dsh-workbuddy-connect 0.7.4 → 0.7.6

package/README.en.md

@@ -13,7 +13,7 @@ Brings the models available in your signed-in WorkBuddy / WorkBuddy AI desktop a
 ```text
 Please install and verify the DSH (DeepSeek Harness) plugin dsh-workbuddy-connect for me (project: https://github.com/corrinehu/dsh-workbuddy-connect).
 Start by reading the project README and confirming which interface I actually use (Web / Desktop / TUI) and its DSH core version — for the Desktop app, the bundled core, never the standalone CLI's version.
-Then install from the official npm package per the version mapping (0.2.0-rc.2 -> 0.7.4, rc.1 -> 0.7.0, 0.1.5-0.1.7 -> 0.6.5), preferring a locally supported non-market channel; on some Desktop distributions (the official Electron app in particular) the profile is app-managed and rules vary by distribution — check mine first, then explore its compliant install route, but never bypass its validation.
+Then install from the official npm package per the version mapping (0.2.0-rc.2 -> 0.7.6, rc.1 -> 0.7.0, 0.1.5-0.1.7 -> 0.6.5), preferring a locally supported non-market channel; on some Desktop distributions (the official Electron app in particular) the profile is app-managed and rules vary by distribution — check mine first, then explore its compliant install route, but never bypass its validation.
 Ask for my consent and make backups before changing any local files or configuration.
 After installing, verify the WorkBuddy group appears in the model picker and walk me through one short conversation.
 If the Desktop install still fails generation validation (e.g. the @types/retry false positive), report it honestly, reference upstream dataelement/dsh-desktop#688, and suggest switching to the standalone Web / TUI — do not modify dependency packages or bypass the check.
@@ -23,7 +23,7 @@ Core-to-plugin quick reference (full table in "Compatibility and release history
 
 | DSH core | Recommended plugin |
 |---|---|
-| 0.2.0-rc.2 | 0.7.4 (npm latest) |
+| 0.2.0-rc.2 | 0.7.6 (npm latest) |
 | 0.2.0-rc.1 | 0.7.0 |
 | 0.1.5 – 0.1.7 | 0.6.5 |
 
@@ -31,8 +31,8 @@ Core-to-plugin quick reference (full table in "Compatibility and release history
 <summary>Manual install (command line, Web / TUI only)</summary>
 
 ```sh
-# Web (pin per your actual core — example: 0.2.0-rc.2 -> 0.7.4; or install from source via github:corrinehu/dsh-workbuddy-connect)
-dsh plugin --profile web add dsh-workbuddy-connect@0.7.4
+# Web (pin per your actual core — example: 0.2.0-rc.2 -> 0.7.6; or install from source via github:corrinehu/dsh-workbuddy-connect)
+dsh plugin --profile web add dsh-workbuddy-connect@0.7.6
 dsh web
 
 # TUI (example for a 0.1.x core; that profile needs pnpm 11, e.g. npx pnpm@11)
@@ -62,7 +62,7 @@ dsh --profile dsh-tui
 
 - **Reasoning levels**: levels explicitly declared by WorkBuddy appear directly — for example, GLM-5.3 and GLM-5.3-Flash offer low / high / max. For models without declared levels, Web and Desktop offer a manual check in the model picker (it sends a few requests and may consume credit); models without a check result or selectable levels keep using WorkBuddy's default.
 
-- **Balance at a glance**: with a WorkBuddy / WorkBuddy AI model selected, the composer shows the account's remaining credit next to the model selector (e.g. `WB.3,401 credits`, `WB AI.3,401 credits` on the international app). Credit is not polled automatically (every status read is a real billing query): one read on mount, then refresh on demand with the ↻ beside it.
+- **Balance at a glance**: with a WorkBuddy / WorkBuddy AI model selected, the composer shows the account's remaining credit next to the model selector (e.g. `WB.3,401 credits`, `WB AI.3,401 credits` on the international app). Credit is not polled automatically (every status read is a real billing query): one read on mount, then refresh on demand with the ↻ beside it. During session switching, the controls may briefly hide until the model selection is ready, then return automatically. The refresh button remains available even when the model has no reasoning-level detection entry or the balance cannot be read.
 
 - **Status and detection**: Settings → Plugins → the matching card shows the account, token validity, remaining credit, and model offers; it also refreshes the model list manually, shows whether the current list came from the upstream or the built-in fallback, and runs manual reasoning-level detection for eligible models. On DSH 0.1.5 the entry lives under Settings → Plugins; on 0.1.6+ it moved to the left-sidebar Plugins panel (workbuddy-connect → View) — and the Settings → Models page shows no WorkBuddy entries on either generation, by design.
 
@@ -112,7 +112,7 @@ dsh plugin --profile web exec dsh-workbuddy-connect doctor --provider workbuddy-
 ## Known limitations
 
 - Verified on macOS with the DSH Web / Desktop / TUI profiles (as of 0.3.2 this requires `0.1.5-rc.1`+ and Node 22+; TUI requires the terminal UI package `0.10.0-beta.5` or newer — see the Install section). Windows probes Local and Roaming AppData in order; WSL first reads credentials from the mounted Windows user profile. If the Windows and Linux user names differ and Windows environment variables are not forwarded into WSL, point `WORKBUDDY_AUTH_FILE` (or `WORKBUDDY_AI_AUTH_FILE` for the international version) at the actual file.
-- **Encrypted desktop credential helper discovery**: the helper is auto-detected on macOS and Windows; on Windows the CN app checks the default path `%LOCALAPPDATA%\Programs\WorkBuddy\WorkBuddy.exe` first and then the uninstall registry records, while the international app has no verified default path and checks the registry only. If auto-detection fails, set `WORKBUDDY_ELECTRON_BIN` (CN) or `WORKBUDDY_AI_ELECTRON_BIN` (international) to the executable explicitly, then fully quit and restart DSH for the change to take effect. Linux has no auto-discovery; an explicit environment variable is required.
+- **Encrypted desktop credential helper discovery**: the helper is auto-detected on macOS and Windows; on Windows the CN app checks the default path `%LOCALAPPDATA%\Programs\WorkBuddy\WorkBuddy.exe` first and then the uninstall registry records, while the international app has no verified default path and checks the registry only. If auto-detection fails, set `WORKBUDDY_ELECTRON_BIN` (CN) or `WORKBUDDY_AI_ELECTRON_BIN` (international) to the executable explicitly, then fully quit and restart DSH for the change to take effect. Linux has no auto-discovery; an explicit environment variable is required. When WSL invokes the Windows-side helper, the plugin automatically normalizes the `ELECTRON_RUN_AS_NODE` entry in the child's `WSLENV` to a single safe flag set (carrying `/w` for forwarding, with no path translation; all other entries are preserved) — no manual `WSLENV` setup is needed. This change has passed offline regression tests; real WSL2 / Windows verification remains outstanding.
 - **The international version's model catalog comes from the app's own interface**: the service splits it by User-Agent, which is a private implementation detail that a server-side change can break. When that happens the plugin degrades to this account's last successful catalog and then to its built-in roster, showing the source (live / saved / built-in), the fetch time, and the failure reason on the card — but long-term compatibility is not guaranteed. The CN version's catalog uses the same interface as the official CLI and is unaffected.
 - **International-version environments not yet covered**: on Windows / WSL / Linux no reliable source for the international app's version has been located yet, so the saved value or the built-in default is used. On macOS, real-shim checks covered complete GPT-family replies, tool calls, and continued turns.
 - **Behaviour change with no credentials**: a version whose app was never signed in — and that left no plugin-owned copy — no longer shows a model group. The CN version used to display a built-in fallback list, but every model on it failed when selected.
@@ -126,7 +126,7 @@ The plugin version must match the DSH core — a mismatched combination fails to
 
 | DSH core | Recommended plugin | Notes |
 |---|---|---|
-| `0.2.0-rc.2` | `0.7.4` (npm latest) | Current line; Windows registry discovery fixed, diagnostics and stability improved — do not stay on 0.7.2. |
+| `0.2.0-rc.2` | `0.7.6` (npm latest) | Current line; fixes enterprise catalog gaps and international chat requests blocked by the upstream channel check. Avoid 0.7.2 with its registry regression. |
 | `0.2.0-rc.1` | `0.7.0` | 0.7.1 drops rc.1 support; stay on this version. |
 | `0.1.5` – `0.1.7` | `0.6.5` | Final release for the old cores; 0.7.0 targets 0.2.0 only. |
 | `0.1.2-rc.1` | `0.3.1` | Older line, historical maintenance only. |
@@ -134,14 +134,16 @@ The plugin version must match the DSH core — a mismatched combination fails to
 
 Release history (full records at [releases](https://github.com/corrinehu/dsh-workbuddy-connect/releases)):
 
+- **0.7.6**: fixes enterprise accounts missing `glm-5.3-flashx` from the model catalog ([#123](https://github.com/corrinehu/dsh-workbuddy-connect/issues/123)), and fixes international chat requests being blocked by the upstream channel check ([#139](https://github.com/corrinehu/dsh-workbuddy-connect/issues/139) / [#142](https://github.com/corrinehu/dsh-workbuddy-connect/issues/142)).
+- **0.7.5**: restores composer controls after session switching ([#125](https://github.com/corrinehu/dsh-workbuddy-connect/issues/125) / [#132](https://github.com/corrinehu/dsh-workbuddy-connect/issues/132)), fixes WSL helper environment forwarding ([#133](https://github.com/corrinehu/dsh-workbuddy-connect/issues/133)), and adds community projects to both READMEs.
 - **0.7.4**: Windows diagnostics and stability improvements: accurate classification of oversized registry-subprocess output, cross-platform test-assumption fixes ([#62](https://github.com/corrinehu/dsh-workbuddy-connect/issues/62)), and a reworked install section.
 - **0.7.3**: fixes Windows registry auto-discovery failing on non-default install paths ([#105](https://github.com/corrinehu/dsh-workbuddy-connect/issues/105)).
-- **0.7.2**: pi-ai becomes a plugin-bundled dependency and rejected inference-field requests are fixed ([#92](https://github.com/corrinehu/dsh-workbuddy-connect/issues/92)); this release carries a Windows registry regression — use 0.7.4 directly.
+- **0.7.2**: pi-ai becomes a plugin-bundled dependency and rejected inference-field requests are fixed ([#92](https://github.com/corrinehu/dsh-workbuddy-connect/issues/92)); this release carries a Windows registry regression — use 0.7.4 or a newer stable release.
 - **0.7.1**: narrows the pi-ai dependency range.
 - **0.7.0**: adapts to DSH 0.2.0's settings-service rework and drops 0.1.x support.
 - **0.6.5**: final release of the 0.1.x line.
 
-Pinned-version install example: `dsh plugin --profile web add dsh-workbuddy-connect@0.7.4`.
+Pinned-version install example: `dsh plugin --profile web add dsh-workbuddy-connect@0.7.6`.
 
 **Do not upgrade the profile-level `@earendil-works/pi-ai` to 1.x**: this plugin and the `0.2.0-rc.2` generation of the DSH core both require `^0.87.1` (bundled by the plugin since 0.7.2), and third-party plugin managers' "updatable" prompts do not check peer constraints — do not act on them ([#86](https://github.com/corrinehu/dsh-workbuddy-connect/issues/86)); likewise, do not blindly remove a leftover `overrides: {'@earendil-works/pi-ai': '0.87.1'}` until you have confirmed nothing else depends on it.
 
@@ -152,6 +154,13 @@ Pinned-version install example: `dsh plugin --profile web add dsh-workbuddy-conn
 - The author is not liable for any direct or indirect loss arising from the use or misuse of this project.
 - This project is not affiliated with, endorsed by, or sponsored by Tencent, WorkBuddy, or DeepSeek. Product names are used for compatibility description only; trademarks belong to their respective owners.
 
+## Related Projects / Community Ecosystem
+
+- **[HanaAgent](https://github.com/liliMozi/openhanako)**: an independent personal AI Agent project.
+- **[hana-workbuddy-connect](https://github.com/miaoyongxu/hana-workbuddy-connect)**: a community-maintained unofficial adapter project that reuses parts of the `dsh-workbuddy-connect` implementation to bring WorkBuddy / WorkBuddy AI models to HanaAgent.
+
+Both projects are maintained independently by third parties. The compatibility, security, and usage support of `hana-workbuddy-connect` are the responsibility of its maintainer. Listing them here is not an official endorsement, nor does it imply any stability or compatibility commitment on this plugin's internal interfaces.
+
 ## Acknowledgements
 
 - [Sliverkiss/workbuddy2api](https://github.com/Sliverkiss/workbuddy2api) (MIT) — reference implementation of the WorkBuddy upstream protocol.

package/README.md

@@ -13,7 +13,7 @@
 ```text
 请帮我安装并验证 DSH（DeepSeek Harness）插件 dsh-workbuddy-connect（项目地址：https://github.com/corrinehu/dsh-workbuddy-connect）：
 先阅读项目 README，确认我实际使用的界面（Web / Desktop / TUI）与 DSH 内核版本，桌面版以 App 内置核心为准，不要用独立 CLI 的版本代替；
-再按版本对应关系从 npm 正式包安装（0.2.0-rc.2→0.7.4、rc.1→0.7.0、0.1.5–0.1.7→0.6.5），优先走本机受支持的非插件市场渠道；部分 Desktop 发行版（尤其官方 Electron 版）的 profile 由 App 管理，各发行版规则未必相同，先确认我所用的发行版，再探查其合规的安装方式，但不得绕过其校验；
+再按版本对应关系从 npm 正式包安装（0.2.0-rc.2→0.7.6、rc.1→0.7.0、0.1.5–0.1.7→0.6.5），优先走本机受支持的非插件市场渠道；部分 Desktop 发行版（尤其官方 Electron 版）的 profile 由 App 管理，各发行版规则未必相同，先确认我所用的发行版，再探查其合规的安装方式，但不得绕过其校验；
 任何本地文件或配置改动，先征得我同意并做好备份；
 装完后验证模型选择器里出现 WorkBuddy 分组，并陪我完成一次简短对话；
 若 Desktop 安装仍因 generation 校验失败（如 @types/retry 误报），请如实报告、参照上游 dataelement/dsh-desktop#688，并建议我改用独立的 Web / TUI，不要修改依赖包或绕过校验。
@@ -23,7 +23,7 @@
 
 | DSH 内核 | 推荐插件版 |
 |---|---|
-| 0.2.0-rc.2 | 0.7.4（npm latest） |
+| 0.2.0-rc.2 | 0.7.6（npm latest） |
 | 0.2.0-rc.1 | 0.7.0 |
 | 0.1.5 – 0.1.7 | 0.6.5 |
 
@@ -31,8 +31,8 @@
 <summary>手动安装（命令行，仅 Web / TUI）</summary>
 
 ```sh
-# Web（按实际内核固定版本，示例为 0.2.0-rc.2 → 0.7.4；也可用 github:corrinehu/dsh-workbuddy-connect 从源码安装）
-dsh plugin --profile web add dsh-workbuddy-connect@0.7.4
+# Web（按实际内核固定版本，示例为 0.2.0-rc.2 → 0.7.6；也可用 github:corrinehu/dsh-workbuddy-connect 从源码安装）
+dsh plugin --profile web add dsh-workbuddy-connect@0.7.6
 dsh web
 
 # TUI（示例为 0.1.x 内核；该 profile 需用 pnpm 11 安装，如 npx pnpm@11）
@@ -62,7 +62,7 @@ dsh --profile dsh-tui
 
 - **推理档位**：WorkBuddy 明确声明的档位会直接显示，例如 GLM-5.3 和 GLM-5.3-Flash 可选 low / high / max。未声明档位的模型可在 Web 和 Desktop 的模型选择器中手动检测（发送少量请求，可能消耗积分）；未检测或没有可用档位的模型使用 WorkBuddy 默认档位。
 
-- **余额速览**：选中 WorkBuddy / WorkBuddy AI 模型时，输入框底部在模型选择器旁显示当前账号的剩余积分（如 `WB.3,401（积分）`、国际版 `WB AI.3,401（积分）`）。积分不自动轮询（每次读取都是真实计费查询），挂载时读取一次后可点旁边的 ↻ 手动刷新。
+- **余额速览**：选中 WorkBuddy / WorkBuddy AI 模型时，输入框底部在模型选择器旁显示当前账号的剩余积分（如 `WB.3,401（积分）`、国际版 `WB AI.3,401（积分）`）。积分不自动轮询（每次读取都是真实计费查询），挂载时读取一次后可点旁边的 ↻ 手动刷新。切换会话时组件可能短暂隐藏，模型选择就绪后自动恢复；即使模型没有推理档位检测入口或余额读取失败，刷新按钮仍保留。
 
 - **信息查看与检测**：设置 → 插件 → 对应卡片可查看账号、令牌有效期、剩余积分和模型优惠，也可手动刷新模型列表并查看当前列表来自上游还是内置兜底，或对可检测模型手动检测推理档位。DSH 0.1.5 的入口在「设置 → 插件」，0.1.6+ 移到主界面左侧栏「插件」面板（workbuddy-connect → 查看）；「设置 → 模型」页两代都不显示 WorkBuddy 条目，属有意设计。
 
@@ -113,7 +113,7 @@ dsh plugin --profile web exec dsh-workbuddy-connect doctor --provider workbuddy-
 ## 已知限制
 
 - 在 macOS 的 DSH Web / Desktop / TUI 下验证通过（0.3.2 起要求 `0.1.5-rc.1`+、Node 22+；TUI 需终端界面插件 `0.10.0-beta.5` 及以上，见安装章节说明）。Windows 会依次探测 Local 与 Roaming AppData；WSL 会优先从挂载的 Windows 用户目录读取登录凭据。若 Windows 与 Linux 用户名不同且 Windows 环境变量未传入 WSL，请通过 `WORKBUDDY_AUTH_FILE`（国际版为 `WORKBUDDY_AI_AUTH_FILE`）指定实际位置。
-- **加密桌面凭据的解密程序定位**：解密程序在 macOS 与 Windows 上会自动探测；Windows 上国内版先查默认路径 `%LOCALAPPDATA%\Programs\WorkBuddy\WorkBuddy.exe`，再查卸载注册表记录，国际版没有已验证的默认路径、仅查注册表。自动探测失败时，可用 `WORKBUDDY_ELECTRON_BIN`（国内版）或 `WORKBUDDY_AI_ELECTRON_BIN`（国际版）显式指定可执行文件，设置后需完全退出并重启 DSH 才生效。Linux 无法自动发现，需显式指定。
+- **加密桌面凭据的解密程序定位**：解密程序在 macOS 与 Windows 上会自动探测；Windows 上国内版先查默认路径 `%LOCALAPPDATA%\Programs\WorkBuddy\WorkBuddy.exe`，再查卸载注册表记录，国际版没有已验证的默认路径、仅查注册表。自动探测失败时，可用 `WORKBUDDY_ELECTRON_BIN`（国内版）或 `WORKBUDDY_AI_ELECTRON_BIN`（国际版）显式指定可执行文件，设置后需完全退出并重启 DSH 才生效。Linux 无法自动发现，需显式指定。WSL 下调用 Windows 侧解密程序时，插件会自动把子进程 `WSLENV` 中的 `ELECTRON_RUN_AS_NODE` 条目规范化为单一安全旗标（含 `/w` 转发、不做路径转换，其余条目原样保留），无需手动设置。此改动已通过离线回归测试，尚未完成 WSL2 / Windows 真机验证。
 - **国际版的模型目录来自 App 界面接口**：服务端按 User-Agent 分流下发，属私有实现，上游改动可能使其失效。届时插件按「本账号上次成功目录 → 内置目录」降级，并在卡片上标明来源（实时 / 已保存 / 内置）、更新时间与失败原因，但不能保证长期兼容。国内版目录走官方 CLI 同款接口，不受此影响。
 - **国际版仍未覆盖的环境**：Windows / WSL / Linux 下国际版 App 的版本读取尚未找到可靠来源，会退回最近保存的版本或内置值。macOS 上已通过真实 shim 验证 GPT 系完整回复、工具调用与续轮。
 - **无凭据时的行为变化**：某版 App 从未登录、也没留下插件自留副本时，该版模型分组不再显示。此前国内版会显示一份内置兜底列表，但那些模型选了必然报错。
@@ -127,7 +127,7 @@ dsh plugin --profile web exec dsh-workbuddy-connect doctor --provider workbuddy-
 
 | DSH 内核 | 推荐插件版 | 注意事项 |
 |---|---|---|
-| `0.2.0-rc.2` | `0.7.4`（npm latest） | 当前最新线；Windows 注册表发现已修复，诊断与稳定性改进，勿停留在 0.7.2。 |
+| `0.2.0-rc.2` | `0.7.6`（npm latest） | 当前最新线；修复企业账号模型目录缺项与国际版对话被渠道校验拦截，勿停留在有注册表回归的 0.7.2。 |
 | `0.2.0-rc.1` | `0.7.0` | 0.7.1 起不再支持 rc.1，请停留本版。 |
 | `0.1.5` – `0.1.7` | `0.6.5` | 旧内核最终版；0.7.0 起仅面向 0.2.0。 |
 | `0.1.2-rc.1` | `0.3.1` | 更早旧线，仅历史维护。 |
@@ -135,14 +135,16 @@ dsh plugin --profile web exec dsh-workbuddy-connect doctor --provider workbuddy-
 
 历次更新（完整记录见 [releases](https://github.com/corrinehu/dsh-workbuddy-connect/releases)）：
 
+- **0.7.6**：修复企业账号模型目录缺少 `glm-5.3-flashx`（[#123](https://github.com/corrinehu/dsh-workbuddy-connect/issues/123)），修复国际版对话请求被上游渠道校验拦截（[#139](https://github.com/corrinehu/dsh-workbuddy-connect/issues/139) / [#142](https://github.com/corrinehu/dsh-workbuddy-connect/issues/142)）。
+- **0.7.5**：修复切换会话后输入框余额与刷新按钮消失（[#125](https://github.com/corrinehu/dsh-workbuddy-connect/issues/125) / [#132](https://github.com/corrinehu/dsh-workbuddy-connect/issues/132)），修复 WSL 调用 Windows 凭据解密程序的环境转发（[#133](https://github.com/corrinehu/dsh-workbuddy-connect/issues/133)），README 收录社区项目（[#130](https://github.com/corrinehu/dsh-workbuddy-connect/issues/130)）。
 - **0.7.4**：Windows 诊断与稳定性改进：注册表子进程输出超限准确分类、跨平台测试假设修正（[#62](https://github.com/corrinehu/dsh-workbuddy-connect/issues/62)），安装说明重排。
 - **0.7.3**：修复 Windows 非默认安装路径下注册表自动发现失败（[#105](https://github.com/corrinehu/dsh-workbuddy-connect/issues/105)）。
-- **0.7.2**：pi-ai 改为插件自带依赖，并修复推理字段请求被拒（[#92](https://github.com/corrinehu/dsh-workbuddy-connect/issues/92)）；该版存在 Windows 注册表回归，请直接使用 0.7.4。
+- **0.7.2**：pi-ai 改为插件自带依赖，并修复推理字段请求被拒（[#92](https://github.com/corrinehu/dsh-workbuddy-connect/issues/92)）；该版存在 Windows 注册表回归，请使用 0.7.4 或更新的正式版本。
 - **0.7.1**：收窄 pi-ai 依赖范围。
 - **0.7.0**：适配 DSH 0.2.0 的设置服务改造，不再支持 0.1.x。
 - **0.6.5**：0.1.x 线最终版本。
 
-固定版本安装示例：`dsh plugin --profile web add dsh-workbuddy-connect@0.7.4`。
+固定版本安装示例：`dsh plugin --profile web add dsh-workbuddy-connect@0.7.6`。
 
 **不要把 profile 级的 `@earendil-works/pi-ai` 升到 1.x**：本插件与 `0.2.0-rc.2` 这一代内核都要求 `^0.87.1`（0.7.2 起由插件自带），第三方插件管理器的「可更新」提示不校验 peer 约束、不能照做（[#86](https://github.com/corrinehu/dsh-workbuddy-connect/issues/86)）；为此历史遗留的 `overrides: {'@earendil-works/pi-ai': '0.87.1'}` 在确认其他插件不依赖前也不要盲目移除。
 
@@ -153,6 +155,13 @@ dsh plugin --profile web exec dsh-workbuddy-connect doctor --provider workbuddy-
 - 本项目作者不对任何因使用或滥用本项目产生的直接或间接损失负责。
 - 本项目与腾讯、WorkBuddy、DeepSeek 均无关联，未获其授权或认可；文中出现的名称仅用于描述兼容关系，其商标权利归各自所有。
 
+## 相关项目 / 社区生态
+
+- **[HanaAgent](https://github.com/liliMozi/openhanako)**：独立的个人 AI Agent 项目。
+- **[hana-workbuddy-connect](https://github.com/miaoyongxu/hana-workbuddy-connect)**：社区维护的非官方适配项目，复用 `dsh-workbuddy-connect` 的部分实现，为 HanaAgent 接入 WorkBuddy / WorkBuddy AI 模型。
+
+以上项目均由第三方独立维护。其中，`hana-workbuddy-connect` 的兼容性、安全性及使用支持由其维护者负责。收录不代表官方背书，也不意味着本插件对内部接口提供稳定性或兼容性承诺。
+
 ## 致谢
 
 - [Sliverkiss/workbuddy2api](https://github.com/Sliverkiss/workbuddy2api)（MIT）— WorkBuddy 上游协议的参照实现。

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as WORKBUDDY_VARIANTS, O as WorkBuddyUpstreamClient, Q as resolveAppVersion, S as CN_VARIANT, a as readHostHeartbeat, b as atRestKeyProviderFor, c as WORKBUDDY_CONNECT_VERSION, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, w as variantFor } from "./host-heartbeat-DVlbwIIo.js";
+import { C as WORKBUDDY_VARIANTS, O as WorkBuddyUpstreamClient, Q as resolveAppVersion, S as CN_VARIANT, a as readHostHeartbeat, b as atRestKeyProviderFor, c as WORKBUDDY_CONNECT_VERSION, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, w as variantFor } from "./host-heartbeat-vU86u9aU.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -1746,14 +1746,14 @@ window.__ModuleLoader__.load({
 			const subscribe = (0, react.useCallback)((listener) => directory.subscribe(listener), [directory]);
 			const snapshot = (0, react.useCallback)(() => directory.getSnapshot(), [directory]);
 			const selection = (0, react.useSyncExternalStore)(subscribe, snapshot, snapshot).current;
-			const card = selection === void 0 ? void 0 : cardVariantFor(selection.provider);
-			const key = card === void 0 || selection === void 0 ? void 0 : `${card.id}:${selection.model}`;
-			return card === void 0 || selection === void 0 || key === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ModelProbe, {
+			if (selection == null) return null;
+			const card = cardVariantFor(selection.provider);
+			return card === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ModelProbe, {
 				model: selection.model,
 				card,
 				label: useLabel(t),
 				t
-			}, key);
+			}, `${card.id}:${selection.model}`);
 		}
 		function ModelProbe({ model, card, label, t }) {
 			const [status, setStatus] = (0, react.useState)();
@@ -2772,7 +2772,7 @@ window.__ModuleLoader__.load({
 		};
 		//#endregion
 		//#region src/version.ts
-		const WORKBUDDY_CONNECT_VERSION = "0.7.4";
+		const WORKBUDDY_CONNECT_VERSION = "0.7.6";
 		//#endregion
 		//#region src/client/WorkBuddyConfigPage.tsx
 		/**

package/lib/{host-heartbeat-DVlbwIIo.js → host-heartbeat-vU86u9aU.js}

@@ -3,7 +3,7 @@ import { homedir, release } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
-import { createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
 import { execFile, execFileSync } from "node:child_process";
 import { accessSync, constants, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 //#region src/app-version.ts
@@ -709,11 +709,39 @@ function commonHeaders(credential) {
 	};
 }
 /**
+* The conversation-channel trio the chat endpoints require.
+*
+* Since 2026-10-16 `www.workbuddy.ai` answers any `/v2/chat/completions`
+* request that omits all three `X-Conversation-*` headers with `400` /
+* `code 11128` / `msg: "conversation id missing"`, whose `displayMsg.zh` is
+* 「请求被拦截，请重新发送」 (issue #139). The official desktop client sends
+* the trio on chat and speech alike — read out of `resources/app.asar`, where
+* the names are `X-Conversation-ID`, `X-Conversation-Request-ID` and
+* `X-Conversation-Message-ID`.
+*
+* A fresh UUID per request is enough, and is what the wire measurement
+* supports: the upstream keeps no history keyed by the id (two calls sharing
+* one id, the second carrying only `system` + `user`, still answered "I don't
+* know"), so the trio marks the channel rather than carrying conversation
+* state. Fresh ids also keep concurrent sub-agents off one shared
+* conversation. The CN gateway was measured accepting the same trio (200 with
+* and without), so both regions carry it and the two paths cannot drift.
+*/
+function conversationHeaders() {
+	return {
+		"X-Conversation-ID": randomUUID(),
+		"X-Conversation-Request-ID": randomUUID(),
+		"X-Conversation-Message-ID": randomUUID()
+	};
+}
+/**
 * Chat request headers, including the X-No-* conventions the official CLI uses.
 *
 * `userAgent` and `clientVersion` carry the same resolved desktop identity for
 * chat and probe requests. Refresh shares `commonHeaders` but never this
-* override, so the two paths cannot drift into each other.
+* override, so the two paths cannot drift into each other. The
+* `X-Conversation-*` trio rides along too — see {@link conversationHeaders} —
+* because the international gateway rejects a chat that omits it.
 */
 function chatHeaders(credential, userAgent, clientVersion) {
 	return {
@@ -726,7 +754,8 @@ function chatHeaders(credential, userAgent, clientVersion) {
 		"X-IDE-Type": "WorkBuddy",
 		"X-IDE-Name": "WorkBuddy",
 		"X-IDE-Version": clientVersion,
-		"X-Product": "SaaS"
+		"X-Product": "SaaS",
+		...conversationHeaders()
 	};
 }
 /** Refresh-endpoint headers; X-Refresh-Token appears here and nowhere else. */
@@ -755,6 +784,28 @@ function billingHeaders(credential) {
 	return headers;
 }
 /**
+* Account-identity headers for the CN catalog requests (`/v3/config` and the
+* console badge read). The gateway also splits `/v3/config` by account
+* identity: an enterprise account without this pair is silently answered with
+* the personal roster (issue #123 — 18 vs 19 models, FlashX missing), and the
+* pair is all-or-nothing there: `X-Enterprise-Id` alone is rejected outright
+* while `X-User-Id` alone selects nothing. So the block is emitted only when
+* both parts exist, and personal accounts keep the bare headers their roster
+* was already correct under. `X-Tenant-Id`/`X-Domain` ride along in the
+* spelling `billingHeaders` already proved the gateway accepts.
+*/
+function identityHeaders(credential) {
+	if (credential.uid === "") return {};
+	if (credential.enterpriseId === void 0 || credential.enterpriseId === "") return {};
+	const headers = {
+		"X-User-Id": credential.uid,
+		"X-Enterprise-Id": credential.enterpriseId,
+		"X-Tenant-Id": credential.enterpriseId
+	};
+	if (credential.domain !== "") headers["X-Domain"] = credential.domain;
+	return headers;
+}
+/**
 * Normalize an OpenAI chat-completions body for the WorkBuddy upstream:
 * force `stream: true` (the upstream rejects non-streaming), flatten
 * `tool_choice` (the upstream's field is a string; object forms return 400),
@@ -1036,6 +1087,13 @@ var WorkBuddyUpstreamClient = class {
 	* advertises is exactly the one its own requests can use. The international
 	* variant has no CLI identity, so it keeps the App-shaped UA.
 	*
+	* The same split has an account-identity axis (issue #123): an enterprise
+	* account must also present `X-User-Id` + `X-Enterprise-Id`, or the gateway
+	* answers with the personal roster. CN sends that pair via
+	* {@link identityHeaders} whenever the credential carries both halves; the
+	* international gateway's split was never measured against account headers,
+	* so it keeps its documented shape.
+	*
 	* Membership is the `cli` roster intersected with the usable rows (see
 	* {@link parseModelCatalog}); the promo badges the product document does
 	* not carry are merged in from a best-effort console read — see
@@ -1057,7 +1115,7 @@ var WorkBuddyUpstreamClient = class {
 				...international ? {
 					"X-Requested-With": "XMLHttpRequest",
 					"X-Product": "SaaS"
-				} : {},
+				} : identityHeaders(credential),
 				"User-Agent": appVersion === void 0 ? CLIENT_UA : appUserAgent(appVersion.version)
 			},
 			signal: signal === void 0 ? AbortSignal.timeout(JSON_TIMEOUT_MS) : AbortSignal.any([signal, AbortSignal.timeout(JSON_TIMEOUT_MS)])
@@ -1094,6 +1152,7 @@ var WorkBuddyUpstreamClient = class {
 					Accept: "application/json",
 					Origin: originReferer(credential),
 					Referer: `${originReferer(credential)}/`,
+					...identityHeaders(credential),
 					"User-Agent": CLIENT_UA
 				},
 				signal: signal === void 0 ? AbortSignal.timeout(JSON_TIMEOUT_MS) : AbortSignal.any([signal, AbortSignal.timeout(JSON_TIMEOUT_MS)])
@@ -1625,6 +1684,23 @@ const INTERNATIONAL_SYSTEM_PROMPT = "You are a helpful assistant.";
 */
 const INTERNATIONAL_PROBE_MAX_TOKENS = 16;
 //#endregion
+//#region src/wsl.ts
+/**
+* Whether this Linux process is running inside Windows Subsystem for Linux.
+*
+* Shared by the desktop-auth candidate probe (`auth.ts`) and the at-rest key
+* helper spawn (`desktop-credential-protection.ts`), so both agree on what
+* "WSL" means. Covers WSL1 and WSL2: WSL2 sets `WSL_DISTRO_NAME` /
+* `WSL_INTEROP`, and every WSL kernel release string carries "microsoft"
+* (e.g. `6.18.33.2-microsoft-standard-WSL2`), which also catches a WSL2
+* session whose env vars were stripped.
+*/
+function isWsl() {
+	if (process.platform !== "linux") return false;
+	if (process.env["WSL_DISTRO_NAME"] !== void 0 || process.env["WSL_INTEROP"] !== void 0) return true;
+	return release().toLowerCase().includes("microsoft");
+}
+//#endregion
 //#region src/status-paths.ts
 /** Node-free constants and types shared by the Host and browser halves. */
 /** Plugin-owned status endpoint consumed by its browser half. */
@@ -2140,6 +2216,86 @@ const PLUTIL_MAX_OUTPUT_BYTES = 65536;
 */
 var DiscoveryIncompleteError = class extends Error {};
 /**
+* Merge a `WSLENV` value so `ELECTRON_RUN_AS_NODE` crosses WSL→Windows
+* interop (#133).
+*
+* WSL only forwards listed variables to a Windows child, and only when the
+* entry carries the `/w` (WSL→Windows) direction flag — a plain
+* `env: { …, ELECTRON_RUN_AS_NODE: '1' }` stays on the Linux side, so the
+* WorkBuddy exe starts in GUI mode and its stdout is app log rather than the
+* key payload.
+*
+* The target variable is consolidated into exactly ONE safe entry, because
+* duplicate same-name entries leave the forwarding direction indeterminate:
+*
+* - the single entry always carries `w` (the plugin's requirement) and takes
+*   the position of the first same-name occurrence;
+* - `u` (Windows→WSL) is kept when ANY existing same-name entry asked for it,
+*   so a user's bidirectional setup survives as `/uw`;
+* - the path flags are dropped: `p` (path translation) and `l` (path list)
+*   would mangle the value, which here is the numeric switch `1` —
+*   `ELECTRON_RUN_AS_NODE=1` must arrive byte-for-byte, never as a converted
+*   path. An inherited `/pw`, `/lw`, or `/l` therefore normalizes to a
+*   path-free flag set rather than being appended to;
+* - a BARE name carries no direction at all, so it counts as neither `w` nor
+*   `u` — it only consolidates;
+* - with no same-name entry at all, `ELECTRON_RUN_AS_NODE/w` is appended;
+* - every OTHER entry keeps its order and bytes; empty segments (the
+*   trailing colons Windows Terminal tends to leave) and exact duplicates
+*   among them are dropped.
+*
+* The result is idempotent: merging it again yields the same string.
+*
+* @param value - the inherited `WSLENV` value, or `undefined` when unset.
+* @returns the `WSLENV` value the child should receive.
+*/
+function wslenvForwardRunAsNode(value) {
+	const merged = [];
+	/** Index of the consolidated target entry inside `merged`, once placed. */
+	let targetIndex = -1;
+	/** The safe flag set for the target: always `w`, plus `u` if asked for. */
+	let targetFlags = "/w";
+	for (const entry of (value ?? "").split(":")) {
+		if (entry === "") continue;
+		const slash = entry.indexOf("/");
+		if ((slash === -1 ? entry : entry.slice(0, slash)) !== "ELECTRON_RUN_AS_NODE") {
+			if (!merged.includes(entry)) merged.push(entry);
+			continue;
+		}
+		if ((slash === -1 ? "" : entry.slice(slash + 1)).includes("u")) targetFlags = "/uw";
+		if (targetIndex === -1) {
+			targetIndex = merged.length;
+			merged.push(`ELECTRON_RUN_AS_NODE${targetFlags}`);
+		} else merged[targetIndex] = `ELECTRON_RUN_AS_NODE${targetFlags}`;
+	}
+	if (targetIndex === -1) merged.push(`ELECTRON_RUN_AS_NODE${targetFlags}`);
+	return merged.join(":");
+}
+/**
+* The environment the at-rest key helper is spawned with (#133).
+*
+* Always a fresh object — the parent (`process.env` in production) is never
+* mutated. `ELECTRON_RUN_AS_NODE=1` forces the Electron binary into plain
+* Node mode; when the spawn crosses WSL→Windows interop — a WSL host and a
+* helper that is itself a Windows executable — the child's `WSLENV` is
+* additionally merged via {@link wslenvForwardRunAsNode} so the interop layer
+* actually forwards that variable. Every other platform and path combination
+* gets the previous behaviour byte-for-byte.
+*
+* @param parent - the environment to inherit (a copy is taken).
+* @param electronPath - the helper binary about to be spawned.
+* @param wsl - whether the current process runs inside WSL.
+* @returns the child process environment.
+*/
+function helperChildEnv(parent, electronPath, wsl) {
+	const childEnv = {
+		...parent,
+		ELECTRON_RUN_AS_NODE: "1"
+	};
+	if (wsl && basename(electronPath).toLowerCase().endsWith(".exe")) childEnv["WSLENV"] = wslenvForwardRunAsNode(childEnv["WSLENV"]);
+	return childEnv;
+}
+/**
 * The default discovery tools: Spotlight for the bundle, `/usr/bin/plutil` for
 * identity. Every failure that means "we could not tell" — a missing tool, a
 * timeout, an oversized answer — is raised as {@link DiscoveryIncompleteError}
@@ -2412,6 +2568,7 @@ function parseWindowsUninstallJson(output) {
 	platform;
 	discoveryBudgetMs;
 	timeoutMs;
+	wsl;
 	source;
 	spawnHelper;
 	/**
@@ -2434,6 +2591,7 @@ function parseWindowsUninstallJson(output) {
 		this.windowsTools = options.windowsTools ?? workBuddyWindowsDiscoveryTools();
 		this.discoveryBudgetMs = options.discoveryBudgetMs ?? 1e4;
 		this.timeoutMs = options.timeoutMs ?? 1e4;
+		this.wsl = options.wsl ?? isWsl;
 		this.spawnHelper = options.spawnHelper ?? ((path) => this.spawnAt(path));
 		this.source = options.source ?? (() => this.spawnPayload());
 	}
@@ -2636,10 +2794,7 @@ function parseWindowsUninstallJson(output) {
 				timeout: this.timeoutMs,
 				maxBuffer: 1048576,
 				windowsHide: true,
-				env: {
-					...process.env,
-					ELECTRON_RUN_AS_NODE: "1"
-				}
+				env: helperChildEnv(process.env, electronPath, this.wsl())
 			}, (error, stdout) => {
 				if (error !== null && error !== void 0) {
 					reject(new WorkBuddyElectronPathError("encrypted-credential-unreadable", `the WorkBuddy key helper (${electronPath}) ${error.killed === true ? `timed out or was killed after ${String(this.timeoutMs)}ms` : error.code !== void 0 ? `exited with code ${String(error.code)}` : "could not be started"}`));
@@ -2843,12 +2998,6 @@ const DESKTOP_AUTH_RELATIVE_PATH = [
 	"auth",
 	"workbuddy-desktop.info"
 ];
-/** Whether this Linux process is running inside Windows Subsystem for Linux. */
-function isWsl() {
-	if (process.platform !== "linux") return false;
-	if (process.env["WSL_DISTRO_NAME"] !== void 0 || process.env["WSL_INTEROP"] !== void 0) return true;
-	return release().toLowerCase().includes("microsoft");
-}
 /** Convert a Windows drive path to WSL's conventional `/mnt/<drive>` form. */
 function windowsPathForWsl(value) {
 	const path = value?.trim();
@@ -4028,7 +4177,7 @@ var WorkBuddyCatalog = class {
 };
 //#endregion
 //#region src/version.ts
-const WORKBUDDY_CONNECT_VERSION = "0.7.4";
+const WORKBUDDY_CONNECT_VERSION = "0.7.6";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -508,6 +508,13 @@ declare class WorkBuddyUpstreamClient {
    * advertises is exactly the one its own requests can use. The international
    * variant has no CLI identity, so it keeps the App-shaped UA.
    *
+   * The same split has an account-identity axis (issue #123): an enterprise
+   * account must also present `X-User-Id` + `X-Enterprise-Id`, or the gateway
+   * answers with the personal roster. CN sends that pair via
+   * {@link identityHeaders} whenever the credential carries both halves; the
+   * international gateway's split was never measured against account headers,
+   * so it keeps its documented shape.
+   *
    * Membership is the `cli` roster intersected with the usable rows (see
    * {@link parseModelCatalog}); the promo badges the product document does
    * not carry are merged in from a best-effort console read — see
@@ -851,6 +858,13 @@ interface WorkBuddyAtRestKeyProviderOptions {
   windowsTools?: WorkBuddyWindowsDiscoveryTools;
   /** Platform override for deterministic discovery tests. */
   platform?: NodeJS.Platform;
+  /**
+   * Whether the helper spawn crosses WSL→Windows interop. Injectable so tests
+   * can simulate a WSL host on any platform; defaults to the shared
+   * {@link isWsl} check. Only consulted for the key-helper spawn (#133) —
+   * never for discovery.
+   */
+  wsl?: () => boolean;
   /**
    * Total budget for one discovery run, covering the search and every
    * candidate check. Injectable so tests can exercise exhaustion without
@@ -878,6 +892,7 @@ interface WorkBuddyAtRestKeyProviderOptions {
   private readonly platform;
   private readonly discoveryBudgetMs;
   private readonly timeoutMs;
+  private readonly wsl;
   private readonly source;
   private readonly spawnHelper;
   /**

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as validAppVersion, A as extractDisplayErrorMessage, B as randomSentinel, C as WORKBUDDY_VARIANTS, D as WORKBUDDY_UPDATE_PATH, F as prepareCnChatBody, G as readCliVersion, H as FALLBACK_CN_APP_VERSION, I as prepareInternationalChatBody, J as WORKBUDDY_APP_VERSION_FILENAME, K as resolveChatIdentity, L as regionOf, M as normalizeCredits, N as parseModelCatalog, O as WorkBuddyUpstreamClient, P as prepareChatBody, Q as resolveAppVersion, R as PROBE_EFFORT_CANDIDATES, S as CN_VARIANT, U as chatUserAgent, V as CN_APP_VERSION_FILENAME, W as fallbackChatIdentity, X as installedAppVersion, Y as appUserAgent, Z as readBundleVersion, _ as desktopAuthCandidatesFor, a as readHostHeartbeat, b as atRestKeyProviderFor, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as WORKBUDDY_AUTH_FILENAME, g as defaultDesktopAuthPath, h as defaultDesktopAuthCandidates, i as processStartTimeMs, j as modelWithCurrentPromotion, k as classifyUpstreamError, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as WORKBUDDY_AUTH_FILE_ENV, q as validCliVersion, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as parseWorkBuddyAuth, w as variantFor, x as AI_VARIANT, y as workbuddyOwnAuthPath, z as probeModel } from "./host-heartbeat-DVlbwIIo.js";
+import { $ as validAppVersion, A as extractDisplayErrorMessage, B as randomSentinel, C as WORKBUDDY_VARIANTS, D as WORKBUDDY_UPDATE_PATH, F as prepareCnChatBody, G as readCliVersion, H as FALLBACK_CN_APP_VERSION, I as prepareInternationalChatBody, J as WORKBUDDY_APP_VERSION_FILENAME, K as resolveChatIdentity, L as regionOf, M as normalizeCredits, N as parseModelCatalog, O as WorkBuddyUpstreamClient, P as prepareChatBody, Q as resolveAppVersion, R as PROBE_EFFORT_CANDIDATES, S as CN_VARIANT, U as chatUserAgent, V as CN_APP_VERSION_FILENAME, W as fallbackChatIdentity, X as installedAppVersion, Y as appUserAgent, Z as readBundleVersion, _ as desktopAuthCandidatesFor, a as readHostHeartbeat, b as atRestKeyProviderFor, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as WORKBUDDY_AUTH_FILENAME, g as defaultDesktopAuthPath, h as defaultDesktopAuthCandidates, i as processStartTimeMs, j as modelWithCurrentPromotion, k as classifyUpstreamError, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as WORKBUDDY_AUTH_FILE_ENV, q as validCliVersion, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as parseWorkBuddyAuth, w as variantFor, x as AI_VARIANT, y as workbuddyOwnAuthPath, z as probeModel } from "./host-heartbeat-vU86u9aU.js";
 import z from "@deepseek-ai/schemastery";
 import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { dirname, join, resolve } from "node:path";

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-connect",
   "displayName": "DSH WorkBuddy Connect",
   "description": "将 WorkBuddy 桌面 App 包含的模型自动接入 DeepSeek Harness — bring WorkBuddy desktop app models into DeepSeek Harness with zero configuration.",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "author": "corrinehu",
   "keywords": [
     "dsh-plugin",