single request, so listing them would offer nothing but failures. Sign in once for that region and its models come back on "detect accounts again" or after a restart; the provider itself stays registered either way, because its settings card and account picker are how you sign in. Model names carry the upstream credit multiplier (e.g. `GLM-5.3 · x0.79`), matching WorkBuddy's own model menu.
 - **Tabbed settings card** — the card's top carries a "Domestic / Global" tab bar; each tab holds its own account picker, credits overview, and model management. Account, directory, selection, and unsaved drafts are fully isolated per tab — switching accounts or refreshing models on one tab never touches the other side's runtime catalog or sessions.
 - **Model management** — refresh the full catalog from upstream and enable or disable each model individually; refresh is a draft operation that only takes effect on save. Upstream also reports credit multiplier, context/output limits, and reasoning efforts; image input is opted in per model manually (off by default).
 - **Local account switching** — discovers the multiple sign-in credentials WorkBuddy's desktop app leaves behind and lets you switch per region. Tokens are never written to DSH settings.
@@ -116,6 +116,8 @@ Marketplace screenshots and GitHub README badges are two separate mechanisms:
 - The plugin depends on WorkBuddy client endpoints (not an official public API), so a WorkBuddy update may require adjustments.
 - **Account switching** relies on the historical auth files the WorkBuddy desktop app leaves behind (the app's own backups), not an official multi-account API. Following the app's current sign-in remains the default; switching is an explicit opt-in, and historical credentials can be invalidated by the app's cleanup or sign-out.
   - If an explicitly selected account disappears locally (the app replaced its login or cleaned up its backups), the plugin does **not** silently switch to another account — that would bill a different account. The card says the saved account no longer exists; pick an account again, or use "Follow the app's sign-in" to clear the saved choice. **Signing in again in the desktop app will not fix this**: the credentials are fine, it is the saved account id that no longer matches.
+  - Users upgrading from before 2.0.0 may still carry the old top-level `accountId` (the migration source). It applies only to its own region and **stops applying once that region is explicitly cleared (`accounts.<region> = ""`)** — otherwise the account you cleared would be silently restored at the next startup. The card shows whether a region is "using the saved account" or "following the app's current sign-in": the restored default is usually the very account you just cleared, so without that line there is no way to tell a successful clear from a no-op.
+- **On Windows, an account change may fail to save while `settings.yaml` is held open.** DSH updates that file by writing a temp file and replacing the target; an antivirus scanner, a sync client (OneDrive), or an open editor can lock it briefly, and once the replacement retries are exhausted the failed write does **not** make `set()` reject. The plugin therefore reads the value back after writing: it shows "cleared" **only once the write is confirmed on disk**, and on failure it reports the error and keeps your previous choice (never a false confirmation that the old selection silently contradicts). Close whatever holds the file and retry.
 - Windows and Linux credential paths are derived from platform conventions and are not verified on real hardware; set `WORKBUDDY_AUTH_FILE` if yours lives elsewhere.
 
 ## Disclaimer

package/README.md

@@ -27,7 +27,7 @@
 
 ## 功能特性
 
-- **双供应商并行接入（国内版 + 国际版）** —— 国内版注册为 `workbuddy` provider（`GLM-5.3`、`DeepSeek-V4-Pro`、`Kimi-K3`、`MiniMax-M3`、`Hy3` 等），国际版注册为 `workbuddy-global` provider（`GPT-5.6`、`Gemini-3.5-Flash`、`GLM-5.3`、`Kimi-K3` 等），**两边模型同时出现在 DSH 模型选择器里**：不同会话可以各选一边，互不干扰。模型名内嵌上游积分倍率（如 `GLM-5.3 · x0.79`），与 WorkBuddy 自身模型菜单一致。
+- **双供应商并行接入（国内版 + 国际版）** —— 国内版注册为 `workbuddy` provider（`GLM-5.3`、`DeepSeek-V4-Pro`、`Kimi-K3`、`MiniMax-M3`、`Hy3` 等），国际版注册为 `workbuddy-global` provider（`GPT-5.6`、`Gemini-3.5-Flash`、`GLM-5.3`、`Kimi-K3` 等）。**有账号的区域其模型会出现在 DSH 模型选择器里**：两边都有账号时两组同时可选，不同会话可以各选一边，互不干扰。**本机没有账号的区域不列出任何模型**（该区域一个请求也发不出去，列出来只会点到就失败）；只要在该区域登录一次，「重新检测账号」或重启后模型就会自动出现——provider 本身始终注册着，因为它的设置卡片与账号选择器正是登录的入口。模型名内嵌上游积分倍率（如 `GLM-5.3 · x0.79`），与 WorkBuddy 自身模型菜单一致。
 - **插件卡片 tab 切换** —— 设置卡片顶部为「国内版 / 国际版」两个 tab，各含独立的账号选择、积分概览与模型管理；每个 tab 的账号、目录、勾选与未保存草稿完全隔离——在一个 tab 里切账号或刷新模型，不会触碰另一边的运行时目录与会话。
 - **模型管理** —— 从上游刷新完整模型目录，逐项勾选启用或禁用；刷新是草稿操作，点保存才生效。上游同时给出积分倍率、上下文/输出上限与推理档位；图片输入按模型手动勾选（默认不勾选）。
 - **本机账号切换** —— 自动发现 WorkBuddy 桌面端留下的多个登录凭据，可按区域切换账号；Token 不写入 DSH 设置。
@@ -124,6 +124,8 @@ dsh plugin --profile desktop add /Users/dmh2002/DshProject/dsh-connect-workbuddy
 - 依赖 WorkBuddy 客户端接口（非官方开放 API），WorkBuddy 更新后插件可能需要随之调整。
 - **账号切换**基于 WorkBuddy 桌面端留下的历史 auth 文件（App 自身的备份产物），并非官方多账号 API。默认行为仍是跟随 App 当前登录；切换账号是显式选项，且历史凭据可能因 App 清理或退出登录而失效。
   - 显式选择的账号若在本机消失（App 更换登录或清理备份文件），插件**不会**静默改选其他账号——那样会让账单落到另一个账号上。卡片会明确说明「保存的账号已不存在」，此时重新选择一个账号，或点「跟随 App 当前登录」清除该选择即可恢复。**重新登录桌面端 App 无法修复这种状态**：凭据本身是好的，失效的只是保存下来的账号标识。
+  - 从 2.0.0 之前的版本升级而来的用户，设置里可能仍留有旧版的顶层 `accountId`（迁移来源）。它只作用于其所属区域，且**该区域被显式清除（`accounts.<区域> = ""`）后即不再生效**——否则清除掉的账号会在下次启动时被静默恢复。卡片会显示每个区域当前是「使用保存的账号」还是「跟随 App 当前登录」：清除后回到的默认账号往往与刚清掉的账号是同一个，没有这行提示就无法分辨清除是否生效。
+- **Windows：设置文件 `settings.yaml` 被占用时，账号改动可能无法保存**。DSH 用「写临时文件 + 覆盖替换」的方式更新该文件，而杀毒软件、OneDrive 等同步盘或正在打开该文件的编辑器会短暂锁住它；重试耗尽后，写入失败**不会**让 `set()` 报错。插件因此会在写入后回读校验：**确认落盘才显示「已清除」**，失败则给出明确错误并保留原来的选择（不会显示一个旧选择默默反驳的假确认）。遇到该提示时，关闭占用该文件的程序后重试即可。
 - Windows / Linux 的凭据默认路径为按平台约定推导，未经真机验证；必要时可通过环境变量 `WORKBUDDY_AUTH_FILE` 指定实际位置。
 
 ## 免责声明

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { T as WorkBuddyUpstreamClient, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-CPIHUxKL.js";
+import { T as WorkBuddyUpstreamClient, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat--iKDuwr5.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -57,6 +57,92 @@ window.__ModuleLoader__.load({
 			};
 		}
 		//#endregion
+		//#region src/client/account-selection.ts
+		/**
+		* A settings write that did not take effect.
+		*
+		* Distinct from a rejected `set()`: this is thrown when the write reported
+		* success and the value is nonetheless absent from the document.
+		*/
+		var WorkBuddySettingsWriteError = class extends Error {
+			/** The settings field that did not land. */
+			field;
+			constructor(field) {
+				super(`workbuddy: settings field "${field}" was not persisted by the settings write`);
+				this.name = "WorkBuddySettingsWriteError";
+				this.field = field;
+			}
+		};
+		/** Read the per-region account selections out of the settings snapshot. */
+		function configuredAccountsOf(configured) {
+			const accounts = configured?.accounts;
+			return typeof accounts === "object" && accounts !== null ? accounts : {};
+		}
+		/**
+		* Write one region's account slot, then confirm the value actually landed.
+		*
+		* `settingsScope.set()` resolving is NOT proof that anything was stored. The
+		* Host's document is `settings.yaml`, replaced by writing a temp file and
+		* renaming it over the target; on Windows an antivirus scanner, a sync client
+		* (OneDrive, Dropbox), or an open editor can hold the file briefly.
+		* `@deepseek-ai/dsh-atomic-write` retries `EPERM` / `EBUSY` / `EACCES` a
+		* bounded number of times and those retries exist only for `win32` — and once
+		* they are exhausted the failure reaches the client as an unsuccessful
+		* response, which the settings scope handles by reloading Host state and
+		* merely RETURNING. The caller's `await` therefore succeeds while the document
+		* is unchanged.
+		*
+		* Reading the field back is the only reliable check, and it is what the
+		* official plugin cards do (`CardForm.store()` compares the user layer against
+		* the value it wrote). Failing loudly matters most on Clear: a false success
+		* would flip the card to "following the app's sign-in" while the old selection
+		* keeps running — the exact confusion that state line exists to remove.
+		*
+		* @param scope - the bound settings scope for this plugin's namespace.
+		* @param region - the region whose slot is written; the other is preserved.
+		* @param value - the account id to save, or `''` to clear the region.
+		* @throws {WorkBuddySettingsWriteError} when the value is readable back as
+		*   something else — i.e. the write silently did not persist.
+		*/
+		async function writeAccountSlot(scope, region, value) {
+			const accounts = configuredAccountsOf(scope.getSnapshot().value);
+			await scope.set("accounts", {
+				...accounts,
+				[region]: value
+			});
+			if (configuredAccountsOf(scope.getSnapshot().value)[region] !== value) throw new WorkBuddySettingsWriteError("accounts");
+		}
+		/**
+		* Write one region's saved model state, then confirm it actually landed.
+		*
+		* The same silent-failure mode as {@link writeAccountSlot} applies to EVERY
+		* settings write, not just the account slot. It matters here for a different
+		* reason: a successful save discards the user's draft, so a write that did not
+		* persist makes the card throw away unsaved edits while claiming they were
+		* saved — unrecoverable, since the drafts are the only copy.
+		*
+		* Verification compares the round-tripped `lastCatalog` ids, which is the part
+		* of the payload that is both user-visible and cheap to compare; the selection
+		* fields ride along in the same object and cannot land separately.
+		*
+		* @param scope - the bound settings scope for this plugin's namespace.
+		* @param region - the region whose model slot is written.
+		* @param payload - the complete next state for that region's slot.
+		* @throws {WorkBuddySettingsWriteError} when the catalog does not read back.
+		*/
+		async function writeRegionModels(scope, region, payload) {
+			const configured = scope.getSnapshot().value?.regions;
+			const regions = typeof configured === "object" && configured !== null ? configured : {};
+			await scope.set("regions", {
+				...regions,
+				[region]: payload
+			});
+			const landed = scope.getSnapshot().value?.regions?.[region];
+			const written = payload.lastCatalog.map((model) => model.id);
+			const stored = landed?.lastCatalog?.map((model) => model.id);
+			if (!(stored !== void 0 && stored.length === written.length && stored.every((id, index) => id === written[index]))) throw new WorkBuddySettingsWriteError("regions");
+		}
+		//#endregion
 		//#region src/client/icon.ts
 		/**
 		* Plugin icon (LD brand logo, 64px) shared across the LaoDing plugin family.
@@ -117,7 +203,10 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-usage-account-copy{display:flex;flex-direction:column;gap:3px;min-width:0}
 .dsm-workbuddy-usage-expiry{padding-left:19px;color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px}
 .dsm-workbuddy-usage-hint{padding-left:19px;color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px}
-.dsm-workbuddy-account-picker{display:block}
+.dsm-workbuddy-account-picker{display:flex;flex-direction:column;gap:8px}
+.dsm-workbuddy-account-state{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px}
+.dsm-workbuddy-account-state:empty{display:none}
+.dsm-workbuddy-account-error{color:var(--dsw-alias-state-error-primary,#ef4444);font-size:12px;line-height:18px;white-space:pre-line}
 .dsm-workbuddy-usage-select-wrap{position:relative}
 .dsm-workbuddy-usage-select{appearance:none;width:100%;font:inherit;padding:10px 34px 10px 12px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:10px;color:var(--dsw-alias-label-primary,#e6e6e6);background:var(--dsw-alias-bg-layer-3,#2a2c33);cursor:pointer;transition:border-color .15s,box-shadow .15s}
 .dsm-workbuddy-usage-select:focus-visible{outline:none;border-color:var(--dsw-alias-brand-primary,#5686fe);box-shadow:0 0 0 3px rgba(86,134,254,.22)}
@@ -255,26 +344,30 @@ window.__ModuleLoader__.load({
 		function dotStyle(status) {
 			return { background: status === "signed-in" ? "var(--dsw-alias-state-success-primary, #22a06b)" : status === "error" ? "var(--dsw-alias-state-error-primary, #d92d20)" : "var(--dsw-alias-label-dimmed, #9aa0a6)" };
 		}
-		/** Read the per-region account selections out of the settings snapshot. */
-		function configuredAccountsOf(configured) {
-			const accounts = configured?.accounts;
-			return typeof accounts === "object" && accounts !== null ? accounts : {};
-		}
 		/** Render WorkBuddy sign-in state, credits, and model selection as one card. */
 		function WorkBuddyCard({ t, settingsScope }) {
 			if (t === void 0) throw new Error("WorkBuddy plugin card requires its translation function");
 			const [open, setOpen] = (0, react.useState)(false);
 			/** The region whose tab is on screen; each tab is its own provider stack. */
 			const [activeRegion, setActiveRegion] = (0, react.useState)("cn");
-			/** Last-known usage per region, so tab dots survive tab switches. */
+			/**
+			* Last-known usage per region, so tab dots survive tab switches.
+			*
+			* The placeholder carries `selectionExplicit: false` because that is the
+			* state the plugin documents as the default before any choice is saved. It
+			* is never rendered: the account picker and its state line only appear once
+			* a real fetch has populated `accounts`.
+			*/
 			const [statusByRegion, setStatusByRegion] = (0, react.useState)({
 				cn: {
 					status: "signed-out",
-					accounts: []
+					accounts: [],
+					selectionExplicit: false
 				},
 				global: {
 					status: "signed-out",
-					accounts: []
+					accounts: [],
+					selectionExplicit: false
 				}
 			});
 			const [busy, setBusy] = (0, react.useState)(false);
@@ -286,6 +379,10 @@ window.__ModuleLoader__.load({
 			/** Save failure surfaced next to the buttons; cleared by the next attempt. */
 			const [saveError, setSaveError] = (0, react.useState)(void 0);
 			const [switchingAccount, setSwitchingAccount] = (0, react.useState)(false);
+			/** Set right after a CONFIRMED Clear so the dropped choice is stated. */
+			const [accountNote, setAccountNote] = (0, react.useState)(void 0);
+			/** A refused account write (silently unpersisted settings on a locked file). */
+			const [accountError, setAccountError] = (0, react.useState)(void 0);
 			const [checkingIn, setCheckingIn] = (0, react.useState)(false);
 			const [checkinActionError, setCheckinActionError] = (0, react.useState)(void 0);
 			const mounted = (0, react.useRef)(true);
@@ -338,7 +435,8 @@ window.__ModuleLoader__.load({
 			]);
 			const status = statusByRegion[activeRegion] ?? {
 				status: "signed-out",
-				accounts: []
+				accounts: [],
+				selectionExplicit: false
 			};
 			(0, react.useEffect)(() => {
 				if (!open || status.status !== "signed-in") return;
@@ -387,13 +485,13 @@ window.__ModuleLoader__.load({
 			const switchAccount = async (accountId) => {
 				if (settingsScope === void 0) return;
 				setSwitchingAccount(true);
+				setAccountNote(void 0);
+				setAccountError(void 0);
 				try {
-					const configuredAccounts = configuredAccountsOf(settingsScope.getSnapshot().value);
-					await settingsScope.set("accounts", {
-						...configuredAccounts,
-						[activeRegion]: accountId
-					});
+					await writeAccountSlot(settingsScope, activeRegion, accountId);
 					await refreshUsage(activeRegion);
+				} catch (error) {
+					if (mounted.current) setAccountError(error instanceof Error ? error.message : t("row.requestFailed"));
 				} finally {
 					if (mounted.current) setSwitchingAccount(false);
 				}
@@ -402,18 +500,29 @@ window.__ModuleLoader__.load({
 			* Drop the explicit choice so the region returns to its documented default:
 			* follow whatever the WorkBuddy app is currently signed in as. The empty
 			* string is the settings-level sentinel for "no explicit selection" (the
-			* store normalizes it away); the account id itself is never written here.
+			* store normalizes it away, and the host's legacy attribution treats it as a
+			* deliberate clear rather than an unset key); the account id itself is never
+			* written here.
+			*
+			* The confirmation is only shown once the write is CONFIRMED. That matters
+			* twice over: the restored default is usually the very account that was
+			* saved, so the state line is the only feedback the user gets — and on
+			* Windows the atomic replace of `settings.yaml` can fail outright (locked by
+			* an antivirus scanner or a sync client), in which case claiming "cleared"
+			* would be a lie that the old selection silently contradicts.
 			*/
 			const clearAccount = async () => {
 				if (settingsScope === void 0) return;
 				setSwitchingAccount(true);
+				setAccountError(void 0);
 				try {
-					const configuredAccounts = configuredAccountsOf(settingsScope.getSnapshot().value);
-					await settingsScope.set("accounts", {
-						...configuredAccounts,
-						[activeRegion]: ""
-					});
+					await writeAccountSlot(settingsScope, activeRegion, "");
 					await refreshUsage(activeRegion);
+					if (mounted.current) setAccountNote("cleared");
+				} catch (error) {
+					if (!mounted.current) return;
+					setAccountNote(void 0);
+					setAccountError(error instanceof Error ? error.message : t("row.requestFailed"));
 				} finally {
 					if (mounted.current) setSwitchingAccount(false);
 				}
@@ -542,15 +651,11 @@ window.__ModuleLoader__.load({
 				setSaving(true);
 				setSaveError(void 0);
 				try {
-					const configuredRegions = configured?.regions;
-					await settingsScope.set("regions", {
-						...typeof configuredRegions === "object" && configuredRegions !== null ? configuredRegions : {},
-						[status.region]: {
-							lastCatalog: visibleModels.map(toPersistedWorkBuddyModel),
-							enabledModelIds: [...activeEnabledIds],
-							imageModelIds: [...activeImageIds],
-							contextBudgets: activeContextBudgets
-						}
+					await writeRegionModels(settingsScope, status.region, {
+						lastCatalog: visibleModels.map(toPersistedWorkBuddyModel),
+						enabledModelIds: [...activeEnabledIds],
+						imageModelIds: [...activeImageIds],
+						contextBudgets: activeContextBudgets
 					});
 					discardModels();
 					await refreshUsage(activeRegion);
@@ -564,6 +669,11 @@ window.__ModuleLoader__.load({
 			const label = status.status === "signed-in" ? t("row.signedIn", { accountName: status.accountName }) : status.status === "error" ? t("row.requestFailed") : t("row.signedOut");
 			/** The saved choice no longer matches a local sign-in (tokens are fine). */
 			const selectionLost = status.status === "signed-out" && status.selectionLost === true;
+			/**
+			* Whether this region runs a saved choice, per the Host. `undefined` only on
+			* the error branch, which renders no picker and therefore no state line.
+			*/
+			const selectionExplicit = status.status === "error" ? void 0 : status.selectionExplicit;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
 				className: `dsm-plugin-card${open ? " dsm-plugin-card-open" : ""}`,
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
@@ -615,6 +725,8 @@ window.__ModuleLoader__.load({
 										className: `dsm-workbuddy-tab${region === activeRegion ? " dsm-workbuddy-tab-active" : ""}`,
 										onClick: () => {
 											setActiveRegion(region);
+											setAccountNote(void 0);
+											setAccountError(void 0);
 										},
 										children: [regionStatus === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 											"aria-hidden": "true",
@@ -668,33 +780,46 @@ window.__ModuleLoader__.load({
 							status.status !== "error" && status.accounts.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 								className: "dsm-workbuddy-account-picker",
 								"aria-label": t("row.accountsTitle"),
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-									className: "dsm-workbuddy-usage-select-wrap",
-									children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
-										className: "dsm-workbuddy-usage-select",
-										value: status.accounts.find((account) => account.selected)?.id ?? "",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "dsm-workbuddy-usage-select-wrap",
+										children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+											className: "dsm-workbuddy-usage-select",
+											value: status.accounts.find((account) => account.selected)?.id ?? "",
+											disabled: switchingAccount || settingsScope?.getSnapshot().writable !== true,
+											onChange: (event) => {
+												switchAccount(event.currentTarget.value);
+											},
+											children: [status.accounts.some((account) => account.selected) ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+												value: "",
+												disabled: true,
+												children: t("row.accountNoneInEffect")
+											}), status.accounts.map((account) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("option", {
+												value: account.id,
+												children: [account.accountName, account.domain === "" ? "" : ` · ${account.domain}`]
+											}, account.id))]
+										})
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsm-btn dsm-btn-outline",
 										disabled: switchingAccount || settingsScope?.getSnapshot().writable !== true,
-										onChange: (event) => {
-											switchAccount(event.currentTarget.value);
+										onClick: () => {
+											clearAccount();
 										},
-										children: [status.accounts.some((account) => account.selected) ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-											value: "",
-											disabled: true,
-											children: t("row.accountNoneInEffect")
-										}), status.accounts.map((account) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("option", {
-											value: account.id,
-											children: [account.accountName, account.domain === "" ? "" : ` · ${account.domain}`]
-										}, account.id))]
+										children: t("row.accountsFollowApp")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-account-state",
+										role: "status",
+										children: accountNote === "cleared" ? t("row.accountsCleared") : selectionExplicit === false ? t("row.accountsFollowingApp") : selectionExplicit === true ? t("row.accountsSavedChoice") : ""
+									}),
+									accountError === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-account-error",
+										role: "alert",
+										children: t("row.accountsWriteFailed", { message: accountError })
 									})
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									type: "button",
-									className: "dsm-btn dsm-btn-outline",
-									disabled: switchingAccount || settingsScope?.getSnapshot().writable !== true,
-									onClick: () => {
-										clearAccount();
-									},
-									children: t("row.accountsFollowApp")
-								})]
+								]
 							}) : null,
 							status.status === "signed-in" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
 								status.credits === void 0 ? null : (() => {
@@ -975,6 +1100,10 @@ window.__ModuleLoader__.load({
 			"row.accountsScanning": "Detecting…",
 			"row.accountsFollowApp": "Follow the app's sign-in",
 			"row.accountNoneInEffect": "No account in effect",
+			"row.accountsSavedChoice": "Using the account saved for this region.",
+			"row.accountsFollowingApp": "Following the app's current sign-in — no account is saved for this region.",
+			"row.accountsCleared": "Saved choice cleared. This region follows the app's current sign-in again.",
+			"row.accountsWriteFailed": "The account change was not saved: {message} — the settings file could not be updated (on Windows it may be locked by an antivirus scanner or a sync client). Your previous choice is still in effect; close whatever holds settings.yaml and try again.",
 			"row.selectionLostHint": "The saved account no longer exists locally.",
 			"row.selectionLostMessage": "The account saved for this region is no longer among the local sign-ins (WorkBuddy replaced its login or cleaned up backups). Your other sign-ins are fine — pick one above, or choose \"Follow the app's sign-in\" to clear the saved choice. Signing in again in the desktop app will not fix this.",
 			"row.modelsTitle": "Models",
@@ -1027,6 +1156,10 @@ window.__ModuleLoader__.load({
 			"row.accountsScanning": "正在检测…",
 			"row.accountsFollowApp": "跟随 App 当前登录",
 			"row.accountNoneInEffect": "当前没有生效的账号",
+			"row.accountsSavedChoice": "正在使用该区域保存的账号。",
+			"row.accountsFollowingApp": "正在跟随 App 当前登录——该区域没有保存账号。",
+			"row.accountsCleared": "已清除保存的选择，该区域重新跟随 App 当前登录。",
+			"row.accountsWriteFailed": "账号改动未保存：{message} —— 设置文件写入失败（Windows 上可能被杀毒软件或同步盘占用）。当前仍是原来保存的选择，请先关闭占用 settings.yaml 的程序再重试。",
 			"row.selectionLostHint": "已保存的账号在本机已不存在。",
 			"row.selectionLostMessage": "该区域保存的账号已不在本机登录列表中（WorkBuddy 更换了登录或清理了备份文件）。本机其他登录仍然可用——请在上方选择一个，或点「跟随 App 当前登录」清除已保存的选择。重新登录桌面端 App 无法修复此问题。",
 			"row.modelsTitle": "模型",

package/lib/{host-heartbeat-CPIHUxKL.js → host-heartbeat--iKDuwr5.js}

@@ -931,6 +931,19 @@ var WorkBuddyCredentialStore = class {
 	selectedAccountId() {
 		return this.accountId;
 	}
+	/**
+	* Whether the region runs a SAVED choice rather than the documented default.
+	*
+	* `false` means "follow the app's current sign-in", which is also what the
+	* card's Clear action restores. The two states can resolve to the very same
+	* account — an upgraded user whose pre-split `accountId` happens to be the
+	* app's current sign-in clears the choice and sees no change at all — so the
+	* card cannot infer this from the account list alone. It reports the state
+	* here so clearing is observable instead of looking like a dead button.
+	*/
+	hasExplicitSelection() {
+		return this.accountId !== void 0;
+	}
 	/** The auth-file path candidates, in probe order. */
 	resolveDesktopCandidates() {
 		const fromEnv = process.env[WORKBUDDY_AUTH_FILE_ENV];
@@ -1427,10 +1440,24 @@ function applyContextBudgets(catalog, budgets = {}) {
 function deriveCatalog(catalog, enabled, budgets = {}) {
 	return applyContextBudgets(enabled.size === 0 ? catalog : catalog.filter((model) => enabled.has(model.id)), budgets);
 }
-/** Mutable catalog shared by the shim's `/v1/models` and the adapter. */
+/**
+* Mutable catalog shared by the shim's `/v1/models` and the adapter.
+*
+* The static fallback exists so an OFFLINE upstream never leaves a provider
+* empty — but "offline" presumes the region is usable at all. A region with no
+* local sign-in cannot serve one single request, so seeding it with a roster
+* puts models in the picker that are guaranteed to 401 (issue #12). The host
+* distinguishes the two cases through {@link WorkBuddyCatalog.setRegionUsable}.
+*/
 var WorkBuddyCatalog = class {
 	models;
 	/**
+	* Whether this region has any local sign-in. Defaults to `true` — the
+	* permissive direction — so a scan that has not run yet (or failed) keeps
+	* serving the fallback rather than blanking a region that may be fine.
+	*/
+	usable = true;
+	/**
 	* @param region Seeds the static fallback for this region; each region's
 	* provider must never serve the other region's roster before its first
 	* live refresh lands.
@@ -1438,9 +1465,37 @@ var WorkBuddyCatalog = class {
 	constructor(region = "cn") {
 		this.models = fallbackModelsFor(region);
 	}
-	/** Current entries; the fallback list until the upstream answer lands. */
+	/**
+	* Current entries; the fallback list until the upstream answer lands.
+	*
+	* Empty while this region has no local sign-in: the provider stays
+	* registered (its row still hosts the settings card and the account picker),
+	* but it advertises nothing to pick. DSH drops empty provider groups from
+	* the picker (`buildModelCatalog` filters `models.length > 0`), so the group
+	* disappears exactly when it would be pure noise.
+	*/
 	current() {
-		return this.models;
+		return this.usable ? this.models : [];
+	}
+	/** Whether this region currently advertises any model. */
+	isRegionUsable() {
+		return this.usable;
+	}
+	/**
+	* Record whether this region has a local sign-in.
+	*
+	* Separate from {@link set} on purpose: `set()` carries a live upstream
+	* answer and must never be empty, while "this region has no account" is a
+	* legitimate empty state that must survive across refreshes. Keeping them
+	* apart is what lets the non-empty guard stay strict.
+	*
+	* @returns whether the value changed, so the caller can skip invalidating
+	*   its adapter snapshots when nothing moved.
+	*/
+	setRegionUsable(usable) {
+		if (this.usable === usable) return false;
+		this.usable = usable;
+		return true;
 	}
 	/** Replace the list; callers invalidate their adapter snapshot after this. */
 	set(models) {
@@ -1451,7 +1506,7 @@ var WorkBuddyCatalog = class {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "2.0.4";
+const WORKBUDDY_CONNECT_VERSION = "2.0.6";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -187,6 +187,17 @@ declare class WorkBuddyCredentialStore {
   selectAccount(accountId: string | undefined): void;
   /** Selected account id, for diagnostics and route assembly. */
   selectedAccountId(): string | undefined;
+  /**
+   * Whether the region runs a SAVED choice rather than the documented default.
+   *
+   * `false` means "follow the app's current sign-in", which is also what the
+   * card's Clear action restores. The two states can resolve to the very same
+   * account — an upgraded user whose pre-split `accountId` happens to be the
+   * app's current sign-in clears the choice and sees no change at all — so the
+   * card cannot infer this from the account list alone. It reports the state
+   * here so clearing is observable instead of looking like a dead button.
+   */
+  hasExplicitSelection(): boolean;
   /** The auth-file path candidates, in probe order. */
   private resolveDesktopCandidates;
   /** The resolved desktop auth-file path, for diagnostics. */
@@ -468,17 +479,53 @@ declare function fallbackModelsFor(region: 'cn' | 'global'): readonly WorkBuddyM
  */
 type WorkBuddyContextBudget = number;
 declare function deriveCatalog(catalog: readonly WorkBuddyModelInfo[], enabled: ReadonlySet<string>, budgets?: Readonly<Record<string, WorkBuddyContextBudget | undefined>>): WorkBuddyModelInfo[];
-/** Mutable catalog shared by the shim's `/v1/models` and the adapter. */
+/**
+ * Mutable catalog shared by the shim's `/v1/models` and the adapter.
+ *
+ * The static fallback exists so an OFFLINE upstream never leaves a provider
+ * empty — but "offline" presumes the region is usable at all. A region with no
+ * local sign-in cannot serve one single request, so seeding it with a roster
+ * puts models in the picker that are guaranteed to 401 (issue #12). The host
+ * distinguishes the two cases through {@link WorkBuddyCatalog.setRegionUsable}.
+ */
 declare class WorkBuddyCatalog {
   private models;
+  /**
+   * Whether this region has any local sign-in. Defaults to `true` — the
+   * permissive direction — so a scan that has not run yet (or failed) keeps
+   * serving the fallback rather than blanking a region that may be fine.
+   */
+  private usable;
   /**
    * @param region Seeds the static fallback for this region; each region's
    * provider must never serve the other region's roster before its first
    * live refresh lands.
    */
   constructor(region?: 'cn' | 'global');
-  /** Current entries; the fallback list until the upstream answer lands. */
+  /**
+   * Current entries; the fallback list until the upstream answer lands.
+   *
+   * Empty while this region has no local sign-in: the provider stays
+   * registered (its row still hosts the settings card and the account picker),
+   * but it advertises nothing to pick. DSH drops empty provider groups from
+   * the picker (`buildModelCatalog` filters `models.length > 0`), so the group
+   * disappears exactly when it would be pure noise.
+   */
   current(): readonly WorkBuddyModelInfo[];
+  /** Whether this region currently advertises any model. */
+  isRegionUsable(): boolean;
+  /**
+   * Record whether this region has a local sign-in.
+   *
+   * Separate from {@link set} on purpose: `set()` carries a live upstream
+   * answer and must never be empty, while "this region has no account" is a
+   * legitimate empty state that must survive across refreshes. Keeping them
+   * apart is what lets the non-empty guard stay strict.
+   *
+   * @returns whether the value changed, so the caller can skip invalidating
+   *   its adapter snapshots when nothing moved.
+   */
+  setRegionUsable(usable: boolean): boolean;
   /** Replace the list; callers invalidate their adapter snapshot after this. */
   set(models: readonly WorkBuddyModelInfo[]): void;
 }
@@ -766,6 +813,11 @@ type WorkBuddyWebUsage =
  * sign-in again), versus nothing usable was found at all (sign in in the
  * desktop app). Only the latter makes the "sign in again" hint truthful —
  * re-signing in does not repair an orphaned id.
+ *
+ * `selectionExplicit` answers a question the account list cannot: whether
+ * the region runs a saved choice at all. Clearing restores the default, and
+ * when the default resolves to the same account the card would otherwise
+ * look unchanged — the "clear did nothing" report.
  */
 {
   status: 'signed-out';
@@ -773,6 +825,8 @@ type WorkBuddyWebUsage =
   message?: string;
   /** The persisted account id matches no local account. */
   selectionLost?: boolean;
+  /** A saved per-region choice is in effect (false = following the app). */
+  selectionExplicit: boolean;
 } | {
   status: 'signed-in';
   accountId: string;
@@ -783,6 +837,8 @@ type WorkBuddyWebUsage =
   region: WorkBuddyWebRegion;
   source?: 'desktop' | 'dsh';
   tokenExpiresAtMs: number;
+  /** A saved per-region choice is in effect (false = following the app). */
+  selectionExplicit: boolean;
   accounts: readonly WorkBuddyWebAccount[];
   models: readonly WorkBuddyWebModel[];
   enabledModelIds: readonly string[];
@@ -817,6 +873,16 @@ interface WorkBuddyStatusRouteOptions {
   contextBudgets(region: WorkBuddyRegion): Readonly<Record<string, number | undefined>>;
   /** Re-read the live catalog of one region from the upstream. */
   discoverModels?(region: WorkBuddyRegion, signal?: AbortSignal): Promise<readonly WorkBuddyModelInfo[]>;
+  /**
+   * Report whether a region still has at least one local sign-in.
+   *
+   * The card is where sign-in state actually changes under the plugin's nose
+   * (the user signs in to the desktop app, then presses "detect accounts
+   * again"), so the routes are the earliest honest place to notice. Both
+   * callers already read `store.accounts()` for their own answer, so this adds
+   * no scan of its own.
+   */
+  regionUsable?(region: WorkBuddyRegion, usable: boolean): void;
 }
 /**
  * Assemble one region's card document. `region` is the tab the card is on;
@@ -898,6 +964,47 @@ declare const Config: z<Config>;
  * picks.
  */
 declare function regionStateOf(config: Config, region: WorkBuddyRegion): WorkBuddyRegionState;
+/**
+ * The account id a region should select, or `undefined` for the documented
+ * default: follow whatever the WorkBuddy app is currently signed in as.
+ *
+ * Three inputs decide it, and the ORDER is the whole point:
+ *
+ * 1. `accounts[region] === ''` — the Clear sentinel. It means "the user
+ *    dropped this region's choice", which is the opposite of the key being
+ *    absent ("never configured"). It therefore terminates the lookup: falling
+ *    through to the legacy `accountId` here would re-bind the very account the
+ *    user just dropped, and would do it after clearing appeared to succeed.
+ * 2. `accounts[region]` set to a real id — an explicit per-region choice.
+ * 3. absent key, with the pre-split `accountId` belonging to this region —
+ *    the legacy migration, attributed once at startup from the local scan.
+ *
+ * `legacyAccountRegion` is resolved asynchronously after the first
+ * `applySelection` pass, so this is a pure function of it rather than a
+ * closure over the stores: the same call answers both the early pass (no
+ * attribution yet) and every later one.
+ */
+declare function selectAccountFor(region: WorkBuddyRegion, value: Config, legacyAccountRegion: WorkBuddyRegion | undefined): string | undefined;
+/** Whether a region carries the Clear sentinel rather than a saved choice. */
+declare function regionCleared(value: Config, region: WorkBuddyRegion): boolean;
+/**
+ * Which region owns the pre-split `accountId`, or `undefined` when it cannot
+ * be attributed (the field is absent, or the account is gone from every local
+ * sign-in list).
+ *
+ * Regions the user explicitly cleared are skipped, even when the saved account
+ * IS among their local sign-ins. `selectAccountFor` already refuses to fall
+ * back for a cleared region, so this cannot change what runs — but it keeps the
+ * attribution honest about its own decision: the region that owns this id is
+ * not the one the user just told the plugin to stop pinning, so the other
+ * region must get the chance to claim it.
+ *
+ * `accountsFor` is injected so the sequential, stop-at-first-match scan is
+ * testable without a filesystem.
+ */
+declare function legacyAttributionRegion(value: Config, accountsFor: (region: WorkBuddyRegion) => Promise<readonly {
+  id: string;
+}[]>): Promise<WorkBuddyRegion | undefined>;
 /**
  * Start both regions' loopback endpoints, register the `workbuddy` (CN) and
  * `workbuddy-global` (international) providers, and refresh each region's
@@ -907,4 +1014,4 @@ declare function regionStateOf(config: Config, region: WorkBuddyRegion): WorkBud
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyReasoning, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyWebAccount, type WorkBuddyWebCheckin, type WorkBuddyWebCredits, type WorkBuddyWebModel, type WorkBuddyWebPackage, type WorkBuddyWebRegion, type WorkBuddyWebUsage, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyReasoning, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyWebAccount, type WorkBuddyWebCheckin, type WorkBuddyWebCredits, type WorkBuddyWebModel, type WorkBuddyWebPackage, type WorkBuddyWebRegion, type WorkBuddyWebUsage, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionCleared, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, selectAccountFor, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as prepareChatBody, C as workbuddyAccountId, D as parseCreditMultiplier, E as classifyUpstreamError, O as parseReasoning, S as parseWorkBuddyAuth, T as WorkBuddyUpstreamClient, _ as authFileName, a as readHostHeartbeat, b as defaultDesktopAuthPath, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, i as processStartTimeMs, j as regionOf, k as parseUpstreamModel, l as FALLBACK_WORKBUDDY_MODELS, m as WORKBUDDY_AUTH_FILENAME, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-CPIHUxKL.js";
+import { A as prepareChatBody, C as workbuddyAccountId, D as parseCreditMultiplier, E as classifyUpstreamError, O as parseReasoning, S as parseWorkBuddyAuth, T as WorkBuddyUpstreamClient, _ as authFileName, a as readHostHeartbeat, b as defaultDesktopAuthPath, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, i as processStartTimeMs, j as regionOf, k as parseUpstreamModel, l as FALLBACK_WORKBUDDY_MODELS, m as WORKBUDDY_AUTH_FILENAME, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat--iKDuwr5.js";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createProvider } from "@earendil-works/pi-ai";
@@ -561,9 +561,13 @@ function toWebAccount(account) {
 async function workBuddyWebStatus(deps, region) {
 	const store = deps.store(region);
 	const accounts = await store.accounts();
-	if ((await store.status()).state !== "signed-out" && accounts.length === 0) return {
+	deps.regionUsable?.(region, accounts.length > 0);
+	const authStatus = await store.status();
+	const selectionExplicit = store.hasExplicitSelection();
+	if (authStatus.state !== "signed-out" && accounts.length === 0) return {
 		status: "signed-out",
-		accounts: []
+		accounts: [],
+		selectionExplicit
 	};
 	let credential;
 	try {
@@ -573,6 +577,7 @@ async function workBuddyWebStatus(deps, region) {
 			status: "signed-out",
 			accounts: accounts.map(toWebAccount),
 			message: safeMessage(error),
+			selectionExplicit,
 			...await store.selectionLost() ? { selectionLost: true } : {}
 		};
 	}
@@ -584,6 +589,7 @@ async function workBuddyWebStatus(deps, region) {
 		region,
 		source: credential.source,
 		tokenExpiresAtMs: credential.expiresAtMs,
+		selectionExplicit,
 		accounts: accounts.map(toWebAccount),
 		models: deps.displayModels(region).map((model) => toWebModel(model, deps.contextBudgets(region))),
 		enabledModelIds: [...deps.enabledModelIds(region)],
@@ -646,7 +652,9 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				try {
-					json(res, 200, { accounts: (await deps.store(region).accounts()).map(toWebAccount) });
+					const accounts = await deps.store(region).accounts();
+					deps.regionUsable?.(region, accounts.length > 0);
+					json(res, 200, { accounts: accounts.map(toWebAccount) });
 				} catch (error) {
 					json(res, 500, { error: safeMessage(error) });
 				}
@@ -759,6 +767,59 @@ function regionStateOf(config, region) {
 /** Every region, in card tab order. */
 const REGION_KEYS = ["cn", "global"];
 /**
+* The account id a region should select, or `undefined` for the documented
+* default: follow whatever the WorkBuddy app is currently signed in as.
+*
+* Three inputs decide it, and the ORDER is the whole point:
+*
+* 1. `accounts[region] === ''` — the Clear sentinel. It means "the user
+*    dropped this region's choice", which is the opposite of the key being
+*    absent ("never configured"). It therefore terminates the lookup: falling
+*    through to the legacy `accountId` here would re-bind the very account the
+*    user just dropped, and would do it after clearing appeared to succeed.
+* 2. `accounts[region]` set to a real id — an explicit per-region choice.
+* 3. absent key, with the pre-split `accountId` belonging to this region —
+*    the legacy migration, attributed once at startup from the local scan.
+*
+* `legacyAccountRegion` is resolved asynchronously after the first
+* `applySelection` pass, so this is a pure function of it rather than a
+* closure over the stores: the same call answers both the early pass (no
+* attribution yet) and every later one.
+*/
+function selectAccountFor(region, value, legacyAccountRegion) {
+	const configured = value.accounts?.[region];
+	if (configured === "") return void 0;
+	if (configured !== void 0) return configured;
+	return legacyAccountRegion === region ? value.accountId : void 0;
+}
+/** Whether a region carries the Clear sentinel rather than a saved choice. */
+function regionCleared(value, region) {
+	return value.accounts?.[region] === "";
+}
+/**
+* Which region owns the pre-split `accountId`, or `undefined` when it cannot
+* be attributed (the field is absent, or the account is gone from every local
+* sign-in list).
+*
+* Regions the user explicitly cleared are skipped, even when the saved account
+* IS among their local sign-ins. `selectAccountFor` already refuses to fall
+* back for a cleared region, so this cannot change what runs — but it keeps the
+* attribution honest about its own decision: the region that owns this id is
+* not the one the user just told the plugin to stop pinning, so the other
+* region must get the chance to claim it.
+*
+* `accountsFor` is injected so the sequential, stop-at-first-match scan is
+* testable without a filesystem.
+*/
+async function legacyAttributionRegion(value, accountsFor) {
+	const id = value.accountId;
+	if (id === void 0) return void 0;
+	for (const region of REGION_KEYS) {
+		if (regionCleared(value, region)) continue;
+		if ((await accountsFor(region)).some((account) => account.id === id)) return region;
+	}
+}
+/**
 * Start both regions' loopback endpoints, register the `workbuddy` (CN) and
 * `workbuddy-global` (international) providers, and refresh each region's
 * model catalog from the upstream once that region's credentials allow it.
@@ -808,11 +869,7 @@ function apply(ctx, config) {
 	* a selection that belongs to the other side of the split.
 	*/
 	let legacyAccountRegion;
-	const effectiveAccountFor = (region, value) => {
-		const explicit = value.accounts?.[region];
-		if (explicit !== void 0) return explicit;
-		return legacyAccountRegion === region ? value.accountId : void 0;
-	};
+	const effectiveAccountFor = (region, value) => selectAccountFor(region, value, legacyAccountRegion);
 	const discoverModels = async (region, signal) => {
 		const credential = await stacks[region].store.resolve();
 		return client.fetchModels(credential, signal);
@@ -825,6 +882,34 @@ function apply(ctx, config) {
 			stacks[region].catalog.set(configuredModels(value, region));
 		}
 		invalidateCatalog();
+		refreshRegionUsability();
+	};
+	/**
+	* Tell each catalog whether its region has ANY local sign-in, so a region the
+	* user has no account for advertises nothing instead of a roster that can
+	* only 401 (issue #12).
+	*
+	* `accounts()` is the right source rather than the SELECTED credential: an
+	* orphaned saved id must not blank a region that still has other sign-ins to
+	* fall back on, and a region the user deliberately cleared must come back to
+	* life the moment its first account appears.
+	*
+	* Deliberately fire-and-forget and idempotent — it runs on every settings
+	* change, and `setRegionUsable` reports whether anything moved so a
+	* no-change pass costs nothing beyond the scan. A failed scan leaves the
+	* previous answer alone (the catalog starts permissive), so a transient
+	* filesystem error never blanks a working region.
+	*/
+	const refreshRegionUsability = async () => {
+		for (const region of REGION_KEYS) {
+			let accounts;
+			try {
+				accounts = await stacks[region].store.accounts();
+			} catch {
+				continue;
+			}
+			if (stacks[region].catalog.setRegionUsable(accounts.length > 0)) invalidateCatalog();
+		}
 	};
 	ctx.inject(["webServer"], (webCtx) => registerWorkBuddyStatusRoute(webCtx, {
 		store: (region) => stacks[region].store,
@@ -833,7 +918,10 @@ function apply(ctx, config) {
 		enabledModelIds: (region) => regionStateOf(current(), region).enabledModelIds ?? [],
 		imageModelIds: (region) => regionStateOf(current(), region).imageModelIds ?? [],
 		contextBudgets: (region) => regionStateOf(current(), region).contextBudgets ?? {},
-		discoverModels
+		discoverModels,
+		regionUsable(region, usable) {
+			if (stacks[region].catalog.setRegionUsable(usable)) invalidateCatalog();
+		}
 	}));
 	ctx.settings.installSection(ctx, WORKBUDDY_SETTINGS_NS, Config, config, {
 		setSource(source) {
@@ -845,14 +933,11 @@ function apply(ctx, config) {
 	});
 	applySelection(config);
 	(async () => {
-		const id = current().accountId;
-		if (id === void 0) return;
 		try {
-			for (const region of REGION_KEYS) if ((await stacks[region].store.accounts()).some((account) => account.id === id)) {
-				legacyAccountRegion = region;
-				applySelection(current());
-				return;
-			}
+			const region = await legacyAttributionRegion(current(), async (candidate) => stacks[candidate].store.accounts());
+			if (region === void 0) return;
+			legacyAccountRegion = region;
+			applySelection(current());
 		} catch {}
 	})();
 	let stopped = false;
@@ -950,4 +1035,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialStore, WorkBuddyUpstreamClient, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { Config, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialStore, WorkBuddyUpstreamClient, apply, authFileName, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveCatalog, fallbackModelsFor, inject, isHeartbeatProcessAlive, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, name, parseCreditMultiplier, parseReasoning, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionCleared, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, selectAccountFor, toPersistedWorkBuddyModel, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "Connect locally signed-in WorkBuddy models to DeepSeek Harness with a read-only credits overview and model management.",
-  "version": "2.0.4",
+  "version": "2.0.6",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",