dsh-workbuddy-connect 0.6.2 → 0.6.4

package/lib/{variants-B3Pa4EBr.js → host-heartbeat-D9DvyLWz.js}

@@ -5,7 +5,7 @@ import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { execFile, execFileSync } from "node:child_process";
-import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { accessSync, constants, readFileSync, realpathSync, statSync } from "node:fs";
 //#region src/app-version.ts
 /**
 * The international desktop app's version, used as the `/v3/config` UA.
@@ -18,9 +18,10 @@ import { accessSync, constants, realpathSync, statSync } from "node:fs";
 * removed — returns the 21-model App document. The UA is therefore built from
 * the form verified in code, not from the earlier prose.
 *
-* The version is only ever a UA component: a missing App, an unreadable
-* plist, or a bad cached value degrades to the last saved value and finally to
-* a compiled-in constant, and never blocks credential use or the provider.
+* The version feeds the international catalog UA and the chat identity's
+* `X-IDE-Version`: a missing App, an unreadable plist, or a bad cached value
+* degrades to the last saved value and finally to a compiled-in constant, and
+* never blocks credential use or the provider.
 *
 * @module dsh-workbuddy-connect/app-version
 */
@@ -628,6 +629,7 @@ const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
 /** Classify an upstream failure from its HTTP status and body excerpt. */
 function classifyUpstreamError(status, body) {
 	if (status === 402) return "hard_credit";
+	if (status === 401) return "session_dead";
 	const lower = body.toLowerCase();
 	for (const marker of HARD_CREDIT_MARKERS) if (lower.includes(marker.toLowerCase()) || body.includes(marker)) return "hard_credit";
 	for (const marker of SESSION_DEAD_MARKERS) if (body.includes(marker)) return "session_dead";
@@ -637,6 +639,26 @@ function classifyUpstreamError(status, body) {
 	if (status >= 400) return "client";
 	return "client";
 }
+/**
+* Extract a user-facing error message from an upstream JSON response body.
+* Prefers WorkBuddy's localized `displayMsg.zh` / `displayMsg.en`, falling back to `msg`.
+*/
+function extractDisplayErrorMessage(body) {
+	const trimmed = body.trim();
+	if (!trimmed.startsWith("{")) return void 0;
+	try {
+		const parsed = JSON.parse(trimmed);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+		const obj = parsed;
+		const displayMsg = obj["displayMsg"];
+		if (typeof displayMsg === "object" && displayMsg !== null && !Array.isArray(displayMsg)) {
+			const localized = displayMsg;
+			if (typeof localized["zh"] === "string" && localized["zh"].trim() !== "") return localized["zh"].trim();
+			if (typeof localized["en"] === "string" && localized["en"].trim() !== "") return localized["en"].trim();
+		}
+		if (typeof obj["msg"] === "string" && obj["msg"].trim() !== "") return obj["msg"].trim();
+	} catch {}
+}
 /** Region for a login domain; an empty domain means CN (matching upstream tooling). */
 function regionOf(domain) {
 	const lowered = domain.trim().toLowerCase();
@@ -665,18 +687,21 @@ function commonHeaders(credential) {
 /**
 * Chat request headers, including the X-No-* conventions the official CLI uses.
 *
-* `userAgent` carries the desktop identity for chat and probe requests; when
-* it is absent the shared CLI-form UA applies. Refresh shares `commonHeaders`
-* but never this override, so the two paths cannot drift into each other.
+* `userAgent` and `clientVersion` carry the same resolved desktop identity for
+* chat and probe requests. Refresh shares `commonHeaders` but never this
+* override, so the two paths cannot drift into each other.
 */
-function chatHeaders(credential, userAgent) {
+function chatHeaders(credential, userAgent, clientVersion) {
 	return {
 		...commonHeaders(credential),
-		...userAgent === void 0 ? {} : { "User-Agent": userAgent },
+		"User-Agent": userAgent,
 		"Content-Type": "application/json",
 		...credential.uid === "" ? { "X-No-User-Id": "1" } : { "X-User-Id": credential.uid },
 		...credential.enterpriseId === void 0 || credential.enterpriseId === "" ? { "X-No-Enterprise-Id": "1" } : { "X-Enterprise-Id": credential.enterpriseId },
 		...credential.domain === "" ? { "X-No-Department-Info": "1" } : { "X-Domain": credential.domain },
+		"X-IDE-Type": "WorkBuddy",
+		"X-IDE-Name": "WorkBuddy",
+		"X-IDE-Version": clientVersion,
 		"X-Product": "SaaS"
 	};
 }
@@ -821,18 +846,21 @@ var WorkBuddyUpstreamClient = class {
 	/** POST the chat endpoint; a successful answer is the raw SSE response. */
 	async chatStream(credential, bodyJson, signal) {
 		const region = regionOf(credential.domain);
+		let identity;
 		let userAgent;
 		try {
-			userAgent = chatUserAgent(await this.resolveChatIdentity(region), region);
+			identity = await this.resolveChatIdentity(region);
+			userAgent = chatUserAgent(identity, region);
 		} catch {
-			userAgent = chatUserAgent(fallbackChatIdentity(region), region);
+			identity = fallbackChatIdentity(region);
+			userAgent = chatUserAgent(identity, region);
 		}
 		let response;
 		try {
 			response = await fetch(`${chatBase(credential)}/v2/chat/completions`, {
 				method: "POST",
 				headers: {
-					...chatHeaders(credential, userAgent),
+					...chatHeaders(credential, userAgent, identity.clientVersion),
 					"Authorization": `Bearer ${credential.accessToken}`
 				},
 				body: region === "global" ? prepareInternationalChatBody(bodyJson) : bodyJson,
@@ -1144,11 +1172,14 @@ var WorkBuddyUpstreamClient = class {
 	*/
 	async probeEffort(credential, model, effort, signal) {
 		const international = regionOf(credential.domain) === "global";
+		let identity;
 		let userAgent;
 		try {
-			userAgent = chatUserAgent(await this.resolveChatIdentity(international ? "global" : "cn"), international ? "global" : "cn");
+			identity = await this.resolveChatIdentity(international ? "global" : "cn");
+			userAgent = chatUserAgent(identity, international ? "global" : "cn");
 		} catch {
-			userAgent = chatUserAgent(fallbackChatIdentity(international ? "global" : "cn"), international ? "global" : "cn");
+			identity = fallbackChatIdentity(international ? "global" : "cn");
+			userAgent = chatUserAgent(identity, international ? "global" : "cn");
 		}
 		const payload = {
 			model,
@@ -1168,7 +1199,7 @@ var WorkBuddyUpstreamClient = class {
 			response = await fetch(`${chatBase(credential)}/v2/chat/completions`, {
 				method: "POST",
 				headers: {
-					...chatHeaders(credential, userAgent),
+					...chatHeaders(credential, userAgent, identity.clientVersion),
 					"Authorization": `Bearer ${credential.accessToken}`
 				},
 				body: JSON.stringify(payload),
@@ -1443,15 +1474,143 @@ const INTERNATIONAL_SYSTEM_PROMPT = "You are a helpful assistant.";
 */
 const INTERNATIONAL_PROBE_MAX_TOKENS = 16;
 //#endregion
+//#region src/status-paths.ts
+/** Node-free constants and types shared by the Host and browser halves. */
+/** Plugin-owned status endpoint consumed by its browser half. */
+const WORKBUDDY_STATUS_PATH = "/plugins/dsh-workbuddy-connect/status";
+/**
+* Plugin-owned probe control endpoint.
+*
+* Separate from the status route because it accepts writes: the status route's
+* loopback Host/Origin guard protects against a DNS-rebinding *page*, which is
+* not the same as authorizing a state-changing action. This route therefore
+* also requires the in-process key the browser half receives with the status
+* document.
+*/
+const WORKBUDDY_PROBE_PATH = "/plugins/dsh-workbuddy-connect/probe";
+/**
+* The international (WorkBuddy AI) variant's own pair of routes.
+*
+* Kept as separate constants rather than a computed suffix so both halves
+* reference literal strings: the browser bundle and the host bundle are built
+* independently, and a shared expression is one build-config drift away from
+* the desk asking a route the host never mounted.
+*/
+const WORKBUDDY_AI_STATUS_PATH = "/plugins/dsh-workbuddy-connect/ai/status";
+const WORKBUDDY_AI_PROBE_PATH = "/plugins/dsh-workbuddy-connect/ai/probe";
+/**
+* Same-origin route backing the browser's update reminder.
+*
+* Read-only like the status route, so the same loopback Host/Origin gate
+* applies; it answers public npm/GitHub metadata only and never token
+* material.
+*/
+const WORKBUDDY_UPDATE_PATH = "/plugins/dsh-workbuddy-connect/update";
+//#endregion
+//#region src/variants.ts
+/**
+* The two WorkBuddy desktop apps this one plugin serves.
+*
+* Both products are the same client framework in different regions, and both
+* write their sign-in into the *same* shared `CodeBuddyExtension` auth
+* directory — they differ by file basename, base URL, catalog endpoint, and
+* display identity. Everything that varies between them is collected here as
+* one descriptor, so no module has to carry its own `if (international)`
+* branch and a third variant would be a data change rather than a refactor.
+*
+* This module is host-side (it names files and env vars). The browser half
+* takes the same ids and routes from the Node-free `status-paths.ts`, which
+* stays the single source shared by both halves.
+*
+* @module dsh-workbuddy-connect/variants
+*/
+/** CN WorkBuddy first: the existing provider keeps its id, paths, and copy. */
+const WORKBUDDY_VARIANTS = [{
+	id: "workbuddy",
+	displayName: "WorkBuddy",
+	appName: "WorkBuddy",
+	region: "cn",
+	env: "WORKBUDDY_AUTH_FILE",
+	electron: {
+		productName: "WorkBuddy",
+		envVar: "WORKBUDDY_ELECTRON_BIN",
+		macOS: {
+			bundleId: "com.tencent.workbuddy.mac",
+			defaultPath: "/Applications/WorkBuddy.app/Contents/MacOS/Electron"
+		},
+		windows: {
+			displayNamePattern: /^WorkBuddy(?:\s+\d+(?:\.\d+)+(?:[-+][0-9A-Za-z.-]+)?)?$/u,
+			exeBasename: "workbuddy.exe",
+			defaultPathSegments: [
+				"Programs",
+				"WorkBuddy",
+				"WorkBuddy.exe"
+			]
+		}
+	},
+	desktopFilename: "workbuddy-desktop.info",
+	ownFilename: ".workbuddy-auth.json",
+	probeFilename: ".workbuddy-probe.json",
+	catalogFilename: ".workbuddy-catalog.json",
+	visibilityFilename: ".workbuddy-model-visibility.json",
+	statusPath: WORKBUDDY_STATUS_PATH,
+	probePath: WORKBUDDY_PROBE_PATH
+}, {
+	id: "workbuddy-ai",
+	displayName: "WorkBuddy AI",
+	appName: "WorkBuddy AI",
+	region: "global",
+	env: "WORKBUDDY_AI_AUTH_FILE",
+	electron: {
+		productName: "WorkBuddy AI",
+		envVar: "WORKBUDDY_AI_ELECTRON_BIN",
+		macOS: {
+			bundleId: "com.workbuddy.workbuddy-ai",
+			defaultPath: "/Applications/WorkBuddy AI.app/Contents/MacOS/Electron"
+		},
+		windows: {
+			displayNamePattern: /^WorkBuddy AI(?:\s+\d+(?:\.\d+)+(?:[-+][0-9A-Za-z.-]+)?)?$/u,
+			exeBasename: "workbuddyai.exe"
+		}
+	},
+	desktopFilename: "workbuddy-desktop-ai.info",
+	ownFilename: ".workbuddy-ai-auth.json",
+	probeFilename: ".workbuddy-ai-probe.json",
+	catalogFilename: ".workbuddy-ai-catalog.json",
+	visibilityFilename: ".workbuddy-ai-model-visibility.json",
+	statusPath: WORKBUDDY_AI_STATUS_PATH,
+	probePath: WORKBUDDY_AI_PROBE_PATH
+}];
+/** The CN variant; the plugin's long-standing default and compatibility anchor. */
+const CN_VARIANT = WORKBUDDY_VARIANTS[0];
+/** The international variant. */
+const AI_VARIANT = WORKBUDDY_VARIANTS[1];
+/** Look up a variant by provider id. */
+function variantFor(id) {
+	return WORKBUDDY_VARIANTS.find((variant) => variant.id === id);
+}
+/**
+* The Electron profile a variant resolves with.
+*
+* Callers inside the plugin pass their known-complete variants; descriptors
+* assembled outside (the type is public and predates the profile) fall back
+* by variant id, so an id-less or unknown custom variant stays on the CN
+* product — the same default the store's other legacy fields assume.
+*/
+function electronProfileFor(variant) {
+	return variant?.electron ?? (variant?.id === AI_VARIANT.id ? AI_VARIANT : CN_VARIANT).electron;
+}
+//#endregion
 //#region src/desktop-credential-protection.ts
 /**
 * WorkBuddy 5.6.x at-rest credential protection: classification, key
-* resolution, and field decryption for the desktop app's encrypted auth file.
+* resolution, and field decryption for the desktop apps' encrypted auth files.
 *
-* Since WorkBuddy 5.6 the desktop app encrypts `auth.accessToken` and
-* `auth.refreshToken` at rest (`buildPolicy: "fields"`, on by default), so the
-* plugin reads `{$wbEncrypted:1, envelope}` wrappers instead of token strings
-* (issues #39/#40). Everything needed to open them lives on the same machine:
+* Since WorkBuddy 5.6 both desktop apps (CN and international, which followed
+* in 5.6.2) encrypt `auth.accessToken` and `auth.refreshToken` at rest
+* (`buildPolicy: "fields"`, on by default), so the plugin reads
+* `{$wbEncrypted:1, envelope}` wrappers instead of token strings (issues
+* #39/#40, #59/#60). Everything needed to open them lives on the same machine:
 *
 * - the sealed payload (`{version:1, atRestSecretKey}`) comes from the
 *   WorkBuddy-modified Electron's private `workbuddyStorage` binding, reached
@@ -1469,18 +1628,17 @@ const INTERNATIONAL_PROBE_MAX_TOKENS = 16;
 *
 * @module dsh-workbuddy-connect/desktop-credential-protection
 */
-/** Env variable that overrides the WorkBuddy Electron binary used as the key helper. */
-const WORKBUDDY_ELECTRON_BIN_ENV = "WORKBUDDY_ELECTRON_BIN";
-/** Platform-default Electron binary, confirmed only on macOS (5.6.2). */
-const MACOS_ELECTRON_PATH = "/Applications/WorkBuddy.app/Contents/MacOS/Electron";
 /**
-* The Electron binary the helper would spawn on this platform, or `undefined`
-* where no default has been verified. Other platforms must set
-* {@link WORKBUDDY_ELECTRON_BIN_ENV} explicitly — the layout is simply not
-* known, and guessing would spawn the wrong app's binary.
+* The platform-default Electron binary for one product, or `undefined` where
+* none is verified. macOS defaults come from each product's measured layout;
+* the Windows default needs `LOCALAPPDATA`, and the international app has no
+* verified default location at all — registry discovery only, never a guess.
 */
-function defaultWorkBuddyElectronPath() {
-	return process.platform === "darwin" ? MACOS_ELECTRON_PATH : void 0;
+function defaultWorkBuddyElectronPath(product, platform = process.platform) {
+	if (platform === "darwin") return product.macOS.defaultPath;
+	if (platform !== "win32" || product.windows.defaultPathSegments === void 0) return void 0;
+	const localAppData = process.env.LOCALAPPDATA?.trim();
+	return localAppData === void 0 || localAppData === "" ? void 0 : join(localAppData, ...product.windows.defaultPathSegments);
 }
 /** Distinct key ids across the wrapped fields, in field order. */
 function keyIdsOf(fields) {
@@ -1661,11 +1819,37 @@ function parseAtRestPayload(text) {
 function deriveProtectorKey(secret) {
 	return createHash("sha256").update(secret, "utf8").digest();
 }
-/** The CN app's bundle id; the only one this round resolves by discovery. */
-const WORKBUDDY_CN_BUNDLE_ID = "com.tencent.workbuddy.mac";
+/**
+* Select discovery by platform. Both products have verified layouts on macOS
+* and Windows (the international app is registry-only there), so discovery no
+* longer gates on region; Linux and others stay `none`.
+*/
+function electronDiscoveryFor(platform = process.platform) {
+	if (platform === "darwin") return "macos-workbuddy";
+	if (platform === "win32") return "windows-workbuddy";
+	return "none";
+}
+/**
+* The at-rest key provider one variant's store should use. Shared by the
+* plugin host and the CLI entry so the browser card and `doctor`/`status` can
+* never disagree about which binary a variant resolves.
+*/
+function atRestKeyProviderFor(variant) {
+	return new WorkBuddyAtRestKeyProvider({
+		product: electronProfileFor(variant),
+		discovery: electronDiscoveryFor()
+	});
+}
 /** Absolute tool paths: never resolved through PATH, which a user can change. */
 const MDFIND_BIN = "/usr/bin/mdfind";
 const PLUTIL_BIN = "/usr/bin/plutil";
+const WINDOWS_REGISTRY_ROOTS = [
+	"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+	"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+	"HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
+];
+const WINDOWS_REGISTRY_OUTPUT_MAX_BYTES = 1048576;
+const WINDOWS_ELECTRON_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u;
 /** One discovery subprocess's own limits; see {@link WorkBuddyAtRestKeyProviderOptions}. */
 const WORKBUDDY_DISCOVERY_STEP_TIMEOUT_MS = 3e3;
 const MDFIND_MAX_OUTPUT_BYTES = 1048576;
@@ -1682,8 +1866,12 @@ var DiscoveryIncompleteError = class extends Error {};
 * identity. Every failure that means "we could not tell" — a missing tool, a
 * timeout, an oversized answer — is raised as {@link DiscoveryIncompleteError}
 * so it can never be silently read as "no such app".
+*
+* `bundleId` is the product being searched for; the Spotlight query and the
+* caller's identity comparison both use it, so the two can never disagree
+* about which app they are looking for.
 */
-function workBuddyDiscoveryTools() {
+function workBuddyDiscoveryTools(bundleId) {
 	const runTool = (bin, args, maxBytes, signal) => new Promise((resolve, reject) => {
 		if (signal.aborted) {
 			reject(new DiscoveryIncompleteError(`${bin} was not started: the discovery budget was already spent`));
@@ -1715,7 +1903,7 @@ function workBuddyDiscoveryTools() {
 	});
 	return {
 		findApps: async (signal) => {
-			return (await runTool(MDFIND_BIN, [`kMDItemCFBundleIdentifier == '${WORKBUDDY_CN_BUNDLE_ID}'`], MDFIND_MAX_OUTPUT_BYTES, signal)).split("\n").map((line) => line.trim()).filter((line) => line.endsWith(".app"));
+			return (await runTool(MDFIND_BIN, [`kMDItemCFBundleIdentifier == '${bundleId}'`], MDFIND_MAX_OUTPUT_BYTES, signal)).split("\n").map((line) => line.trim()).filter((line) => line.endsWith(".app"));
 		},
 		bundleIdentifier: async (bundlePath, signal) => {
 			try {
@@ -1749,6 +1937,58 @@ function workBuddyDiscoveryTools() {
 	};
 }
 /**
+* The Windows registry discovery tool. It is deliberately separate from the
+* macOS Spotlight/plutil seam: the two platforms have different identity and
+* candidate rules, and neither tool should accidentally become cross-platform.
+*/
+function workBuddyWindowsDiscoveryTools() {
+	const systemRoot = process.env.SystemRoot?.trim();
+	const regPath = systemRoot === void 0 || systemRoot === "" ? void 0 : join(systemRoot, "System32", "reg.exe");
+	const runTool = (root, signal) => new Promise((resolve, reject) => {
+		if (regPath === void 0) {
+			reject(new DiscoveryIncompleteError("SystemRoot is not configured"));
+			return;
+		}
+		if (signal.aborted) {
+			reject(new DiscoveryIncompleteError("reg.exe was not started: the discovery budget was already spent"));
+			return;
+		}
+		let settled = false;
+		const child = execFile(regPath, [
+			"query",
+			root,
+			"/s"
+		], {
+			maxBuffer: WINDOWS_REGISTRY_OUTPUT_MAX_BYTES,
+			timeout: WORKBUDDY_DISCOVERY_STEP_TIMEOUT_MS,
+			windowsHide: true
+		}, (error, stdout, stderr) => {
+			if (settled) return;
+			settled = true;
+			if (error !== null && error !== void 0) {
+				if (error.killed !== true && (error.code === 1 || error.code === "1") && windowsRegistryKeyMissing(stderr)) {
+					resolve("");
+					return;
+				}
+				reject(new DiscoveryIncompleteError(`reg.exe could not complete (${error.killed === true ? "timed out" : String(error.code ?? "unavailable")})`));
+				return;
+			}
+			resolve(stdout);
+		});
+		const abort = () => {
+			if (settled) return;
+			settled = true;
+			child.kill();
+			reject(new DiscoveryIncompleteError("reg.exe was abandoned: the discovery budget was spent"));
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		child.on("close", () => {
+			signal.removeEventListener("abort", abort);
+		});
+	});
+	return { queryUninstallRoot: runTool };
+}
+/**
 * In-memory protector-key resolver: one spawn per key id, single-flight, never
 * persisted. The cache is keyed by the id envelopes ask for, so an envelope
 * sealed under a rotated key triggers exactly one fresh resolution.
@@ -1760,9 +2000,12 @@ function workBuddyDiscoveryTools() {
 	* a different app.
 	*/
 	explicitPath;
+	product;
 	defaultPath;
 	discovery;
 	tools;
+	windowsTools;
+	platform;
 	discoveryBudgetMs;
 	timeoutMs;
 	source;
@@ -1775,13 +2018,16 @@ function workBuddyDiscoveryTools() {
 	discoveredPath;
 	cache;
 	inflight;
-	constructor(options = {}) {
-		const fromEnv = process.env[WORKBUDDY_ELECTRON_BIN_ENV]?.trim();
+	constructor(options) {
+		this.product = options.product;
+		const fromEnv = process.env[options.product.envVar]?.trim();
 		const envPath = fromEnv === void 0 || fromEnv === "" ? void 0 : fromEnv;
 		this.explicitPath = options.electronPath ?? envPath;
 		this.discovery = options.discovery ?? "none";
-		this.defaultPath = options.defaultElectronPath === void 0 ? defaultWorkBuddyElectronPath() : options.defaultElectronPath ?? void 0;
-		this.tools = options.tools ?? workBuddyDiscoveryTools();
+		this.platform = options.platform ?? process.platform;
+		this.defaultPath = this.discovery === "none" ? void 0 : options.defaultElectronPath === void 0 ? defaultWorkBuddyElectronPath(options.product, this.platform) : options.defaultElectronPath ?? void 0;
+		this.tools = options.tools ?? workBuddyDiscoveryTools(options.product.macOS.bundleId);
+		this.windowsTools = options.windowsTools ?? workBuddyWindowsDiscoveryTools();
 		this.discoveryBudgetMs = options.discoveryBudgetMs ?? 1e4;
 		this.timeoutMs = options.timeoutMs ?? 1e4;
 		this.spawnHelper = options.spawnHelper ?? ((path) => this.spawnAt(path));
@@ -1839,29 +2085,29 @@ function workBuddyDiscoveryTools() {
 	*/
 	async resolveElectronPath() {
 		if (this.explicitPath !== void 0) {
-			if (!isExecutable(this.explicitPath)) throw new WorkBuddyElectronPathError("electron-path-invalid", `the configured WorkBuddy Electron binary is not available at ${this.explicitPath}; check ${WORKBUDDY_ELECTRON_BIN_ENV} or unset it to let the plugin look for the app itself`);
+			if (!isExecutable(this.explicitPath)) throw new WorkBuddyElectronPathError("electron-path-invalid", `the configured ${this.product.productName} Electron binary is not available at ${this.explicitPath}; check ${this.product.envVar} or unset it to let the plugin look for the app itself`);
 			return this.explicitPath;
 		}
-		if (this.discovery === "none") throw new WorkBuddyElectronPathError("electron-binary-unavailable", `no WorkBuddy Electron binary is configured for this platform; set ${WORKBUDDY_ELECTRON_BIN_ENV} to the app's Electron binary`);
+		if (this.discovery === "none") throw new WorkBuddyElectronPathError("electron-binary-unavailable", `no ${this.product.productName} Electron binary is configured for this platform; set ${this.product.envVar} to the app's Electron binary`);
 		if (this.defaultPath !== void 0 && isExecutable(this.defaultPath)) return this.defaultPath;
 		if (this.discoveredPath !== void 0) {
 			if (isExecutable(this.discoveredPath)) return this.discoveredPath;
 			this.discoveredPath = void 0;
 		}
-		const found = await this.discoverMacosApp();
+		const found = this.discovery === "macos-workbuddy" ? await this.discoverMacosApp() : await this.discoverWindowsApp();
 		this.discoveredPath = found;
 		return found;
 	}
 	/**
-	* Resolve the CN app through Spotlight, then prove each candidate's identity
-	* before it can be executed.
+	* Resolve this product's app through Spotlight, then prove each candidate's
+	* identity before it can be executed.
 	*
 	* The whole flow shares one budget: a hang in one candidate must not extend
 	* the wait for the others, and running out of budget is reported as an
 	* unfinished check rather than an absent app.
 	*/
 	async discoverMacosApp() {
-		if (process.platform !== "darwin") throw new WorkBuddyElectronPathError("electron-binary-unavailable", `no WorkBuddy Electron binary is configured for this platform; set ${WORKBUDDY_ELECTRON_BIN_ENV} to the app's Electron binary`);
+		if (this.platform !== "darwin") throw new WorkBuddyElectronPathError("electron-binary-unavailable", `no ${this.product.productName} Electron binary is configured for this platform; set ${this.product.envVar} to the app's Electron binary`);
 		const controller = new AbortController();
 		const timer = setTimeout(() => controller.abort(), this.discoveryBudgetMs);
 		try {
@@ -1869,7 +2115,7 @@ function workBuddyDiscoveryTools() {
 			try {
 				candidates = await this.tools.findApps(controller.signal);
 			} catch {
-				throw discoveryIncomplete("the app search did not complete");
+				throw discoveryIncomplete(this.product.productName, "the app search did not complete");
 			}
 			const seen = /* @__PURE__ */ new Map();
 			let unresolved = false;
@@ -1892,7 +2138,7 @@ function workBuddyDiscoveryTools() {
 					unresolved = true;
 					continue;
 				}
-				if (bundleIdentifier !== "com.tencent.workbuddy.mac") continue;
+				if (bundleIdentifier !== this.product.macOS.bundleId) continue;
 				const electronPath = join(candidate, "Contents", "MacOS", "Electron");
 				if (!isExecutable(electronPath)) continue;
 				let identity;
@@ -1914,15 +2160,65 @@ function workBuddyDiscoveryTools() {
 					...version === void 0 ? {} : { version }
 				});
 			}
-			if (seen.size > 1) throw new WorkBuddyElectronPathError("electron-binary-ambiguous", `more than one WorkBuddy application was found, so none was chosen:\n${[...seen.values()].map((app) => `  - ${app.bundlePath}${app.version === void 0 ? "" : ` (${app.version})`}`).join("\n")}\n set ${WORKBUDDY_ELECTRON_BIN_ENV} to the one to use`);
-			if (unresolved) throw discoveryIncomplete("some candidates could not be checked");
-			if (seen.size === 0) throw new WorkBuddyElectronPathError("electron-binary-not-found", "no WorkBuddy application was found in the default location or the system index; if WorkBuddy is installed elsewhere, it may not be indexed yet");
+			if (seen.size > 1) {
+				const listed = [...seen.values()].map((app) => `  - ${app.bundlePath}${app.version === void 0 ? "" : ` (${app.version})`}`).join("\n");
+				throw new WorkBuddyElectronPathError("electron-binary-ambiguous", `more than one ${this.product.productName} application was found, so none was chosen:\n${listed}\n set ${this.product.envVar} to the one to use`);
+			}
+			if (unresolved) throw discoveryIncomplete(this.product.productName, "some candidates could not be checked");
+			if (seen.size === 0) throw new WorkBuddyElectronPathError("electron-binary-not-found", `no ${this.product.productName} application was found in the default location or the system index; if it is installed elsewhere, it may not be indexed yet; set ${this.product.envVar} to the app's Electron binary`);
 			return [...seen.values()][0].electronPath;
 		} finally {
 			clearTimeout(timer);
 			controller.abort();
 		}
 	}
+	/**
+	* Resolve this product's app through Windows uninstall records. Registry
+	* entries provide hints, not trust: every DisplayIcon candidate must still
+	* be the product's Electron binary with the known Electron layout before
+	* execution.
+	*/
+	async discoverWindowsApp() {
+		if (this.platform !== "win32") throw new WorkBuddyElectronPathError("electron-binary-unavailable", `no ${this.product.productName} Electron binary is configured for this platform; set ${this.product.envVar} to the app's Electron binary`);
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), this.discoveryBudgetMs);
+		try {
+			const candidates = [];
+			let unresolved = false;
+			for (const root of WINDOWS_REGISTRY_ROOTS) {
+				let output;
+				try {
+					output = await this.windowsTools.queryUninstallRoot(root, controller.signal);
+				} catch {
+					unresolved = true;
+					continue;
+				}
+				const parsed = parseWindowsRegistryOutput(output, this.product.windows.displayNamePattern);
+				candidates.push(...parsed.candidates);
+				unresolved ||= parsed.incomplete;
+			}
+			const seen = /* @__PURE__ */ new Map();
+			for (const candidate of new Set(candidates)) {
+				const inspection = inspectWindowsElectronCandidate(candidate, this.platform, this.product.windows.exeBasename);
+				if (inspection === "unresolved") {
+					unresolved = true;
+					continue;
+				}
+				if (inspection === void 0) continue;
+				seen.set(inspection.identity, inspection.electronPath);
+			}
+			if (unresolved) throw discoveryIncomplete(this.product.productName, "some registry entries or candidates could not be checked");
+			if (seen.size > 1) {
+				const listed = [...seen.values()].map((path) => `  - ${path}`).join("\n");
+				throw new WorkBuddyElectronPathError("electron-binary-ambiguous", `more than one ${this.product.productName} application was found, so none was chosen:\n${listed}\n set ${this.product.envVar} to the one to use`);
+			}
+			if (seen.size === 0) throw new WorkBuddyElectronPathError("electron-binary-not-found", `no usable ${this.product.productName} Electron binary was found in the default location or Windows uninstall records; set ${this.product.envVar} to the app's Electron binary`);
+			return [...seen.values()][0];
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+		}
+	}
 	async spawnPayload() {
 		return await this.spawnHelper(await this.resolveElectronPath());
 	}
@@ -1951,6 +2247,115 @@ function workBuddyDiscoveryTools() {
 		});
 	}
 };
+/** Only known missing-key diagnostics can safely make a failed query empty. */
+function windowsRegistryKeyMissing(stderr) {
+	const detail = stderr.trim();
+	return /^ERROR:\s*The system was unable to find the specified registry key or value\.?$/iu.test(detail) || /^错误[:：]\s*系统找不到指定的注册表项或值[。.]?$/u.test(detail);
+}
+/**
+* Parse the value columns emitted by `reg query ... /s`.
+*
+* Entries are filtered by the product's DisplayName pattern *before* the
+* DisplayIcon is judged, so another product's records — however broken — are
+* excluded as decisively not ours and can never mark this product's search
+* incomplete.
+*/
+function parseWindowsRegistryOutput(output, displayNamePattern) {
+	const entries = /* @__PURE__ */ new Map();
+	let currentKey;
+	for (const line of output.split(/\r?\n/u)) {
+		const keyMatch = /^\s*(HKEY_[^\r\n]+?)\s*$/iu.exec(line);
+		if (keyMatch !== null) {
+			currentKey = keyMatch[1];
+			entries.set(currentKey, {});
+			continue;
+		}
+		if (currentKey === void 0) continue;
+		const valueMatch = /^\s+(DisplayName|DisplayIcon)\s+REG_[A-Z0-9_]+\s*(.*?)\s*$/iu.exec(line);
+		if (valueMatch === null) continue;
+		const entry = entries.get(currentKey);
+		if (entry === void 0) continue;
+		const value = valueMatch[2] ?? "";
+		if (valueMatch[1].toLowerCase() === "displayname") entry.displayName = value;
+		else entry.displayIcon = value;
+	}
+	const candidates = [];
+	let incomplete = false;
+	for (const entry of entries.values()) {
+		if (entry.displayName === void 0) continue;
+		if (!displayNamePattern.test(entry.displayName.trim())) continue;
+		const displayIcon = entry.displayIcon === void 0 ? void 0 : parseWindowsDisplayIcon(entry.displayIcon);
+		if (displayIcon === void 0) incomplete = true;
+		else candidates.push(displayIcon);
+	}
+	return {
+		candidates,
+		incomplete
+	};
+}
+/** Read a quoted DisplayIcon path and remove the Windows icon-index suffix. */
+function parseWindowsDisplayIcon(value) {
+	const raw = value.trim();
+	let path;
+	if (raw.startsWith("\"")) {
+		const closingQuote = raw.indexOf("\"", 1);
+		if (closingQuote < 0) return void 0;
+		const suffix = raw.slice(closingQuote + 1).trim();
+		if (suffix !== "" && !/^,\d+$/u.test(suffix)) return void 0;
+		path = raw.slice(1, closingQuote).replace(/,\d+$/u, "");
+	} else {
+		const match = /^(.+?\.exe)(?:,\d+)?$/iu.exec(raw);
+		if (match === null) return void 0;
+		path = match[1];
+	}
+	path = path.trim();
+	return /\.exe$/iu.test(path) ? path : void 0;
+}
+/**
+* Validate the known Windows layout for the product's exe. `undefined` is a
+* decidable exclusion; `unresolved` is reserved for errors that prevent
+* checking.
+*/
+function inspectWindowsElectronCandidate(electronPath, platform, exeBasename) {
+	if (platform !== "win32" || basename(electronPath).toLowerCase() !== exeBasename) return void 0;
+	let binaryStat;
+	try {
+		binaryStat = statSync(electronPath);
+	} catch (error) {
+		return isENOENT$1(error) ? void 0 : "unresolved";
+	}
+	if (!binaryStat.isFile()) return void 0;
+	try {
+		accessSync(electronPath, constants.X_OK);
+	} catch (error) {
+		return isENOENT$1(error) ? void 0 : "unresolved";
+	}
+	const installRoot = dirname(electronPath);
+	let version;
+	try {
+		version = readFileSync(join(installRoot, "version"), "utf8").trim();
+	} catch (error) {
+		return isENOENT$1(error) ? void 0 : "unresolved";
+	}
+	if (!WINDOWS_ELECTRON_VERSION_PATTERN.test(version)) return void 0;
+	let resourcesStat;
+	try {
+		resourcesStat = statSync(join(installRoot, "resources", "app.asar"));
+	} catch (error) {
+		return isENOENT$1(error) ? void 0 : "unresolved";
+	}
+	if (!resourcesStat.isFile()) return void 0;
+	let identity;
+	try {
+		identity = realpathSync(electronPath);
+	} catch (error) {
+		return isENOENT$1(error) ? void 0 : "unresolved";
+	}
+	return {
+		electronPath,
+		identity: platform === "win32" ? identity.toLowerCase() : identity
+	};
+}
 /** Whether a path exists and is executable; never throws. */
 function isExecutable(path) {
 	try {
@@ -1981,8 +2386,8 @@ function reasonCodeOf(error) {
 function isENOENT$1(error) {
 	return error?.code === "ENOENT";
 }
-function discoveryIncomplete(detail) {
-	return new WorkBuddyElectronPathError("electron-discovery-incomplete", `the WorkBuddy application search did not finish (${detail}); this is not proof that the app is missing`);
+function discoveryIncomplete(productName, detail) {
+	return new WorkBuddyElectronPathError("electron-discovery-incomplete", `the ${productName} application search did not finish (${detail}); this is not proof that the app is missing`);
 }
 /**
 * The helper: run inside WorkBuddy's Electron as plain Node, where the
@@ -2199,7 +2604,7 @@ var WorkBuddyCredentialStore = class {
 		this.refresh = options.refresh;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.ownPath = options.ownPath ?? (options.variant ? join(resolveDshHome(), options.variant.ownFilename) : workbuddyOwnAuthPath());
-		this.keyProvider = options.keyProvider ?? new WorkBuddyAtRestKeyProvider();
+		this.keyProvider = options.keyProvider ?? new WorkBuddyAtRestKeyProvider({ product: electronProfileFor(options.variant) });
 		this.desktopPathOverride = options.desktopPath;
 	}
 	/**
@@ -3203,33 +3608,8 @@ var WorkBuddyCatalog = class {
 	}
 };
 //#endregion
-//#region src/status-paths.ts
-/** Node-free constants and types shared by the Host and browser halves. */
-/** Plugin-owned status endpoint consumed by its browser half. */
-const WORKBUDDY_STATUS_PATH = "/plugins/dsh-workbuddy-connect/status";
-/**
-* Plugin-owned probe control endpoint.
-*
-* Separate from the status route because it accepts writes: the status route's
-* loopback Host/Origin guard protects against a DNS-rebinding *page*, which is
-* not the same as authorizing a state-changing action. This route therefore
-* also requires the in-process key the browser half receives with the status
-* document.
-*/
-const WORKBUDDY_PROBE_PATH = "/plugins/dsh-workbuddy-connect/probe";
-/**
-* The international (WorkBuddy AI) variant's own pair of routes.
-*
-* Kept as separate constants rather than a computed suffix so both halves
-* reference literal strings: the browser bundle and the host bundle are built
-* independently, and a shared expression is one build-config drift away from
-* the desk asking a route the host never mounted.
-*/
-const WORKBUDDY_AI_STATUS_PATH = "/plugins/dsh-workbuddy-connect/ai/status";
-const WORKBUDDY_AI_PROBE_PATH = "/plugins/dsh-workbuddy-connect/ai/probe";
-//#endregion
 //#region src/version.ts
-const WORKBUDDY_CONNECT_VERSION = "0.6.2";
+const WORKBUDDY_CONNECT_VERSION = "0.6.4";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -3400,58 +3780,4 @@ function isHeartbeatProcessAlive(heartbeat) {
 	return startAtMs <= heartbeat.registeredAt;
 }
 //#endregion
-//#region src/variants.ts
-/**
-* The two WorkBuddy desktop apps this one plugin serves.
-*
-* Both products are the same client framework in different regions, and both
-* write their sign-in into the *same* shared `CodeBuddyExtension` auth
-* directory — they differ by file basename, base URL, catalog endpoint, and
-* display identity. Everything that varies between them is collected here as
-* one descriptor, so no module has to carry its own `if (international)`
-* branch and a third variant would be a data change rather than a refactor.
-*
-* This module is host-side (it names files and env vars). The browser half
-* takes the same ids and routes from the Node-free `status-paths.ts`, which
-* stays the single source shared by both halves.
-*
-* @module dsh-workbuddy-connect/variants
-*/
-/** CN WorkBuddy first: the existing provider keeps its id, paths, and copy. */
-const WORKBUDDY_VARIANTS = [{
-	id: "workbuddy",
-	displayName: "WorkBuddy",
-	appName: "WorkBuddy",
-	region: "cn",
-	env: "WORKBUDDY_AUTH_FILE",
-	desktopFilename: "workbuddy-desktop.info",
-	ownFilename: ".workbuddy-auth.json",
-	probeFilename: ".workbuddy-probe.json",
-	catalogFilename: ".workbuddy-catalog.json",
-	visibilityFilename: ".workbuddy-model-visibility.json",
-	statusPath: WORKBUDDY_STATUS_PATH,
-	probePath: WORKBUDDY_PROBE_PATH
-}, {
-	id: "workbuddy-ai",
-	displayName: "WorkBuddy AI",
-	appName: "WorkBuddy AI",
-	region: "global",
-	env: "WORKBUDDY_AI_AUTH_FILE",
-	desktopFilename: "workbuddy-desktop-ai.info",
-	ownFilename: ".workbuddy-ai-auth.json",
-	probeFilename: ".workbuddy-ai-probe.json",
-	catalogFilename: ".workbuddy-ai-catalog.json",
-	visibilityFilename: ".workbuddy-ai-model-visibility.json",
-	statusPath: WORKBUDDY_AI_STATUS_PATH,
-	probePath: WORKBUDDY_AI_PROBE_PATH
-}];
-/** The CN variant; the plugin's long-standing default and compatibility anchor. */
-const CN_VARIANT = WORKBUDDY_VARIANTS[0];
-/** The international variant. */
-const AI_VARIANT = WORKBUDDY_VARIANTS[1];
-/** Look up a variant by provider id. */
-function variantFor(id) {
-	return WORKBUDDY_VARIANTS.find((variant) => variant.id === id);
-}
-//#endregion
-export { normalizeCredits as A, chatUserAgent as B, desktopAuthCandidatesFor as C, WorkBuddyUpstreamClient as D, WorkBuddyAtRestKeyProvider as E, PROBE_EFFORT_CANDIDATES as F, WORKBUDDY_APP_VERSION_FILENAME as G, readCliVersion as H, probeModel as I, readBundleVersion as J, appUserAgent as K, randomSentinel as L, prepareChatBody as M, prepareInternationalChatBody as N, classifyUpstreamError as O, regionOf as P, CN_APP_VERSION_FILENAME as R, defaultDesktopAuthPath as S, workbuddyOwnAuthPath as T, resolveChatIdentity as U, fallbackChatIdentity as V, validCliVersion as W, validAppVersion as X, resolveAppVersion as Y, WorkBuddyCatalog as _, WORKBUDDY_HOST_HEARTBEAT_FILENAME as a, WorkBuddyCredentialStore as b, processStartTimeMs as c, writeHostHeartbeat as d, WORKBUDDY_CONNECT_VERSION as f, FALLBACK_WORKBUDDY_MODELS as g, FALLBACK_WORKBUDDY_AI_MODELS as h, variantFor as i, parseModelCatalog as j, modelWithCurrentPromotion as k, readHostHeartbeat as l, WORKBUDDY_STATUS_PATH as m, CN_VARIANT as n, clearHostHeartbeat as o, WORKBUDDY_PROBE_PATH as p, installedAppVersion as q, WORKBUDDY_VARIANTS as r, isHeartbeatProcessAlive as s, AI_VARIANT as t, workbuddyHostHeartbeatPath as u, WORKBUDDY_AUTH_FILENAME as v, parseWorkBuddyAuth as w, defaultDesktopAuthCandidates as x, WORKBUDDY_AUTH_FILE_ENV as y, FALLBACK_CN_APP_VERSION as z };
+export { extractDisplayErrorMessage as A, CN_APP_VERSION_FILENAME as B, WORKBUDDY_VARIANTS as C, WORKBUDDY_UPDATE_PATH as D, WORKBUDDY_STATUS_PATH as E, prepareInternationalChatBody as F, resolveChatIdentity as G, chatUserAgent as H, regionOf as I, appUserAgent as J, validCliVersion as K, PROBE_EFFORT_CANDIDATES as L, normalizeCredits as M, parseModelCatalog as N, WorkBuddyUpstreamClient as O, prepareChatBody as P, validAppVersion as Q, probeModel as R, CN_VARIANT as S, WORKBUDDY_PROBE_PATH as T, fallbackChatIdentity as U, FALLBACK_CN_APP_VERSION as V, readCliVersion as W, readBundleVersion as X, installedAppVersion as Y, resolveAppVersion as Z, desktopAuthCandidatesFor as _, readHostHeartbeat as a, atRestKeyProviderFor as b, WORKBUDDY_CONNECT_VERSION as c, WorkBuddyCatalog as d, WORKBUDDY_AUTH_FILENAME as f, defaultDesktopAuthPath as g, defaultDesktopAuthCandidates as h, processStartTimeMs as i, modelWithCurrentPromotion as j, classifyUpstreamError as k, FALLBACK_WORKBUDDY_AI_MODELS as l, WorkBuddyCredentialStore as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, WORKBUDDY_AUTH_FILE_ENV as p, WORKBUDDY_APP_VERSION_FILENAME as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, FALLBACK_WORKBUDDY_MODELS as u, parseWorkBuddyAuth as v, variantFor as w, AI_VARIANT as x, workbuddyOwnAuthPath as y, randomSentinel as z };