dsh-connect-workbuddy 5.8.1 → 5.8.3

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as parseCreditMultiplier, A as isEncryptedCredentialError, At as isWorkbuddyBundle, B as WorkBuddyCredentialRejectedError, C as WorkBuddyCredentialStore, Ct as clearAtRestKeyCache, D as defaultDesktopAuthDirs, Dt as findWorkbuddyAppExecutable, E as defaultDesktopAuthCandidates, Et as fetchAtRestKeyPayload, F as workbuddyAccountId, Ft as workbuddyAppExecutableCandidates, G as forceNeutralHead, H as channelGateMemberOf, I as workbuddyOwnAuthPath, J as isCredentialRejectedError, K as isContextTooLongBody, L as CONTEXT_OVERFLOW_MARKER, Lt as resolveDshHome, M as legacyWorkbuddyOwnAuthPath, Mt as macosNestedAppBundles, N as parseWorkBuddyAuth, Nt as openEncryptedField, O as defaultDesktopAuthPath, P as preferredAccountName, Pt as readAtRestKey, Q as openingEvidenceOfBody, R as CREDENTIAL_REJECTED_CODE, Rt as withFileLock, S as WORKBUDDY_AUTH_FILE_ENV, St as WORKBUDDY_APP_EXECUTABLE_ENV, T as authFileName, Tt as deriveAtRestKeyId, U as classifyUpstreamError, V as WorkBuddyUpstreamClient, W as declaredTools, X as knownRegionOf, Y as isFirstMessageGateBody, Z as modelIdOfBody, _ as deriveCatalog, _t as parseQueueAnswer, a as readHostHeartbeat, at as requestEvidenceOf, b as ENCRYPTED_CREDENTIAL_CODE, bt as imageDefaultFor, c as WORKBUDDY_CONNECT_VERSION, ct as defaultOffModelIds, dt as offRefused, et as parseReasoning, f as piAiRuntimeInfo, ft as recordRefusal, g as applyContextBudgets, gt as pickImageModel, h as WorkBuddyCatalog, ht as WorkBuddyImageError, i as processStartTimeMs, it as regionOf, j as isVaultAccountId, jt as macosBundleExecutable, k as hasEncryptedCredentialFields, kt as isEncryptedFieldWrapper, l as createFileRosterSeenStore, lt as lastRefusalFor, m as FALLBACK_WORKBUDDY_MODELS_GLOBAL, mt as DEFAULT_IMAGE_SIZE, n as clearHostHeartbeat, nt as perturbChannelFingerprints, o as workbuddyHostHeartbeatPath, ot as attachBusyLevels, p as FALLBACK_WORKBUDDY_MODELS, pt as withEffectiveOff, q as isConversationIdGateBody, r as isHeartbeatProcessAlive, rt as prepareChatBody, s as writeHostHeartbeat, st as REFUSES_OFF_MODEL_IDS, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as parseUpstreamModel, ut as offDefaultFor, v as fallbackModelsFor, vt as queueNoticeText, w as WorkBuddyEncryptedCredentialError, wt as deriveAtRestKey, x as WORKBUDDY_AUTH_FILENAME, xt as nativeModalityOf, y as withoutRouters, yt as NATIVE_MODALITY_BY_MODEL_ID, z as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, zt as writeFileAtomic } from "./host-heartbeat-CM-09T4U.js";
+import { $ as parseCreditMultiplier, A as isEncryptedCredentialError, At as isEncryptedFieldWrapper, B as WorkBuddyCredentialRejectedError, Bt as writeFileAtomic, C as WorkBuddyCredentialStore, Ct as WORKBUDDY_APP_EXECUTABLE_ENV, D as defaultDesktopAuthDirs, Dt as fetchAtRestKeyPayload, E as defaultDesktopAuthCandidates, Et as deriveAtRestKeyId, F as workbuddyAccountId, Ft as readAtRestKey, G as forceNeutralHead, H as channelGateMemberOf, I as workbuddyOwnAuthPath, It as workbuddyAppExecutableCandidates, J as isCredentialRejectedError, K as isContextTooLongBody, L as CONTEXT_OVERFLOW_MARKER, M as legacyWorkbuddyOwnAuthPath, Mt as macosBundleExecutable, N as parseWorkBuddyAuth, Nt as macosNestedAppBundles, O as defaultDesktopAuthPath, Ot as findWorkbuddyAppExecutable, P as preferredAccountName, Pt as openEncryptedField, Q as openingEvidenceOfBody, R as CREDENTIAL_REJECTED_CODE, Rt as resolveDshHome, S as WORKBUDDY_AUTH_FILE_ENV, St as nativeModalityOf, T as authFileName, Tt as deriveAtRestKey, U as classifyUpstreamError, V as WorkBuddyUpstreamClient, W as declaredTools, X as knownRegionOf, Y as isFirstMessageGateBody, Z as modelIdOfBody, _ as deriveCatalog, _t as pickImageModel, a as readHostHeartbeat, at as requestEvidenceOf, b as ENCRYPTED_CREDENTIAL_CODE, bt as NATIVE_MODALITY_BY_MODEL_ID, c as WORKBUDDY_CONNECT_VERSION, ct as REFUSES_OFF_MODEL_IDS, dt as offDefaultFor, et as parseReasoning, f as piAiRuntimeInfo, ft as offRefused, g as applyContextBudgets, gt as WorkBuddyImageError, h as WorkBuddyCatalog, ht as DEFAULT_IMAGE_SIZE, i as processStartTimeMs, it as regionOf, j as isVaultAccountId, jt as isWorkbuddyBundle, k as hasEncryptedCredentialFields, l as createFileRosterSeenStore, lt as defaultOffModelIds, m as FALLBACK_WORKBUDDY_MODELS_GLOBAL, mt as withEffectiveOff, n as clearHostHeartbeat, nt as perturbChannelFingerprints, o as workbuddyHostHeartbeatPath, ot as rewriteSessionTitleModel, p as FALLBACK_WORKBUDDY_MODELS, pt as recordRefusal, q as isConversationIdGateBody, r as isHeartbeatProcessAlive, rt as prepareChatBody, s as writeHostHeartbeat, st as attachBusyLevels, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as parseUpstreamModel, ut as lastRefusalFor, v as fallbackModelsFor, vt as parseQueueAnswer, w as WorkBuddyEncryptedCredentialError, wt as clearAtRestKeyCache, x as WORKBUDDY_AUTH_FILENAME, xt as imageDefaultFor, y as withoutRouters, yt as queueNoticeText, z as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, zt as withFileLock } from "./host-heartbeat-DzfWuVsm.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -4229,6 +4229,8 @@ function createWorkBuddyShim(options) {
 	* silent difference after an upgrade.
 	*/
 	const keepPromptLastEnabled = options.keepPromptLast === true;
+	const extraInjectedPrefixes = Array.isArray(options.extraInjectedPrefixes) ? options.extraInjectedPrefixes.filter((entry) => typeof entry === "string" && entry !== "") : [];
+	const sessionTitleOptions = options.sessionTitle ?? {};
 	const SHARED_SECRET = randomBytes(32).toString("base64url");
 	/**
 	* Whether this process's prompts have been PROVEN to need the invisible
@@ -4382,7 +4384,10 @@ function createWorkBuddyShim(options) {
 			return;
 		}
 		const raw = (await readBody(req)).toString("utf8");
-		const prepared = prepareChatBody(raw, { keepPromptLast: keepPromptLastEnabled });
+		const prepared = rewriteSessionTitleModel(prepareChatBody(raw, {
+			keepPromptLast: keepPromptLastEnabled,
+			extraInjectedPrefixes
+		}), sessionTitleOptions);
 		const requestModelId = modelIdOfBody(prepared);
 		if (onRequestBody !== void 0) try {
 			onRequestBody(prepared);
@@ -5956,12 +5961,77 @@ function isInside(parent, child) {
 	if (inner === outer) return true;
 	return inner.startsWith(outer.endsWith(sep) ? outer : outer + sep);
 }
-/** The session directory this tool call came from, when the Host supplies one. */
-function sessionDirOf(execution) {
-	const cwd = execution?.agent?.session?.header?.cwd;
-	if (typeof cwd !== "string") return "";
-	const trimmed = cwd.trim();
-	return trimmed !== "" && isAbsolute(trimmed) ? trimmed : "";
+/** The session directory this call came from, when the Host supplies one.
+*
+* THE ORDER INSIDE THIS FUNCTION IS THE FIX. The session's live projection is
+* read FIRST, because it is the directory the human and the model are actually
+* in; the session header is the fallback, because it is where that projection
+* starts from (`init: header => header.cwd ?? null`) and because a session that
+* never committed a projection has nothing else.
+*
+* Both sources are re-validated here: the session service already rejects
+* relative headers, but a hand-built agent in a test (or a Host with a looser
+* contract) must not be able to smuggle a relative path through either one.
+*/
+function sessionDirOf(execution, directoryOf) {
+	const dirs = sessionDirCandidates(execution, directoryOf);
+	return dirs.projection !== "" ? dirs.projection : dirs.header;
+}
+/**
+* Both session-directory sources, kept APART so the caller can tell them — and
+* therefore fall back between them — by validity, not just by presence.
+*
+* {@link sessionDirOf} collapses these into one answer, which is right for "where
+* are we" but loses the information "the projection said X, the header says Y".
+* The ladder in {@link resolveWorkingDir} needs the pair: a projection can go
+* STALE (the directory was deleted, moved, or is an offline mount) while the
+* creation-time header still points at a perfectly good directory. Without the
+* split, a stale projection is a hard refusal even though a usable directory is
+* one field away.
+*
+* Both sources are re-validated the same way as in {@link sessionDirOf}: absolute
+* and non-blank, so a hand-built session cannot smuggle a relative path through
+* either field.
+*/
+function sessionDirCandidates(execution, directoryOf) {
+	const session = execution?.agent?.session;
+	let projection = "";
+	if (session !== void 0 && directoryOf !== void 0) {
+		const live = directoryOf(session);
+		if (typeof live === "string") {
+			const trimmed = live.trim();
+			if (trimmed !== "" && isAbsolute(trimmed)) projection = trimmed;
+		}
+	}
+	const cwd = session?.header?.cwd;
+	let header = "";
+	if (typeof cwd === "string") {
+		const trimmed = cwd.trim();
+		if (trimmed !== "" && isAbsolute(trimmed)) header = trimmed;
+	}
+	return {
+		projection,
+		header
+	};
+}
+/**
+* Why `path` cannot be a turn's working directory, or `''` when it can.
+*
+* The three checks the ladder has always applied (exists / is a directory /
+* readable), stated once so the projection→header fallback in
+* {@link resolveWorkingDir} re-runs exactly the same gate instead of a weaker
+* private copy.
+*/
+function dirRejection(path) {
+	if (!existsSync(path)) return `working_dir "${path}" 不存在。`;
+	let isDir = false;
+	try {
+		isDir = statSync(path).isDirectory();
+	} catch (error) {
+		return `working_dir "${path}" 无法读取：${error instanceof Error ? error.message : String(error)}`;
+	}
+	if (!isDir) return `working_dir "${path}" 不是一个目录。`;
+	return "";
 }
 /**
 * Decide the directory one turn runs in.
@@ -5980,8 +6050,10 @@ function sessionDirOf(execution) {
 * A scratch turn is exempt by construction: it is a fresh empty temp directory
 * the bridge just created, so there is nothing in it to leak.
 */
-function resolveWorkingDir(args, options, execution) {
-	const sessionDir = sessionDirOf(execution);
+function resolveWorkingDir(args, options, execution, directoryOf) {
+	const dirs = sessionDirCandidates(execution, directoryOf);
+	const primarySessionDir = dirs.projection !== "" && dirs.projection !== dirs.header ? dirs.projection : dirs.header;
+	const fallbackSessionDir = primarySessionDir !== dirs.header && dirs.header !== "" ? dirs.header : "";
 	const explicit = typeof args["working_dir"] === "string" ? args["working_dir"].trim() : "";
 	let chosen = "";
 	let fromArgument = false;
@@ -5994,7 +6066,7 @@ function resolveWorkingDir(args, options, execution) {
 		};
 		chosen = explicit;
 		fromArgument = true;
-	} else if (sessionDir !== "") chosen = sessionDir;
+	} else if (primarySessionDir !== "") chosen = primarySessionDir;
 	else if (options.workingDir !== "") chosen = options.workingDir;
 	else if (args["allow_unattended"] === true || options.allowUnattended) return {
 		ok: true,
@@ -6008,31 +6080,17 @@ function resolveWorkingDir(args, options, execution) {
 		unattended: false,
 		reason: "no working directory。宿主目前不把会话 cwd 传给插件工具，所以这个值必须由调用方给：① 传 working_dir 指定一个已存在的绝对路径目录；② 在插件配置里设 cliBridge.workingDir；③ 若本回合只是通用问答、不需要任何目录，传 allow_unattended: true（会在一个临时目录里跑，该目录是它的读写边界，不碰你的 home 或会话工作区）。"
 	};
-	if (!existsSync(chosen)) return {
-		ok: false,
-		dir: "",
-		unattended: false,
-		reason: `working_dir "${chosen}" 不存在。`
-	};
-	let isDir = false;
-	try {
-		isDir = statSync(chosen).isDirectory();
-	} catch (error) {
-		return {
-			ok: false,
-			dir: "",
-			unattended: false,
-			reason: `working_dir "${chosen}" 无法读取：${error instanceof Error ? error.message : String(error)}`
-		};
-	}
-	if (!isDir) return {
+	const rejection = dirRejection(chosen);
+	if (rejection !== "" && !fromArgument && chosen === primarySessionDir && fallbackSessionDir !== "" && dirRejection(fallbackSessionDir) === "") chosen = fallbackSessionDir;
+	else if (rejection !== "") return {
 		ok: false,
 		dir: "",
 		unattended: false,
-		reason: `working_dir "${chosen}" 不是一个目录。`
+		reason: !fromArgument && chosen === primarySessionDir && fallbackSessionDir !== "" && dirRejection(fallbackSessionDir) !== "" ? `${rejection}（回退的会话目录 "${fallbackSessionDir}" 同样不可用，工作目录投影与会话 header 都失效了。）` : rejection
 	};
 	const roots = [];
-	if (sessionDir !== "") roots.push(sessionDir);
+	if (primarySessionDir !== "") roots.push(primarySessionDir);
+	if (fallbackSessionDir !== "") roots.push(fallbackSessionDir);
 	if (options.workingDir !== "") roots.push(options.workingDir);
 	roots.push(...options.allowedDirs);
 	if (!roots.some((root) => root !== "" && isInside(root, chosen))) {
@@ -6249,7 +6307,7 @@ async function runAsk(args, execution, deps, entrance = "tool") {
 		ok: false,
 		error: "message 不能为空：要说清楚这一轮让 CodeBuddy 做什么。"
 	});
-	const dir = resolveWorkingDir(args, options, execution);
+	const dir = resolveWorkingDir(args, options, execution, deps.directoryOf);
 	if (!dir.ok) return result({
 		ok: false,
 		error: dir.reason
@@ -6497,6 +6555,20 @@ function formatCommandOutcome(value, extra = {}) {
 	return head + denied + footer + truncated + delivery;
 }
 /**
+* The command's slice of the invocation the tool's resolver needs.
+*
+* The command's agent IS a live agent (the Host's command service passes the
+* whole thing, not a narrowed subset), so it satisfies `BridgeToolExecution`
+* structurally. The `signal` field is carried so the shared resolver sees the
+* same object shape it sees from a tool call.
+*/
+function sessionDirOfCommand(invocation, directoryOf) {
+	return sessionDirOf({
+		...invocation.agent !== void 0 ? { agent: invocation.agent } : {},
+		...invocation.signal !== void 0 ? { signal: invocation.signal } : {}
+	}, directoryOf);
+}
+/**
 * Register `/codebuddy`, returning the disposer.
 *
 * `commands` is passed in rather than looked up so a Host without the service
@@ -6519,10 +6591,10 @@ function mountCodebuddyCommand(commands, deps) {
 			description: "用 CodeBuddy 在当前工作区跑一轮；留空 = 评审未提交改动；以 --edit 开头 = 这一轮允许改文件。注意：默认（cliBridge.injectResult=true）跑完会把结论回注给本会话的模型，那一次唤醒会真的消耗 DSH token；设 injectResult=false 才完全不碰模型。CodeBuddy 那一侧的账号额度每次都会消耗。",
 			input: { hint: "留空 = 评审未提交改动；写要求 = 只读执行（如\"看一下这个函数为什么崩\"）；要以 --edit 开头 = 允许改文件（如\"--edit 修一下这个空指针\"）" },
 			handler: async (invocation) => {
-				const cwd = invocation.agent?.session?.header?.cwd;
-				if (typeof cwd !== "string" || cwd.trim() === "") return {
+				const cwd = sessionDirOfCommand(invocation, deps.directoryOf);
+				if (cwd === "") return {
 					kind: "error",
-					text: "这个会话没有工作区路径（session.header.cwd 为空），无法确定 CodeBuddy 该在哪里跑。请在一个打开过目录的会话里再试。"
+					text: "这个会话没有工作区路径（会话的工作目录投影为空，回退的 session.header.cwd 也为空），无法确定 CodeBuddy 该在哪里跑。请在一个打开过目录的会话里再试。"
 				};
 				const raw = typeof invocation.rawInput === "string" ? invocation.rawInput : "";
 				const parsed = parseCommandInput(raw);
@@ -6750,7 +6822,7 @@ function normalizeCliBridgeOptions(settings, onRejected) {
 * Returning `undefined` rather than an enabled flag keeps every caller honest:
 * there is no "mounted but disabled" state to accidentally treat as live.
 */
-function createCliBridgeRuntime(settings, regions, log) {
+function createCliBridgeRuntime(settings, regions, log, directoryOf) {
 	const options = normalizeCliBridgeOptions(settings, (message) => log(message));
 	if (!options.enabled) return void 0;
 	const live = createLiveBoard();
@@ -6761,7 +6833,8 @@ function createCliBridgeRuntime(settings, regions, log) {
 			regions,
 			log,
 			gate: gateFor(options),
-			live
+			live,
+			...directoryOf !== void 0 ? { directoryOf } : {}
 		},
 		live
 	};
@@ -8528,6 +8601,26 @@ async function writePoolProbes(region, updates) {
 function safeMessage(error) {
 	return (error instanceof Error ? error.message : String(error)).replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]").slice(0, 500);
 }
+/**
+* The upstream-identity switches the card may write through `__save`.
+*
+* These are TOP-LEVEL config fields (see the schema in `index.ts`), not a
+* nested block, so each is set on its own path and no merge base is involved.
+* The list is a constant here rather than derived from the schema because this
+* endpoint must stay a closed allow-list: deriving it would let an unrelated
+* schema addition quietly widen what the browser can write.
+*
+* Every entry is a switch the user can already set by hand in
+* `cordis.patch.yml`; this list only adds a UI route to the same fields (issue
+* #133 suggestions 2 and 3), so it can never expose anything the config file
+* does not already expose.
+*/
+const UPSTREAM_SWITCH_FIELDS = /* @__PURE__ */ new Set([
+	"usageIdentity",
+	"keepPromptLast",
+	"extraInjectedPrefixes",
+	"sessionTitle"
+]);
 /** A non-null, non-array object: the only shape the slot merge applies to. */
 function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -9373,7 +9466,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						req.on("error", reject);
 					});
 					const field = body.field;
-					if (field !== "regions" && field !== "accounts" && field !== "cliBridge") return json(res, 400, { error: "field must be regions, accounts or cliBridge" });
+					if (field !== "regions" && field !== "accounts" && field !== "cliBridge" && !(typeof field === "string" && UPSTREAM_SWITCH_FIELDS.has(field))) return json(res, 400, { error: "field must be regions, accounts, cliBridge, usageIdentity, keepPromptLast, extraInjectedPrefixes or sessionTitle" });
 					const row = settings.describe().find((r) => String(r.ns).includes("workbuddy"));
 					if (row === void 0) return json(res, 503, { error: "workbuddy namespace missing from describe()" });
 					const current = field === "regions" ? regionsMapOf(row.value?.[field]) : unwrapVolatileDeep(row.value?.[field] ?? {});
@@ -9391,6 +9484,17 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 							value: mergedBridge
 						});
 					}
+					if (UPSTREAM_SWITCH_FIELDS.has(field)) {
+						await settings.mutate(row.ns, [{
+							op: "set",
+							path: [field],
+							value: body.value
+						}], void 0);
+						return json(res, 200, {
+							ok: true,
+							value: { [field]: body.value }
+						});
+					}
 					const merged = { ...current };
 					for (const [key, slot] of Object.entries(incoming)) {
 						const prior = current[key];
@@ -9746,7 +9850,12 @@ const Config = z.object({
 		z.const("always")
 	]).default("failure").description("When to perturb scanned messages with invisible characters: \"off\" only rescues after a channel-gate refusal, \"failure\" (default) learns from a successful rescue and starts later requests perturbed, \"always\" starts every request with the dense rescue for a gateway whose plain attempt is guaranteed to fail.")),
 	usageIdentity: asVolatile(z.boolean().default(false).description("Make the upstream's usage page record these calls like the official client's: add the X-IDE-* identity headers (which fill the 使用端 column) and send the conversation ids as 32-hex UUIDv7. Off by default — it is a display alignment measured by a reporter, not by this plugin, and the chat channel identity (User-Agent) and request body never change.")),
-	keepPromptLast: asVolatile(z.boolean().default(false).description("Move the harness-injected runtime context above the real prompt, so the WorkBuddy usage page records what you actually typed instead of the injected block. Message count and text are preserved; the one edit is the recorded prompt's own leading <acp> marker. Off by default because it changes the message order the upstream counts."))
+	keepPromptLast: asVolatile(z.boolean().default(false).description("Move the harness-injected runtime context above the real prompt, so the WorkBuddy usage page records what you actually typed instead of the injected block. Message count and text are preserved; the one edit is the recorded prompt's own leading <acp> marker. Off by default because it changes the message order the upstream counts.")),
+	extraInjectedPrefixes: asVolatile(z.array(z.string()).default([]).description("Extra literal prefixes (issue #133) treated like the harness-injected context markers when keepPromptLast is on — for blocks a companion plugin injects that the built-in list does not recognize. Each entry matches the start of a trailing user message; read only while keepPromptLast is enabled. Sampled when the plugin mounts: reload the plugin (or restart the host) after changing it.")),
+	sessionTitle: asVolatile(z.object({
+		enabled: z.boolean().default(false),
+		model: z.string().default("wb-lite")
+	}).default({}).description("Move the host session-title request onto a hidden lightweight model (issues #132/#133). The host fires one real upstream request per new session either way; enabled re-points it at `model` (default wb-lite, measured 0 credits by the reporter) instead of billing the main paid model. Request volume still counts, and the lightweight model is reporter-measured, not reproduced here. Sampled when the plugin mounts: reload the plugin (or restart the host) after changing it."))
 });
 /**
 * One region's saved model state. A config written before the region split has
@@ -9909,6 +10018,8 @@ function apply(ctx, config) {
 				logger: ctx.logger,
 				channelPerturbation: unwrapVolatile(config.channelPerturbation) ?? "failure",
 				keepPromptLast: unwrapVolatile(config.keepPromptLast) === true,
+				extraInjectedPrefixes: unwrapVolatile(config.extraInjectedPrefixes) ?? [],
+				sessionTitle: unwrapVolatile(config.sessionTitle) ?? {},
 				/**
 				* Pool routing, bound to THIS region.
 				*
@@ -10259,6 +10370,8 @@ function apply(ctx, config) {
 	});
 	let cliTools;
 	let cliCommands;
+	let cliDirectoryOf;
+	const cliDirectoryProbe = (session) => cliDirectoryOf?.(session) ?? null;
 	let cliRuntime;
 	let cliRuntimeKey = "";
 	let disposeCliTool;
@@ -10279,7 +10392,7 @@ function apply(ctx, config) {
 			cliRuntime = createCliBridgeRuntime(settings, REGION_KEYS.map((region) => ({
 				region,
 				store: stacks[region].store
-			})), (message) => ctx.logger.warn(`dsh-connect-workbuddy: ${message}`));
+			})), (message) => ctx.logger.warn(`dsh-connect-workbuddy: ${message}`), cliDirectoryProbe);
 		}
 		if (cliRuntime === void 0) {
 			disposeCliSurfaces();
@@ -10308,6 +10421,42 @@ function apply(ctx, config) {
 			cliCommands = void 0;
 		});
 	});
+	ctx.inject(["sessionProjections"], (projectionCtx) => {
+		const reader = projectionCtx.sessionProjections;
+		if (reader === void 0 || typeof reader.stateOf !== "function") return;
+		/**
+		* The one place the projection key is spelled out.
+		*
+		* It must match the Host's own registration — key
+		* `"workingDirectory"`, stateVersion 1, in the Host's
+		* @deepseek-ai/dsh-working-directory package. If the Host renames the key, this is
+		* the line that has to follow, and the comment is what tells the next reader
+		* where to look.
+		*
+		* Returns null for `"no committed directory"`, which is the same signal the header
+		* path produces when it has nothing — so the ladder below it behaves identically.
+		* NOTE what it deliberately does NOT do: fall back to the service's own default.
+		* The Host's get() answers stateOf(...) ?? defaultDirectory, and that fallback is
+		* the Host process's cwd, i.e. a directory nobody chose. Substituting it here would
+		* quietly turn `"we do not know"` into `"use this one"`, which is the one change this
+		* whole refactor must not make.
+		*/
+		const WORKING_DIRECTORY_PROJECTION_KEY = "workingDirectory";
+		cliDirectoryOf = (session) => {
+			let state;
+			try {
+				state = reader.stateOf(session, WORKING_DIRECTORY_PROJECTION_KEY);
+			} catch {
+				return null;
+			}
+			if (typeof state !== "string") return null;
+			const trimmed = state.trim();
+			return trimmed === "" ? null : trimmed;
+		};
+		projectionCtx.effect(() => () => {
+			cliDirectoryOf = void 0;
+		});
+	});
 	ctx.inject(["webServer"], (webCtx) => registerWorkBuddyStatusRoute(webCtx, {
 		store: (region) => stacks[region].store,
 		client,

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型（国内版与国际版）接入 DeepSeek Harness：每次刷新按上游目录自动读取每个模型的积分倍率，支持逐模型图片输入开关、多账号切换与账号池自动换号，并提供每日签到、卡片与输入框里的胶囊积分读数等只读积分概览。",
-  "version": "5.8.1",
+  "version": "5.8.3",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",