dsh-workbuddy-connect 0.6.3 → 0.6.4

package/lib/index.d.ts

@@ -20,9 +20,9 @@ type WorkBuddySignedOutReasonCode =
 'credential-region-mismatch' |
 /** An encrypted credential exists but could not be opened (wrong key, GCM failure, helper crash). */
 'encrypted-credential-unreadable' |
-/** CN on a supported platform: discovery ran to completion and found no usable candidate. */
+/** A product on a supported platform: discovery ran to completion and found no usable candidate. */
 'electron-binary-not-found' |
-/** CN on a supported platform: discovery found more than one distinct usable app. */
+/** A product on a supported platform: discovery found more than one distinct usable app. */
 'electron-binary-ambiguous' |
 /** No auto-discovery for this product/platform and no explicit path configured. */
 'electron-binary-unavailable' |
@@ -619,6 +619,15 @@ interface WorkBuddyVariant {
   region: WorkBuddyRegion;
   /** Env var overriding the desktop auth-file location. */
   env: string;
+  /**
+   * How this product's Electron helper is identified and located.
+   *
+   * Optional for source compatibility: `WorkBuddyVariant` is a public type and
+   * existing callers construct their own descriptors without it. Resolution
+   * falls back to {@link electronProfileFor}, keyed by variant id — an
+   * unknown id stays on the CN profile, the store's other legacy default.
+   */
+  electron?: WorkBuddyElectronProduct;
   /** Basename of the desktop app's own auth file in the shared auth directory. */
   desktopFilename: string;
   /** Basename of the plugin-owned credential copy under `$DSH_HOME`. */
@@ -647,6 +656,39 @@ interface WorkBuddyVariant {
   /** Same-origin probe-control route consumed by this variant's card. */
   probePath: string;
 }
+/**
+ * How one product's Electron key helper is identified on each platform, and
+ * which env var names an explicit binary for it (issues #59/#60).
+ *
+ * The profile is the *only* place product identity enters helper resolution —
+ * never the discovery setting, which only says whether a platform may be
+ * searched at all: two products on the same platform differ by bundle id /
+ * registry name / exe basename, so a discovery that matches one can never
+ * legitimately execute the other's binary.
+ */
+interface WorkBuddyElectronProduct {
+  /** Product name for helper diagnostics and error copy, e.g. `WorkBuddy AI`. */
+  productName: string;
+  /** Env var naming an explicit Electron binary for this product alone. */
+  envVar: string;
+  /** macOS identity and default install layout, verified per product. */
+  macOS: {
+    bundleId: string;
+    defaultPath: string;
+  };
+  /**
+   * Windows identity from the uninstall registry and the exe it names.
+   * `defaultPathSegments` exists only where the default install location has
+   * been measured (CN); the international app has only been seen in
+   * user-chosen locations, so it stays registry-only — an unverified default
+   * is a guess, and guessing is how the wrong app gets executed.
+   */
+  windows: {
+    displayNamePattern: RegExp;
+    exeBasename: string;
+    defaultPathSegments?: readonly string[];
+  };
+}
 /** CN WorkBuddy first: the existing provider keeps its id, paths, and copy. */
 declare const WORKBUDDY_VARIANTS: readonly WorkBuddyVariant[];
 /** The CN variant; the plugin's long-standing default and compatibility anchor. */
@@ -665,15 +707,16 @@ type WorkBuddyKeyPayloadSource = () => Promise<string>;
  * Which automatic discovery, if any, this provider may run when no explicit
  * binary is configured.
  *
- * `none` is the safe default: a provider that has not been told which product
- * it serves must not reach for another product's app. The CN line selects a
- * platform-specific discovery only where that platform's app layout has been
- * verified; Global remains `none`.
+ * The value says which *platform* may be searched, never which product: two
+ * products on the same platform are told apart by the product profile
+ * ({@link WorkBuddyElectronProduct} — bundle id, registry name, exe basename),
+ * so a search for one can never execute the other's binary. `none` remains the
+ * safe default for platforms without a verified layout (Linux today).
  */
 type WorkBuddyElectronDiscovery = 'none' | 'macos-workbuddy' | 'windows-workbuddy';
 /** Seams the discovery flow runs through, so tests never spawn a process. */
 interface WorkBuddyDiscoveryTools {
-  /** Candidate `.app` bundles for the CN bundle id, or a throw for an unusable tool. */
+  /** Candidate `.app` bundles for the product's bundle id, or a throw for an unusable tool. */
   findApps: (signal: AbortSignal) => Promise<readonly string[]>;
   /**
    * `CFBundleIdentifier` of a bundle, or `undefined` when the tool could not
@@ -691,6 +734,15 @@ interface WorkBuddyWindowsDiscoveryTools {
 }
 /** Provider options. */
 interface WorkBuddyAtRestKeyProviderOptions {
+  /**
+   * Which product's Electron this provider resolves. Required and the only
+   * source of product identity: it names the explicit-path env var, the bundle
+   * id / registry name / exe basename discovery must match, and the platform
+   * default. Without it the provider could not even decide which env var to
+   * read — the discovery setting alone cannot carry this (both products are
+   * `none` on Linux, yet each must read its own variable).
+   */
+  product: WorkBuddyElectronProduct;
   /** Explicit Electron binary; overrides the platform default and env. */
   electronPath?: string;
   /** Helper timeout in milliseconds; default 10s. */
@@ -747,6 +799,7 @@ interface WorkBuddyAtRestKeyProviderOptions {
    * a different app.
    */
   private readonly explicitPath;
+  private readonly product;
   private readonly defaultPath;
   private readonly discovery;
   private readonly tools;
@@ -764,7 +817,7 @@ interface WorkBuddyAtRestKeyProviderOptions {
   private discoveredPath;
   private cache;
   private inflight;
-  constructor(options?: WorkBuddyAtRestKeyProviderOptions);
+  constructor(options: WorkBuddyAtRestKeyProviderOptions);
   /**
    * The binary the default helper would use, for diagnostics.
    *
@@ -793,8 +846,8 @@ interface WorkBuddyAtRestKeyProviderOptions {
    */
   private resolveElectronPath;
   /**
-   * Resolve the CN app through Spotlight, then prove each candidate's identity
-   * before it can be executed.
+   * Resolve this product's app through Spotlight, then prove each candidate's
+   * identity before it can be executed.
    *
    * The whole flow shares one budget: a hang in one candidate must not extend
    * the wait for the others, and running out of budget is reported as an
@@ -802,9 +855,10 @@ interface WorkBuddyAtRestKeyProviderOptions {
    */
   private discoverMacosApp;
   /**
-   * Resolve the CN app through Windows uninstall records. Registry entries
-   * provide hints, not trust: every DisplayIcon candidate must still be a
-   * WorkBuddy Electron binary with the known Electron layout before execution.
+   * Resolve this product's app through Windows uninstall records. Registry
+   * entries provide hints, not trust: every DisplayIcon candidate must still
+   * be the product's Electron binary with the known Electron layout before
+   * execution.
    */
   private discoverWindowsApp;
   private spawnPayload;

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as modelWithCurrentPromotion, B as FALLBACK_CN_APP_VERSION, C as desktopAuthCandidatesFor, D as electronDiscoveryFor, E as WorkBuddyAtRestKeyProvider, F as regionOf, G as validCliVersion, H as fallbackChatIdentity, I as PROBE_EFFORT_CANDIDATES, J as installedAppVersion, K as WORKBUDDY_APP_VERSION_FILENAME, L as probeModel, M as parseModelCatalog, N as prepareChatBody, O as WorkBuddyUpstreamClient, P as prepareInternationalChatBody, R as randomSentinel, S as defaultDesktopAuthPath, T as workbuddyOwnAuthPath, U as readCliVersion, V as chatUserAgent, W as resolveChatIdentity, X as resolveAppVersion, Y as readBundleVersion, Z as validAppVersion, _ as WorkBuddyCatalog, a as WORKBUDDY_HOST_HEARTBEAT_FILENAME, b as WorkBuddyCredentialStore, c as processStartTimeMs, d as writeHostHeartbeat, f as WORKBUDDY_CONNECT_VERSION, g as FALLBACK_WORKBUDDY_MODELS, h as FALLBACK_WORKBUDDY_AI_MODELS, i as variantFor, j as normalizeCredits, k as classifyUpstreamError, l as readHostHeartbeat, n as CN_VARIANT, o as clearHostHeartbeat, q as appUserAgent, r as WORKBUDDY_VARIANTS, s as isHeartbeatProcessAlive, t as AI_VARIANT, u as workbuddyHostHeartbeatPath, v as WORKBUDDY_AUTH_FILENAME, w as parseWorkBuddyAuth, x as defaultDesktopAuthCandidates, y as WORKBUDDY_AUTH_FILE_ENV, z as CN_APP_VERSION_FILENAME } from "./variants-D_oxWP_K.js";
+import { A as extractDisplayErrorMessage, B as CN_APP_VERSION_FILENAME, C as WORKBUDDY_VARIANTS, D as WORKBUDDY_UPDATE_PATH, F as prepareInternationalChatBody, G as resolveChatIdentity, H as chatUserAgent, I as regionOf, J as appUserAgent, K as validCliVersion, L as PROBE_EFFORT_CANDIDATES, M as normalizeCredits, N as parseModelCatalog, O as WorkBuddyUpstreamClient, P as prepareChatBody, Q as validAppVersion, R as probeModel, S as CN_VARIANT, U as fallbackChatIdentity, V as FALLBACK_CN_APP_VERSION, W as readCliVersion, X as readBundleVersion, Y as installedAppVersion, Z as resolveAppVersion, _ as desktopAuthCandidatesFor, a as readHostHeartbeat, b as atRestKeyProviderFor, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as WORKBUDDY_AUTH_FILENAME, g as defaultDesktopAuthPath, h as defaultDesktopAuthCandidates, i as processStartTimeMs, j as modelWithCurrentPromotion, k as classifyUpstreamError, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as WORKBUDDY_AUTH_FILE_ENV, q as WORKBUDDY_APP_VERSION_FILENAME, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as parseWorkBuddyAuth, w as variantFor, x as AI_VARIANT, y as workbuddyOwnAuthPath, z as randomSentinel } from "./host-heartbeat-D9DvyLWz.js";
 import z from "@deepseek-ai/schemastery";
 import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { dirname, join, resolve } from "node:path";
@@ -770,7 +770,9 @@ function createWorkBuddyShim(options) {
 		req.on("close", () => controller.abort());
 		const result = await client.chatStream(credential, prepared, controller.signal);
 		if (!result.ok) {
-			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status}): ${result.message.slice(0, 400)}`);
+			const detail = extractDisplayErrorMessage(result.message) ?? result.message.slice(0, 400);
+			const statusNote = (result.status === 401 || result.status === 403) && result.kind !== "session_dead" ? "" : ` (http ${result.status})`;
+			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind}${statusNote}: ${detail}`);
 			return;
 		}
 		res.writeHead(200, {
@@ -1146,7 +1148,7 @@ var WorkBuddyProbeService = class {
 function safeMessage(error) {
 	return (error instanceof Error ? error.message : String(error)).replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]").slice(0, 500);
 }
-function json$1(res, status, body) {
+function json$2(res, status, body) {
 	const payload = JSON.stringify(body);
 	res.writeHead(status, {
 		"Content-Type": "application/json",
@@ -1245,17 +1247,17 @@ async function workBuddyWebStatus(deps) {
 function workBuddyStatusHandler(deps) {
 	return async (req, res) => {
 		if (req.method !== "GET") {
-			json$1(res, 405, { error: "method not allowed" });
+			json$2(res, 405, { error: "method not allowed" });
 			return;
 		}
 		if (!loopbackRequest(req)) {
-			json$1(res, 403, { error: "request-not-trusted" });
+			json$2(res, 403, { error: "request-not-trusted" });
 			return;
 		}
 		try {
-			json$1(res, 200, await workBuddyWebStatus(deps));
+			json$2(res, 200, await workBuddyWebStatus(deps));
 		} catch (error) {
-			json$1(res, 500, { error: safeMessage(error) });
+			json$2(res, 500, { error: safeMessage(error) });
 		}
 	};
 }
@@ -1274,6 +1276,308 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 	}, "dsh-workbuddy-connect: Web status route");
 }
 //#endregion
+//#region src/update.ts
+/**
+* Public update metadata and bounded version checking for WorkBuddy Connect.
+*
+* Two upstreams, strictly layered so the judgement never depends on the
+* enrichment: npm's dist-tags decide whether a newer release exists, and only
+* then is GitHub's release list consulted — one request that feeds both the
+* "versions behind" count and the per-release notes. Every upstream answer is
+* treated as untrusted input: bodies are size-capped while streaming, releases
+* are re-validated on the browser side by {@link parseWorkBuddyUpdateResult}
+* before anything renders.
+*
+* This module is host/browser shared and dependency-free by design (the client
+* bundle's runtime imports stay React + local modules only).
+*
+* @module dsh-workbuddy-connect/update
+*/
+const WORKBUDDY_REPOSITORY_URL = "https://github.com/corrinehu/dsh-workbuddy-connect";
+const WORKBUDDY_UPDATE_NPM_METADATA_URL = `https://registry.npmjs.org/-/package/dsh-workbuddy-connect/dist-tags`;
+const WORKBUDDY_UPDATE_RELEASES_API_URL = `${WORKBUDDY_REPOSITORY_URL.replace("https://github.com", "https://api.github.com/repos")}/releases?per_page=100`;
+const WORKBUDDY_RELEASE_PAGE_BASE = `${WORKBUDDY_REPOSITORY_URL}/releases/tag/`;
+const WORKBUDDY_UPDATE_MAX_METADATA_BYTES = 65536;
+const WORKBUDDY_UPDATE_MAX_RELEASES_BYTES = 1048576;
+/** GitHub caps one page at 100 releases; ours is far below that today. */
+const RELEASES_LIST_MAX = 100;
+const RELEASE_NAME_MAX_CHARS = 200;
+const RELEASE_NOTES_MAX_CHARS = 16e3;
+/** Parse one exact SemVer version, accepting the conventional leading `v`. */
+function parseWorkBuddyVersion(raw) {
+	if (typeof raw !== "string") return void 0;
+	const normalized = raw.startsWith("v") ? raw.slice(1) : raw;
+	const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u.exec(normalized);
+	if (match === null) return void 0;
+	const rawPrerelease = match[4] === void 0 ? [] : match[4].split(".");
+	if (rawPrerelease.some((identifier) => /^\d+$/u.test(identifier) && !/^(0|[1-9]\d*)$/u.test(identifier))) return void 0;
+	const prerelease = rawPrerelease.map((identifier) => /^(0|[1-9]\d*)$/u.test(identifier) ? Number(identifier) : identifier);
+	if (prerelease.some((identifier) => typeof identifier === "number" && !Number.isSafeInteger(identifier))) return void 0;
+	const parsed = {
+		major: Number(match[1]),
+		minor: Number(match[2]),
+		patch: Number(match[3]),
+		prerelease
+	};
+	return [
+		parsed.major,
+		parsed.minor,
+		parsed.patch
+	].every(Number.isSafeInteger) ? parsed : void 0;
+}
+/**
+* One canonical spelling per SemVer value: leading `v` and build metadata
+* fold away, so `v0.6.4`, `0.6.4`, and `0.6.4+build` dedupe as one release.
+* Returns `undefined` for unparseable input; callers drop those first.
+*/
+function canonicalWorkBuddyVersion(version) {
+	const parsed = parseWorkBuddyVersion(version);
+	if (parsed === void 0) return void 0;
+	return `${String(parsed.major)}.${String(parsed.minor)}.${String(parsed.patch)}` + (parsed.prerelease.length === 0 ? "" : `-${parsed.prerelease.join(".")}`);
+}
+function compareIdentifiers(left, right) {
+	if (typeof left === "number" && typeof right === "number") return left < right ? -1 : left > right ? 1 : 0;
+	if (typeof left === "number") return -1;
+	if (typeof right === "number") return 1;
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+/** Compare two versions using SemVer precedence (build metadata ignored). */
+function compareWorkBuddyVersions(left, right) {
+	const a = parseWorkBuddyVersion(left);
+	const b = parseWorkBuddyVersion(right);
+	if (a === void 0 || b === void 0) throw new TypeError("invalid WorkBuddy Connect version");
+	for (const [aPart, bPart] of [
+		[a.major, b.major],
+		[a.minor, b.minor],
+		[a.patch, b.patch]
+	]) if (aPart !== bPart) return aPart < bPart ? -1 : 1;
+	if (a.prerelease.length === 0 && b.prerelease.length !== 0) return 1;
+	if (a.prerelease.length !== 0 && b.prerelease.length === 0) return -1;
+	for (let index = 0; index < Math.max(a.prerelease.length, b.prerelease.length); index += 1) {
+		const aPart = a.prerelease[index];
+		const bPart = b.prerelease[index];
+		if (aPart === void 0) return -1;
+		if (bPart === void 0) return 1;
+		const comparison = compareIdentifiers(aPart, bPart);
+		if (comparison !== 0) return comparison;
+	}
+	return 0;
+}
+function boundedText(value, maxBytes) {
+	if (new TextEncoder().encode(value).byteLength > maxBytes) throw new RangeError("update response is too large");
+	return value;
+}
+async function readBoundedText(response, maxBytes) {
+	if (response.body === null) return boundedText(await response.text(), maxBytes);
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const next = await reader.read();
+			if (next.done) break;
+			total += next.value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel();
+				throw new RangeError("update response is too large");
+			}
+			chunks.push(decoder.decode(next.value, { stream: true }));
+		}
+		chunks.push(decoder.decode());
+		return chunks.join("");
+	} finally {
+		reader.releaseLock();
+	}
+}
+async function fetchBounded(fetchImpl, url, maxBytes, timeoutMs, headers) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => {
+		controller.abort(/* @__PURE__ */ new Error("update request timed out"));
+	}, timeoutMs);
+	try {
+		const response = await fetchImpl(url, {
+			headers,
+			signal: controller.signal
+		});
+		return {
+			response,
+			text: await readBoundedText(response, maxBytes)
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** Strip control characters, normalize newlines, and cap the length. */
+function cleanReleaseText(value, maxLength) {
+	if (typeof value !== "string" || value.length === 0) return void 0;
+	const clean = value.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/gu, "").replace(/\r\n?/gu, "\n").trim().slice(0, maxLength);
+	return clean.length === 0 ? void 0 : clean;
+}
+function cleanPublishedAt(value) {
+	return typeof value === "string" && /^\d{4}-\d{2}-\d{2}T/iu.test(value) ? value.slice(0, 64) : void 0;
+}
+/**
+* The `latest` dist-tag only. Pre-release channels are not this plugin's
+* release line, so recommending one would be wrong even when newer.
+*/
+function latestDistTag(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const tags = value["dist-tags"] ?? value;
+	if (typeof tags !== "object" || tags === null || Array.isArray(tags)) return void 0;
+	const candidate = tags["latest"];
+	return typeof candidate === "string" && parseWorkBuddyVersion(candidate) !== void 0 ? candidate : void 0;
+}
+function releasePageUrl(version) {
+	return `${WORKBUDDY_RELEASE_PAGE_BASE}v${version}`;
+}
+/**
+* Parse GitHub's release-list page into the in-range releases, newest first.
+* Unknown entry shapes are skipped, never fatal: the count and the notes both
+* degrade per-entry rather than dropping the whole judgement.
+*/
+function releasesInRange(currentVersion, latestVersion, value) {
+	if (!Array.isArray(value) || value.length > RELEASES_LIST_MAX) return void 0;
+	const releases = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const raw of value) {
+		if (typeof raw !== "object" || raw === null || Array.isArray(raw)) continue;
+		const entry = raw;
+		const tag = entry["tag_name"];
+		if (typeof tag !== "string") continue;
+		if (parseWorkBuddyVersion(tag) === void 0) continue;
+		if (compareWorkBuddyVersions(tag, currentVersion) <= 0 || compareWorkBuddyVersions(tag, latestVersion) > 0) continue;
+		const canonical = canonicalWorkBuddyVersion(tag);
+		if (canonical === void 0 || seen.has(canonical)) continue;
+		seen.add(canonical);
+		const name = cleanReleaseText(entry["name"], RELEASE_NAME_MAX_CHARS);
+		const notes = cleanReleaseText(entry["body"], RELEASE_NOTES_MAX_CHARS);
+		const publishedAt = cleanPublishedAt(entry["published_at"]);
+		releases.push({
+			version: tag,
+			...name === void 0 ? {} : { name },
+			...notes === void 0 ? {} : { notes },
+			...publishedAt === void 0 ? {} : { publishedAt }
+		});
+	}
+	releases.sort((left, right) => compareWorkBuddyVersions(right.version, left.version));
+	return releases;
+}
+/** Enrich an available update from GitHub's release list; degrade on failure. */
+async function releaseList(currentVersion, latestVersion, fetchImpl, timeoutMs) {
+	try {
+		const { response, text } = await fetchBounded(fetchImpl, WORKBUDDY_UPDATE_RELEASES_API_URL, WORKBUDDY_UPDATE_MAX_RELEASES_BYTES, timeoutMs, { accept: "application/vnd.github+json" });
+		if (!response.ok) return void 0;
+		return releasesInRange(currentVersion, latestVersion, JSON.parse(text));
+	} catch {
+		return;
+	}
+}
+/** Check npm's public dist-tags and enrich an available update with release notes. */
+async function checkWorkBuddyUpdate(options) {
+	const { currentVersion } = options;
+	if (parseWorkBuddyVersion(currentVersion) === void 0) return {
+		status: "unavailable",
+		currentVersion,
+		reason: "invalid-current-version"
+	};
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const timeoutMs = options.timeoutMs ?? 8e3;
+	let metadata;
+	try {
+		const { response, text } = await fetchBounded(fetchImpl, WORKBUDDY_UPDATE_NPM_METADATA_URL, WORKBUDDY_UPDATE_MAX_METADATA_BYTES, timeoutMs, { accept: "application/json" });
+		if (!response.ok) return {
+			status: "unavailable",
+			currentVersion,
+			reason: "registry-unavailable"
+		};
+		metadata = JSON.parse(text);
+	} catch (error) {
+		return {
+			status: "unavailable",
+			currentVersion,
+			reason: error instanceof SyntaxError || error instanceof RangeError ? "invalid-registry-response" : "registry-unavailable"
+		};
+	}
+	const latestVersion = latestDistTag(metadata);
+	if (latestVersion === void 0) return {
+		status: "unavailable",
+		currentVersion,
+		reason: "invalid-registry-response"
+	};
+	if (compareWorkBuddyVersions(latestVersion, currentVersion) <= 0) return {
+		status: "up-to-date",
+		currentVersion,
+		latestVersion: currentVersion
+	};
+	const releases = await releaseList(currentVersion, latestVersion, fetchImpl, timeoutMs);
+	return {
+		status: "update-available",
+		currentVersion,
+		latestVersion,
+		releaseUrl: releasePageUrl(latestVersion),
+		releases: releases ?? [],
+		...releases === void 0 ? {} : { versionsBehind: releases.length }
+	};
+}
+//#endregion
+//#region src/update-route.ts
+function json$1(res, status, value) {
+	const payload = JSON.stringify(value);
+	res.writeHead(status, {
+		"Content-Type": "application/json; charset=utf-8",
+		"Content-Length": Buffer.byteLength(payload),
+		"Cache-Control": "no-store",
+		"X-Content-Type-Options": "nosniff"
+	});
+	res.end(payload);
+}
+/** The same browser-origin gate the status route uses: DNS-rebinding pages die here. */
+function browserRequestAllowed(req) {
+	return hostIsLoopback(req.headers.host) && originIsLoopback(req.headers.origin);
+}
+/** Build the route handler; the caller owns registration and disposal. */
+function workBuddyUpdateHandler(options) {
+	return async (req, res) => {
+		if (req.method !== "GET") {
+			json$1(res, 405, { error: "method not allowed" });
+			return;
+		}
+		if (!browserRequestAllowed(req)) {
+			json$1(res, 403, { error: "forbidden" });
+			return;
+		}
+		let result;
+		try {
+			result = await checkWorkBuddyUpdate({
+				currentVersion: options.currentVersion,
+				...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+				timeoutMs: options.timeoutMs ?? 8e3
+			});
+		} catch {
+			result = {
+				status: "unavailable",
+				currentVersion: options.currentVersion,
+				reason: "registry-unavailable"
+			};
+		}
+		json$1(res, 200, result);
+	};
+}
+/** Register the update route on the optional host web server. */
+function registerWorkBuddyUpdateRoute(ctx, options) {
+	ctx.effect(() => {
+		const dispose = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_UPDATE_PATH,
+			handler: workBuddyUpdateHandler(options)
+		});
+		return () => {
+			dispose();
+		};
+	}, "dsh-workbuddy-connect: update route");
+}
+//#endregion
 //#region src/probe-route.ts
 /**
 * Probe control route: the only state-changing endpoint the plugin exposes.
@@ -1766,7 +2070,7 @@ function apply(ctx, config) {
 	* case that must not fall back to a shared preference bucket.
 	*/
 	const lastAccounts = /* @__PURE__ */ new Map();
-	const atRestKeysFor = (variant) => new WorkBuddyAtRestKeyProvider({ discovery: electronDiscoveryFor(variant) });
+	const atRestKeysFor = (variant) => atRestKeyProviderFor(variant);
 	const runtimes = WORKBUDDY_VARIANTS.map((variant) => createVariantRuntime(config, variant, () => current(), (id) => lastIdentities.get(id), (id) => lastAccounts.get(id), atRestKeysFor(variant)));
 	const probeKey = createProbeKey();
 	let setMaximumContextWindow;
@@ -1841,6 +2145,7 @@ function apply(ctx, config) {
 		runtime.invalidate();
 	};
 	ctx.inject(["webServer"], (webCtx) => {
+		registerWorkBuddyUpdateRoute(webCtx, { currentVersion: WORKBUDDY_CONNECT_VERSION });
 		for (const runtime of runtimes) {
 			registerWorkBuddyStatusRoute(webCtx, {
 				path: runtime.variant.statusPath,

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-connect",
   "displayName": "DSH WorkBuddy Connect",
   "description": "将 WorkBuddy 桌面 App 包含的模型自动接入 DeepSeek Harness — bring WorkBuddy desktop app models into DeepSeek Harness with zero configuration.",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "author": "corrinehu",
   "keywords": [
     "dsh-plugin",