dsh-workbuddy-bridge 0.3.0 → 0.3.1

package/lib/{variants-3SmUZ0e_.js → heartbeat-DihKwwFX.js}

@@ -2342,6 +2342,107 @@ function discoveryIncomplete(detail) {
 const HELPER_SCRIPT = "process.stdout.write(String(process._linkedBinding(\"electron_browser_workbuddy_storage\").loggerGet()))";
 const HELPER_SCRIPT_ARGUMENT_FLAG = "-e";
 //#endregion
+//#region src/shared/paths.ts
+/** Node-free constants and types shared by the Host and browser halves. */
+/** Plugin-owned status endpoint consumed by its browser half. */
+const WORKBUDDY_STATUS_PATH = "/plugins/dsh-workbuddy-bridge/status";
+/**
+* Plugin-owned probe control endpoint.
+*
+* Separate from the status route because it accepts writes: the status route's
+* loopback Host/Origin guard protects against a DNS-rebinding *page*, which is
+* not the same as authorizing a state-changing action. This route therefore
+* also requires the in-memory key the browser half receives with the status
+* document.
+*/
+const WORKBUDDY_PROBE_PATH = "/plugins/dsh-workbuddy-bridge/probe";
+/**
+* The international (WorkBuddy AI) variant's own pair of routes.
+*
+* Kept as separate constants rather than a computed suffix so both halves
+* reference literal strings: the browser bundle and the host bundle are built
+* independently, and a shared expression is one build-config drift away from
+* the desk asking a route the host never mounted.
+*/
+const WORKBUDDY_AI_STATUS_PATH = "/plugins/dsh-workbuddy-bridge/ai/status";
+const WORKBUDDY_AI_PROBE_PATH = "/plugins/dsh-workbuddy-bridge/ai/probe";
+/**
+* Plugin-owned per-message credit route.
+*
+* A read-only GET taking `?sessionId=…`, answering `messageId → credit` for one
+* Session. It is its own route rather than a field of the status document
+* because the two have different lifetimes: the status document is per
+* *account* and is re-read when the account changes, while credit accounting
+* is per *Session* and grows as messages are sent.
+*
+* **One route for both variants, on purpose.** The accounting is attributed to
+* a DSH `messageId` before it is stored, and a message id belongs to one
+* Session regardless of which provider served it — a conversation can switch
+* between the two WorkBuddy products (or away from both) mid-thread. A route
+* per variant would force the message row to know which provider answered a
+* message *it is merely labelling*, and would strand every message whose turn
+* ran under the other variant.
+*
+* No key is required: the route only reads what this plugin already observed on
+* its own loopback stream, carries no credential material, and answers loopback
+* requests through the same Host/Origin guard as the status route.
+*/
+const WORKBUDDY_CREDIT_PATH = "/plugins/dsh-workbuddy-bridge/credit";
+//#endregion
+//#region src/variants.ts
+/**
+* The two WorkBuddy desktop apps this one plugin serves.
+*
+* Both products are the same client framework in different regions, and both
+* write their sign-in into the *same* shared `CodeBuddyExtension` auth
+* directory — they differ by file basename, base URL, catalog endpoint, and
+* display identity. Everything that varies between them is collected here as
+* one descriptor, so no module has to carry its own `if (international)`
+* branch and a third variant would be a data change rather than a refactor.
+*
+* This module is host-side (it names files and env vars). The browser half
+* takes the same ids and routes from the Node-free `status-paths.ts`, which
+* stays the single source shared by both halves.
+*
+* @module dsh-workbuddy-bridge/variants
+*/
+/** CN WorkBuddy first: the existing provider keeps its id, paths, and copy. */
+const WORKBUDDY_VARIANTS = [{
+	id: "workbuddy",
+	displayName: "WorkBuddy",
+	appName: "WorkBuddy",
+	region: "cn",
+	env: "WORKBUDDY_AUTH_FILE",
+	desktopFilename: "workbuddy-desktop.info",
+	ownFilename: ".workbuddy-auth.json",
+	probeFilename: ".workbuddy-probe.json",
+	catalogFilename: ".workbuddy-catalog.json",
+	visibilityFilename: ".workbuddy-model-visibility.json",
+	statusPath: WORKBUDDY_STATUS_PATH,
+	probePath: WORKBUDDY_PROBE_PATH
+}, {
+	id: "workbuddy-ai",
+	displayName: "WorkBuddy AI",
+	appName: "WorkBuddy AI",
+	region: "global",
+	env: "WORKBUDDY_AI_AUTH_FILE",
+	desktopFilename: "workbuddy-desktop-ai.info",
+	ownFilename: ".workbuddy-ai-auth.json",
+	probeFilename: ".workbuddy-ai-probe.json",
+	catalogFilename: ".workbuddy-ai-catalog.json",
+	visibilityFilename: ".workbuddy-ai-model-visibility.json",
+	statusPath: WORKBUDDY_AI_STATUS_PATH,
+	probePath: WORKBUDDY_AI_PROBE_PATH
+}];
+/** The CN variant; the plugin's long-standing default and compatibility anchor. */
+const CN_VARIANT = WORKBUDDY_VARIANTS[0];
+/** The international variant. */
+const AI_VARIANT = WORKBUDDY_VARIANTS[1];
+/** Look up a variant by provider id. */
+function variantFor(id) {
+	return WORKBUDDY_VARIANTS.find((variant) => variant.id === id);
+}
+//#endregion
 //#region src/credential/store.ts
 /**
 * WorkBuddy credential resolution. The primary source is the WorkBuddy
@@ -2528,6 +2629,38 @@ function isENOENT(error) {
 	return error?.code === "ENOENT";
 }
 /**
+* Which automatic at-rest key discovery this store may run, by variant.
+*
+* **One home for a rule that had three.** The choice used to be made at every
+* call site — `src/index.ts` and `src/cli/bin.ts` each spelled out
+* `discovery: variant.id === CN_VARIANT.id ? cnAppDiscovery() : 'none'` — and the
+* store's own default was a bare `new WorkBuddyAtRestKeyProvider()`, whose
+* discovery is `'none'`. So a caller that did neither got a provider that could
+* never open an encrypted credential: `scripts/live-e2e.mjs` was exactly that
+* caller, and it failed with `electron-binary-unavailable` on every platform
+* (2026-10-03, found by the release checklist). The store knows its variant, so
+* the choice belongs here.
+*
+* Why the difference is deliberate:
+*
+* - Only the CN WorkBuddy install has been verified to hold the key its envelopes
+*   name, and only its macOS/Windows layout is known, so CN may look for the app.
+* - A Global (WorkBuddy AI) encrypted credential has never been seen live, so that
+*   variant runs at `'none'` — no default path and no app search. A Global unlock
+*   must not silently execute the *CN* app's Electron. An explicit
+*   `WORKBUDDY_ELECTRON_BIN` still works for Global.
+*
+* **No variant** means the CN product's own default file —
+* `defaultDesktopAuthCandidates()` is the `workbuddy-desktop.info` path, never the
+* AI one — so it gets the same discovery CN does.
+*
+* A keyId mismatch is still reported as a diagnosis rather than a wrong open, and
+* the helper only runs if an encrypted credential is actually read.
+*/
+function atRestDiscoveryFor(variant) {
+	return variant === void 0 || variant.id === CN_VARIANT.id ? cnAppDiscovery() : "none";
+}
+/**
 * Read-only credential store with demand-driven refresh.
 *
 * Refresh policy: refresh only when the access token is inside the margin
@@ -2549,7 +2682,7 @@ var WorkBuddyCredentialStore = class {
 		this.refresh = options.refresh;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.ownPath = options.ownPath ?? (options.variant ? join(resolveDshHome(), options.variant.ownFilename) : workbuddyOwnAuthPath());
-		this.keyProvider = options.keyProvider ?? new WorkBuddyAtRestKeyProvider();
+		this.keyProvider = options.keyProvider ?? new WorkBuddyAtRestKeyProvider({ discovery: atRestDiscoveryFor(options.variant) });
 		this.desktopPathOverride = options.desktopPath;
 	}
 	/**
@@ -2624,6 +2757,7 @@ var WorkBuddyCredentialStore = class {
 				expiresAtMs: credential.expiresAtMs,
 				...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs: credential.refreshExpiresAtMs },
 				...credential.nickname === void 0 ? {} : { nickname: credential.nickname },
+				...credential.uid === "" ? {} : { uid: credential.uid },
 				...credential.domain === "" ? {} : { domain: credential.domain },
 				source: credential.source
 			};
@@ -3553,55 +3687,8 @@ var WorkBuddyCatalog = class {
 	}
 };
 //#endregion
-//#region src/shared/paths.ts
-/** Node-free constants and types shared by the Host and browser halves. */
-/** Plugin-owned status endpoint consumed by its browser half. */
-const WORKBUDDY_STATUS_PATH = "/plugins/dsh-workbuddy-bridge/status";
-/**
-* Plugin-owned probe control endpoint.
-*
-* Separate from the status route because it accepts writes: the status route's
-* loopback Host/Origin guard protects against a DNS-rebinding *page*, which is
-* not the same as authorizing a state-changing action. This route therefore
-* also requires the in-memory key the browser half receives with the status
-* document.
-*/
-const WORKBUDDY_PROBE_PATH = "/plugins/dsh-workbuddy-bridge/probe";
-/**
-* The international (WorkBuddy AI) variant's own pair of routes.
-*
-* Kept as separate constants rather than a computed suffix so both halves
-* reference literal strings: the browser bundle and the host bundle are built
-* independently, and a shared expression is one build-config drift away from
-* the desk asking a route the host never mounted.
-*/
-const WORKBUDDY_AI_STATUS_PATH = "/plugins/dsh-workbuddy-bridge/ai/status";
-const WORKBUDDY_AI_PROBE_PATH = "/plugins/dsh-workbuddy-bridge/ai/probe";
-/**
-* Plugin-owned per-message credit route.
-*
-* A read-only GET taking `?sessionId=…`, answering `messageId → credit` for one
-* Session. It is its own route rather than a field of the status document
-* because the two have different lifetimes: the status document is per
-* *account* and is re-read when the account changes, while credit accounting
-* is per *Session* and grows as messages are sent.
-*
-* **One route for both variants, on purpose.** The accounting is attributed to
-* a DSH `messageId` before it is stored, and a message id belongs to one
-* Session regardless of which provider served it — a conversation can switch
-* between the two WorkBuddy products (or away from both) mid-thread. A route
-* per variant would force the message row to know which provider answered a
-* message *it is merely labelling*, and would strand every message whose turn
-* ran under the other variant.
-*
-* No key is required: the route only reads what this plugin already observed on
-* its own loopback stream, carries no credential material, and answers loopback
-* requests through the same Host/Origin guard as the status route.
-*/
-const WORKBUDDY_CREDIT_PATH = "/plugins/dsh-workbuddy-bridge/credit";
-//#endregion
 //#region src/version.ts
-const WORKBUDDY_BRIDGE_VERSION = "0.3.0";
+const WORKBUDDY_BRIDGE_VERSION = "0.3.1";
 //#endregion
 //#region src/web/heartbeat.ts
 /**
@@ -3772,58 +3859,4 @@ function isHeartbeatProcessAlive(heartbeat) {
 	return startAtMs <= heartbeat.registeredAt;
 }
 //#endregion
-//#region src/variants.ts
-/**
-* The two WorkBuddy desktop apps this one plugin serves.
-*
-* Both products are the same client framework in different regions, and both
-* write their sign-in into the *same* shared `CodeBuddyExtension` auth
-* directory — they differ by file basename, base URL, catalog endpoint, and
-* display identity. Everything that varies between them is collected here as
-* one descriptor, so no module has to carry its own `if (international)`
-* branch and a third variant would be a data change rather than a refactor.
-*
-* This module is host-side (it names files and env vars). The browser half
-* takes the same ids and routes from the Node-free `status-paths.ts`, which
-* stays the single source shared by both halves.
-*
-* @module dsh-workbuddy-bridge/variants
-*/
-/** CN WorkBuddy first: the existing provider keeps its id, paths, and copy. */
-const WORKBUDDY_VARIANTS = [{
-	id: "workbuddy",
-	displayName: "WorkBuddy",
-	appName: "WorkBuddy",
-	region: "cn",
-	env: "WORKBUDDY_AUTH_FILE",
-	desktopFilename: "workbuddy-desktop.info",
-	ownFilename: ".workbuddy-auth.json",
-	probeFilename: ".workbuddy-probe.json",
-	catalogFilename: ".workbuddy-catalog.json",
-	visibilityFilename: ".workbuddy-model-visibility.json",
-	statusPath: WORKBUDDY_STATUS_PATH,
-	probePath: WORKBUDDY_PROBE_PATH
-}, {
-	id: "workbuddy-ai",
-	displayName: "WorkBuddy AI",
-	appName: "WorkBuddy AI",
-	region: "global",
-	env: "WORKBUDDY_AI_AUTH_FILE",
-	desktopFilename: "workbuddy-desktop-ai.info",
-	ownFilename: ".workbuddy-ai-auth.json",
-	probeFilename: ".workbuddy-ai-probe.json",
-	catalogFilename: ".workbuddy-ai-catalog.json",
-	visibilityFilename: ".workbuddy-ai-model-visibility.json",
-	statusPath: WORKBUDDY_AI_STATUS_PATH,
-	probePath: WORKBUDDY_AI_PROBE_PATH
-}];
-/** The CN variant; the plugin's long-standing default and compatibility anchor. */
-const CN_VARIANT = WORKBUDDY_VARIANTS[0];
-/** The international variant. */
-const AI_VARIANT = WORKBUDDY_VARIANTS[1];
-/** Look up a variant by provider id. */
-function variantFor(id) {
-	return WORKBUDDY_VARIANTS.find((variant) => variant.id === id);
-}
-//#endregion
-export { modelWithCurrentPromotion as A, CN_APP_VERSION_FILENAME as B, defaultDesktopAuthPath as C, WorkBuddyAtRestKeyProvider as D, workbuddyOwnAuthPath as E, regionOf as F, resolveChatIdentity as G, chatUserAgent as H, PROBE_EFFORT_CANDIDATES as I, appUserAgent as J, validCliVersion as K, probeModel as L, parseModelCatalog as M, prepareChatBody as N, cnAppDiscovery as O, prepareInternationalChatBody as P, validAppVersion as Q, randomSentinel as R, defaultDesktopAuthCandidates as S, parseWorkBuddyAuth as T, fallbackChatIdentity as U, FALLBACK_CN_APP_VERSION as V, readCliVersion as W, readBundleVersion as X, installedAppVersion as Y, resolveAppVersion as Z, FALLBACK_WORKBUDDY_MODELS as _, WORKBUDDY_HOST_HEARTBEAT_FILENAME as a, WORKBUDDY_AUTH_FILE_ENV as b, processStartTimeMs as c, writeHostHeartbeat as d, WORKBUDDY_BRIDGE_VERSION as f, FALLBACK_WORKBUDDY_AI_MODELS as g, WORKBUDDY_STATUS_PATH as h, variantFor as i, normalizeCredits as j, WorkBuddyUpstreamClient as k, readHostHeartbeat as l, WORKBUDDY_PROBE_PATH as m, CN_VARIANT as n, clearHostHeartbeat as o, WORKBUDDY_CREDIT_PATH as p, WORKBUDDY_APP_VERSION_FILENAME as q, WORKBUDDY_VARIANTS as r, isHeartbeatProcessAlive as s, AI_VARIANT as t, workbuddyHostHeartbeatPath as u, WorkBuddyCatalog as v, desktopAuthCandidatesFor as w, WorkBuddyCredentialStore as x, WORKBUDDY_AUTH_FILENAME as y, classifyUpstreamError as z };
+export { parseModelCatalog as A, chatUserAgent as B, variantFor as C, WorkBuddyUpstreamClient as D, WORKBUDDY_STATUS_PATH as E, probeModel as F, WORKBUDDY_APP_VERSION_FILENAME as G, readCliVersion as H, randomSentinel as I, readBundleVersion as J, appUserAgent as K, classifyUpstreamError as L, prepareInternationalChatBody as M, regionOf as N, modelWithCurrentPromotion as O, PROBE_EFFORT_CANDIDATES as P, CN_APP_VERSION_FILENAME as R, WORKBUDDY_VARIANTS as S, WORKBUDDY_PROBE_PATH as T, resolveChatIdentity as U, fallbackChatIdentity as V, validCliVersion as W, validAppVersion as X, resolveAppVersion as Y, desktopAuthCandidatesFor as _, readHostHeartbeat as a, AI_VARIANT as b, WORKBUDDY_BRIDGE_VERSION as c, WorkBuddyCatalog as d, WORKBUDDY_AUTH_FILENAME as f, defaultDesktopAuthPath as g, defaultDesktopAuthCandidates as h, processStartTimeMs as i, prepareChatBody as j, normalizeCredits as k, FALLBACK_WORKBUDDY_AI_MODELS as l, WorkBuddyCredentialStore as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, WORKBUDDY_AUTH_FILE_ENV as p, installedAppVersion as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, FALLBACK_WORKBUDDY_MODELS as u, parseWorkBuddyAuth as v, WORKBUDDY_CREDIT_PATH as w, CN_VARIANT as x, workbuddyOwnAuthPath as y, FALLBACK_CN_APP_VERSION as z };

package/lib/index.d.ts

@@ -906,6 +906,14 @@ interface WorkBuddyAuthStatus {
   expiresAtMs?: number;
   refreshExpiresAtMs?: number;
   nickname?: string;
+  /**
+   * The account's own id (`account.uid`), when the credential carries one.
+   *
+   * The fallback display name: the desktop document is the only source of a
+   * nickname, and it does not always have one. Non-secret — the same identity
+   * the per-account state is keyed by, sent upstream as `X-User-Id`.
+   */
+  uid?: string;
   domain?: string;
   source?: 'desktop' | 'dsh';
   /**
@@ -933,9 +941,10 @@ interface WorkBuddyStoreOptions {
   refreshMarginMs?: number;
   /**
    * Resolver for WorkBuddy 5.6's at-rest protector key, needed when the
-   * desktop file stores encrypted token fields. Defaults to the real
-   * provider, which spawns the WorkBuddy Electron binary; tests stand in a
-   * stub. Structural so a store never depends on how the key is reached.
+   * desktop file stores encrypted token fields. Defaults to the real provider
+   * with the discovery this store's variant may run — see
+   * {@link atRestDiscoveryFor}. Tests stand in a stub; the shape is structural
+   * so a store never depends on how the key is reached.
    */
   keyProvider?: Pick<WorkBuddyAtRestKeyProvider, 'protectorKeyFor' | 'helperPath'>;
 }

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as modelWithCurrentPromotion, B as CN_APP_VERSION_FILENAME, C as defaultDesktopAuthPath, D as WorkBuddyAtRestKeyProvider, E as workbuddyOwnAuthPath, F as regionOf, G as resolveChatIdentity, H as chatUserAgent, I as PROBE_EFFORT_CANDIDATES, J as appUserAgent, K as validCliVersion, L as probeModel, M as parseModelCatalog, N as prepareChatBody, O as cnAppDiscovery, P as prepareInternationalChatBody, Q as validAppVersion, R as randomSentinel, S as defaultDesktopAuthCandidates, T as parseWorkBuddyAuth, U as fallbackChatIdentity, V as FALLBACK_CN_APP_VERSION, W as readCliVersion, X as readBundleVersion, Y as installedAppVersion, Z as resolveAppVersion, _ as FALLBACK_WORKBUDDY_MODELS, a as WORKBUDDY_HOST_HEARTBEAT_FILENAME, b as WORKBUDDY_AUTH_FILE_ENV, c as processStartTimeMs, d as writeHostHeartbeat, f as WORKBUDDY_BRIDGE_VERSION, g as FALLBACK_WORKBUDDY_AI_MODELS, i as variantFor, j as normalizeCredits, k as WorkBuddyUpstreamClient, l as readHostHeartbeat, n as CN_VARIANT, o as clearHostHeartbeat, p as WORKBUDDY_CREDIT_PATH, q as WORKBUDDY_APP_VERSION_FILENAME, r as WORKBUDDY_VARIANTS, s as isHeartbeatProcessAlive, t as AI_VARIANT, u as workbuddyHostHeartbeatPath, v as WorkBuddyCatalog, w as desktopAuthCandidatesFor, x as WorkBuddyCredentialStore, y as WORKBUDDY_AUTH_FILENAME, z as classifyUpstreamError } from "./variants-3SmUZ0e_.js";
+import { A as parseModelCatalog, B as chatUserAgent, C as variantFor, D as WorkBuddyUpstreamClient, F as probeModel, G as WORKBUDDY_APP_VERSION_FILENAME, H as readCliVersion, I as randomSentinel, J as readBundleVersion, K as appUserAgent, L as classifyUpstreamError, M as prepareInternationalChatBody, N as regionOf, O as modelWithCurrentPromotion, P as PROBE_EFFORT_CANDIDATES, R as CN_APP_VERSION_FILENAME, S as WORKBUDDY_VARIANTS, U as resolveChatIdentity, V as fallbackChatIdentity, W as validCliVersion, X as validAppVersion, Y as resolveAppVersion, _ as desktopAuthCandidatesFor, a as readHostHeartbeat, b as AI_VARIANT, c as WORKBUDDY_BRIDGE_VERSION, d as WorkBuddyCatalog, f as WORKBUDDY_AUTH_FILENAME, g as defaultDesktopAuthPath, h as defaultDesktopAuthCandidates, i as processStartTimeMs, j as prepareChatBody, k as normalizeCredits, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as WORKBUDDY_AUTH_FILE_ENV, q as installedAppVersion, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as parseWorkBuddyAuth, w as WORKBUDDY_CREDIT_PATH, x as CN_VARIANT, y as workbuddyOwnAuthPath, z as FALLBACK_CN_APP_VERSION } from "./heartbeat-DihKwwFX.js";
 import z from "@deepseek-ai/schemastery";
 import { dirname, join, resolve } from "node:path";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
@@ -1467,6 +1467,7 @@ async function workBuddyWebStatus(deps) {
 	const status = {
 		status: "signed-in",
 		...authStatus.nickname === void 0 ? {} : { nickname: authStatus.nickname },
+		...authStatus.uid === void 0 ? {} : { uid: authStatus.uid },
 		...authStatus.domain === void 0 || authStatus.domain === "" ? {} : { domain: authStatus.domain },
 		...authStatus.source === void 0 ? {} : { source: authStatus.source },
 		...authStatus.expiresAtMs === void 0 ? {} : { expiresAt: authStatus.expiresAtMs }
@@ -1913,13 +1914,12 @@ function fallbackFor(variant) {
 	return variant.id === CN_VARIANT.id ? FALLBACK_WORKBUDDY_MODELS : FALLBACK_WORKBUDDY_AI_MODELS;
 }
 /** Build one variant's stores and probe state. */
-function createVariantRuntime(config, variant, identityOf, accountOf, keyProvider, creditIndex) {
+function createVariantRuntime(config, variant, identityOf, accountOf, creditIndex) {
 	const client = new WorkBuddyUpstreamClient();
 	const configured = configuredAuthFile(config, variant);
 	const store = new WorkBuddyCredentialStore({
 		variant,
 		...configured === void 0 ? {} : { desktopPath: configured },
-		...keyProvider === void 0 ? {} : { keyProvider },
 		refresh: (credential) => client.refreshToken(credential)
 	});
 	const fallback = fallbackFor(variant);
@@ -2121,9 +2121,8 @@ function apply(ctx, refs) {
 	* case that must not fall back to a shared preference bucket.
 	*/
 	const lastAccounts = /* @__PURE__ */ new Map();
-	const atRestKeysFor = (variant) => new WorkBuddyAtRestKeyProvider({ discovery: variant.id === CN_VARIANT.id ? cnAppDiscovery() : "none" });
 	const creditIndex = new WorkBuddySessionCreditIndex();
-	const runtimes = WORKBUDDY_VARIANTS.map((variant) => createVariantRuntime(config(), variant, (id) => lastIdentities.get(id), (id) => lastAccounts.get(id), atRestKeysFor(variant), creditIndex));
+	const runtimes = WORKBUDDY_VARIANTS.map((variant) => createVariantRuntime(config(), variant, (id) => lastIdentities.get(id), (id) => lastAccounts.get(id), creditIndex));
 	const probeKey = createProbeKey();
 	/**
 	* Point a variant at an account identity, invalidating whatever the previous

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-bridge",
   "displayName": "DSH WorkBuddy Bridge",
   "description": "将 WorkBuddy 桌面 App 包含的模型自动接入 DeepSeek Harness — bring WorkBuddy desktop app models into DeepSeek Harness with zero configuration.",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "author": "zlZayn",
   "keywords": [
     "dsh",