dsh-connect-workbuddy 4.2.0 → 4.3.0

package/lib/{host-heartbeat-C4TXu8ew.js → host-heartbeat-jNlsUMZO.js}

@@ -1706,6 +1706,107 @@ function parseVaultDocumentWithWriteTime(text, filePath) {
 		...refreshedFrom === void 0 ? {} : { refreshedFrom }
 	};
 }
+/**
+* File name of the vault's DISMISSAL list, stored beside the vault entries.
+*
+* It exists because deleting a vault entry is not the same as deleting an
+* account. `syncVault` writes every desktop sign-in it scans back into the
+* vault — that is how a desktop account becomes selectable — so removing the
+* vault file alone was undone by the very next scan: the row came back and the
+* button read as broken (measured: `removeAccount` returns true, `accounts()`
+* still lists it).
+*
+* Dismissal means HIDDEN UNTIL THE USER SCANS AGAIN, not deleted forever. A
+* desktop sign-in is still there in the app, and the manual 「re-scan」 action is
+* the user asking to see what the machine currently has — so
+* {@link WorkBuddyCredentialStore.clearDismissals} empties this list on every
+* manual scan and the accounts return. Without that, a removed account could
+* never be recovered except by reinstalling or re-signing in.
+*
+* The list must survive the automatic refreshes in between: the card polls the
+* usage route every 60 seconds, and an in-memory-only dismissal would let the
+* account reappear a minute after the user removed it. Hence a file.
+*
+* Dismissal is per ACCOUNT, not per source: hiding only the vault copy would
+* leave the same account listed from the desktop file, which is the
+* half-measure that produced the report.
+*/
+const VAULT_DISMISSED_FILENAME = ".dismissed.json";
+/** Current on-disk format of the dismissal list; readers reject others. */
+const DISMISSED_FORMAT_VERSION = 1;
+/**
+* How long one scan may be shared across callers, in milliseconds.
+*
+* One page open asks the store for the same account list six times (usage
+* route: accounts, status, resolve; the credits panel: once PER ACCOUNT through
+* `credentialFor`; and both region tabs poll together). Each read re-listed the
+* auth directory, re-parsed every file and re-ran the vault merge — measured at
+* 6 `readdir` and (6N+12) `readFile` for N accounts.
+*
+* Why a WINDOW and not a plain in-flight share: the six reads are SEQUENTIAL
+* (`await` one after another), so by the time the second starts the first has
+* resolved and there is nothing in flight to join. Sharing only concurrent reads
+* optimised nothing at all.
+*
+* Why so short: this is not a cache of the account list, it is an admission that
+* one page open IS one logical read. Anything longer would delay noticing a
+* sign-in the desktop app made on its own — discovery IS polling, so this window
+* is how long such a change may stay unseen. The card polls every 60 s, so 1 s is
+* invisible to the user while collapsing one page open from six scans to one. A
+* write through this store invalidates the window outright, so the actions the
+* user takes here (OAuth add, import, remove, rescan) are never delayed by it.
+*/
+const SCAN_SHARE_WINDOW_MS = 1e3;
+/** Read the dismissal list; an absent or unreadable file reads as empty. */
+async function readDismissed(dir) {
+	const dismissed = /* @__PURE__ */ new Set();
+	try {
+		const parsed = JSON.parse(await readFile(join(dir, VAULT_DISMISSED_FILENAME), "utf8"));
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return dismissed;
+		const document = parsed;
+		if (document["version"] !== DISMISSED_FORMAT_VERSION) return dismissed;
+		const ids = document["accountIds"];
+		if (!Array.isArray(ids)) return dismissed;
+		for (const id of ids) if (typeof id === "string" && VAULT_ACCOUNT_ID_RE.test(id)) dismissed.add(id);
+	} catch {}
+	return dismissed;
+}
+/** Write the dismissal list atomically under its own lock. */
+async function writeDismissed(dir, dismissed) {
+	const path = join(dir, VAULT_DISMISSED_FILENAME);
+	const ids = [...dismissed].slice(-1e3);
+	const document = {
+		version: DISMISSED_FORMAT_VERSION,
+		accountIds: ids
+	};
+	await withFileLock(path, async () => {
+		await writeFileAtomic(path, `${JSON.stringify(document, null, 2)}\n`, {
+			mode: 384,
+			dirMode: 448
+		});
+	});
+}
+/**
+* Whether a directory entry is ONE ACCOUNT's vault credential file.
+*
+* The vault directory holds more than credentials: `writeDismissed` puts
+* `.dismissed.json` here, and atomic writes transiently leave
+* `<id>.json.<hex>.tmp` siblings behind. Both used to be swept up by a bare
+* `endsWith('.json')` check, and the DISMISSAL file in particular is
+* well-formed JSON that is not a credential — so `diagnose` reported it at the
+* user as 「not a readable vault credential」 on any machine where an account
+* had been removed, turning a healthy sign-in into an unreadable-looking one.
+*
+* The rule is the account id shape the store itself writes
+* ({@link VAULT_ACCOUNT_ID_RE}), not a naming convention: a file qualifies only
+* when its stem is a real id, which no bookkeeping or temp file can be. A
+* `.tmp` sibling therefore fails on the dot of its extension, and a hidden file
+* fails on its leading dot even before that.
+*/
+function isVaultCredentialFileName(name) {
+	if (!name.endsWith(".json")) return false;
+	return VAULT_ACCOUNT_ID_RE.test(name.slice(0, -5));
+}
 /** Current on-disk format of the vault; readers reject others. */
 const VAULT_FORMAT_VERSION = 1;
 /**
@@ -2027,7 +2128,7 @@ async function readVaultEntries(dir) {
 		throw error;
 	}
 	for (const name of names) {
-		if (!name.endsWith(".json")) continue;
+		if (!isVaultCredentialFileName(name)) continue;
 		const path = join(dir, name);
 		try {
 			const parsed = parseVaultDocumentWithWriteTime(await readFile(path, "utf8"), path);
@@ -2140,6 +2241,28 @@ var WorkBuddyCredentialStore = class {
 	accountId;
 	inflight;
 	/**
+	* In-flight/completed scan for the CURRENT `readAll` generation.
+	*
+	* One page open calls `readAll` six times: the usage route asks for the
+	* account list, the sign-in state and the resolved credential, then the
+	* per-account credits panel asks once PER ACCOUNT (`credentialFor`), and both
+	* region tabs poll on the same timer. Each call re-read every auth file,
+	* re-parsed it, and re-ran the vault merge — measured at 6 `readdir` + (6N+12)
+	* `readFile` for N accounts, i.e. the cost grew with the account count on a
+	* path whose answer cannot change within one tick.
+	*
+	* This is deliberately NOT a time-based cache: a TTL would make the card show
+	* a stale account list after an OAuth add or an import, which is the very
+	* class of bug this card keeps chasing. Instead the promise is shared while it
+	* is in flight, and every WRITE clears it (see `invalidateScan`) — so a read
+	* after a write always scans again, and a read during a scan joins it.
+	*
+	* Undefined means "no scan in flight and nothing cached".
+	*/
+	scanInflight;
+	/** When the cached scan was STARTED, epoch ms; only meaningful with it set. */
+	scanAtMs = 0;
+	/**
 	* A RUNTIME account override from the pool's rotation, or undefined.
 	*
 	* Deliberately separate from {@link accountId}, which is the user's persisted
@@ -2202,6 +2325,7 @@ var WorkBuddyCredentialStore = class {
 	setDesktopPath(path) {
 		this.desktopPathOverride = path;
 		this.inflight = void 0;
+		this.invalidateScan();
 	}
 	/**
 	* Select an account by id; tokens stay outside settings.
@@ -2215,6 +2339,7 @@ var WorkBuddyCredentialStore = class {
 	selectAccount(accountId) {
 		this.accountId = accountId === "" ? void 0 : accountId;
 		this.inflight = void 0;
+		this.invalidateScan();
 	}
 	/** Selected account id, for diagnostics and route assembly. */
 	selectedAccountId() {
@@ -2290,13 +2415,42 @@ var WorkBuddyCredentialStore = class {
 	* region's accounts are invisible to selection, refresh, and status alike,
 	* which is what keeps the two regions' providers from cross-billing.
 	*/
+	/**
+	* The account list, sharing one scan across concurrent and repeated reads.
+	*
+	* See {@link scanInflight}: the whole performance fix lives in these four
+	* lines. Every caller keeps its OWN semantics (`current`, `accounts`,
+	* `status`, `selectionLost`), because this returns the same array they used
+	* to build themselves — only the filesystem work is shared.
+	*
+	* A failed scan is NOT cached: the rejection clears the slot so the next read
+	* retries, rather than pinning every later caller to one transient failure.
+	*/
 	async readAll() {
+		const now = Date.now();
+		if (this.scanInflight !== void 0 && now - this.scanAtMs < SCAN_SHARE_WINDOW_MS) return this.scanInflight;
+		this.scanAtMs = now;
+		this.scanInflight = this.scanAll().catch((error) => {
+			this.scanInflight = void 0;
+			throw error;
+		});
+		return this.scanInflight;
+	}
+	/** Drop the shared scan so the next read re-reads the filesystem. */
+	invalidateScan() {
+		this.scanInflight = void 0;
+		this.scanAtMs = 0;
+	}
+	/** The one real scan: read every candidate file, then merge the vault. */
+	async scanAll() {
 		const files = await this.candidateFiles();
+		const dismissed = await readDismissed(this.vaultDir());
 		const byId = /* @__PURE__ */ new Map();
 		for (const file of files) {
 			const credential = await readAuthFile(file, this.resolveAtRestKey);
 			if (credential === void 0 || !this.matchesRegion(credential.domain)) continue;
 			const id = workbuddyAccountId(credential);
+			if (dismissed.has(id)) continue;
 			const existing = byId.get(id);
 			if (existing === void 0) {
 				byId.set(id, credential);
@@ -2307,12 +2461,13 @@ var WorkBuddyCredentialStore = class {
 		for (const own of await this.readOwns()) {
 			if (!this.matchesRegion(own.domain)) continue;
 			const id = workbuddyAccountId(own);
+			if (dismissed.has(id)) continue;
 			const existing = byId.get(id);
 			if (existing === void 0) byId.set(id, own);
 			else if (fileRank(existing.filePath) !== 0 && own.expiresAtMs > existing.expiresAtMs) byId.set(id, own);
 		}
-		await this.syncVault(byId);
-		return [...byId.values()];
+		await this.syncVault(byId, dismissed);
+		return Object.freeze([...byId.values()]);
 	}
 	/**
 	* Merge the scan's credentials into the vault and read the vault back.
@@ -2323,7 +2478,7 @@ var WorkBuddyCredentialStore = class {
 	* mtime-stable and every sync is O(accounts) reads with at most one write
 	* per CHANGED account.
 	*/
-	async syncVault(scan) {
+	async syncVault(scan, dismissed) {
 		const dir = this.vaultDir();
 		let entries;
 		try {
@@ -2333,6 +2488,7 @@ var WorkBuddyCredentialStore = class {
 		}
 		let dirReady = false;
 		for (const [id, credential] of scan) {
+			if (dismissed.has(id)) continue;
 			const incumbent = entries.get(id);
 			if (incumbent !== void 0 && !shouldReplaceVaultEntry(credential, incumbent)) continue;
 			if (!dirReady) try {
@@ -2353,6 +2509,7 @@ var WorkBuddyCredentialStore = class {
 		for (const [id, entry] of entries) {
 			if (!this.matchesRegion(entry.credential.domain)) continue;
 			const existing = scan.get(id);
+			if (dismissed.has(id)) continue;
 			if (existing === void 0) scan.set(id, entry.credential);
 			else if (entry.refreshedFrom !== void 0 && entry.refreshedFrom === authFileName(existing.filePath)) scan.set(id, entry.credential);
 			else if (fileRank(existing.filePath) !== 0 && entry.credential.expiresAtMs > existing.expiresAtMs) scan.set(id, entry.credential);
@@ -2526,20 +2683,92 @@ var WorkBuddyCredentialStore = class {
 			source: "dsh",
 			filePath: join(dir, `${id}.json`)
 		});
+		await this.forgetDismissal(dir, id);
 		this.inflight = void 0;
+		this.invalidateScan();
 		return id;
 	}
 	/**
-	* Remove ONE account's plugin-stored credential by id.
+	* Drop one id from the dismissal list, if present.
 	*
-	* Only the VAULT entry is deleted — the desktop app's auth files are read-only
-	* to this plugin and are never touched, so an account that still exists as a
-	* desktop sign-in reappears on the next scan. That is the honest behaviour:
-	* the button means "forget what the plugin stored", not "sign the app out".
+	* Silent by design: called on the ADD paths, where a list that cannot be
+	* updated must not fail the action the user asked for. The consequence is the
+	* same as before the fix — the account stays hidden until the list is
+	* repaired — while throwing here would report a failed sign-in that succeeded.
+	*/
+	async forgetDismissal(dir, accountId) {
+		try {
+			const dismissed = await readDismissed(dir);
+			if (!dismissed.has(accountId)) return;
+			dismissed.delete(accountId);
+			await writeDismissed(dir, dismissed);
+		} catch {}
+	}
+	/**
+	* Forget EVERY dismissal, so the next read lists the accounts again.
+	*
+	* Called by the manual 「re-scan」 action. Dismissal is "hide until I ask to
+	* scan again", and this is that ask: the user is requesting what the machine
+	* currently has, which includes accounts they hid earlier. Leaving the list
+	* intact would make a removed desktop account unrecoverable from the UI — the
+	* opposite of what the button promises.
+	*
+	* PREFERS deleting the file over writing an empty list: an absent file is the
+	* normal state and keeps the vault directory free of a file that says nothing.
+	* The unlink is not the only way, though, because on Windows removing a file
+	* another process holds open fails with `EPERM`/`EBUSY`/`EACCES` — an antivirus
+	* scanner, OneDrive, or an editor with it open, the same contention the card's
+	* `isFileContentionWriteError` classifies for profile writes and the reason
+	* `docs/WINDOWS.md` keeps a register. POSIX unlinks open files happily, so
+	* without this the promise 「点重新检测账号即可找回」 would be false, silently,
+	* on exactly the platform it matters most on.
+	*
+	* So the unlink falls back to OVERWRITING the list with an empty one through
+	* the same locked atomic write `writeDismissed` uses. For every reader the two
+	* outcomes are identical (`readDismissed` yields no ids either way), so the
+	* user's ask is honoured even when the file itself cannot be removed.
+	*
+	* Returns whether the dismissals are now genuinely gone, VERIFIED by reading
+	* the list back rather than by trusting the write: the caller renders this, so
+	* "it worked" has to mean it. A `false` is the honest answer for a vault that
+	* could neither be unlinked nor rewritten, and the rescan still runs — the
+	* accounts simply stay hidden, which the UI can now say out loud instead of
+	* showing a button that appears to have done nothing.
+	*/
+	async clearDismissals() {
+		this.inflight = void 0;
+		this.invalidateScan();
+		const dir = this.vaultDir();
+		const path = join(dir, VAULT_DISMISSED_FILENAME);
+		try {
+			await rm(path, { force: true });
+		} catch {
+			try {
+				await writeDismissed(dir, /* @__PURE__ */ new Set());
+			} catch {
+				return (await readDismissed(dir)).size === 0;
+			}
+		}
+		return (await readDismissed(dir)).size === 0;
+	}
+	/**
+	* Remove ONE account from this region's list, by id.
 	*
-	* Returns whether a stored entry was actually removed, so the caller can
-	* distinguish "removed" from "this account only ever existed as a desktop
-	* sign-in" without a second scan.
+	* The account is DISMISSED, not merely deleted. Deleting the vault entry alone
+	* was undone by the next scan: `syncVault` writes every desktop sign-in it
+	* finds back into the vault (that is how a desktop account becomes selectable)
+	* and `readAll` merges the vault in afterwards, so a removed desktop account
+	* returned on the very next read while `removeAccount` had reported `true`.
+	* Measured before the fix: remove → `true`, then `accounts()` still lists it.
+	*
+	* The desktop app's auth files stay read-only: dismissing hides the account
+	* from this plugin without signing the app out, and that is exactly what the
+	* card says. Re-adding it (a fresh OAuth sign-in or an import) clears the
+	* dismissal, so the account is not lost to a future login.
+	*
+	* Returns whether a stored vault entry was also removed, so the caller can
+	* still tell "removed" from "only a desktop sign-in" — the dismissal happens
+	* either way, because only the user gets to decide an account is dismissed.
 	*/
 	async removeAccount(accountId) {
 		if (!VAULT_ACCOUNT_ID_RE.test(accountId)) throw new Error(`workbuddy: refusing to remove '${accountId}': not a vault account id`);
@@ -2557,6 +2786,17 @@ var WorkBuddyCredentialStore = class {
 		});
 		if (this.rotatedAccountId === accountId) this.rotatedAccountId = void 0;
 		if (this.accountId === accountId) this.accountId = void 0;
+		const dir = this.vaultDir();
+		try {
+			await mkdir(dir, { recursive: true });
+			const dismissed = await readDismissed(dir);
+			if (!dismissed.has(accountId)) {
+				dismissed.add(accountId);
+				await writeDismissed(dir, dismissed);
+			}
+		} catch {}
+		this.inflight = void 0;
+		this.invalidateScan();
 		return removed;
 	}
 	/**
@@ -2575,6 +2815,7 @@ var WorkBuddyCredentialStore = class {
 			recursive: true,
 			force: true
 		});
+		this.invalidateScan();
 	}
 	needsRefresh(credential) {
 		if (credential.expiresAtMs <= 0) return true;
@@ -2595,6 +2836,7 @@ var WorkBuddyCredentialStore = class {
 				...outcome.domain === void 0 || outcome.domain === "" ? {} : { domain: outcome.domain },
 				source: "dsh"
 			};
+			this.invalidateScan();
 			await writeVaultEntry(this.vaultDir(), workbuddyAccountId(credential), refreshed, credential.filePath).catch(() => {});
 			return refreshed;
 		} catch (error) {
@@ -2679,7 +2921,7 @@ var WorkBuddyCredentialStore = class {
 		const tried = [...await this.candidateFiles(), ...this.ownCandidates()];
 		try {
 			const names = await readdir(this.vaultDir());
-			for (const name of names.filter((entry) => entry.endsWith(".json"))) {
+			for (const name of names.filter(isVaultCredentialFileName)) {
 				const path = join(this.vaultDir(), name);
 				tried.push(path);
 				let text;
@@ -3197,7 +3439,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.2.0";
+const WORKBUDDY_CONNECT_VERSION = "4.3.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -247,6 +247,28 @@ declare class WorkBuddyCredentialStore {
   private desktopPathOverride;
   private accountId;
   private inflight;
+  /**
+   * In-flight/completed scan for the CURRENT `readAll` generation.
+   *
+   * One page open calls `readAll` six times: the usage route asks for the
+   * account list, the sign-in state and the resolved credential, then the
+   * per-account credits panel asks once PER ACCOUNT (`credentialFor`), and both
+   * region tabs poll on the same timer. Each call re-read every auth file,
+   * re-parsed it, and re-ran the vault merge — measured at 6 `readdir` + (6N+12)
+   * `readFile` for N accounts, i.e. the cost grew with the account count on a
+   * path whose answer cannot change within one tick.
+   *
+   * This is deliberately NOT a time-based cache: a TTL would make the card show
+   * a stale account list after an OAuth add or an import, which is the very
+   * class of bug this card keeps chasing. Instead the promise is shared while it
+   * is in flight, and every WRITE clears it (see `invalidateScan`) — so a read
+   * after a write always scans again, and a read during a scan joins it.
+   *
+   * Undefined means "no scan in flight and nothing cached".
+   */
+  private scanInflight;
+  /** When the cached scan was STARTED, epoch ms; only meaningful with it set. */
+  private scanAtMs;
   /**
    * A RUNTIME account override from the pool's rotation, or undefined.
    *
@@ -331,7 +353,22 @@ declare class WorkBuddyCredentialStore {
    * region's accounts are invisible to selection, refresh, and status alike,
    * which is what keeps the two regions' providers from cross-billing.
    */
+  /**
+   * The account list, sharing one scan across concurrent and repeated reads.
+   *
+   * See {@link scanInflight}: the whole performance fix lives in these four
+   * lines. Every caller keeps its OWN semantics (`current`, `accounts`,
+   * `status`, `selectionLost`), because this returns the same array they used
+   * to build themselves — only the filesystem work is shared.
+   *
+   * A failed scan is NOT cached: the rejection clears the slot so the next read
+   * retries, rather than pinning every later caller to one transient failure.
+   */
   private readAll;
+  /** Drop the shared scan so the next read re-reads the filesystem. */
+  private invalidateScan;
+  /** The one real scan: read every candidate file, then merge the vault. */
+  private scanAll;
   /**
    * Merge the scan's credentials into the vault and read the vault back.
    *
@@ -430,16 +467,64 @@ declare class WorkBuddyCredentialStore {
    */
   addOAuthAccount(credential: Omit<WorkBuddyCredential, 'source' | 'filePath'>): Promise<string>;
   /**
-   * Remove ONE account's plugin-stored credential by id.
-   *
-   * Only the VAULT entry is deleted — the desktop app's auth files are read-only
-   * to this plugin and are never touched, so an account that still exists as a
-   * desktop sign-in reappears on the next scan. That is the honest behaviour:
-   * the button means "forget what the plugin stored", not "sign the app out".
-   *
-   * Returns whether a stored entry was actually removed, so the caller can
-   * distinguish "removed" from "this account only ever existed as a desktop
-   * sign-in" without a second scan.
+   * Drop one id from the dismissal list, if present.
+   *
+   * Silent by design: called on the ADD paths, where a list that cannot be
+   * updated must not fail the action the user asked for. The consequence is the
+   * same as before the fix — the account stays hidden until the list is
+   * repaired — while throwing here would report a failed sign-in that succeeded.
+   */
+  private forgetDismissal;
+  /**
+   * Forget EVERY dismissal, so the next read lists the accounts again.
+   *
+   * Called by the manual 「re-scan」 action. Dismissal is "hide until I ask to
+   * scan again", and this is that ask: the user is requesting what the machine
+   * currently has, which includes accounts they hid earlier. Leaving the list
+   * intact would make a removed desktop account unrecoverable from the UI — the
+   * opposite of what the button promises.
+   *
+   * PREFERS deleting the file over writing an empty list: an absent file is the
+   * normal state and keeps the vault directory free of a file that says nothing.
+   * The unlink is not the only way, though, because on Windows removing a file
+   * another process holds open fails with `EPERM`/`EBUSY`/`EACCES` — an antivirus
+   * scanner, OneDrive, or an editor with it open, the same contention the card's
+   * `isFileContentionWriteError` classifies for profile writes and the reason
+   * `docs/WINDOWS.md` keeps a register. POSIX unlinks open files happily, so
+   * without this the promise 「点重新检测账号即可找回」 would be false, silently,
+   * on exactly the platform it matters most on.
+   *
+   * So the unlink falls back to OVERWRITING the list with an empty one through
+   * the same locked atomic write `writeDismissed` uses. For every reader the two
+   * outcomes are identical (`readDismissed` yields no ids either way), so the
+   * user's ask is honoured even when the file itself cannot be removed.
+   *
+   * Returns whether the dismissals are now genuinely gone, VERIFIED by reading
+   * the list back rather than by trusting the write: the caller renders this, so
+   * "it worked" has to mean it. A `false` is the honest answer for a vault that
+   * could neither be unlinked nor rewritten, and the rescan still runs — the
+   * accounts simply stay hidden, which the UI can now say out loud instead of
+   * showing a button that appears to have done nothing.
+   */
+  clearDismissals(): Promise<boolean>;
+  /**
+   * Remove ONE account from this region's list, by id.
+   *
+   * The account is DISMISSED, not merely deleted. Deleting the vault entry alone
+   * was undone by the next scan: `syncVault` writes every desktop sign-in it
+   * finds back into the vault (that is how a desktop account becomes selectable)
+   * and `readAll` merges the vault in afterwards, so a removed desktop account
+   * returned on the very next read while `removeAccount` had reported `true`.
+   * Measured before the fix: remove → `true`, then `accounts()` still lists it.
+   *
+   * The desktop app's auth files stay read-only: dismissing hides the account
+   * from this plugin without signing the app out, and that is exactly what the
+   * card says. Re-adding it (a fresh OAuth sign-in or an import) clears the
+   * dismissal, so the account is not lost to a future login.
+   *
+   * Returns whether a stored vault entry was also removed, so the caller can
+   * still tell "removed" from "only a desktop sign-in" — the dismissal happens
+   * either way, because only the user gets to decide an account is dismissed.
    */
   removeAccount(accountId: string): Promise<boolean>;
   /**

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as isWorkbuddyBundle, A as workbuddyAccountId, B as parseCreditMultiplier, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, H as parseUpstreamModel, I as classifyUpstreamError, J as deriveAtRestKeyId, K as clearAtRestKeyCache, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as isEncryptedFieldWrapper, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as prepareChatBody, V as parseReasoning, W as regionOf, X as findWorkbuddyAppExecutable, Y as fetchAtRestKeyPayload, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as macosBundleExecutable, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as workbuddyAppExecutableCandidates, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as openEncryptedField, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as deriveAtRestKey, r as isHeartbeatProcessAlive, rt as readAtRestKey, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosNestedAppBundles, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-C4TXu8ew.js";
+import { $ as isWorkbuddyBundle, A as workbuddyAccountId, B as parseCreditMultiplier, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, H as parseUpstreamModel, I as classifyUpstreamError, J as deriveAtRestKeyId, K as clearAtRestKeyCache, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as isEncryptedFieldWrapper, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as prepareChatBody, V as parseReasoning, W as regionOf, X as findWorkbuddyAppExecutable, Y as fetchAtRestKeyPayload, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as macosBundleExecutable, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as workbuddyAppExecutableCandidates, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as openEncryptedField, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as deriveAtRestKey, r as isHeartbeatProcessAlive, rt as readAtRestKey, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosNestedAppBundles, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-jNlsUMZO.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -3952,9 +3952,14 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				try {
-					const accounts = await deps.store(region).accounts();
+					const store = deps.store(region);
+					const dismissalsCleared = await store.clearDismissals();
+					const accounts = await store.accounts();
 					deps.regionUsable?.(region, accounts.length > 0);
-					json(res, 200, { accounts: accounts.map(toWebAccount) });
+					json(res, 200, {
+						accounts: accounts.map(toWebAccount),
+						dismissalsCleared
+					});
 				} catch (error) {
 					json(res, 500, { error: safeMessage(error) });
 				}

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",