dsh-connect-workbuddy 2.0.5 → 2.0.6

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 2.0.6 (2026-09-22)
+
+### Fixes
+
+- **没有账号的区域不再向模型选择器列出模型**（issue #12，报告者 `stephenyab`）。此前只有国内版账号的用户，模型选择器里会多出一整组 `WorkBuddy Global`（**恰好 20 个**，与 `FALLBACK_WORKBUDDY_MODELS_GLOBAL` 逐条一致）——这些模型一个都用不了：该区域连凭据都解析不出来，选中后 `store.resolve()` 必抛错，shim 一律回 `401 not_signed_in`。**选择器说可选、实际必失败**，对单区域用户是纯噪音。
+
+  - **根因**：静态 fallback 的初衷是「上游离线也不让 provider 空着」，但它无条件播种（`new WorkBuddyCatalog(region)` 即装载整份 fallback），而 `deriveCatalog` 的「空勾选 = 全量」又把整份放行；启动时的真实刷新对无账号区域必然失败、只留一条 `logger.warn`，fallback 便永久留存。DSH 宿主对凭据一无所知（`buildModelCatalog` 只过滤 `models.length > 0`），于是原样渲染。
+  - **修复**：`WorkBuddyCatalog` 新增「本区域是否有本机登录」状态（`setRegionUsable()` / `isRegionUsable()`），无账号时 `current()` 返回空数组 → 宿主的空分组过滤让该分组**直接消失**。**provider 本身照常注册**：它的设置卡片与账号选择器正是用户登录的入口，隐藏分组是目录层决定，不是注册层决定。
+  - **与 `set()` 的非空守卫分开**，没有放宽它：两者回答不同问题——`set()` 承载**上游真实答案**，永不允许为空；「本区域没有账号」是**合法的空状态**，且必须能跨刷新存活。合并二者会要么丢掉守卫、要么丢掉隐藏分组的能力。测试专门锁定这一点：区域不可用期间上游刷新仍会在内部恢复目录，账号一出现即可立即服务。
+  - **默认可用（宽松方向）**：`setRegionUsable` 由异步扫描调用，扫描尚未完成或失败时保持原状，因此**一次瞬时文件系统错误不会把正常区域清空**。
+  - **两个触发点覆盖登录后的恢复**：① 设置变更时重算（`applySelection` 之后）；② 卡片侧——usage 轮询与「重新检测账号」路由本就调用 `store.accounts()`，顺手上报可用性，所以用户登录桌面端后**无需重启**，模型自动出现。`setRegionUsable()` 返回值表明状态是否真的变化，未变化时不做多余的 adapter 失效。
+  - **对称覆盖两侧**：报告举的例子是「只有国内版账号 → 国际版多出 20 个」，反之亦然（只有国际版账号时国内版会多出 12 个），修复同时作用于两个区域。
+
+  **核查**：报告的根因链**逐条属实**，本版本按报告建议的方向（其「建议修复方向」第 1、2、3 条）实现。我们额外确认了它列出的两条实现约束确实成立——`catalog.ts` 的 `set([])` 会抛错（故另开一条状态而非放宽守卫）、空目录会让宿主过滤掉整个分组（故无需注销 provider），并验证了它在第 5 条提到但未展开的点：`routableProviders` 仍包含该 provider id，这与选择器过滤是两个独立概念，本次不改动。
+
+  **措辞说明**：`README` 此前写「两边模型同时出现在选择器里」——该表述自本版本起变为**有条件**（有账号才出现），中英文 README 与 2.0.0 的 CHANGELOG 条目均已就地更正，而不是留着一个已被推翻的说法。
+
+### Tests
+
+测试总数 173 → 179（新增 6 例）：
+
+- `tests/issue12-region-hiding.spec.ts` 新增 2 例（新文件，端到端复现报告者的环境）：CN-only 机器上 `workbuddy-global` **不再列出任何模型**，而 `workbuddy` 正常服务；同时断言 **provider 与可配置 provider 仍在册**（登录入口不能消失）。第 2 例覆盖恢复路径：登录国际版账号后经设置链路重算，模型**无需重启**即可用。
+- `catalog.spec.ts` 新增 4 例：默认可用（扫描未完成不误清空）、无账号后 `current()` 为空且 `isRegionUsable()` 为假、`setRegionUsable()` 的「无变化」返回值语义、以及**非空守卫与可用性标记互相独立**（区域不可用期间 `set()` 仍保有真实目录，账号出现即恢复）。
+
+每条新增守卫都用「删掉对应实现即失败」验证过：让 `current()` 忽略可用性标记会挂 5 例；移除 `applySelection` 的重算调用会挂 3 例（含一条端到端用例）。
+
+### Docs
+
+- `README.md` / `README.en.md`：双供应商一节的「两边模型同时出现」改为「**有账号的区域**其模型出现」，并说明无账号区域不列出、登录后自动恢复、provider 始终注册。
+- `CHANGELOG.md` 2.0.0 条目中同一处表述就地标注了 2.0.6 的收紧。
+
 ## 2.0.5 (2026-09-22)
 
 ### Fixes
@@ -131,7 +162,7 @@
 
 - **🆕 国内版与国际版拆分为两个并行供应商，可同时使用**——此前一个 provider 一次只能活一个区域（选哪个账号整个 `workbuddy` 就服务于哪个区域，切账号 = 翻转整个运行时目录）。现在两侧是两套完全独立的实例，**互不干扰**：
 
-  - **双 provider 注册**：国内版保持 `workbuddy`（老 id 不变，存量会话的默认模型与已保存选择全部继续有效），国际版新增 `workbuddy-global`（displayName `WorkBuddy Global`）。**两边模型同时出现在 DSH 模型选择器里**——不同会话 / 子代理可以各选一边，互不干扰。
+  - **双 provider 注册**：国内版保持 `workbuddy`（老 id 不变，存量会话的默认模型与已保存选择全部继续有效），国际版新增 `workbuddy-global`（displayName `WorkBuddy Global`）。两边模型同时出现在 DSH 模型选择器里——不同会话 / 子代理可以各选一边，互不干扰。（**2.0.6 起收紧**：没有账号的区域不再列出模型，理由见该版本 CHANGELOG 的 issue #12 一节。）
   - **每个区域一套完整运行时栈**：凭据 store、模型 catalog、回环 shim、adapter 各一份。store 按凭据域名过滤可见账号（`workbuddy.ai` → 国际版，其余 → 国内版），两个区域的账号可同时在线。
   - **插件卡片 tab 化**：设置卡片顶部新增「国内版 / 国际版」tab 栏（带各自登录状态圆点）。每个 tab 有独立的账号选择、积分概览、签到与模型管理；**切 tab 不丢另一侧未保存的草稿**（模型勾选 / 图片开关 / 上下文预算的草稿按区域隔离保存）。4 条卡片路由全部按 `?region=cn|global` 参数化。
   - **「减少刷新变化」**：一个 tab 里切账号、刷新模型、轮询积分，完全不触碰另一边的运行时目录——绑定另一边模型的进行中会话不受任何影响（单 provider 架构做不到这一点）。

package/README.en.md

@@ -21,7 +21,7 @@ A [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness) bund
 
 ## Features
 
-- **Dual parallel providers (CN + international)** — the CN side registers as the `workbuddy` provider (`GLM-5.3`, `DeepSeek-V4-Pro`, `Kimi-K3`, `MiniMax-M3`, `Hy3`, etc.), the international side as `workbuddy-global` (`GPT-5.6`, `Gemini-3.5-Flash`, `GLM-5.3`, `Kimi-K3`, etc.), and **both rosters appear in the DSH model picker simultaneously**: different sessions can each pick a side without interfering. Model names carry the upstream credit multiplier (e.g. `GLM-5.3 · x0.79`), matching WorkBuddy's own model menu.
+- **Dual parallel providers (CN + international)** — the CN side registers as the `workbuddy` provider (`GLM-5.3`, `DeepSeek-V4-Pro`, `Kimi-K3`, `MiniMax-M3`, `Hy3`, etc.), the international side as `workbuddy-global` (`GPT-5.6`, `Gemini-3.5-Flash`, `GLM-5.3`, `Kimi-K3`, etc.). **A region's models appear in the DSH model picker when that region has an account**: with accounts on both sides, both rosters are selectable at once, and different sessions can each pick a side without interfering. **A region with no local sign-in lists no models** — it cannot serve a single request, so listing them would offer nothing but failures. Sign in once for that region and its models come back on "detect accounts again" or after a restart; the provider itself stays registered either way, because its settings card and account picker are how you sign in. Model names carry the upstream credit multiplier (e.g. `GLM-5.3 · x0.79`), matching WorkBuddy's own model menu.
 - **Tabbed settings card** — the card's top carries a "Domestic / Global" tab bar; each tab holds its own account picker, credits overview, and model management. Account, directory, selection, and unsaved drafts are fully isolated per tab — switching accounts or refreshing models on one tab never touches the other side's runtime catalog or sessions.
 - **Model management** — refresh the full catalog from upstream and enable or disable each model individually; refresh is a draft operation that only takes effect on save. Upstream also reports credit multiplier, context/output limits, and reasoning efforts; image input is opted in per model manually (off by default).
 - **Local account switching** — discovers the multiple sign-in credentials WorkBuddy's desktop app leaves behind and lets you switch per region. Tokens are never written to DSH settings.

package/README.md

@@ -27,7 +27,7 @@
 
 ## 功能特性
 
-- **双供应商并行接入（国内版 + 国际版）** —— 国内版注册为 `workbuddy` provider（`GLM-5.3`、`DeepSeek-V4-Pro`、`Kimi-K3`、`MiniMax-M3`、`Hy3` 等），国际版注册为 `workbuddy-global` provider（`GPT-5.6`、`Gemini-3.5-Flash`、`GLM-5.3`、`Kimi-K3` 等），**两边模型同时出现在 DSH 模型选择器里**：不同会话可以各选一边，互不干扰。模型名内嵌上游积分倍率（如 `GLM-5.3 · x0.79`），与 WorkBuddy 自身模型菜单一致。
+- **双供应商并行接入（国内版 + 国际版）** —— 国内版注册为 `workbuddy` provider（`GLM-5.3`、`DeepSeek-V4-Pro`、`Kimi-K3`、`MiniMax-M3`、`Hy3` 等），国际版注册为 `workbuddy-global` provider（`GPT-5.6`、`Gemini-3.5-Flash`、`GLM-5.3`、`Kimi-K3` 等）。**有账号的区域其模型会出现在 DSH 模型选择器里**：两边都有账号时两组同时可选，不同会话可以各选一边，互不干扰。**本机没有账号的区域不列出任何模型**（该区域一个请求也发不出去，列出来只会点到就失败）；只要在该区域登录一次，「重新检测账号」或重启后模型就会自动出现——provider 本身始终注册着，因为它的设置卡片与账号选择器正是登录的入口。模型名内嵌上游积分倍率（如 `GLM-5.3 · x0.79`），与 WorkBuddy 自身模型菜单一致。
 - **插件卡片 tab 切换** —— 设置卡片顶部为「国内版 / 国际版」两个 tab，各含独立的账号选择、积分概览与模型管理；每个 tab 的账号、目录、勾选与未保存草稿完全隔离——在一个 tab 里切账号或刷新模型，不会触碰另一边的运行时目录与会话。
 - **模型管理** —— 从上游刷新完整模型目录，逐项勾选启用或禁用；刷新是草稿操作，点保存才生效。上游同时给出积分倍率、上下文/输出上限与推理档位；图片输入按模型手动勾选（默认不勾选）。
 - **本机账号切换** —— 自动发现 WorkBuddy 桌面端留下的多个登录凭据，可按区域切换账号；Token 不写入 DSH 设置。

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { T as WorkBuddyUpstreamClient, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-BOrNj3pY.js";
+import { T as WorkBuddyUpstreamClient, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, l as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat--iKDuwr5.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/{host-heartbeat-BOrNj3pY.js → host-heartbeat--iKDuwr5.js}

@@ -1440,10 +1440,24 @@ function applyContextBudgets(catalog, budgets = {}) {
 function deriveCatalog(catalog, enabled, budgets = {}) {
 	return applyContextBudgets(enabled.size === 0 ? catalog : catalog.filter((model) => enabled.has(model.id)), budgets);
 }
-/** Mutable catalog shared by the shim's `/v1/models` and the adapter. */
+/**
+* Mutable catalog shared by the shim's `/v1/models` and the adapter.
+*
+* The static fallback exists so an OFFLINE upstream never leaves a provider
+* empty — but "offline" presumes the region is usable at all. A region with no
+* local sign-in cannot serve one single request, so seeding it with a roster
+* puts models in the picker that are guaranteed to 401 (issue #12). The host
+* distinguishes the two cases through {@link WorkBuddyCatalog.setRegionUsable}.
+*/
 var WorkBuddyCatalog = class {
 	models;
 	/**
+	* Whether this region has any local sign-in. Defaults to `true` — the
+	* permissive direction — so a scan that has not run yet (or failed) keeps
+	* serving the fallback rather than blanking a region that may be fine.
+	*/
+	usable = true;
+	/**
 	* @param region Seeds the static fallback for this region; each region's
 	* provider must never serve the other region's roster before its first
 	* live refresh lands.
@@ -1451,9 +1465,37 @@ var WorkBuddyCatalog = class {
 	constructor(region = "cn") {
 		this.models = fallbackModelsFor(region);
 	}
-	/** Current entries; the fallback list until the upstream answer lands. */
+	/**
+	* Current entries; the fallback list until the upstream answer lands.
+	*
+	* Empty while this region has no local sign-in: the provider stays
+	* registered (its row still hosts the settings card and the account picker),
+	* but it advertises nothing to pick. DSH drops empty provider groups from
+	* the picker (`buildModelCatalog` filters `models.length > 0`), so the group
+	* disappears exactly when it would be pure noise.
+	*/
 	current() {
-		return this.models;
+		return this.usable ? this.models : [];
+	}
+	/** Whether this region currently advertises any model. */
+	isRegionUsable() {
+		return this.usable;
+	}
+	/**
+	* Record whether this region has a local sign-in.
+	*
+	* Separate from {@link set} on purpose: `set()` carries a live upstream
+	* answer and must never be empty, while "this region has no account" is a
+	* legitimate empty state that must survive across refreshes. Keeping them
+	* apart is what lets the non-empty guard stay strict.
+	*
+	* @returns whether the value changed, so the caller can skip invalidating
+	*   its adapter snapshots when nothing moved.
+	*/
+	setRegionUsable(usable) {
+		if (this.usable === usable) return false;
+		this.usable = usable;
+		return true;
 	}
 	/** Replace the list; callers invalidate their adapter snapshot after this. */
 	set(models) {
@@ -1464,7 +1506,7 @@ var WorkBuddyCatalog = class {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "2.0.5";
+const WORKBUDDY_CONNECT_VERSION = "2.0.6";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -479,17 +479,53 @@ declare function fallbackModelsFor(region: 'cn' | 'global'): readonly WorkBuddyM
  */
 type WorkBuddyContextBudget = number;
 declare function deriveCatalog(catalog: readonly WorkBuddyModelInfo[], enabled: ReadonlySet<string>, budgets?: Readonly<Record<string, WorkBuddyContextBudget | undefined>>): WorkBuddyModelInfo[];
-/** Mutable catalog shared by the shim's `/v1/models` and the adapter. */
+/**
+ * Mutable catalog shared by the shim's `/v1/models` and the adapter.
+ *
+ * The static fallback exists so an OFFLINE upstream never leaves a provider
+ * empty — but "offline" presumes the region is usable at all. A region with no
+ * local sign-in cannot serve one single request, so seeding it with a roster
+ * puts models in the picker that are guaranteed to 401 (issue #12). The host
+ * distinguishes the two cases through {@link WorkBuddyCatalog.setRegionUsable}.
+ */
 declare class WorkBuddyCatalog {
   private models;
+  /**
+   * Whether this region has any local sign-in. Defaults to `true` — the
+   * permissive direction — so a scan that has not run yet (or failed) keeps
+   * serving the fallback rather than blanking a region that may be fine.
+   */
+  private usable;
   /**
    * @param region Seeds the static fallback for this region; each region's
    * provider must never serve the other region's roster before its first
    * live refresh lands.
    */
   constructor(region?: 'cn' | 'global');
-  /** Current entries; the fallback list until the upstream answer lands. */
+  /**
+   * Current entries; the fallback list until the upstream answer lands.
+   *
+   * Empty while this region has no local sign-in: the provider stays
+   * registered (its row still hosts the settings card and the account picker),
+   * but it advertises nothing to pick. DSH drops empty provider groups from
+   * the picker (`buildModelCatalog` filters `models.length > 0`), so the group
+   * disappears exactly when it would be pure noise.
+   */
   current(): readonly WorkBuddyModelInfo[];
+  /** Whether this region currently advertises any model. */
+  isRegionUsable(): boolean;
+  /**
+   * Record whether this region has a local sign-in.
+   *
+   * Separate from {@link set} on purpose: `set()` carries a live upstream
+   * answer and must never be empty, while "this region has no account" is a
+   * legitimate empty state that must survive across refreshes. Keeping them
+   * apart is what lets the non-empty guard stay strict.
+   *
+   * @returns whether the value changed, so the caller can skip invalidating
+   *   its adapter snapshots when nothing moved.
+   */
+  setRegionUsable(usable: boolean): boolean;
   /** Replace the list; callers invalidate their adapter snapshot after this. */
   set(models: readonly WorkBuddyModelInfo[]): void;
 }
@@ -837,6 +873,16 @@ interface WorkBuddyStatusRouteOptions {
   contextBudgets(region: WorkBuddyRegion): Readonly<Record<string, number | undefined>>;
   /** Re-read the live catalog of one region from the upstream. */
   discoverModels?(region: WorkBuddyRegion, signal?: AbortSignal): Promise<readonly WorkBuddyModelInfo[]>;
+  /**
+   * Report whether a region still has at least one local sign-in.
+   *
+   * The card is where sign-in state actually changes under the plugin's nose
+   * (the user signs in to the desktop app, then presses "detect accounts
+   * again"), so the routes are the earliest honest place to notice. Both
+   * callers already read `store.accounts()` for their own answer, so this adds
+   * no scan of its own.
+   */
+  regionUsable?(region: WorkBuddyRegion, usable: boolean): void;
 }
 /**
  * Assemble one region's card document. `region` is the tab the card is on;

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as prepareChatBody, C as workbuddyAccountId, D as parseCreditMultiplier, E as classifyUpstreamError, O as parseReasoning, S as parseWorkBuddyAuth, T as WorkBuddyUpstreamClient, _ as authFileName, a as readHostHeartbeat, b as defaultDesktopAuthPath, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, i as processStartTimeMs, j as regionOf, k as parseUpstreamModel, l as FALLBACK_WORKBUDDY_MODELS, m as WORKBUDDY_AUTH_FILENAME, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat-BOrNj3pY.js";
+import { A as prepareChatBody, C as workbuddyAccountId, D as parseCreditMultiplier, E as classifyUpstreamError, O as parseReasoning, S as parseWorkBuddyAuth, T as WorkBuddyUpstreamClient, _ as authFileName, a as readHostHeartbeat, b as defaultDesktopAuthPath, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WorkBuddyCredentialStore, h as WORKBUDDY_AUTH_FILE_ENV, i as processStartTimeMs, j as regionOf, k as parseUpstreamModel, l as FALLBACK_WORKBUDDY_MODELS, m as WORKBUDDY_AUTH_FILENAME, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as defaultDesktopAuthCandidates, w as workbuddyOwnAuthPath, x as legacyWorkbuddyOwnAuthPath, y as defaultDesktopAuthDirs } from "./host-heartbeat--iKDuwr5.js";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createProvider } from "@earendil-works/pi-ai";
@@ -561,6 +561,7 @@ function toWebAccount(account) {
 async function workBuddyWebStatus(deps, region) {
 	const store = deps.store(region);
 	const accounts = await store.accounts();
+	deps.regionUsable?.(region, accounts.length > 0);
 	const authStatus = await store.status();
 	const selectionExplicit = store.hasExplicitSelection();
 	if (authStatus.state !== "signed-out" && accounts.length === 0) return {
@@ -651,7 +652,9 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				try {
-					json(res, 200, { accounts: (await deps.store(region).accounts()).map(toWebAccount) });
+					const accounts = await deps.store(region).accounts();
+					deps.regionUsable?.(region, accounts.length > 0);
+					json(res, 200, { accounts: accounts.map(toWebAccount) });
 				} catch (error) {
 					json(res, 500, { error: safeMessage(error) });
 				}
@@ -879,6 +882,34 @@ function apply(ctx, config) {
 			stacks[region].catalog.set(configuredModels(value, region));
 		}
 		invalidateCatalog();
+		refreshRegionUsability();
+	};
+	/**
+	* Tell each catalog whether its region has ANY local sign-in, so a region the
+	* user has no account for advertises nothing instead of a roster that can
+	* only 401 (issue #12).
+	*
+	* `accounts()` is the right source rather than the SELECTED credential: an
+	* orphaned saved id must not blank a region that still has other sign-ins to
+	* fall back on, and a region the user deliberately cleared must come back to
+	* life the moment its first account appears.
+	*
+	* Deliberately fire-and-forget and idempotent — it runs on every settings
+	* change, and `setRegionUsable` reports whether anything moved so a
+	* no-change pass costs nothing beyond the scan. A failed scan leaves the
+	* previous answer alone (the catalog starts permissive), so a transient
+	* filesystem error never blanks a working region.
+	*/
+	const refreshRegionUsability = async () => {
+		for (const region of REGION_KEYS) {
+			let accounts;
+			try {
+				accounts = await stacks[region].store.accounts();
+			} catch {
+				continue;
+			}
+			if (stacks[region].catalog.setRegionUsable(accounts.length > 0)) invalidateCatalog();
+		}
 	};
 	ctx.inject(["webServer"], (webCtx) => registerWorkBuddyStatusRoute(webCtx, {
 		store: (region) => stacks[region].store,
@@ -887,7 +918,10 @@ function apply(ctx, config) {
 		enabledModelIds: (region) => regionStateOf(current(), region).enabledModelIds ?? [],
 		imageModelIds: (region) => regionStateOf(current(), region).imageModelIds ?? [],
 		contextBudgets: (region) => regionStateOf(current(), region).contextBudgets ?? {},
-		discoverModels
+		discoverModels,
+		regionUsable(region, usable) {
+			if (stacks[region].catalog.setRegionUsable(usable)) invalidateCatalog();
+		}
 	}));
 	ctx.settings.installSection(ctx, WORKBUDDY_SETTINGS_NS, Config, config, {
 		setSource(source) {

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "Connect locally signed-in WorkBuddy models to DeepSeek Harness with a read-only credits overview and model management.",
-  "version": "2.0.5",
+  "version": "2.0.6",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",