dsh-connect-workbuddy 5.5.0 → 5.5.1

package/CHANGELOG.md

@@ -1,11 +1,21 @@
 # Changelog
 
-## Unreleased
+## 5.5.1 (2026-10-23)
+
+> 补丁版本：修「账号池状态重启就失效」的根因，以及同一症状的另外三处（手动排序箭头、`regionsMapOf` 跳层读旧副本、卡片保存把脏数据带回去）。**没有新增任何功能**：请求路径、provider 路由、模型目录、计费与凭据一律未变，5.5.0 的全部能力原样保留。
+> **本版会主动改写一个设置字段的形状**：被 5.4.0–5.5.0 写脏的 `regions` 字段会在**开机时**被清洗一次（只动形状，不动任何区域内容，干净 profile 不写）。如果你正是「账号池重启就失效」的受害者，升级后重启一次即可恢复，**不需要手动改 profile**；国际版整槽沉到第 4 层的情况也会被捞回来（本机实测 3 个成员与 27 个模型目录）。
 
 ### Fixes
 
 - **排序箭头在「账号池还没保存开启」时不出现 —— 先勾选再排序这条自然路径被堵死。** `AccountPool.tsx` 的 `moveEnabled` 读的是**已保存**的 `pool.enabled`，而同一行旁边的 `isMember` 读的却是**草稿** `active.memberAccountIds`。于是：勾选账号入池（草稿变了）→ 想去排序 → **箭头根本不存在**，因为开关还没保存；用户既看不到箭头，也就没有理由去按保存，下一次保存自然「什么都没写」——这正是「手动排序没保存」的实际形态。改成读草稿的 `active.enabled`：箭头描述的是草稿，就该跟着草稿走（报告运行中的池仍然是 `poolRunning`，那个值没有动）。变异验证：改回 `pool.enabled`，新增用例立刻红（期望 4 个箭头、实际 0 个）。
 - **`regionsMapOf()` 会跳到更深一层，读到同名区域的过期副本。** 旧规则是「只要有 `regions` 键就往下跳」，理由是可以同时接受「整份 settings」和「regions map」两种入参。但 regions **map 自己也可能有 `regions` 键** —— 本机真实 profile 里 `config.regions` 下就躺着 `accounts` / `regions` / `cliBridge` 三个旧写入留下的兄弟键。一旦跳下去，读到的就是**另一份更旧的同名区域**：实测同一份文档，「按 section 读」得到 `['c','a','b']`，「按 map 读」得到 `[]`（正是「排序明明存了却读不出来」）。现在改为**按形状判定**：外层对象只要含有区域 id（`cn` / `global`）就是 map，直接用它；否则才是 section，才往里跳。变异验证：把判定换回无条件跳，新增用例立刻红。
+- **「账号池状态重启就失效」的根因：目录修复把整份 settings 写进了 `regions` 字段。** 上一条修的是**读**，这一条修的是**造出那份脏数据的写**。`writeRegionCatalog()` 用 `{ op: 'set', path: ['regions'] }` 写回目录，所以它的值必须是 `regions` **字段**；但它把 `describe().value`（**整份 section**：`{authFile, accounts, regions, cliBridge, …}`）交给了 `mergeRegionCatalog()`，而后者把入参当字段读、又原样展开写回。结果每次开机目录修复都把 section 写进字段：真正的区域表被推到下一层 `regions` 键里，`accounts` / `cliBridge` 成了两个假区域槽，于是宿主 `regionStateOf(config, 'cn')`（只读一层）读到的是**空** —— 账号池开关、成员、手动排序、目标模型、模型选择全部「看起来没保存」，下次保存再把这份空写回去。每次开机多一层：本机实测 5 层、字段 103 KB（其中 3 层是纯拷贝）。修法：`mergeRegionCatalog()` 统一走 `regionsMapOf()`（接受 section 或字段），返回值恒为字段本身；`regionStateOf()`、设置保存端点 `__save`、卡片各写路径的合并基点、以及 `readOrderAccountIds()` 全部改走同一个窄化函数。
+  - **脏 profile 不靠人手修**：`regionsMapOf()` 现在同时做三件事 —— 丢掉 section/槽位的兄弟键名拷贝；把只活在下层的区域**捞回来**（本机 `global` 就是这种情况：外层 `cn` 还在、国际版整槽只在下一层，不捞就等于让第一次写入删掉用户的国际版池）；「在表里的区域」仍然以外层为准，且当多个深层副本都有同一区域时按**用户配置量**取舍而不是按深浅（本机就有 `{lastCatalog}` 的空壳副本躺在一个仍有 3 个成员的真副本上面 —— 按深浅会捞回空壳）。修复写仍只在目录指纹变化时触发，但**字段脏时也写一次**，否则「目录恰好一致」的 profile 永远等不到打扫。
+  - **修复写不再「只在目录变了才写」**：目录指纹相同时，只要 `Config['regions']` 还带兄弟键名就照写一次（`regionsFieldIsCorrupt()`），否则「目录恰好与上游一致」的 profile 永远等不到打扫 —— 那种 profile 的脏数据会活得比产生它的 bug 还久。写一次即净，之后这条分支不再触发。
+  - **开机再补一次独立清洗**（`healRegionsField()`）：上面那条挂在「拿到实时模型目录」之后，于是关掉的区域、断网启动、上游空回答这三种情况都不会清洗。新增一次纯形状写入 —— 不需要上游、不碰任何区域内容、干净 profile 直接返回不写（只扫一遍键名），失败只记 warn（读侧本来就已是对的）。
+  - **代价控制在请求路径上**：`regionStateOf()` 现在是每次请求都会走的读（池开关、模型选择、额度门控），而 heal 会深拷贝整份字段（每区一份多模型目录）。实测 28 模型槽位：不做快路径是 **11 µs/次**（原来裸读 0.05 µs），加「干净字段原样返回」的快路径后回到 **0.09 µs**；脏字段 0.86 µs 且只到 profile 被写入修复为止。快路径的成立条件写在代码注释里（只有**字段本身**是 volatile，槽内是普通数据），并用同引用断言（`toBe`）钉住，防止以后被顺手删掉。
+  - **实测（本机真实 profile）**：修复前该字段 5 层嵌套、103 KB；用新 `mergeRegionCatalog()` 对同一份 section 重算，输出恰为 `['cn','global']`，13 KB；`cn` 保住 `pool.enabled=true` / `step-5-preview` / **8 个成员**，`global` 从下层捞回 `pool.enabled=true` / `deepseek-v4.1-flash` / **3 个成员**与 27 个模型目录。另有「主动清空」的保护：外层已显式写成 `null`（schemastery 把 `{}` 简化成 `null`）时不再从下层捞，否则会把用户清掉的池子复活。
+  - **变异验证（六处，逐个改回旧行为都必红）**：①`mergeRegionCatalog()` 改回「把入参当字段」→ `catalog-write.spec.ts` 红 4 条；②`regionStateOf()` 改回单层裸读 → `region.spec.ts` 红（`global` 读成空）；③`__save` 改回对原始字段合并 → `web-status.spec.ts` 红（写回的值里出现 `regions` 兄弟键、`global` 消失）；④卡片写路径改回直接展开原始快照 → `client-account-selection.spec.ts` 红；⑤删掉快路径 → `region.spec.ts` 的同引用断言红；⑥删掉开机清洗的脏判断 → `catalog-write.spec.ts` 的「干净字段不写」红。新增 24 条测试（`catalog-write.spec.ts` 13 条、`region.spec.ts` 8 条、`web-status.spec.ts` / `client-account-selection.spec.ts` / `manual-order.spec.ts` 各 1 条）。
 
 ### Docs
 

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as defaultDesktopAuthCandidates, L as WorkBuddyUpstreamClient, M as workbuddyOwnAuthPath, Mt as hostPeersInfo, a as readHostHeartbeat, b as WorkBuddyCredentialStore, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, k as legacyWorkbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, vt as WORKBUDDY_APP_EXECUTABLE_ENV, w as defaultDesktopAuthDirs, wt as findWorkbuddyAppExecutableWithSource, y as WORKBUDDY_AUTH_FILE_ENV } from "./host-heartbeat-CVnH8S3J.js";
+import { C as defaultDesktopAuthCandidates, L as WorkBuddyUpstreamClient, M as workbuddyOwnAuthPath, Mt as hostPeersInfo, a as readHostHeartbeat, b as WorkBuddyCredentialStore, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, k as legacyWorkbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, vt as WORKBUDDY_APP_EXECUTABLE_ENV, w as defaultDesktopAuthDirs, wt as findWorkbuddyAppExecutableWithSource, y as WORKBUDDY_AUTH_FILE_ENV } from "./host-heartbeat-BhgyeZWV.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -204,15 +204,166 @@ window.__ModuleLoader__.load({
 		* counts as the whole section only when it shows a key that is neither a region
 		* id nor a known sibling — i.e. it looks like a settings document. A plain (or
 		* dirty) `cn` / `global` map is returned as-is.
+		*
+		* THE RESULT IS HEALED, not merely narrowed — see {@link healedRegionsMap}.
+		* Returning the map "as-is" is what let a corrupted document keep reading as
+		* half-empty: the field held `cn` at level 0 and `global` only one level down,
+		* so every `global` question answered "never configured" even though the file
+		* still had the answer. Reads and writes both come through here, so healing
+		* here fixes both halves at once (the Host's `regionStateOf`, the card's
+		* `nextRegion*` write bases, and the catalog repair's write).
 		*/
 		function regionsMapOf(value) {
+			const peeled = peelLiveReference(value);
+			if (typeof peeled === "object" && peeled !== null && !Array.isArray(peeled)) {
+				const candidate = peeled;
+				if (!isRecord(candidate["regions"]) && !carriesForeignKey(candidate)) return candidate;
+			}
 			const unwrapped = unwrapVolatileDeep(value);
 			if (typeof unwrapped !== "object" || unwrapped === null || Array.isArray(unwrapped)) return {};
 			const record = unwrapped;
 			const nested = record["regions"];
-			if (typeof nested !== "object" || nested === null || Array.isArray(nested)) return record;
-			const regionIds = WORKBUDDY_REGIONS;
-			return Object.keys(record).some((key) => regionIds.includes(key)) ? record : nested;
+			if (typeof nested !== "object" || nested === null || Array.isArray(nested)) return healedRegionsMap(record);
+			return healedRegionsMap(hasRegionKey(record) ? record : nested);
+		}
+		/** `value` with ONE `{get(): T}` live reference peeled, exactly like a read. */
+		function peelLiveReference(value) {
+			if (value === null || typeof value !== "object") return value;
+			const get = value.get;
+			return typeof get === "function" ? get() : value;
+		}
+		/** Whether the object carries a sibling-field name where a region id belongs. */
+		function carriesForeignKey(record) {
+			return Object.keys(record).some((key) => REGION_MAP_FOREIGN_KEYS.has(key));
+		}
+		/**
+		* Names that belong to the settings SECTION (`Config` in `src/index.ts`) or to
+		* one region SLOT (`regionStateConfig`) — never to the `regions` map.
+		*
+		* They are the signature of a data-loss bug and the list that undoes it. From
+		* 5.4.0 to 5.5.0 `mergeRegionCatalog` was handed the WHOLE settings section but
+		* read it as the `regions` field, so every boot's directory repair wrote
+		* `{ accounts, regions, cliBridge }` INTO the field — replacing the region map
+		* and burying the real one under a `regions` key. A live profile ended up five
+		* levels deep (one per startup) and 258 KB of duplicated slots.
+		*
+		* Neither a region id (`cn` / `global`) nor any future one can collide with
+		* these names, so removing them from the map is safe, idempotent, and does not
+		* discard a region that a newer build might add.
+		*/
+		const REGION_MAP_FOREIGN_KEYS = /* @__PURE__ */ new Set([
+			"authFile",
+			"accountId",
+			"accounts",
+			"regions",
+			"cliBridge",
+			"enabled",
+			"showCreditsInMainUi",
+			"creditPosition",
+			"lastCatalog",
+			"enabledModelIds",
+			"imageModelIds",
+			"imageToolEnabled",
+			"offModelIds",
+			"contextBudgets",
+			"pool"
+		]);
+		/** A non-null, non-array object: the only shape a slot or a level can have. */
+		function isRecord(value) {
+			return typeof value === "object" && value !== null && !Array.isArray(value);
+		}
+		/** Whether a map carries at least one real region id. */
+		function hasRegionKey(map) {
+			return Object.keys(map).some((key) => WORKBUDDY_REGIONS.includes(key));
+		}
+		/**
+		* How much USER CONFIG one candidate slot actually carries.
+		*
+		* Used only when the map lost a region and the copies left at different depths
+		* disagree — and they do: the bug's own directory repair wrote a slot that held
+		* nothing but `lastCatalog` (it started from a map where the region was already
+		* missing), while the copy further down still holds the pool the user had
+		* checked in. "Shallowest wins" would therefore resurrect the EMPTY one and
+		* throw away the real configuration. Depth is not age in this wreckage; CONTENT
+		* is the only usable signal.
+		*
+		* Deliberately counts only non-default, user-authored values: resolved slots
+		* carry every schema default, so a slot's key count says nothing.
+		*/
+		function slotConfigWeight(slot) {
+			let weight = 0;
+			const pool = slot["pool"];
+			if (isRecord(pool)) {
+				if (pool["enabled"] === true) weight += 4;
+				if (Array.isArray(pool["memberAccountIds"]) && pool["memberAccountIds"].length > 0) weight += 4;
+				if (Array.isArray(pool["orderAccountIds"]) && pool["orderAccountIds"].length > 0) weight += 2;
+				if (typeof pool["targetModelId"] === "string" && pool["targetModelId"] !== "") weight += 2;
+				if (typeof pool["probeInputTokens"] === "number" && pool["probeInputTokens"] > 0) weight += 1;
+			}
+			for (const key of [
+				"enabledModelIds",
+				"imageModelIds",
+				"offModelIds"
+			]) {
+				const list = slot[key];
+				if (Array.isArray(list) && list.length > 0) weight += 1;
+			}
+			const budgets = slot["contextBudgets"];
+			if (isRecord(budgets) && Object.keys(budgets).length > 0) weight += 1;
+			if (slot["enabled"] === false) weight += 1;
+			if (slot["showCreditsInMainUi"] === false) weight += 1;
+			if (slot["imageToolEnabled"] === true) weight += 1;
+			return weight;
+		}
+		/**
+		* The `regions` map with a corrupted document's wreckage removed.
+		*
+		* Two repairs, both keyed on the bug's signature (a foreign key or a nested
+		* `regions` copy) so a HEALTHY map passes through untouched:
+		*
+		*  1. DROP every key that names a section field or a slot field. Those are the
+		*     copies the bug wrote; keeping them means the next save carries them
+		*     forward forever.
+		*  2. RECOVER a region this level does not have from the copies buried beneath
+		*     it. A region that IS here is never replaced — the outer copy is the one
+		*     the surviving writers have been updating, and re-reading a stale inner
+		*     copy over it is exactly the defect the shape rule above was fixed for.
+		*
+		* Recovery exists because `global` in the measured profile lived ONLY one level
+		* down: without it, the host reads that region as "never configured" and the
+		* first write after the fix would delete the user's international pool outright.
+		*
+		* Among the buried copies of a MISSING region, the one carrying the most user
+		* configuration wins rather than the shallowest — see {@link slotConfigWeight}:
+		* the bug's own directory repair left `{ lastCatalog }` slots that look newer
+		* but hold nothing, one level above the copy with the pool still in it.
+		*/
+		function healedRegionsMap(map) {
+			const healed = {};
+			for (const [key, slot] of Object.entries(map)) {
+				if (REGION_MAP_FOREIGN_KEYS.has(key)) continue;
+				healed[key] = slot;
+			}
+			const recovered = {};
+			let deeper = map;
+			for (let depth = 0; depth < 8; depth += 1) {
+				const nested = deeper["regions"];
+				if (!isRecord(nested)) break;
+				for (const region of WORKBUDDY_REGIONS) {
+					if (region in map) continue;
+					const candidate = nested[region];
+					if (!isRecord(candidate)) continue;
+					const weight = slotConfigWeight(candidate);
+					const best = recovered[region];
+					if (best === void 0 || weight > best.weight) recovered[region] = {
+						slot: candidate,
+						weight
+					};
+				}
+				deeper = nested;
+			}
+			for (const [region, entry] of Object.entries(recovered)) healed[region] = entry.slot;
+			return healed;
 		}
 		/** One region's stored slot as a plain object; any other shape reads as empty. */
 		function regionSlotOf(value, region) {
@@ -537,7 +688,9 @@ window.__ModuleLoader__.load({
 		* value, so reading it wrong silently deleted the untouched region.
 		*/
 		function fieldSnapshotOf(scope, field) {
-			const value = unwrapVolatileDeep(scope.getSnapshot().value?.[field]);
+			const stored = scope.getSnapshot().value?.[field];
+			if (field === "regions") return regionsMapOf(stored);
+			const value = unwrapVolatileDeep(stored);
 			return typeof value === "object" && value !== null ? value : {};
 		}
 		/**
@@ -884,12 +1037,18 @@ window.__ModuleLoader__.load({
 		* `orderAccountIds` may be anything at all. Every shape that is not a list of
 		* strings means "no manual order", which is also an older profile's spelling —
 		* never a crash.
+		*
+		* The map comes from `regionsMapOf` rather than a bare `value.regions` lookup:
+		* it accepts the section OR the field and heals a field an older build
+		* corrupted (the "restart reset" report). That is not cosmetic here — on the
+		* measured profile the INTERNATIONAL slot survived only one level down, so a
+		* direct lookup reported "no manual order" for the region whose order the user
+		* had actually saved, and the credit panel listed those accounts in the Host's
+		* order instead.
 		*/
 		function readOrderAccountIds(value, region) {
 			if (region === void 0) return [];
-			const regions = value?.regions;
-			if (typeof regions !== "object" || regions === null) return [];
-			const slot = regions[region];
+			const slot = regionsMapOf(value)[region];
 			if (typeof slot !== "object" || slot === null) return [];
 			const order = slot.pool;
 			if (typeof order !== "object" || order === null) return [];

package/lib/{host-heartbeat-CVnH8S3J.js → host-heartbeat-BhgyeZWV.js}

@@ -5966,7 +5966,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "5.5.0";
+const WORKBUDDY_CONNECT_VERSION = "5.5.1";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -2911,6 +2911,57 @@ declare function withWorkBuddyRegion(path: string, region: WorkBuddyWebRegion):
  * answer 400 instead of guessing.
  */
 declare function regionOfStatusUrl(url: string): WorkBuddyWebRegion | undefined;
+/**
+ * Narrow a settings value to the `regions` map. Accepts EITHER the whole
+ * settings section (the Host's resolved `Config`) OR the `regions` map itself,
+ * and unwraps the former. This tolerance is deliberate: passing the whole
+ * section where the map was expected was a real shipped bug in the sibling
+ * project — the lookup then read `section['cn']` (absent), so the card's
+ * checkbox reported `true` forever and clicking it appeared to do nothing even
+ * though the write succeeded.
+ *
+ * The resolved section delivers `regions` as a `{get(): T}` LIVE reference, and
+ * a live reference is `typeof === 'object'` and not an array — so it passes a
+ * naive object check and gets returned as if it were the map. Every lookup on
+ * it is then `undefined`: the enabled flag reads back as "on" forever (the very
+ * symptom described above), and a merge that spreads this map silently drops
+ * the region it was not editing. Unwrap before narrowing.
+ *
+ * THE HOP IS CONDITIONAL, and that is the whole point (a saved manual pool
+ * order "disappearing"). "Has a `regions` key" is NOT sufficient evidence that
+ * the caller passed the whole section: the `regions` MAP can legitimately carry
+ * a `regions` key of its own, because an earlier build could write a sibling
+ * field name into it — a live profile was found with `accounts`, `regions` and
+ * `cliBridge` sitting beside `cn` / `global`. Hopping there means reading a
+ * DIFFERENT, older copy of the same region: measured, the same document returned
+ * `['c','a','b']` when read as a section and `[]` when read as a map. So a value
+ * counts as the whole section only when it shows a key that is neither a region
+ * id nor a known sibling — i.e. it looks like a settings document. A plain (or
+ * dirty) `cn` / `global` map is returned as-is.
+ *
+ * THE RESULT IS HEALED, not merely narrowed — see {@link healedRegionsMap}.
+ * Returning the map "as-is" is what let a corrupted document keep reading as
+ * half-empty: the field held `cn` at level 0 and `global` only one level down,
+ * so every `global` question answered "never configured" even though the file
+ * still had the answer. Reads and writes both come through here, so healing
+ * here fixes both halves at once (the Host's `regionStateOf`, the card's
+ * `nextRegion*` write bases, and the catalog repair's write).
+ */
+declare function regionsMapOf(value: unknown): Record<string, unknown>;
+/**
+ * Whether the stored `regions` FIELD still carries the debris described at
+ * {@link REGION_MAP_FOREIGN_KEYS}.
+ *
+ * Pass the field itself (`Config['regions']`), not the whole section: the
+ * section legitimately has `accounts` / `cliBridge` beside `regions`, so asking
+ * that question of a section would always answer "corrupt".
+ *
+ * The catalog repair uses it to write even when the model directory already
+ * matches: without that, a profile whose directory is in agreement would never
+ * be cleaned — the very shape that made the pool look unsaved would outlive the
+ * fix that stops producing it.
+ */
+declare function regionsFieldIsCorrupt(value: unknown): boolean;
 /**
  * Whether one region's provider is switched on. Opt-out semantics: only an
  * explicit `false` disables it, so a config written before this switch existed
@@ -4446,4 +4497,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_TPS_PATH, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, modelIdOfBody, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_TPS_PATH, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, modelIdOfBody, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, regionsFieldIsCorrupt, regionsMapOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as prepareChatBody, A as parseWorkBuddyAuth, At as readAtRestKey, B as declaredTools, C as defaultDesktopAuthCandidates, Ct as findWorkbuddyAppExecutable, D as isEncryptedCredentialError, Dt as macosBundleExecutable, E as hasEncryptedCredentialFields, Et as isWorkbuddyBundle, F as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, Ft as writeFileAtomic, G as isFirstMessageGateBody, H as isContextTooLongBody, I as WorkBuddyCredentialRejectedError, J as openingEvidenceOfBody, K as knownRegionOf, L as WorkBuddyUpstreamClient, M as workbuddyOwnAuthPath, N as CONTEXT_OVERFLOW_MARKER, Nt as resolveDshHome, O as isVaultAccountId, Ot as macosNestedAppBundles, P as CREDENTIAL_REJECTED_CODE, Pt as withFileLock, Q as perturbChannelFingerprints, R as channelGateMemberOf, S as authFileName, St as fetchAtRestKeyPayload, T as defaultDesktopAuthPath, Tt as isEncryptedFieldWrapper, U as isConversationIdGateBody, V as forceNeutralHead, W as isCredentialRejectedError, X as parseReasoning, Y as parseCreditMultiplier, Z as parseUpstreamModel, _ as ENCRYPTED_CREDENTIAL_CODE, _t as nativeModalityOf, a as readHostHeartbeat, at as lastRefusalFor, b as WorkBuddyCredentialStore, bt as deriveAtRestKey, c as WORKBUDDY_CONNECT_VERSION, ct as recordRefusal, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as WorkBuddyImageError, et as regionOf, f as WorkBuddyCatalog, ft as pickImageModel, g as withoutRouters, gt as imageDefaultFor, h as fallbackModelsFor, ht as NATIVE_MODALITY_BY_MODEL_ID, i as processStartTimeMs, it as defaultOffModelIds, j as workbuddyAccountId, jt as workbuddyAppExecutableCandidates, k as legacyWorkbuddyOwnAuthPath, kt as openEncryptedField, l as piAiRuntimeInfo, lt as withEffectiveOff, m as deriveCatalog, mt as queueNoticeText, n as clearHostHeartbeat, nt as attachBusyLevels, o as workbuddyHostHeartbeatPath, ot as offDefaultFor, p as applyContextBudgets, pt as parseQueueAnswer, q as modelIdOfBody, r as isHeartbeatProcessAlive, rt as REFUSES_OFF_MODEL_IDS, s as writeHostHeartbeat, st as offRefused, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as requestEvidenceOf, u as FALLBACK_WORKBUDDY_MODELS, ut as DEFAULT_IMAGE_SIZE, v as WORKBUDDY_AUTH_FILENAME, vt as WORKBUDDY_APP_EXECUTABLE_ENV, w as defaultDesktopAuthDirs, x as WorkBuddyEncryptedCredentialError, xt as deriveAtRestKeyId, y as WORKBUDDY_AUTH_FILE_ENV, yt as clearAtRestKeyCache, z as classifyUpstreamError } from "./host-heartbeat-CVnH8S3J.js";
+import { $ as prepareChatBody, A as parseWorkBuddyAuth, At as readAtRestKey, B as declaredTools, C as defaultDesktopAuthCandidates, Ct as findWorkbuddyAppExecutable, D as isEncryptedCredentialError, Dt as macosBundleExecutable, E as hasEncryptedCredentialFields, Et as isWorkbuddyBundle, F as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, Ft as writeFileAtomic, G as isFirstMessageGateBody, H as isContextTooLongBody, I as WorkBuddyCredentialRejectedError, J as openingEvidenceOfBody, K as knownRegionOf, L as WorkBuddyUpstreamClient, M as workbuddyOwnAuthPath, N as CONTEXT_OVERFLOW_MARKER, Nt as resolveDshHome, O as isVaultAccountId, Ot as macosNestedAppBundles, P as CREDENTIAL_REJECTED_CODE, Pt as withFileLock, Q as perturbChannelFingerprints, R as channelGateMemberOf, S as authFileName, St as fetchAtRestKeyPayload, T as defaultDesktopAuthPath, Tt as isEncryptedFieldWrapper, U as isConversationIdGateBody, V as forceNeutralHead, W as isCredentialRejectedError, X as parseReasoning, Y as parseCreditMultiplier, Z as parseUpstreamModel, _ as ENCRYPTED_CREDENTIAL_CODE, _t as nativeModalityOf, a as readHostHeartbeat, at as lastRefusalFor, b as WorkBuddyCredentialStore, bt as deriveAtRestKey, c as WORKBUDDY_CONNECT_VERSION, ct as recordRefusal, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as WorkBuddyImageError, et as regionOf, f as WorkBuddyCatalog, ft as pickImageModel, g as withoutRouters, gt as imageDefaultFor, h as fallbackModelsFor, ht as NATIVE_MODALITY_BY_MODEL_ID, i as processStartTimeMs, it as defaultOffModelIds, j as workbuddyAccountId, jt as workbuddyAppExecutableCandidates, k as legacyWorkbuddyOwnAuthPath, kt as openEncryptedField, l as piAiRuntimeInfo, lt as withEffectiveOff, m as deriveCatalog, mt as queueNoticeText, n as clearHostHeartbeat, nt as attachBusyLevels, o as workbuddyHostHeartbeatPath, ot as offDefaultFor, p as applyContextBudgets, pt as parseQueueAnswer, q as modelIdOfBody, r as isHeartbeatProcessAlive, rt as REFUSES_OFF_MODEL_IDS, s as writeHostHeartbeat, st as offRefused, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as requestEvidenceOf, u as FALLBACK_WORKBUDDY_MODELS, ut as DEFAULT_IMAGE_SIZE, v as WORKBUDDY_AUTH_FILENAME, vt as WORKBUDDY_APP_EXECUTABLE_ENV, w as defaultDesktopAuthDirs, x as WorkBuddyEncryptedCredentialError, xt as deriveAtRestKeyId, y as WORKBUDDY_AUTH_FILE_ENV, yt as clearAtRestKeyCache, z as classifyUpstreamError } from "./host-heartbeat-BhgyeZWV.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -451,15 +451,184 @@ function regionOfStatusUrl(url) {
 * counts as the whole section only when it shows a key that is neither a region
 * id nor a known sibling — i.e. it looks like a settings document. A plain (or
 * dirty) `cn` / `global` map is returned as-is.
+*
+* THE RESULT IS HEALED, not merely narrowed — see {@link healedRegionsMap}.
+* Returning the map "as-is" is what let a corrupted document keep reading as
+* half-empty: the field held `cn` at level 0 and `global` only one level down,
+* so every `global` question answered "never configured" even though the file
+* still had the answer. Reads and writes both come through here, so healing
+* here fixes both halves at once (the Host's `regionStateOf`, the card's
+* `nextRegion*` write bases, and the catalog repair's write).
 */
 function regionsMapOf(value) {
+	const peeled = peelLiveReference(value);
+	if (typeof peeled === "object" && peeled !== null && !Array.isArray(peeled)) {
+		const candidate = peeled;
+		if (!isRecord$1(candidate["regions"]) && !carriesForeignKey(candidate)) return candidate;
+	}
 	const unwrapped = unwrapVolatileDeep(value);
 	if (typeof unwrapped !== "object" || unwrapped === null || Array.isArray(unwrapped)) return {};
 	const record = unwrapped;
 	const nested = record["regions"];
-	if (typeof nested !== "object" || nested === null || Array.isArray(nested)) return record;
-	const regionIds = WORKBUDDY_REGIONS;
-	return Object.keys(record).some((key) => regionIds.includes(key)) ? record : nested;
+	if (typeof nested !== "object" || nested === null || Array.isArray(nested)) return healedRegionsMap(record);
+	return healedRegionsMap(hasRegionKey(record) ? record : nested);
+}
+/** `value` with ONE `{get(): T}` live reference peeled, exactly like a read. */
+function peelLiveReference(value) {
+	if (value === null || typeof value !== "object") return value;
+	const get = value.get;
+	return typeof get === "function" ? get() : value;
+}
+/** Whether the object carries a sibling-field name where a region id belongs. */
+function carriesForeignKey(record) {
+	return Object.keys(record).some((key) => REGION_MAP_FOREIGN_KEYS.has(key));
+}
+/**
+* Names that belong to the settings SECTION (`Config` in `src/index.ts`) or to
+* one region SLOT (`regionStateConfig`) — never to the `regions` map.
+*
+* They are the signature of a data-loss bug and the list that undoes it. From
+* 5.4.0 to 5.5.0 `mergeRegionCatalog` was handed the WHOLE settings section but
+* read it as the `regions` field, so every boot's directory repair wrote
+* `{ accounts, regions, cliBridge }` INTO the field — replacing the region map
+* and burying the real one under a `regions` key. A live profile ended up five
+* levels deep (one per startup) and 258 KB of duplicated slots.
+*
+* Neither a region id (`cn` / `global`) nor any future one can collide with
+* these names, so removing them from the map is safe, idempotent, and does not
+* discard a region that a newer build might add.
+*/
+const REGION_MAP_FOREIGN_KEYS = /* @__PURE__ */ new Set([
+	"authFile",
+	"accountId",
+	"accounts",
+	"regions",
+	"cliBridge",
+	"enabled",
+	"showCreditsInMainUi",
+	"creditPosition",
+	"lastCatalog",
+	"enabledModelIds",
+	"imageModelIds",
+	"imageToolEnabled",
+	"offModelIds",
+	"contextBudgets",
+	"pool"
+]);
+/** A non-null, non-array object: the only shape a slot or a level can have. */
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Whether a map carries at least one real region id. */
+function hasRegionKey(map) {
+	return Object.keys(map).some((key) => WORKBUDDY_REGIONS.includes(key));
+}
+/**
+* How much USER CONFIG one candidate slot actually carries.
+*
+* Used only when the map lost a region and the copies left at different depths
+* disagree — and they do: the bug's own directory repair wrote a slot that held
+* nothing but `lastCatalog` (it started from a map where the region was already
+* missing), while the copy further down still holds the pool the user had
+* checked in. "Shallowest wins" would therefore resurrect the EMPTY one and
+* throw away the real configuration. Depth is not age in this wreckage; CONTENT
+* is the only usable signal.
+*
+* Deliberately counts only non-default, user-authored values: resolved slots
+* carry every schema default, so a slot's key count says nothing.
+*/
+function slotConfigWeight(slot) {
+	let weight = 0;
+	const pool = slot["pool"];
+	if (isRecord$1(pool)) {
+		if (pool["enabled"] === true) weight += 4;
+		if (Array.isArray(pool["memberAccountIds"]) && pool["memberAccountIds"].length > 0) weight += 4;
+		if (Array.isArray(pool["orderAccountIds"]) && pool["orderAccountIds"].length > 0) weight += 2;
+		if (typeof pool["targetModelId"] === "string" && pool["targetModelId"] !== "") weight += 2;
+		if (typeof pool["probeInputTokens"] === "number" && pool["probeInputTokens"] > 0) weight += 1;
+	}
+	for (const key of [
+		"enabledModelIds",
+		"imageModelIds",
+		"offModelIds"
+	]) {
+		const list = slot[key];
+		if (Array.isArray(list) && list.length > 0) weight += 1;
+	}
+	const budgets = slot["contextBudgets"];
+	if (isRecord$1(budgets) && Object.keys(budgets).length > 0) weight += 1;
+	if (slot["enabled"] === false) weight += 1;
+	if (slot["showCreditsInMainUi"] === false) weight += 1;
+	if (slot["imageToolEnabled"] === true) weight += 1;
+	return weight;
+}
+/**
+* The `regions` map with a corrupted document's wreckage removed.
+*
+* Two repairs, both keyed on the bug's signature (a foreign key or a nested
+* `regions` copy) so a HEALTHY map passes through untouched:
+*
+*  1. DROP every key that names a section field or a slot field. Those are the
+*     copies the bug wrote; keeping them means the next save carries them
+*     forward forever.
+*  2. RECOVER a region this level does not have from the copies buried beneath
+*     it. A region that IS here is never replaced — the outer copy is the one
+*     the surviving writers have been updating, and re-reading a stale inner
+*     copy over it is exactly the defect the shape rule above was fixed for.
+*
+* Recovery exists because `global` in the measured profile lived ONLY one level
+* down: without it, the host reads that region as "never configured" and the
+* first write after the fix would delete the user's international pool outright.
+*
+* Among the buried copies of a MISSING region, the one carrying the most user
+* configuration wins rather than the shallowest — see {@link slotConfigWeight}:
+* the bug's own directory repair left `{ lastCatalog }` slots that look newer
+* but hold nothing, one level above the copy with the pool still in it.
+*/
+function healedRegionsMap(map) {
+	const healed = {};
+	for (const [key, slot] of Object.entries(map)) {
+		if (REGION_MAP_FOREIGN_KEYS.has(key)) continue;
+		healed[key] = slot;
+	}
+	const recovered = {};
+	let deeper = map;
+	for (let depth = 0; depth < 8; depth += 1) {
+		const nested = deeper["regions"];
+		if (!isRecord$1(nested)) break;
+		for (const region of WORKBUDDY_REGIONS) {
+			if (region in map) continue;
+			const candidate = nested[region];
+			if (!isRecord$1(candidate)) continue;
+			const weight = slotConfigWeight(candidate);
+			const best = recovered[region];
+			if (best === void 0 || weight > best.weight) recovered[region] = {
+				slot: candidate,
+				weight
+			};
+		}
+		deeper = nested;
+	}
+	for (const [region, entry] of Object.entries(recovered)) healed[region] = entry.slot;
+	return healed;
+}
+/**
+* Whether the stored `regions` FIELD still carries the debris described at
+* {@link REGION_MAP_FOREIGN_KEYS}.
+*
+* Pass the field itself (`Config['regions']`), not the whole section: the
+* section legitimately has `accounts` / `cliBridge` beside `regions`, so asking
+* that question of a section would always answer "corrupt".
+*
+* The catalog repair uses it to write even when the model directory already
+* matches: without that, a profile whose directory is in agreement would never
+* be cleaned — the very shape that made the pool look unsaved would outlive the
+* fix that stops producing it.
+*/
+function regionsFieldIsCorrupt(value) {
+	const unwrapped = unwrapVolatileDeep(value);
+	if (!isRecord$1(unwrapped)) return false;
+	return Object.keys(unwrapped).some((key) => REGION_MAP_FOREIGN_KEYS.has(key));
 }
 /** One region's stored slot as a plain object; any other shape reads as empty. */
 function regionSlotOf(value, region) {
@@ -560,8 +729,8 @@ const WORKBUDDY_SETTINGS_NS = "workbuddy";
 /**
 * Writing the model's saved directory back to the Host's settings document.
 *
-* THE HOST-SIDE HALF OF ISSUES #114/#115. The card's own save path lives in
-* the browser half (`src/client/`), but the repair that heals a STALE saved
+* THE HOST-SIDE HALF OF ISSUES #114/#115. The card's own save path lives in the
+* browser half (`src/client/`), but the repair that heals a STALE saved
 * directory has to happen where the LIVE roster lands — inside the Host
 * process, right after the upstream answered. So this module writes through
 * the Host's own settings service, using the same merge discipline the
@@ -574,6 +743,19 @@ const WORKBUDDY_SETTINGS_NS = "workbuddy";
 * replaced, every other key of the slot is preserved, and the sibling region
 * is untouched.
 *
+* THE VALUE THIS MODULE WRITES IS THE `regions` FIELD, NOT THE SETTINGS
+* SECTION. That distinction is the whole of this bug — reported as
+* "账号池状态重启就失效". `describe()` hands back the resolved SECTION
+* (`{authFile, accounts, regions, cliBridge, …}`), and
+* `mutate(ns, [{ op: 'set', path: ['regions'], … }])` stores whatever it is
+* given AT that path. Handing it the section therefore wrote the section INTO
+* the field: the real region map was pushed down under a nested `regions` key,
+* its own siblings (`accounts`, `cliBridge`) became fake region slots, and the
+* Host's `regionStateOf(config, 'cn')` — which reads exactly one level — then
+* answered "no slot". Every account-pool preference, model selection and
+* directory looked unsaved after the next restart, and each startup added
+* another level (measured on a live profile: five levels, 258 KB).
+*
 * WHY THE HOST SERVICE RATHER THAN THE SCOPE. The plugin's browser half
 * writes through the Host's settings endpoint because the browser-side
 * `scope.set()` replaces the whole field with the browser's own (possibly
@@ -584,25 +766,27 @@ const WORKBUDDY_SETTINGS_NS = "workbuddy";
 * @module dsh-connect-workbuddy/catalog-write
 */
 /**
-* Merge one region's repaired directory into the `regions` field, preserving
-* every other key of that region's slot and the whole sibling region.
+* Merge one region's repaired directory into the `regions` FIELD.
+*
+* `current` may be EITHER the resolved settings section (what `describe()`
+* answers, and what {@link writeRegionCatalog} passes) OR the bare `regions`
+* field; `regionsMapOf` narrows both and heals a document the bug above already
+* corrupted. The RETURN value is always the field itself — the exact shape
+* `path: ['regions']` expects — never the section around it.
 *
 * The merge is done on the AUTHORITATIVE value the settings service holds —
 * not on a snapshot the caller brought — because a snapshot can be stale and
 * a stale merge is how the other region disappears.
 */
 function mergeRegionCatalog(current, region, catalog) {
-	const field = unwrapVolatileDeep(current) ?? {};
-	const regions = field["regions"] ?? {};
-	const slot = regions[region] ?? {};
+	const regions = regionsMapOf(current);
+	const stored = regions[region];
+	const slot = typeof stored === "object" && stored !== null && !Array.isArray(stored) ? stored : {};
 	return {
-		...field,
-		regions: {
-			...regions,
-			[region]: {
-				...slot,
-				lastCatalog: catalog
-			}
+		...regions,
+		[region]: {
+			...slot,
+			lastCatalog: catalog
 		}
 	};
 }
@@ -627,6 +811,39 @@ async function writeRegionCatalog(service, ns, region, catalog) {
 	}], void 0);
 	return true;
 }
+/**
+* Clean a `regions` field an older build corrupted, WITHOUT touching any
+* region's content.
+*
+* WHY THIS IS SEPARATE FROM {@link writeRegionCatalog}. The catalog repair is
+* the writer that produced the wreckage, so it is also a natural place to clean
+* it — but it only runs when the live roster arrived (an enabled region, a
+* reachable upstream, a non-empty answer). A profile would therefore stay dirty
+* for as long as the network is down, and a region the user has switched OFF
+* would never be cleaned at all. This write needs neither: it is one settings
+* round-trip at boot, and it is a no-op for every healthy profile (a single key
+* scan, no mutation).
+*
+* It is a pure shape fix, not a merge: `regionsMapOf` already answers the
+* healed map, and the field is replaced with exactly that. Reads are correct
+* without this write (they narrow through the same helper), so failing to write
+* costs tidiness only — the caller logs and carries on.
+*
+* @returns whether the write happened.
+*/
+async function healRegionsField(service, ns) {
+	if (service === void 0) return false;
+	const row = service.describe().find((entry) => entry.ns === ns);
+	if (row === void 0) return false;
+	const section = row.value ?? {};
+	if (!regionsFieldIsCorrupt(section["regions"])) return false;
+	await service.mutate(ns, [{
+		op: "set",
+		path: ["regions"],
+		value: regionsMapOf(section)
+	}], void 0);
+	return true;
+}
 //#endregion
 //#region src/credential-recovery.ts
 /** How long a verdict stays fresh by default. */
@@ -9033,8 +9250,8 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 					if (field !== "regions" && field !== "accounts" && field !== "cliBridge") return json(res, 400, { error: "field must be regions, accounts or cliBridge" });
 					const row = settings.describe().find((r) => String(r.ns).includes("workbuddy"));
 					if (row === void 0) return json(res, 503, { error: "workbuddy namespace missing from describe()" });
-					const current = unwrapVolatileDeep(row.value?.[field] ?? {});
-					const incoming = body.value ?? {};
+					const current = field === "regions" ? regionsMapOf(row.value?.[field]) : unwrapVolatileDeep(row.value?.[field] ?? {});
+					const incoming = field === "regions" ? regionsMapOf(body.value) : body.value ?? {};
 					if (field === "cliBridge") {
 						if (!isPlainRecord(incoming)) return json(res, 400, { error: "cliBridge value must be an object" });
 						const mergedBridge = nextCliBridgeSettings(current, incoming);
@@ -9408,7 +9625,7 @@ const Config = z.object({
 * picks.
 */
 function regionStateOf(config, region) {
-	const stored = unwrapVolatile(config.regions)?.[region];
+	const stored = regionsMapOf(config.regions)[region];
 	if (stored !== void 0 && stored !== null) return stored;
 	if (region !== "cn") return {};
 	const lastCatalog = unwrapVolatile(config.lastCatalog);
@@ -9685,7 +9902,7 @@ function apply(ctx, config) {
 			return rest;
 		});
 		if (repaired.length === 0) return;
-		if (catalogFingerprint(repaired) === catalogFingerprint(saved)) return;
+		if (!(catalogFingerprint(repaired) !== catalogFingerprint(saved)) && !regionsFieldIsCorrupt(current().regions)) return;
 		try {
 			await writeRegionCatalog(hostSettings(), settingsNs, region, repaired);
 		} catch (error) {
@@ -9701,6 +9918,27 @@ function apply(ctx, config) {
 	*/
 	const hostSettings = () => ctx.get?.("settings");
 	/**
+	* Clean a `regions` field a previous version corrupted, once, at boot.
+	*
+	* The corruption itself is fixed at the source (`src/catalog-write.ts`) and the
+	* read paths heal in memory, so a dirty profile is CORRECT long before this
+	* runs — but it stays dirty in the file, and the next save would carry the
+	* debris forward. The catalog repair writes the same clean shape, yet it only
+	* runs when a live roster arrives: a disabled region, an unreachable upstream
+	* or an empty answer would leave the wreckage in place for as long as those
+	* conditions hold. This needs no upstream at all.
+	*
+	* FAIL-SOFT, exactly like the repair: the read side is already right, so a
+	* write that cannot land costs tidiness and nothing else.
+	*/
+	const healRegionsFieldIfCorrupt = async () => {
+		try {
+			await healRegionsField(hostSettings(), settingsNs);
+		} catch (error) {
+			ctx.logger.warn("dsh-connect-workbuddy: could not clean the shape of the regions setting", error);
+		}
+	};
+	/**
 	* Legacy migration for the pre-split single `accountId`: its region is
 	* resolved once from the local account scan and the selection is then
 	* attributed to that region ONLY — the other region keeps its documented
@@ -10939,6 +11177,7 @@ function apply(ctx, config) {
 			return;
 		}
 		if (stopped) return;
+		const regionsFieldHealed = healRegionsFieldIfCorrupt();
 		for (const region of REGION_KEYS) {
 			if (!regionEnabled(current(), region)) continue;
 			(async () => {
@@ -10950,6 +11189,7 @@ function apply(ctx, config) {
 					const state = regionStateOf(current(), region);
 					stacks[region].catalog.set(withEffectiveOff(withImageSelection(deriveCatalog(models, new Set(state.enabledModelIds ?? []), state.contextBudgets ?? {}), new Set(state.imageModelIds ?? [])), new Set(savedOffModelIds(state, models))));
 					adapters[region].invalidate();
+					await regionsFieldHealed;
 					await repairRegionCatalog(region, models);
 				} catch (error) {
 					ctx.logger.warn(`dsh-connect-workbuddy: dynamic ${region} model catalog unavailable; serving the static fallback list`, error);
@@ -10961,4 +11201,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_TPS_PATH, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, modelIdOfBody, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_TPS_PATH, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, modelIdOfBody, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, regionsFieldIsCorrupt, regionsMapOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型（国内版与国际版）接入 DeepSeek Harness：每次刷新按上游目录自动读取每个模型的积分倍率，支持逐模型图片输入开关、多账号切换与账号池自动换号，并提供每日签到、卡片与输入框里的胶囊积分读数等只读积分概览。",
-  "version": "5.5.0",
+  "version": "5.5.1",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",