dsh-connect-workbuddy 4.0.0 → 4.3.0

package/lib/{host-heartbeat-vvVjdY_q.js → host-heartbeat-jNlsUMZO.js}

@@ -1,4 +1,4 @@
-import { readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { createDecipheriv, createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { dirname, join, win32 } from "node:path";
@@ -736,6 +736,38 @@ function regionOf(domain) {
 	return "cn";
 }
 /**
+* The STRICT counterpart of {@link regionOf}: a region's domain only when it is
+* positively recognised, `undefined` for anything else.
+*
+* `regionOf`'s catch-all is deliberate — the CN product is single-homed, so an
+* unrecognised spelling is treated as CN and a real (if oddly written) CN
+* credential still resolves. That reasoning holds only for a domain the
+* UPSTREAM issued. It does not hold for a value read out of a file someone
+* handed the plugin: there "unrecognised" means "cannot be classified", and
+* calling it CN would file a foreign or spoofed credential in the CN vault.
+* Import gates must use this, not {@link regionOf}.
+*
+* Both sides are matched on their registrable domain, so a bare host and any
+* subdomain qualify while a lookalike such as `codebuddy.cn.evil.com` cannot.
+*
+* `copilot.tencent.com` is NOT a third product — it is this plugin's OWN CN
+* chat gateway (`CN_CHAT_BASE`), and the credential's `domain` field carries it
+* verbatim on real records. Refusing it here made the plugin reject its own
+* export: the card exported 8 accounts, and re-importing that file skipped the
+* three whose `domain` was the gateway. It cannot be spoofed into the wrong
+* region by being recognised here — it names the CN gateway, so admitting it is
+* the same decision as admitting `workbuddy.cn`.
+*/
+function knownRegionOf(domain) {
+	const lowered = domain.trim().toLowerCase();
+	if (lowered === "") return void 0;
+	if (lowered === "workbuddy.ai" || lowered.endsWith(".workbuddy.ai")) return "global";
+	if (lowered === "codebuddy.ai" || lowered.endsWith(".codebuddy.ai")) return "global";
+	if (lowered === "workbuddy.cn" || lowered.endsWith(".workbuddy.cn")) return "cn";
+	if (lowered === "codebuddy.cn" || lowered.endsWith(".codebuddy.cn")) return "cn";
+	if (lowered === "copilot.tencent.com" || lowered.endsWith(".copilot.tencent.com")) return "cn";
+}
+/**
 * Gateway for a global credential.
 *
 * International accounts are NOT interchangeable across brand domains: a token
@@ -1564,8 +1596,14 @@ const WORKBUDDY_AUTH_FILENAME = ".workbuddy-auth.json";
 const WORKBUDDY_AUTH_FILE_ENV = "WORKBUDDY_AUTH_FILE";
 /** Basename of the live WorkBuddy desktop auth file. */
 const WORKBUDDY_LIVE_FILENAME = "workbuddy-desktop.info";
-/** Prefix of the plugin-owned per-region credential copies. */
+/** Prefix of the plugin-owned per-region credential copies (legacy, read-only). */
 const WORKBUDDY_OWN_PREFIX = ".workbuddy-auth";
+/**
+* Directory name (inside the Harness home) of the plugin's unified credential
+* vault: every account the plugin knows — scanned from the desktop app AND
+* added through OAuth sign-in — is persisted there, one file per account.
+*/
+const WORKBUDDY_VAULT_DIRNAME = "workbuddy-vault";
 /** Current on-disk format of the plugin-owned copy; readers reject others. */
 const OWN_FORMAT_VERSION = 1;
 /**
@@ -1585,6 +1623,193 @@ function legacyWorkbuddyOwnAuthPath() {
 	return join(resolveDshHome(), WORKBUDDY_AUTH_FILENAME);
 }
 /**
+* The vault's directory for one region inside the Harness home.
+*
+* The vault is the plugin's UNIFIED credential store: every account the
+* plugin knows lives here, whether it was scanned from the desktop app's
+* auth directory or added through OAuth sign-in. One file per account,
+* named by the account's stable id — so two sources yielding the same
+* account converge on the same file instead of duplicating it.
+*/
+function workbuddyVaultDir(region) {
+	return join(resolveDshHome(), WORKBUDDY_VAULT_DIRNAME, region);
+}
+/**
+* Serialize a credential to the vault's on-disk document.
+*
+* The on-disk field names are the DESKTOP document's snake-free shapes
+* (`expiresAt`, `lastRefreshTime`), which is what `parseWorkBuddyAuth`
+* reads back. Serializing the runtime camelCase fields verbatim parsed as
+* `expiresAtMs: 0` on the next read — every restart re-refreshed every
+* account, and a refresh outage could then take down sign-ins that were
+* perfectly healthy on disk.
+*/
+function vaultDocument(credential, accountId, refreshedFrom) {
+	return {
+		version: VAULT_FORMAT_VERSION,
+		accountId,
+		refreshedAtMs: Date.now(),
+		...refreshedFrom === void 0 ? {} : { refreshedFrom: authFileName(refreshedFrom) },
+		auth: {
+			accessToken: credential.accessToken,
+			refreshToken: credential.refreshToken,
+			expiresAt: credential.expiresAtMs > 0 ? Math.floor(credential.expiresAtMs / 1e3) : 0,
+			...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAt: Math.floor(credential.refreshExpiresAtMs / 1e3) },
+			...credential.lastRefreshAtMs === void 0 ? {} : { lastRefreshTime: Math.floor(credential.lastRefreshAtMs / 1e3) },
+			domain: credential.domain
+		},
+		account: {
+			uid: credential.uid,
+			...credential.enterpriseId === void 0 ? {} : { enterpriseId: credential.enterpriseId },
+			...credential.nickname === void 0 ? {} : { nickname: credential.nickname },
+			...credential.uin === void 0 ? {} : { uin: credential.uin }
+		}
+	};
+}
+/** Parse the vault document; other versions and shapes are rejected. */
+function parseVaultDocument(text, filePath) {
+	const parsed = parseVaultDocumentWithWriteTime(text, filePath);
+	return parsed === void 0 ? void 0 : parsed.credential;
+}
+/**
+* Parse a vault document into its credential plus the LOCAL write time.
+*
+* Internal merge plumbing: `refreshedAtMs` is the freshness signal
+* {@link isFresherVaultEntry} needs, but it is not part of
+* {@link WorkBuddyCredential} (the runtime type is shared with OAuth and
+* desktop reads, none of which carry it).
+*/
+function parseVaultDocumentWithWriteTime(text, filePath) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const document = parsed;
+	if (document["version"] !== VAULT_FORMAT_VERSION) return void 0;
+	if (typeof document["auth"] !== "object" || document["auth"] === null) return void 0;
+	const credential = parseWorkBuddyAuth(JSON.stringify({
+		auth: document["auth"],
+		account: document["account"]
+	}), filePath);
+	if (credential === void 0) return void 0;
+	const refreshedAtMs = typeof document["refreshedAtMs"] === "number" && document["refreshedAtMs"] > 0 ? document["refreshedAtMs"] : void 0;
+	const refreshedFrom = typeof document["refreshedFrom"] === "string" && document["refreshedFrom"] !== "" ? document["refreshedFrom"] : void 0;
+	return {
+		credential: {
+			...credential,
+			source: "dsh"
+		},
+		...refreshedAtMs === void 0 ? {} : { refreshedAtMs },
+		...refreshedFrom === void 0 ? {} : { refreshedFrom }
+	};
+}
+/**
+* File name of the vault's DISMISSAL list, stored beside the vault entries.
+*
+* It exists because deleting a vault entry is not the same as deleting an
+* account. `syncVault` writes every desktop sign-in it scans back into the
+* vault — that is how a desktop account becomes selectable — so removing the
+* vault file alone was undone by the very next scan: the row came back and the
+* button read as broken (measured: `removeAccount` returns true, `accounts()`
+* still lists it).
+*
+* Dismissal means HIDDEN UNTIL THE USER SCANS AGAIN, not deleted forever. A
+* desktop sign-in is still there in the app, and the manual 「re-scan」 action is
+* the user asking to see what the machine currently has — so
+* {@link WorkBuddyCredentialStore.clearDismissals} empties this list on every
+* manual scan and the accounts return. Without that, a removed account could
+* never be recovered except by reinstalling or re-signing in.
+*
+* The list must survive the automatic refreshes in between: the card polls the
+* usage route every 60 seconds, and an in-memory-only dismissal would let the
+* account reappear a minute after the user removed it. Hence a file.
+*
+* Dismissal is per ACCOUNT, not per source: hiding only the vault copy would
+* leave the same account listed from the desktop file, which is the
+* half-measure that produced the report.
+*/
+const VAULT_DISMISSED_FILENAME = ".dismissed.json";
+/** Current on-disk format of the dismissal list; readers reject others. */
+const DISMISSED_FORMAT_VERSION = 1;
+/**
+* How long one scan may be shared across callers, in milliseconds.
+*
+* One page open asks the store for the same account list six times (usage
+* route: accounts, status, resolve; the credits panel: once PER ACCOUNT through
+* `credentialFor`; and both region tabs poll together). Each read re-listed the
+* auth directory, re-parsed every file and re-ran the vault merge — measured at
+* 6 `readdir` and (6N+12) `readFile` for N accounts.
+*
+* Why a WINDOW and not a plain in-flight share: the six reads are SEQUENTIAL
+* (`await` one after another), so by the time the second starts the first has
+* resolved and there is nothing in flight to join. Sharing only concurrent reads
+* optimised nothing at all.
+*
+* Why so short: this is not a cache of the account list, it is an admission that
+* one page open IS one logical read. Anything longer would delay noticing a
+* sign-in the desktop app made on its own — discovery IS polling, so this window
+* is how long such a change may stay unseen. The card polls every 60 s, so 1 s is
+* invisible to the user while collapsing one page open from six scans to one. A
+* write through this store invalidates the window outright, so the actions the
+* user takes here (OAuth add, import, remove, rescan) are never delayed by it.
+*/
+const SCAN_SHARE_WINDOW_MS = 1e3;
+/** Read the dismissal list; an absent or unreadable file reads as empty. */
+async function readDismissed(dir) {
+	const dismissed = /* @__PURE__ */ new Set();
+	try {
+		const parsed = JSON.parse(await readFile(join(dir, VAULT_DISMISSED_FILENAME), "utf8"));
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return dismissed;
+		const document = parsed;
+		if (document["version"] !== DISMISSED_FORMAT_VERSION) return dismissed;
+		const ids = document["accountIds"];
+		if (!Array.isArray(ids)) return dismissed;
+		for (const id of ids) if (typeof id === "string" && VAULT_ACCOUNT_ID_RE.test(id)) dismissed.add(id);
+	} catch {}
+	return dismissed;
+}
+/** Write the dismissal list atomically under its own lock. */
+async function writeDismissed(dir, dismissed) {
+	const path = join(dir, VAULT_DISMISSED_FILENAME);
+	const ids = [...dismissed].slice(-1e3);
+	const document = {
+		version: DISMISSED_FORMAT_VERSION,
+		accountIds: ids
+	};
+	await withFileLock(path, async () => {
+		await writeFileAtomic(path, `${JSON.stringify(document, null, 2)}\n`, {
+			mode: 384,
+			dirMode: 448
+		});
+	});
+}
+/**
+* Whether a directory entry is ONE ACCOUNT's vault credential file.
+*
+* The vault directory holds more than credentials: `writeDismissed` puts
+* `.dismissed.json` here, and atomic writes transiently leave
+* `<id>.json.<hex>.tmp` siblings behind. Both used to be swept up by a bare
+* `endsWith('.json')` check, and the DISMISSAL file in particular is
+* well-formed JSON that is not a credential — so `diagnose` reported it at the
+* user as 「not a readable vault credential」 on any machine where an account
+* had been removed, turning a healthy sign-in into an unreadable-looking one.
+*
+* The rule is the account id shape the store itself writes
+* ({@link VAULT_ACCOUNT_ID_RE}), not a naming convention: a file qualifies only
+* when its stem is a real id, which no bookkeeping or temp file can be. A
+* `.tmp` sibling therefore fails on the dot of its extension, and a hidden file
+* fails on its leading dot even before that.
+*/
+function isVaultCredentialFileName(name) {
+	if (!name.endsWith(".json")) return false;
+	return VAULT_ACCOUNT_ID_RE.test(name.slice(0, -5));
+}
+/** Current on-disk format of the vault; readers reject others. */
+const VAULT_FORMAT_VERSION = 1;
+/**
 * Platform-default directories holding the WorkBuddy desktop app's auth file.
 *
 * Windows and Linux prefer the OS-issued env location and fall back to the
@@ -1796,6 +2021,21 @@ function authFileName(path) {
 	return separator === -1 ? path : path.slice(separator + 1);
 }
 /**
+* The exact shape of an account id — sha256 hex sliced to 24 characters, which
+* is what {@link workbuddyAccountId} emits and therefore the only string a
+* vault file name can legitimately have.
+*
+* An id becomes a path segment, so this is also the traversal guard: an
+* attacker-supplied `../..` is rejected before it can address anything outside
+* the vault directory. Exported so the HTTP route can reject a bad id with a
+* 400 instead of a thrown error.
+*/
+const VAULT_ACCOUNT_ID_RE = /^[0-9a-f]{24}$/;
+/** Whether a string is a well-formed account id. */
+function isVaultAccountId(value) {
+	return typeof value === "string" && VAULT_ACCOUNT_ID_RE.test(value);
+}
+/**
 * Stable account id. `uin` is the billing identity the upstream keys on and
 * survives across re-login; `uid` is the fallback for documents without one.
 */
@@ -1803,15 +2043,15 @@ function workbuddyAccountId(credential) {
 	const stable = credential.uin ?? credential.uid ?? credential.nickname ?? "unknown";
 	return createHash("sha256").update(`workbuddy\0${stable}`).digest("hex").slice(0, 24);
 }
-/** Serialize the plugin-owned copy. */
-function ownDocument(credential, accountId) {
-	return {
-		version: OWN_FORMAT_VERSION,
-		...accountId === void 0 ? {} : { accountId },
-		credential
-	};
-}
-/** Parse the plugin-owned copy; other versions and shapes are rejected. */
+/**
+* Parse the plugin-owned copy; other versions and shapes are rejected.
+*
+* Pre-vault copies serialized the RUNTIME credential verbatim, whose expiry
+* field is `expiresAtMs` (ms) rather than the desktop document's
+* `expiresAt` (s) that `parseWorkBuddyAuth` reads — the round trip used to
+* lose the expiry and force a refresh after every restart. The runtime field
+* is read back here as the fallback.
+*/
 function parseOwnDocument(text, filePath) {
 	let parsed;
 	try {
@@ -1825,8 +2065,11 @@ function parseOwnDocument(text, filePath) {
 	if (typeof document["credential"] !== "object" || document["credential"] === null) return void 0;
 	const credential = parseWorkBuddyAuth(JSON.stringify({ auth: document["credential"] }), filePath);
 	if (credential === void 0) return void 0;
+	const runtime = document["credential"];
+	const legacyExpiry = typeof runtime["expiresAtMs"] === "number" ? expiryToMs(runtime["expiresAtMs"]) : 0;
 	return {
 		...credential,
+		...credential.expiresAtMs === 0 && legacyExpiry > 0 ? { expiresAtMs: legacyExpiry } : {},
 		source: "dsh"
 	};
 }
@@ -1835,6 +2078,79 @@ function isENOENT(error) {
 	return error?.code === "ENOENT";
 }
 /**
+* Whether a freshly scanned credential should REPLACE a vault entry of the
+* same account.
+*
+* The vault is a CACHE of credentials the machine already holds, not a
+* competing source. Two clocks decide, compared like against like:
+*
+* - The scan's clock is the DESKTOP document's `lastRefreshTime` (the
+*   upstream's own issuance time) — and the live file ranks above every
+*   backup regardless of time, per {@link fileRank}.
+* - The vault entry's clock is `refreshedAtMs`, the local write time of the
+*   plugin refresh (or OAuth login) that produced it. A wall clock is not
+*   comparable to an issuance time, so the two are NOT mixed: the entry is
+*   replaced only when the scan's read is the live sign-in AND either the
+*   entry predates the scan read's issuance, or the entry was written before
+*   the plugin refreshed into it — approximated by requiring the live file's
+*   issuance to be NEWER than the entry's write time.
+*
+* The rule's purpose is breaking the refresh loop: without it, a scan keeps
+* reinstating the (older, soon-to-expire) desktop token over the refreshed
+* vault copy, so every restart re-refreshes every account. With it, the
+* desktop token wins only while it is genuinely newer than what the plugin
+* last wrote — after that the refreshed copy is the operative credential,
+* exactly like the pre-vault per-region copies behaved.
+*/
+function shouldReplaceVaultEntry(candidate, incumbent) {
+	if (fileRank(candidate.filePath) !== 0) return false;
+	const writeMs = incumbent.refreshedAtMs;
+	if (writeMs === void 0) return true;
+	const issuanceMs = candidate.lastRefreshAtMs;
+	if (issuanceMs === void 0) return candidate.expiresAtMs > incumbent.credential.expiresAtMs;
+	return issuanceMs > writeMs;
+}
+/**
+* Read every vault entry for one region directory.
+*
+* The map is keyed by account id, which the FILE NAME already carries: the
+* id inside the document is checked against it and a mismatched file is
+* skipped — a file copied between accounts (or a half-written rename) must
+* not silently answer for the wrong account.
+*/
+async function readVaultEntries(dir) {
+	const entries = /* @__PURE__ */ new Map();
+	let names;
+	try {
+		names = await readdir(dir);
+	} catch (error) {
+		if (isENOENT(error)) return entries;
+		throw error;
+	}
+	for (const name of names) {
+		if (!isVaultCredentialFileName(name)) continue;
+		const path = join(dir, name);
+		try {
+			const parsed = parseVaultDocumentWithWriteTime(await readFile(path, "utf8"), path);
+			if (parsed === void 0) continue;
+			const id = name.slice(0, -5);
+			if (workbuddyAccountId(parsed.credential) !== id) continue;
+			entries.set(id, parsed);
+		} catch {}
+	}
+	return entries;
+}
+/** Write one vault entry atomically under the file lock. */
+async function writeVaultEntry(dir, accountId, credential, refreshedFrom) {
+	const path = join(dir, `${accountId}.json`);
+	await withFileLock(path, async () => {
+		await writeFileAtomic(path, `${JSON.stringify(vaultDocument(credential, accountId, refreshedFrom), null, 2)}\n`, {
+			mode: 384,
+			dirMode: 448
+		});
+	});
+}
+/**
 * Probe one auth file, reporting WHY it yielded no credential.
 *
 * The desktop app encrypts its token fields on Windows builds. The plain read
@@ -1916,12 +2232,37 @@ var WorkBuddyCredentialStore = class {
 	ownPathExplicit;
 	legacyOwnPath;
 	legacyOwnPathExplicit;
+	vaultDirExplicit;
+	/** The vault directory, resolved ONCE at construction. */
+	vaultDirResolved;
 	authDirs;
 	resolveAtRestKey;
 	desktopPathOverride;
 	accountId;
 	inflight;
 	/**
+	* In-flight/completed scan for the CURRENT `readAll` generation.
+	*
+	* One page open calls `readAll` six times: the usage route asks for the
+	* account list, the sign-in state and the resolved credential, then the
+	* per-account credits panel asks once PER ACCOUNT (`credentialFor`), and both
+	* region tabs poll on the same timer. Each call re-read every auth file,
+	* re-parsed it, and re-ran the vault merge — measured at 6 `readdir` + (6N+12)
+	* `readFile` for N accounts, i.e. the cost grew with the account count on a
+	* path whose answer cannot change within one tick.
+	*
+	* This is deliberately NOT a time-based cache: a TTL would make the card show
+	* a stale account list after an OAuth add or an import, which is the very
+	* class of bug this card keeps chasing. Instead the promise is shared while it
+	* is in flight, and every WRITE clears it (see `invalidateScan`) — so a read
+	* after a write always scans again, and a read during a scan joins it.
+	*
+	* Undefined means "no scan in flight and nothing cached".
+	*/
+	scanInflight;
+	/** When the cached scan was STARTED, epoch ms; only meaningful with it set. */
+	scanAtMs = 0;
+	/**
 	* A RUNTIME account override from the pool's rotation, or undefined.
 	*
 	* Deliberately separate from {@link accountId}, which is the user's persisted
@@ -1938,6 +2279,8 @@ var WorkBuddyCredentialStore = class {
 		this.ownPathExplicit = options.ownPath;
 		this.legacyOwnPath = options.legacyOwnPath ?? legacyWorkbuddyOwnAuthPath();
 		this.legacyOwnPathExplicit = options.legacyOwnPath;
+		this.vaultDirExplicit = options.vaultDir;
+		this.vaultDirResolved = options.vaultDir ?? (options.region !== void 0 ? workbuddyVaultDir(options.region) : join(resolveDshHome(), "workbuddy-vault"));
 		this.authDirs = options.authDirs;
 		this.desktopPathOverride = options.desktopPath;
 		this.resolveAtRestKey = options.resolveAtRestKey ?? readAtRestKey;
@@ -1974,10 +2317,15 @@ var WorkBuddyCredentialStore = class {
 			workbuddyOwnAuthPath("global")
 		];
 	}
+	/** The vault directory this store reads and writes (fixed at construction). */
+	vaultDir() {
+		return this.vaultDirResolved;
+	}
 	/** Repoint the desktop file or directory; applies on the next read. */
 	setDesktopPath(path) {
 		this.desktopPathOverride = path;
 		this.inflight = void 0;
+		this.invalidateScan();
 	}
 	/**
 	* Select an account by id; tokens stay outside settings.
@@ -1991,6 +2339,7 @@ var WorkBuddyCredentialStore = class {
 	selectAccount(accountId) {
 		this.accountId = accountId === "" ? void 0 : accountId;
 		this.inflight = void 0;
+		this.invalidateScan();
 	}
 	/** Selected account id, for diagnostics and route assembly. */
 	selectedAccountId() {
@@ -2066,13 +2415,42 @@ var WorkBuddyCredentialStore = class {
 	* region's accounts are invisible to selection, refresh, and status alike,
 	* which is what keeps the two regions' providers from cross-billing.
 	*/
+	/**
+	* The account list, sharing one scan across concurrent and repeated reads.
+	*
+	* See {@link scanInflight}: the whole performance fix lives in these four
+	* lines. Every caller keeps its OWN semantics (`current`, `accounts`,
+	* `status`, `selectionLost`), because this returns the same array they used
+	* to build themselves — only the filesystem work is shared.
+	*
+	* A failed scan is NOT cached: the rejection clears the slot so the next read
+	* retries, rather than pinning every later caller to one transient failure.
+	*/
 	async readAll() {
+		const now = Date.now();
+		if (this.scanInflight !== void 0 && now - this.scanAtMs < SCAN_SHARE_WINDOW_MS) return this.scanInflight;
+		this.scanAtMs = now;
+		this.scanInflight = this.scanAll().catch((error) => {
+			this.scanInflight = void 0;
+			throw error;
+		});
+		return this.scanInflight;
+	}
+	/** Drop the shared scan so the next read re-reads the filesystem. */
+	invalidateScan() {
+		this.scanInflight = void 0;
+		this.scanAtMs = 0;
+	}
+	/** The one real scan: read every candidate file, then merge the vault. */
+	async scanAll() {
 		const files = await this.candidateFiles();
+		const dismissed = await readDismissed(this.vaultDir());
 		const byId = /* @__PURE__ */ new Map();
 		for (const file of files) {
 			const credential = await readAuthFile(file, this.resolveAtRestKey);
 			if (credential === void 0 || !this.matchesRegion(credential.domain)) continue;
 			const id = workbuddyAccountId(credential);
+			if (dismissed.has(id)) continue;
 			const existing = byId.get(id);
 			if (existing === void 0) {
 				byId.set(id, credential);
@@ -2083,11 +2461,59 @@ var WorkBuddyCredentialStore = class {
 		for (const own of await this.readOwns()) {
 			if (!this.matchesRegion(own.domain)) continue;
 			const id = workbuddyAccountId(own);
+			if (dismissed.has(id)) continue;
 			const existing = byId.get(id);
 			if (existing === void 0) byId.set(id, own);
 			else if (fileRank(existing.filePath) !== 0 && own.expiresAtMs > existing.expiresAtMs) byId.set(id, own);
 		}
-		return [...byId.values()];
+		await this.syncVault(byId, dismissed);
+		return Object.freeze([...byId.values()]);
+	}
+	/**
+	* Merge the scan's credentials into the vault and read the vault back.
+	*
+	* Incremental by contract: a scan that finds nothing new writes nothing.
+	* Per account, the vault entry is written only when the scan's read is
+	* fresher by {@link isFresherVaultEntry} — so a steady-state scan is
+	* mtime-stable and every sync is O(accounts) reads with at most one write
+	* per CHANGED account.
+	*/
+	async syncVault(scan, dismissed) {
+		const dir = this.vaultDir();
+		let entries;
+		try {
+			entries = await readVaultEntries(dir);
+		} catch {
+			return;
+		}
+		let dirReady = false;
+		for (const [id, credential] of scan) {
+			if (dismissed.has(id)) continue;
+			const incumbent = entries.get(id);
+			if (incumbent !== void 0 && !shouldReplaceVaultEntry(credential, incumbent)) continue;
+			if (!dirReady) try {
+				await mkdir(dir, { recursive: true });
+				dirReady = true;
+			} catch {
+				return;
+			}
+			await writeVaultEntry(dir, id, credential);
+			entries.set(id, {
+				credential: {
+					...credential,
+					source: "dsh"
+				},
+				refreshedAtMs: Date.now()
+			});
+		}
+		for (const [id, entry] of entries) {
+			if (!this.matchesRegion(entry.credential.domain)) continue;
+			const existing = scan.get(id);
+			if (dismissed.has(id)) continue;
+			if (existing === void 0) scan.set(id, entry.credential);
+			else if (entry.refreshedFrom !== void 0 && entry.refreshedFrom === authFileName(existing.filePath)) scan.set(id, entry.credential);
+			else if (fileRank(existing.filePath) !== 0 && entry.credential.expiresAtMs > existing.expiresAtMs) scan.set(id, entry.credential);
+		}
 	}
 	/**
 	* Default when no account is explicitly selected: the live sign-in, else the
@@ -2238,6 +2664,142 @@ var WorkBuddyCredentialStore = class {
 		}
 	}
 	/**
+	* Persist one OAuth sign-in into the unified vault.
+	*
+	* The credential is written with `source: 'dsh'` (it never came from a
+	* desktop file) and joins the readable set on the next scan — the vault is
+	* read by `readAll()` like any other source, so no separate discovery path
+	* exists. The write is idempotent per account id: re-adding an account
+	* replaces its entry, which is exactly what re-issuing a login means.
+	*
+	* Returns the account id so the card can offer to select it right away.
+	*/
+	async addOAuthAccount(credential) {
+		const id = workbuddyAccountId(credential);
+		const dir = this.vaultDir();
+		await mkdir(dir, { recursive: true });
+		await writeVaultEntry(dir, id, {
+			...credential,
+			source: "dsh",
+			filePath: join(dir, `${id}.json`)
+		});
+		await this.forgetDismissal(dir, id);
+		this.inflight = void 0;
+		this.invalidateScan();
+		return id;
+	}
+	/**
+	* Drop one id from the dismissal list, if present.
+	*
+	* Silent by design: called on the ADD paths, where a list that cannot be
+	* updated must not fail the action the user asked for. The consequence is the
+	* same as before the fix — the account stays hidden until the list is
+	* repaired — while throwing here would report a failed sign-in that succeeded.
+	*/
+	async forgetDismissal(dir, accountId) {
+		try {
+			const dismissed = await readDismissed(dir);
+			if (!dismissed.has(accountId)) return;
+			dismissed.delete(accountId);
+			await writeDismissed(dir, dismissed);
+		} catch {}
+	}
+	/**
+	* Forget EVERY dismissal, so the next read lists the accounts again.
+	*
+	* Called by the manual 「re-scan」 action. Dismissal is "hide until I ask to
+	* scan again", and this is that ask: the user is requesting what the machine
+	* currently has, which includes accounts they hid earlier. Leaving the list
+	* intact would make a removed desktop account unrecoverable from the UI — the
+	* opposite of what the button promises.
+	*
+	* PREFERS deleting the file over writing an empty list: an absent file is the
+	* normal state and keeps the vault directory free of a file that says nothing.
+	* The unlink is not the only way, though, because on Windows removing a file
+	* another process holds open fails with `EPERM`/`EBUSY`/`EACCES` — an antivirus
+	* scanner, OneDrive, or an editor with it open, the same contention the card's
+	* `isFileContentionWriteError` classifies for profile writes and the reason
+	* `docs/WINDOWS.md` keeps a register. POSIX unlinks open files happily, so
+	* without this the promise 「点重新检测账号即可找回」 would be false, silently,
+	* on exactly the platform it matters most on.
+	*
+	* So the unlink falls back to OVERWRITING the list with an empty one through
+	* the same locked atomic write `writeDismissed` uses. For every reader the two
+	* outcomes are identical (`readDismissed` yields no ids either way), so the
+	* user's ask is honoured even when the file itself cannot be removed.
+	*
+	* Returns whether the dismissals are now genuinely gone, VERIFIED by reading
+	* the list back rather than by trusting the write: the caller renders this, so
+	* "it worked" has to mean it. A `false` is the honest answer for a vault that
+	* could neither be unlinked nor rewritten, and the rescan still runs — the
+	* accounts simply stay hidden, which the UI can now say out loud instead of
+	* showing a button that appears to have done nothing.
+	*/
+	async clearDismissals() {
+		this.inflight = void 0;
+		this.invalidateScan();
+		const dir = this.vaultDir();
+		const path = join(dir, VAULT_DISMISSED_FILENAME);
+		try {
+			await rm(path, { force: true });
+		} catch {
+			try {
+				await writeDismissed(dir, /* @__PURE__ */ new Set());
+			} catch {
+				return (await readDismissed(dir)).size === 0;
+			}
+		}
+		return (await readDismissed(dir)).size === 0;
+	}
+	/**
+	* Remove ONE account from this region's list, by id.
+	*
+	* The account is DISMISSED, not merely deleted. Deleting the vault entry alone
+	* was undone by the next scan: `syncVault` writes every desktop sign-in it
+	* finds back into the vault (that is how a desktop account becomes selectable)
+	* and `readAll` merges the vault in afterwards, so a removed desktop account
+	* returned on the very next read while `removeAccount` had reported `true`.
+	* Measured before the fix: remove → `true`, then `accounts()` still lists it.
+	*
+	* The desktop app's auth files stay read-only: dismissing hides the account
+	* from this plugin without signing the app out, and that is exactly what the
+	* card says. Re-adding it (a fresh OAuth sign-in or an import) clears the
+	* dismissal, so the account is not lost to a future login.
+	*
+	* Returns whether a stored vault entry was also removed, so the caller can
+	* still tell "removed" from "only a desktop sign-in" — the dismissal happens
+	* either way, because only the user gets to decide an account is dismissed.
+	*/
+	async removeAccount(accountId) {
+		if (!VAULT_ACCOUNT_ID_RE.test(accountId)) throw new Error(`workbuddy: refusing to remove '${accountId}': not a vault account id`);
+		const path = join(this.vaultDir(), `${accountId}.json`);
+		const removed = await withFileLock(path, async () => {
+			let existed = true;
+			try {
+				await rm(path, { force: false });
+			} catch (error) {
+				if (!isENOENT(error)) throw error;
+				existed = false;
+			}
+			await rm(`${path}.lock`, { force: false }).catch(() => {});
+			return existed;
+		});
+		if (this.rotatedAccountId === accountId) this.rotatedAccountId = void 0;
+		if (this.accountId === accountId) this.accountId = void 0;
+		const dir = this.vaultDir();
+		try {
+			await mkdir(dir, { recursive: true });
+			const dismissed = await readDismissed(dir);
+			if (!dismissed.has(accountId)) {
+				dismissed.add(accountId);
+				await writeDismissed(dir, dismissed);
+			}
+		} catch {}
+		this.inflight = void 0;
+		this.invalidateScan();
+		return removed;
+	}
+	/**
 	* Remove every plugin-owned copy this store could read (per-region file,
 	* legacy single file, and their lock siblings); the desktop files are
 	* untouched. A region store's logout therefore also clears the legacy
@@ -2249,6 +2811,11 @@ var WorkBuddyCredentialStore = class {
 			await rm(path, { force: true });
 			await rm(`${path}.lock`, { force: true });
 		}
+		await rm(this.vaultDir(), {
+			recursive: true,
+			force: true
+		});
+		this.invalidateScan();
 	}
 	needsRefresh(credential) {
 		if (credential.expiresAtMs <= 0) return true;
@@ -2269,23 +2836,14 @@ var WorkBuddyCredentialStore = class {
 				...outcome.domain === void 0 || outcome.domain === "" ? {} : { domain: outcome.domain },
 				source: "dsh"
 			};
-			await this.saveOwn(refreshed);
+			this.invalidateScan();
+			await writeVaultEntry(this.vaultDir(), workbuddyAccountId(credential), refreshed, credential.filePath).catch(() => {});
 			return refreshed;
 		} catch (error) {
 			if (credential.expiresAtMs > Date.now() + 3e4) return credential;
 			throw new Error(`workbuddy: token refresh failed and the access token is expired (${String(error)}); open the WorkBuddy desktop app once to sign in again`);
 		}
 	}
-	async saveOwn(credential) {
-		const accountId = workbuddyAccountId(credential);
-		const path = this.ownAuthPath();
-		await withFileLock(path, async () => {
-			await writeFileAtomic(path, `${JSON.stringify(ownDocument(credential, accountId), null, 2)}\n`, {
-				mode: 384,
-				dirMode: 448
-			});
-		});
-	}
 	/**
 	* Every readable plugin-owned copy, in candidate order; absent or corrupt
 	* files are skipped rather than propagated.
@@ -2360,8 +2918,34 @@ var WorkBuddyCredentialStore = class {
 				continue;
 			}
 		}
+		const tried = [...await this.candidateFiles(), ...this.ownCandidates()];
+		try {
+			const names = await readdir(this.vaultDir());
+			for (const name of names.filter(isVaultCredentialFileName)) {
+				const path = join(this.vaultDir(), name);
+				tried.push(path);
+				let text;
+				try {
+					text = await readFile(path, "utf8");
+				} catch (error) {
+					if (!isENOENT(error)) candidates.push({
+						path,
+						source: "dsh",
+						reason: "unreadable",
+						message: error instanceof Error ? error.message : String(error)
+					});
+					continue;
+				}
+				if (parseVaultDocument(text, path) === void 0) candidates.push({
+					path,
+					source: "dsh",
+					reason: "invalid",
+					message: "not a readable vault credential"
+				});
+			}
+		} catch {}
 		return {
-			tried: [...await this.candidateFiles(), ...this.ownCandidates()],
+			tried,
 			failures: candidates
 		};
 	}
@@ -2855,7 +3439,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.0.0";
+const WORKBUDDY_CONNECT_VERSION = "4.3.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -3013,4 +3597,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { macosNestedAppBundles as $, workbuddyOwnAuthPath as A, parseUpstreamModel as B, defaultDesktopAuthDirs as C, legacyWorkbuddyOwnAuthPath as D, isEncryptedCredentialError as E, classifyUpstreamError as F, deriveAtRestKey as G, regionOf as H, declaredTools as I, findWorkbuddyAppExecutable as J, deriveAtRestKeyId as K, isCredentialRejectedError as L, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as M, WorkBuddyCredentialRejectedError as N, parseWorkBuddyAuth as O, WorkBuddyUpstreamClient as P, macosBundleExecutable as Q, parseCreditMultiplier as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, WORKBUDDY_APP_EXECUTABLE_ENV as U, prepareChatBody as V, clearAtRestKeyCache as W, isEncryptedFieldWrapper as X, findWorkbuddyAppExecutableWithSource as Y, isWorkbuddyBundle as Z, WORKBUDDY_AUTH_FILENAME as _, readHostHeartbeat as a, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, openEncryptedField as et, WorkBuddyCatalog as f, ENCRYPTED_CREDENTIAL_CODE as g, fallbackModelsFor as h, processStartTimeMs as i, CREDENTIAL_REJECTED_CODE as j, workbuddyAccountId as k, piAiRuntimeInfo as l, deriveCatalog as m, clearHostHeartbeat as n, workbuddyAppExecutableCandidates as nt, workbuddyHostHeartbeatPath as o, applyContextBudgets as p, fetchAtRestKeyPayload as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, readAtRestKey as tt, FALLBACK_WORKBUDDY_MODELS as u, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, parseReasoning as z };
+export { isWorkbuddyBundle as $, workbuddyAccountId as A, parseCreditMultiplier as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, WORKBUDDY_APP_EXECUTABLE_ENV as G, parseUpstreamModel as H, classifyUpstreamError as I, deriveAtRestKeyId as J, clearAtRestKeyCache as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, isEncryptedFieldWrapper as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, prepareChatBody as U, parseReasoning as V, regionOf as W, findWorkbuddyAppExecutable as X, fetchAtRestKeyPayload as Y, findWorkbuddyAppExecutableWithSource as Z, WORKBUDDY_AUTH_FILENAME as _, readHostHeartbeat as a, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, macosBundleExecutable as et, WorkBuddyCatalog as f, ENCRYPTED_CREDENTIAL_CODE as g, fallbackModelsFor as h, processStartTimeMs as i, workbuddyAppExecutableCandidates as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, deriveCatalog as m, clearHostHeartbeat as n, openEncryptedField as nt, workbuddyHostHeartbeatPath as o, applyContextBudgets as p, deriveAtRestKey as q, isHeartbeatProcessAlive as r, readAtRestKey as rt, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, macosNestedAppBundles as tt, FALLBACK_WORKBUDDY_MODELS as u, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, knownRegionOf as z };