dsh-connect-workbuddy 4.0.0 → 4.3.0

package/lib/index.d.ts

@@ -116,6 +116,12 @@ interface WorkBuddyStoreOptions {
    * pre-dual-provider location. Injectable for tests.
    */
   legacyOwnPath?: string;
+  /**
+   * The unified credential vault directory for this store. Defaults to the
+   * per-region directory under the Harness home; injectable so the vault's
+   * merge/scan behaviour is testable without touching a real machine.
+   */
+  vaultDir?: string;
   /**
    * Auth directories to scan, overriding the platform defaults. Injectable so
    * the multi-account scan is testable without touching a real machine.
@@ -233,11 +239,36 @@ declare class WorkBuddyCredentialStore {
   private readonly ownPathExplicit;
   private readonly legacyOwnPath;
   private readonly legacyOwnPathExplicit;
+  private readonly vaultDirExplicit;
+  /** The vault directory, resolved ONCE at construction. */
+  private readonly vaultDirResolved;
   private readonly authDirs;
   private readonly resolveAtRestKey;
   private desktopPathOverride;
   private accountId;
   private inflight;
+  /**
+   * In-flight/completed scan for the CURRENT `readAll` generation.
+   *
+   * One page open calls `readAll` six times: the usage route asks for the
+   * account list, the sign-in state and the resolved credential, then the
+   * per-account credits panel asks once PER ACCOUNT (`credentialFor`), and both
+   * region tabs poll on the same timer. Each call re-read every auth file,
+   * re-parsed it, and re-ran the vault merge — measured at 6 `readdir` + (6N+12)
+   * `readFile` for N accounts, i.e. the cost grew with the account count on a
+   * path whose answer cannot change within one tick.
+   *
+   * This is deliberately NOT a time-based cache: a TTL would make the card show
+   * a stale account list after an OAuth add or an import, which is the very
+   * class of bug this card keeps chasing. Instead the promise is shared while it
+   * is in flight, and every WRITE clears it (see `invalidateScan`) — so a read
+   * after a write always scans again, and a read during a scan joins it.
+   *
+   * Undefined means "no scan in flight and nothing cached".
+   */
+  private scanInflight;
+  /** When the cached scan was STARTED, epoch ms; only meaningful with it set. */
+  private scanAtMs;
   /**
    * A RUNTIME account override from the pool's rotation, or undefined.
    *
@@ -268,6 +299,8 @@ declare class WorkBuddyCredentialStore {
    * the real machine's legacy copy.
    */
   private ownCandidates;
+  /** The vault directory this store reads and writes (fixed at construction). */
+  private vaultDir;
   /** Repoint the desktop file or directory; applies on the next read. */
   setDesktopPath(path: string | undefined): void;
   /**
@@ -320,7 +353,32 @@ declare class WorkBuddyCredentialStore {
    * region's accounts are invisible to selection, refresh, and status alike,
    * which is what keeps the two regions' providers from cross-billing.
    */
+  /**
+   * The account list, sharing one scan across concurrent and repeated reads.
+   *
+   * See {@link scanInflight}: the whole performance fix lives in these four
+   * lines. Every caller keeps its OWN semantics (`current`, `accounts`,
+   * `status`, `selectionLost`), because this returns the same array they used
+   * to build themselves — only the filesystem work is shared.
+   *
+   * A failed scan is NOT cached: the rejection clears the slot so the next read
+   * retries, rather than pinning every later caller to one transient failure.
+   */
   private readAll;
+  /** Drop the shared scan so the next read re-reads the filesystem. */
+  private invalidateScan;
+  /** The one real scan: read every candidate file, then merge the vault. */
+  private scanAll;
+  /**
+   * Merge the scan's credentials into the vault and read the vault back.
+   *
+   * Incremental by contract: a scan that finds nothing new writes nothing.
+   * Per account, the vault entry is written only when the scan's read is
+   * fresher by {@link isFresherVaultEntry} — so a steady-state scan is
+   * mtime-stable and every sync is O(accounts) reads with at most one write
+   * per CHANGED account.
+   */
+  private syncVault;
   /**
    * Default when no account is explicitly selected: the live sign-in, else the
    * freshest credential. Following the app's current sign-in is the documented
@@ -396,6 +454,79 @@ declare class WorkBuddyCredentialStore {
   private describeMissingCredential;
   /** Read-only sign-in summary; never refreshes and never throws. */
   status(): Promise<WorkBuddyAuthStatus>;
+  /**
+   * Persist one OAuth sign-in into the unified vault.
+   *
+   * The credential is written with `source: 'dsh'` (it never came from a
+   * desktop file) and joins the readable set on the next scan — the vault is
+   * read by `readAll()` like any other source, so no separate discovery path
+   * exists. The write is idempotent per account id: re-adding an account
+   * replaces its entry, which is exactly what re-issuing a login means.
+   *
+   * Returns the account id so the card can offer to select it right away.
+   */
+  addOAuthAccount(credential: Omit<WorkBuddyCredential, 'source' | 'filePath'>): Promise<string>;
+  /**
+   * Drop one id from the dismissal list, if present.
+   *
+   * Silent by design: called on the ADD paths, where a list that cannot be
+   * updated must not fail the action the user asked for. The consequence is the
+   * same as before the fix — the account stays hidden until the list is
+   * repaired — while throwing here would report a failed sign-in that succeeded.
+   */
+  private forgetDismissal;
+  /**
+   * Forget EVERY dismissal, so the next read lists the accounts again.
+   *
+   * Called by the manual 「re-scan」 action. Dismissal is "hide until I ask to
+   * scan again", and this is that ask: the user is requesting what the machine
+   * currently has, which includes accounts they hid earlier. Leaving the list
+   * intact would make a removed desktop account unrecoverable from the UI — the
+   * opposite of what the button promises.
+   *
+   * PREFERS deleting the file over writing an empty list: an absent file is the
+   * normal state and keeps the vault directory free of a file that says nothing.
+   * The unlink is not the only way, though, because on Windows removing a file
+   * another process holds open fails with `EPERM`/`EBUSY`/`EACCES` — an antivirus
+   * scanner, OneDrive, or an editor with it open, the same contention the card's
+   * `isFileContentionWriteError` classifies for profile writes and the reason
+   * `docs/WINDOWS.md` keeps a register. POSIX unlinks open files happily, so
+   * without this the promise 「点重新检测账号即可找回」 would be false, silently,
+   * on exactly the platform it matters most on.
+   *
+   * So the unlink falls back to OVERWRITING the list with an empty one through
+   * the same locked atomic write `writeDismissed` uses. For every reader the two
+   * outcomes are identical (`readDismissed` yields no ids either way), so the
+   * user's ask is honoured even when the file itself cannot be removed.
+   *
+   * Returns whether the dismissals are now genuinely gone, VERIFIED by reading
+   * the list back rather than by trusting the write: the caller renders this, so
+   * "it worked" has to mean it. A `false` is the honest answer for a vault that
+   * could neither be unlinked nor rewritten, and the rescan still runs — the
+   * accounts simply stay hidden, which the UI can now say out loud instead of
+   * showing a button that appears to have done nothing.
+   */
+  clearDismissals(): Promise<boolean>;
+  /**
+   * Remove ONE account from this region's list, by id.
+   *
+   * The account is DISMISSED, not merely deleted. Deleting the vault entry alone
+   * was undone by the next scan: `syncVault` writes every desktop sign-in it
+   * finds back into the vault (that is how a desktop account becomes selectable)
+   * and `readAll` merges the vault in afterwards, so a removed desktop account
+   * returned on the very next read while `removeAccount` had reported `true`.
+   * Measured before the fix: remove → `true`, then `accounts()` still lists it.
+   *
+   * The desktop app's auth files stay read-only: dismissing hides the account
+   * from this plugin without signing the app out, and that is exactly what the
+   * card says. Re-adding it (a fresh OAuth sign-in or an import) clears the
+   * dismissal, so the account is not lost to a future login.
+   *
+   * Returns whether a stored vault entry was also removed, so the caller can
+   * still tell "removed" from "only a desktop sign-in" — the dismissal happens
+   * either way, because only the user gets to decide an account is dismissed.
+   */
+  removeAccount(accountId: string): Promise<boolean>;
   /**
    * Remove every plugin-owned copy this store could read (per-region file,
    * legacy single file, and their lock siblings); the desktop files are
@@ -406,7 +537,6 @@ declare class WorkBuddyCredentialStore {
   logout(): Promise<void>;
   private needsRefresh;
   private refreshNow;
-  private saveOwn;
   /**
    * Every readable plugin-owned copy, in candidate order; absent or corrupt
    * files are skipped rather than propagated.
@@ -578,6 +708,30 @@ interface UpstreamErrorDetail {
  * them at the openresty layer with an HTML 401.
  */
 declare function regionOf(domain: string): WorkBuddyRegion;
+/**
+ * The STRICT counterpart of {@link regionOf}: a region's domain only when it is
+ * positively recognised, `undefined` for anything else.
+ *
+ * `regionOf`'s catch-all is deliberate — the CN product is single-homed, so an
+ * unrecognised spelling is treated as CN and a real (if oddly written) CN
+ * credential still resolves. That reasoning holds only for a domain the
+ * UPSTREAM issued. It does not hold for a value read out of a file someone
+ * handed the plugin: there "unrecognised" means "cannot be classified", and
+ * calling it CN would file a foreign or spoofed credential in the CN vault.
+ * Import gates must use this, not {@link regionOf}.
+ *
+ * Both sides are matched on their registrable domain, so a bare host and any
+ * subdomain qualify while a lookalike such as `codebuddy.cn.evil.com` cannot.
+ *
+ * `copilot.tencent.com` is NOT a third product — it is this plugin's OWN CN
+ * chat gateway (`CN_CHAT_BASE`), and the credential's `domain` field carries it
+ * verbatim on real records. Refusing it here made the plugin reject its own
+ * export: the card exported 8 accounts, and re-importing that file skipped the
+ * three whose `domain` was the gateway. It cannot be spoofed into the wrong
+ * region by being recognised here — it names the CN gateway, so admitting it is
+ * the same decision as admitting `workbuddy.cn`.
+ */
+declare function knownRegionOf(domain: string): WorkBuddyRegion | undefined;
 /**
  * Normalize an OpenAI chat-completions body for the WorkBuddy upstream:
  * force `stream: true` (the upstream rejects non-streaming), flatten
@@ -1778,6 +1932,59 @@ declare const WORKBUDDY_CHECKIN_PATH = "/plugins/dsh-connect-workbuddy/checkin";
  * browser half.
  */
 declare const WORKBUDDY_PROBE_PATH = "/plugins/dsh-connect-workbuddy/probe";
+/**
+ * One entry of the transfer PREVIEW: display fields only, never token
+ * material. `hasToken` is the import decision input — the import step skips
+ * records without one — and the indexes are the FILE's positions, so the user
+ * picks by the same numbers the import call sends back.
+ */
+interface WorkBuddyTransferPreviewEntry {
+  index: number;
+  uid: string;
+  nickname: string;
+  email: string;
+  hasToken: boolean;
+}
+/** The preview answer: the desensitized listing plus the file's total count. */
+interface WorkBuddyTransferPreview {
+  accounts: readonly WorkBuddyTransferPreviewEntry[];
+  total: number;
+}
+/**
+ * The import answer. `imported` counts records merged into the vault (new OR
+ * overwritten — both change the stored entry); `skipped` counts what was
+ * left out: missing token, a bad index, or a record whose login domain does
+ * not belong to the addressed region.
+ */
+interface WorkBuddyTransferImportAnswer {
+  imported: number;
+  skipped: number;
+}
+/**
+ * The shared file format's record shape, subset the importer consumes.
+ *
+ * Contract with sibling tools exporting the same format: a JSON array of
+ * objects keyed in snake_case — `access_token` (required), `refresh_token`,
+ * `uid`, `nickname`, `email`, `domain`, `expiresAt` (epoch ms),
+ * `refreshExpiresAt`, `auth_raw`. Extra fields ride along untouched.
+ */
+interface WorkBuddyTransferRecord {
+  access_token: string;
+  refresh_token?: string;
+  uid?: string;
+  nickname?: string;
+  email?: string;
+  domain?: string;
+  /** Access-token expiry in epoch MILLISECONDS, the sibling format's unit. */
+  expiresAt?: number;
+  refreshExpiresAt?: number;
+  /** The sibling tool's original credential document, preserved verbatim. */
+  auth_raw?: unknown;
+}
+/** The export answer: the records themselves, tokens included. */
+interface WorkBuddyTransferExportAnswer {
+  accounts: WorkBuddyTransferRecord[];
+}
 /** Query parameter naming the region a card request addresses. */
 declare const WORKBUDDY_REGION_PARAM = "region";
 /** Every region, in card tab order. */
@@ -2410,7 +2617,79 @@ interface WorkBuddyStatusRouteOptions {
    * that needs a working probe dependency.
    */
   pool?: WorkBuddyPoolDeps;
+  /**
+   * OAuth QR sign-in: start a login and poll it to completion.
+   *
+   * Optional as a whole: a Host built without it simply omits the card's
+   * sign-in affordance (an older bundle keeps rendering, minus the button).
+   */
+  oauth?: WorkBuddyOAuthDeps;
+  /**
+   * Batch credential export / import between machines.
+   *
+   * Optional as a whole: a Host built without it simply omits the card's
+   * transfer section (an older bundle keeps rendering, minus the buttons).
+   */
+  transfer?: WorkBuddyTransferDeps;
+}
+/**
+ * What the transfer route needs from the Host. Everything is region-scoped:
+ * the two regions' vaults are parallel stacks, and an export of one tab must
+ * never leak the other tab's accounts.
+ */
+interface WorkBuddyTransferDeps {
+  /**
+   * Export the named accounts' credentials in the shared transfer format.
+   * Unknown ids are simply absent from the answer; an answer with zero
+   * records means nothing named was exportable (the caller decides whether
+   * that is an error).
+   */
+  exportAccounts(region: WorkBuddyRegion, accountIds: readonly string[]): Promise<WorkBuddyTransferExportAnswer>;
+  /** Parse transfer-file text into the desensitized preview. */
+  previewImport(region: WorkBuddyRegion, text: string): Promise<WorkBuddyTransferPreview>;
+  /**
+   * Merge the selected file entries into the region's vault. Returns the
+   * counters the card reports; `skipped` covers missing tokens, bad indexes,
+   * and records belonging to the other region.
+   */
+  importAccounts(region: WorkBuddyRegion, text: string, indexes: readonly number[]): Promise<WorkBuddyTransferImportAnswer>;
 }
+/**
+ * What the OAuth route needs from the Host: the two session actions, plus the
+ * persistence step the route cannot do itself (only the Host may touch the
+ * credential vault).
+ */
+interface WorkBuddyOAuthDeps {
+  /**
+   * Start one login for the region. Resolves the URL the user opens to scan
+   * and confirm, or an actionable error.
+   */
+  start(region: WorkBuddyRegion): Promise<WorkBuddyOAuthStartResult>;
+  /**
+   * Poll once. The card repeats until `done` — then either the account was
+   * persisted (the Host saved it to the vault) or an error is reported.
+   */
+  poll(region: WorkBuddyRegion, loginId: string): Promise<WorkBuddyOAuthPollView>;
+}
+/** The start answer, token-free (the state never leaves the Host). */
+type WorkBuddyOAuthStartResult = {
+  loginId: string;
+  verificationUri: string;
+  expiresIn: number;
+} | {
+  error: string;
+};
+/** The poll answer the card sees. `account` carries display fields only. */
+type WorkBuddyOAuthPollView = {
+  done: false;
+} | {
+  done: true;
+  accountName: string;
+  accountId: string;
+} | {
+  done: true;
+  error: string;
+};
 /**
  * What the pool route needs from the Host.
  *
@@ -2444,6 +2723,22 @@ interface WorkBuddyPoolDeps {
    * checked) instead of passing the guard and running a batch over nothing.
    */
   effectiveMemberAccountIds?(region: WorkBuddyRegion): Promise<readonly string[]>;
+  /**
+   * Test ONE account against the region's target model.
+   *
+   * The per-row button's Host half. Optional: a Host built without it simply
+   * omits the row button (an older bundle keeps rendering, minus the control).
+   * Returns undefined when the region cannot name a target model — the same
+   * refusal the batch route reports as 409.
+   */
+  testOne?(region: WorkBuddyRegion, accountId: string): Promise<WorkBuddyPoolTestRow | undefined>;
+  /**
+   * Forget ONE account's plugin-stored credential. Only the vault entry is
+   * removed; the desktop app's files are never touched. Returns whether an
+   * entry existed — false means the account exists only as a desktop sign-in
+   * (or was already gone), which the card reports instead of a silent no-op.
+   */
+  removeOne?(region: WorkBuddyRegion, accountId: string): Promise<boolean>;
   /**
    * Today's check-in state per account id.
    *
@@ -2772,4 +3067,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };