dsh-workbuddy-connect 0.7.5 → 0.7.7

package/README.en.md

@@ -13,7 +13,7 @@ Brings the models available in your signed-in WorkBuddy / WorkBuddy AI desktop a
 ```text
 Please install and verify the DSH (DeepSeek Harness) plugin dsh-workbuddy-connect for me (project: https://github.com/corrinehu/dsh-workbuddy-connect).
 Start by reading the project README and confirming which interface I actually use (Web / Desktop / TUI) and its DSH core version — for the Desktop app, the bundled core, never the standalone CLI's version.
-Then install from the official npm package per the version mapping (0.2.0-rc.2 -> 0.7.5, rc.1 -> 0.7.0, 0.1.5-0.1.7 -> 0.6.5), preferring a locally supported non-market channel; on some Desktop distributions (the official Electron app in particular) the profile is app-managed and rules vary by distribution — check mine first, then explore its compliant install route, but never bypass its validation.
+Then install from the official npm package per the version mapping (0.2.1-rc.1 -> 0.7.7, 0.2.0-rc.2 -> 0.7.6, rc.1 -> 0.7.0, 0.1.5-0.1.7 -> 0.6.5), preferring a locally supported non-market channel; on some Desktop distributions (the official Electron app in particular) the profile is app-managed and rules vary by distribution — check mine first, then explore its compliant install route, but never bypass its validation.
 Ask for my consent and make backups before changing any local files or configuration.
 After installing, verify the WorkBuddy group appears in the model picker and walk me through one short conversation.
 If the Desktop install still fails generation validation (e.g. the @types/retry false positive), report it honestly, reference upstream dataelement/dsh-desktop#688, and suggest switching to the standalone Web / TUI — do not modify dependency packages or bypass the check.
@@ -23,7 +23,8 @@ Core-to-plugin quick reference (full table in "Compatibility and release history
 
 | DSH core | Recommended plugin |
 |---|---|
-| 0.2.0-rc.2 | 0.7.5 (npm latest) |
+| 0.2.1-rc.1 | 0.7.7 (npm latest) |
+| 0.2.0-rc.2 | 0.7.6 |
 | 0.2.0-rc.1 | 0.7.0 |
 | 0.1.5 – 0.1.7 | 0.6.5 |
 
@@ -31,8 +32,8 @@ Core-to-plugin quick reference (full table in "Compatibility and release history
 <summary>Manual install (command line, Web / TUI only)</summary>
 
 ```sh
-# Web (pin per your actual core — example: 0.2.0-rc.2 -> 0.7.5; or install from source via github:corrinehu/dsh-workbuddy-connect)
-dsh plugin --profile web add dsh-workbuddy-connect@0.7.5
+# Web (pin per your actual core — example: 0.2.0-rc.2 -> 0.7.6; or install from source via github:corrinehu/dsh-workbuddy-connect)
+dsh plugin --profile web add dsh-workbuddy-connect@0.7.6
 dsh web
 
 # TUI (example for a 0.1.x core; that profile needs pnpm 11, e.g. npx pnpm@11)
@@ -126,7 +127,8 @@ The plugin version must match the DSH core — a mismatched combination fails to
 
 | DSH core | Recommended plugin | Notes |
 |---|---|---|
-| `0.2.0-rc.2` | `0.7.5` (npm latest) | Current line; fixes disappearing composer controls and WSL helper environment forwarding. Avoid 0.7.2 with its registry regression. |
+| `0.2.1-rc.1` | `0.7.7` | Current line; the core moved to `@earendil-works/pi-ai` 1.3.0, so the plugin bundles 1.3.0 too — a leftover 0.87.1 overrides entry must be removed (see the pi-ai note below). |
+| `0.2.0-rc.2` | `0.7.6` | Previous core line; fixes enterprise catalog gaps and international chat requests blocked by the upstream channel check. Avoid 0.7.2 with its registry regression. |
 | `0.2.0-rc.1` | `0.7.0` | 0.7.1 drops rc.1 support; stay on this version. |
 | `0.1.5` – `0.1.7` | `0.6.5` | Final release for the old cores; 0.7.0 targets 0.2.0 only. |
 | `0.1.2-rc.1` | `0.3.1` | Older line, historical maintenance only. |
@@ -134,6 +136,8 @@ The plugin version must match the DSH core — a mismatched combination fails to
 
 Release history (full records at [releases](https://github.com/corrinehu/dsh-workbuddy-connect/releases)):
 
+- **0.7.7**: adapts to the DSH 0.2.1-rc.1 core: peers narrow to 0.2.1-rc.1 and the plugin-bundled `@earendil-works/pi-ai` moves to 1.3.0 with it (a profile-level leftover 0.87.1 overrides entry must be removed, or the plugin fails to load).
+- **0.7.6**: fixes enterprise accounts missing `glm-5.3-flashx` from the model catalog ([#123](https://github.com/corrinehu/dsh-workbuddy-connect/issues/123)), and fixes international chat requests being blocked by the upstream channel check ([#139](https://github.com/corrinehu/dsh-workbuddy-connect/issues/139) / [#142](https://github.com/corrinehu/dsh-workbuddy-connect/issues/142)).
 - **0.7.5**: restores composer controls after session switching ([#125](https://github.com/corrinehu/dsh-workbuddy-connect/issues/125) / [#132](https://github.com/corrinehu/dsh-workbuddy-connect/issues/132)), fixes WSL helper environment forwarding ([#133](https://github.com/corrinehu/dsh-workbuddy-connect/issues/133)), and adds community projects to both READMEs.
 - **0.7.4**: Windows diagnostics and stability improvements: accurate classification of oversized registry-subprocess output, cross-platform test-assumption fixes ([#62](https://github.com/corrinehu/dsh-workbuddy-connect/issues/62)), and a reworked install section.
 - **0.7.3**: fixes Windows registry auto-discovery failing on non-default install paths ([#105](https://github.com/corrinehu/dsh-workbuddy-connect/issues/105)).
@@ -142,9 +146,9 @@ Release history (full records at [releases](https://github.com/corrinehu/dsh-wor
 - **0.7.0**: adapts to DSH 0.2.0's settings-service rework and drops 0.1.x support.
 - **0.6.5**: final release of the 0.1.x line.
 
-Pinned-version install example: `dsh plugin --profile web add dsh-workbuddy-connect@0.7.5`.
+Pinned-version install example: `dsh plugin --profile web add dsh-workbuddy-connect@0.7.6`.
 
-**Do not upgrade the profile-level `@earendil-works/pi-ai` to 1.x**: this plugin and the `0.2.0-rc.2` generation of the DSH core both require `^0.87.1` (bundled by the plugin since 0.7.2), and third-party plugin managers' "updatable" prompts do not check peer constraints — do not act on them ([#86](https://github.com/corrinehu/dsh-workbuddy-connect/issues/86)); likewise, do not blindly remove a leftover `overrides: {'@earendil-works/pi-ai': '0.87.1'}` until you have confirmed nothing else depends on it.
+**pi-ai versions are per core line and must not be mixed**: the 0.2.1-rc.1 core line (plugin 0.7.7+) moved to `@earendil-works/pi-ai` 1.3.0 (bundled by the plugin), so a profile-level leftover `overrides: {'@earendil-works/pi-ai': '0.87.1'}` **must be removed** or the plugin fails to load; the 0.2.0-rc.2 core line (plugin 0.7.6) still requires `^0.87.1` — on that line, **do not** upgrade the profile-level pi-ai to 1.x, and do not act on third-party plugin managers' "updatable" prompts, which do not check peer constraints ([#86](https://github.com/corrinehu/dsh-workbuddy-connect/issues/86)).
 
 ## Disclaimer
 

package/README.md

@@ -13,7 +13,7 @@
 ```text
 请帮我安装并验证 DSH（DeepSeek Harness）插件 dsh-workbuddy-connect（项目地址：https://github.com/corrinehu/dsh-workbuddy-connect）：
 先阅读项目 README，确认我实际使用的界面（Web / Desktop / TUI）与 DSH 内核版本，桌面版以 App 内置核心为准，不要用独立 CLI 的版本代替；
-再按版本对应关系从 npm 正式包安装（0.2.0-rc.2→0.7.5、rc.1→0.7.0、0.1.5–0.1.7→0.6.5），优先走本机受支持的非插件市场渠道；部分 Desktop 发行版（尤其官方 Electron 版）的 profile 由 App 管理，各发行版规则未必相同，先确认我所用的发行版，再探查其合规的安装方式，但不得绕过其校验；
+再按版本对应关系从 npm 正式包安装（0.2.1-rc.1→0.7.7、0.2.0-rc.2→0.7.6、rc.1→0.7.0、0.1.5–0.1.7→0.6.5），优先走本机受支持的非插件市场渠道；部分 Desktop 发行版（尤其官方 Electron 版）的 profile 由 App 管理，各发行版规则未必相同，先确认我所用的发行版，再探查其合规的安装方式，但不得绕过其校验；
 任何本地文件或配置改动，先征得我同意并做好备份；
 装完后验证模型选择器里出现 WorkBuddy 分组，并陪我完成一次简短对话；
 若 Desktop 安装仍因 generation 校验失败（如 @types/retry 误报），请如实报告、参照上游 dataelement/dsh-desktop#688，并建议我改用独立的 Web / TUI，不要修改依赖包或绕过校验。
@@ -23,7 +23,8 @@
 
 | DSH 内核 | 推荐插件版 |
 |---|---|
-| 0.2.0-rc.2 | 0.7.5（npm latest） |
+| 0.2.1-rc.1 | 0.7.7（npm latest） |
+| 0.2.0-rc.2 | 0.7.6 |
 | 0.2.0-rc.1 | 0.7.0 |
 | 0.1.5 – 0.1.7 | 0.6.5 |
 
@@ -31,8 +32,8 @@
 <summary>手动安装（命令行，仅 Web / TUI）</summary>
 
 ```sh
-# Web（按实际内核固定版本，示例为 0.2.0-rc.2 → 0.7.5；也可用 github:corrinehu/dsh-workbuddy-connect 从源码安装）
-dsh plugin --profile web add dsh-workbuddy-connect@0.7.5
+# Web（按实际内核固定版本，示例为 0.2.0-rc.2 → 0.7.6；也可用 github:corrinehu/dsh-workbuddy-connect 从源码安装）
+dsh plugin --profile web add dsh-workbuddy-connect@0.7.6
 dsh web
 
 # TUI（示例为 0.1.x 内核；该 profile 需用 pnpm 11 安装，如 npx pnpm@11）
@@ -127,7 +128,8 @@ dsh plugin --profile web exec dsh-workbuddy-connect doctor --provider workbuddy-
 
 | DSH 内核 | 推荐插件版 | 注意事项 |
 |---|---|---|
-| `0.2.0-rc.2` | `0.7.5`（npm latest） | 当前最新线；修复输入框组件消失与 WSL helper 环境转发，勿停留在有注册表回归的 0.7.2。 |
+| `0.2.1-rc.1` | `0.7.7` | 当前最新线；内核升级到 `@earendil-works/pi-ai` 1.3.0，插件同步自带 1.3.0，历史遗留的 0.87.1 overrides 必须移除（见下方 pi-ai 说明）。 |
+| `0.2.0-rc.2` | `0.7.6` | 上一代内核线；修复企业账号模型目录缺项与国际版对话被渠道校验拦截，勿停留在有注册表回归的 0.7.2。 |
 | `0.2.0-rc.1` | `0.7.0` | 0.7.1 起不再支持 rc.1，请停留本版。 |
 | `0.1.5` – `0.1.7` | `0.6.5` | 旧内核最终版；0.7.0 起仅面向 0.2.0。 |
 | `0.1.2-rc.1` | `0.3.1` | 更早旧线，仅历史维护。 |
@@ -135,6 +137,9 @@ dsh plugin --profile web exec dsh-workbuddy-connect doctor --provider workbuddy-
 
 历次更新（完整记录见 [releases](https://github.com/corrinehu/dsh-workbuddy-connect/releases)）：
 
+- **0.7.7**：适配 DSH 0.2.1-rc.1 内核：peer 收窄到 0.2.1-rc.1，插件自带的 `@earendil-works/pi-ai` 随内核升级到 1.3.0（profile 级历史遗留的 0.87.1 overrides 必须移除，否则插件无法加载）；修复国际版与国内版推理档位检测停留「检测未完成」——上游把档位拒绝码改拼为 `invalid_parameter_value`（[#143](https://github.com/corrinehu/dsh-workbuddy-connect/issues/143) / [#148](https://github.com/corrinehu/dsh-workbuddy-connect/issues/148)，PR [#145](https://github.com/corrinehu/dsh-workbuddy-connect/pull/145)）；修复中文 Windows 控制台下注册表缺键诊断因 GBK 编码被误判（zh-CN 实机验证）。
+- **0.7.6**：修复企业账号模型目录缺少 `glm-5.3-flashx`（[#123](https://github.com/corrinehu/dsh-workbuddy-connect/issues/123)），修复国际版对话请求被上游渠道校验拦截（[#139](https://github.com/corrinehu/dsh-workbuddy-connect/issues/139) / [#142](https://github.com/corrinehu/dsh-workbuddy-connect/issues/142)）。
+- **0.7.5**：修复切换会话后输入框余额与刷新按钮消失（[#125](https://github.com/corrinehu/dsh-workbuddy-connect/issues/125) / [#132](https://github.com/corrinehu/dsh-workbuddy-connect/issues/132)），修复 WSL 调用 Windows 凭据解密程序的环境转发（[#133](https://github.com/corrinehu/dsh-workbuddy-connect/issues/133)），README 收录社区项目（[#130](https://github.com/corrinehu/dsh-workbuddy-connect/issues/130)）。
 - **0.7.4**：Windows 诊断与稳定性改进：注册表子进程输出超限准确分类、跨平台测试假设修正（[#62](https://github.com/corrinehu/dsh-workbuddy-connect/issues/62)），安装说明重排。
 - **0.7.3**：修复 Windows 非默认安装路径下注册表自动发现失败（[#105](https://github.com/corrinehu/dsh-workbuddy-connect/issues/105)）。
 - **0.7.2**：pi-ai 改为插件自带依赖，并修复推理字段请求被拒（[#92](https://github.com/corrinehu/dsh-workbuddy-connect/issues/92)）；该版存在 Windows 注册表回归，请使用 0.7.4 或更新的正式版本。
@@ -142,9 +147,9 @@ dsh plugin --profile web exec dsh-workbuddy-connect doctor --provider workbuddy-
 - **0.7.0**：适配 DSH 0.2.0 的设置服务改造，不再支持 0.1.x。
 - **0.6.5**：0.1.x 线最终版本。
 
-固定版本安装示例：`dsh plugin --profile web add dsh-workbuddy-connect@0.7.5`。
+固定版本安装示例：`dsh plugin --profile web add dsh-workbuddy-connect@0.7.6`。
 
-**不要把 profile 级的 `@earendil-works/pi-ai` 升到 1.x**：本插件与 `0.2.0-rc.2` 这一代内核都要求 `^0.87.1`（0.7.2 起由插件自带），第三方插件管理器的「可更新」提示不校验 peer 约束、不能照做（[#86](https://github.com/corrinehu/dsh-workbuddy-connect/issues/86)）；为此历史遗留的 `overrides: {'@earendil-works/pi-ai': '0.87.1'}` 在确认其他插件不依赖前也不要盲目移除。
+**pi-ai 版本按内核线区分，不能混**：0.2.1-rc.1 内核线（插件 0.7.7+）已升级到 `@earendil-works/pi-ai` 1.3.0（由插件自带），profile 级历史遗留的 `overrides: {'@earendil-works/pi-ai': '0.87.1'}` **必须移除**，否则插件会因加载到旧一代 pi-ai 而启动失败；0.2.0-rc.2 内核线（插件 0.7.6）仍要求 `^0.87.1`，在这条线上**不要**把 profile 级的 pi-ai 升到 1.x，第三方插件管理器的「可更新」提示不校验 peer 约束、不能照做（[#86](https://github.com/corrinehu/dsh-workbuddy-connect/issues/86)）。
 
 ## 免责声明
 

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as WORKBUDDY_VARIANTS, O as WorkBuddyUpstreamClient, Q as resolveAppVersion, S as CN_VARIANT, a as readHostHeartbeat, b as atRestKeyProviderFor, c as WORKBUDDY_CONNECT_VERSION, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, w as variantFor } from "./host-heartbeat-CvtbpuQi.js";
+import { C as WORKBUDDY_VARIANTS, O as WorkBuddyUpstreamClient, Q as resolveAppVersion, S as CN_VARIANT, a as readHostHeartbeat, b as atRestKeyProviderFor, c as WORKBUDDY_CONNECT_VERSION, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, w as variantFor } from "./host-heartbeat-FytEpUGO.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -2772,7 +2772,7 @@ window.__ModuleLoader__.load({
 		};
 		//#endregion
 		//#region src/version.ts
-		const WORKBUDDY_CONNECT_VERSION = "0.7.5";
+		const WORKBUDDY_CONNECT_VERSION = "0.7.7";
 		//#endregion
 		//#region src/client/WorkBuddyConfigPage.tsx
 		/**

package/lib/{host-heartbeat-CvtbpuQi.js → host-heartbeat-FytEpUGO.js}

@@ -3,7 +3,7 @@ import { homedir, release } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
-import { createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
 import { execFile, execFileSync } from "node:child_process";
 import { accessSync, constants, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 //#region src/app-version.ts
@@ -396,22 +396,37 @@ function randomSentinel() {
 * - `model_param_invalid` — the global endpoint, measured 2026-10-01. A
 *   non-canonical value is answered `400` / `11133` with this code, which names
 *   no field (`extError.param` is empty), instead of one that names the effort.
-*   It is generic enough to be readable here only because the baseline step has
-*   already proved the *same* request without `reasoning_effort` succeeds,
-*   leaving the sentinel as the only difference between the two attempts. A
-*   sibling code in the same `11133` envelope that names another parameter
-*   (`integer_below_min_value`, the `max_tokens` floor) and a body carrying no
-*   `extError` at all (`11102`, unknown model) are therefore not mistaken for
-*   it, and neither is a level-sweep answer. It is *not* added to `cn`: that
-*   endpoint was measured answering the specific code, and reading a generic
-*   code there would widen attribution beyond what was observed.
+* - `invalid_parameter_value` — both endpoints. Measured on the global
+*   endpoint 2026-10-16 (issue #143); observed on the China endpoint the same
+*   day (`deepseek-v4-pro`, PR #145 discussion) and reproduced there
+*   2026-10-17 on WorkBuddy CN 5.8.2. The *same* `400` / `11133` envelope as
+*   `model_param_invalid`, with `extError.code` respelled and the `msg`
+*   unchanged; a non-canonical value is again what triggers it and the
+*   baseline still answers 200. Kept alongside the old spellings rather than
+*   replacing them: the rename was observed on the gateways, not promised for
+*   every model behind them.
 *
-* Neither is treated as a permanent protocol promise: anything unrecognized
-* still degrades to `unknown` rather than to a capability conclusion.
+* The generic codes name no effort field. They are readable here only
+* because the baseline step has already proved the *same* request without
+* `reasoning_effort` succeeds, leaving the sentinel as the only difference
+* between the two attempts — an isolation that holds per endpoint, which is
+* why both regions read the respelled spelling once each was observed on it.
+* A sibling code in the same `11133` envelope that names another parameter
+* (`integer_below_min_value`, the `max_tokens` floor) and a body carrying no
+* `extError` at all (`11102`, unknown model) are therefore not mistaken for
+* them, and neither is a level-sweep answer.
+*
+* None of these is treated as a permanent protocol promise: anything
+* unrecognized still degrades to `unknown` rather than to a capability
+* conclusion.
 */
 const INVALID_EFFORT_CODES = {
-	cn: /* @__PURE__ */ new Set(["invalid_reasoning_effort"]),
-	global: /* @__PURE__ */ new Set(["invalid_reasoning_effort", "model_param_invalid"])
+	cn: /* @__PURE__ */ new Set(["invalid_reasoning_effort", "invalid_parameter_value"]),
+	global: /* @__PURE__ */ new Set([
+		"invalid_reasoning_effort",
+		"model_param_invalid",
+		"invalid_parameter_value"
+	])
 };
 /** Whether an attempt is an attributable rejection of the effort value. */
 function isEffortRejection(attempt, region) {
@@ -709,11 +724,39 @@ function commonHeaders(credential) {
 	};
 }
 /**
+* The conversation-channel trio the chat endpoints require.
+*
+* Since 2026-10-16 `www.workbuddy.ai` answers any `/v2/chat/completions`
+* request that omits all three `X-Conversation-*` headers with `400` /
+* `code 11128` / `msg: "conversation id missing"`, whose `displayMsg.zh` is
+* 「请求被拦截，请重新发送」 (issue #139). The official desktop client sends
+* the trio on chat and speech alike — read out of `resources/app.asar`, where
+* the names are `X-Conversation-ID`, `X-Conversation-Request-ID` and
+* `X-Conversation-Message-ID`.
+*
+* A fresh UUID per request is enough, and is what the wire measurement
+* supports: the upstream keeps no history keyed by the id (two calls sharing
+* one id, the second carrying only `system` + `user`, still answered "I don't
+* know"), so the trio marks the channel rather than carrying conversation
+* state. Fresh ids also keep concurrent sub-agents off one shared
+* conversation. The CN gateway was measured accepting the same trio (200 with
+* and without), so both regions carry it and the two paths cannot drift.
+*/
+function conversationHeaders() {
+	return {
+		"X-Conversation-ID": randomUUID(),
+		"X-Conversation-Request-ID": randomUUID(),
+		"X-Conversation-Message-ID": randomUUID()
+	};
+}
+/**
 * Chat request headers, including the X-No-* conventions the official CLI uses.
 *
 * `userAgent` and `clientVersion` carry the same resolved desktop identity for
 * chat and probe requests. Refresh shares `commonHeaders` but never this
-* override, so the two paths cannot drift into each other.
+* override, so the two paths cannot drift into each other. The
+* `X-Conversation-*` trio rides along too — see {@link conversationHeaders} —
+* because the international gateway rejects a chat that omits it.
 */
 function chatHeaders(credential, userAgent, clientVersion) {
 	return {
@@ -726,7 +769,8 @@ function chatHeaders(credential, userAgent, clientVersion) {
 		"X-IDE-Type": "WorkBuddy",
 		"X-IDE-Name": "WorkBuddy",
 		"X-IDE-Version": clientVersion,
-		"X-Product": "SaaS"
+		"X-Product": "SaaS",
+		...conversationHeaders()
 	};
 }
 /** Refresh-endpoint headers; X-Refresh-Token appears here and nowhere else. */
@@ -755,6 +799,28 @@ function billingHeaders(credential) {
 	return headers;
 }
 /**
+* Account-identity headers for the CN catalog requests (`/v3/config` and the
+* console badge read). The gateway also splits `/v3/config` by account
+* identity: an enterprise account without this pair is silently answered with
+* the personal roster (issue #123 — 18 vs 19 models, FlashX missing), and the
+* pair is all-or-nothing there: `X-Enterprise-Id` alone is rejected outright
+* while `X-User-Id` alone selects nothing. So the block is emitted only when
+* both parts exist, and personal accounts keep the bare headers their roster
+* was already correct under. `X-Tenant-Id`/`X-Domain` ride along in the
+* spelling `billingHeaders` already proved the gateway accepts.
+*/
+function identityHeaders(credential) {
+	if (credential.uid === "") return {};
+	if (credential.enterpriseId === void 0 || credential.enterpriseId === "") return {};
+	const headers = {
+		"X-User-Id": credential.uid,
+		"X-Enterprise-Id": credential.enterpriseId,
+		"X-Tenant-Id": credential.enterpriseId
+	};
+	if (credential.domain !== "") headers["X-Domain"] = credential.domain;
+	return headers;
+}
+/**
 * Normalize an OpenAI chat-completions body for the WorkBuddy upstream:
 * force `stream: true` (the upstream rejects non-streaming), flatten
 * `tool_choice` (the upstream's field is a string; object forms return 400),
@@ -1036,6 +1102,13 @@ var WorkBuddyUpstreamClient = class {
 	* advertises is exactly the one its own requests can use. The international
 	* variant has no CLI identity, so it keeps the App-shaped UA.
 	*
+	* The same split has an account-identity axis (issue #123): an enterprise
+	* account must also present `X-User-Id` + `X-Enterprise-Id`, or the gateway
+	* answers with the personal roster. CN sends that pair via
+	* {@link identityHeaders} whenever the credential carries both halves; the
+	* international gateway's split was never measured against account headers,
+	* so it keeps its documented shape.
+	*
 	* Membership is the `cli` roster intersected with the usable rows (see
 	* {@link parseModelCatalog}); the promo badges the product document does
 	* not carry are merged in from a best-effort console read — see
@@ -1057,7 +1130,7 @@ var WorkBuddyUpstreamClient = class {
 				...international ? {
 					"X-Requested-With": "XMLHttpRequest",
 					"X-Product": "SaaS"
-				} : {},
+				} : identityHeaders(credential),
 				"User-Agent": appVersion === void 0 ? CLIENT_UA : appUserAgent(appVersion.version)
 			},
 			signal: signal === void 0 ? AbortSignal.timeout(JSON_TIMEOUT_MS) : AbortSignal.any([signal, AbortSignal.timeout(JSON_TIMEOUT_MS)])
@@ -1094,6 +1167,7 @@ var WorkBuddyUpstreamClient = class {
 					Accept: "application/json",
 					Origin: originReferer(credential),
 					Referer: `${originReferer(credential)}/`,
+					...identityHeaders(credential),
 					"User-Agent": CLIENT_UA
 				},
 				signal: signal === void 0 ? AbortSignal.timeout(JSON_TIMEOUT_MS) : AbortSignal.any([signal, AbortSignal.timeout(JSON_TIMEOUT_MS)])
@@ -2351,7 +2425,7 @@ function workBuddyWindowsDiscoveryTools() {
 			if (settled) return;
 			settled = true;
 			if (error !== null && error !== void 0) {
-				if (error.killed !== true && (error.code === 1 || error.code === "1") && windowsRegistryKeyMissing(stderr.toString("utf8"))) {
+				if (error.killed !== true && (error.code === 1 || error.code === "1") && windowsRegistryKeyMissingFromBytes(stderr)) {
 					resolve(Buffer.alloc(0));
 					return;
 				}
@@ -2770,6 +2844,24 @@ function windowsRegistryKeyMissing(stderr) {
 	return /^ERROR:\s*The system was unable to find the specified registry key or value\.?$/iu.test(detail) || /^错误[:：]\s*系统找不到指定的注册表项或值[。.]?$/u.test(detail);
 }
 /**
+* Reg.exe speaks the console OEM code page, not UTF-8: on a zh-CN install the
+* missing-key diagnostic arrives as cp936 bytes, which UTF-8 decoding turns
+* into mojibake no diagnostic regex can match — the query then reads as
+* "incomplete" on every absent root. Extension of #88's byte-level principle:
+* the bytes decide, so decode as UTF-8 first and then as GBK. ASCII — every
+* English diagnostic — is identical under both, so a match is unambiguous and
+* recognition only ever widens; a genuine failure (access denied, unknown
+* diagnostics) still stays incomplete in either decode.
+*/
+function windowsRegistryKeyMissingFromBytes(stderr) {
+	if (windowsRegistryKeyMissing(stderr.toString("utf8"))) return true;
+	try {
+		return windowsRegistryKeyMissing(new TextDecoder("gbk").decode(stderr));
+	} catch {
+		return false;
+	}
+}
+/**
 * Parse the value columns emitted by `reg query ... /s`.
 *
 * Entries are filtered by the product's DisplayName pattern *before* the
@@ -4118,7 +4210,7 @@ var WorkBuddyCatalog = class {
 };
 //#endregion
 //#region src/version.ts
-const WORKBUDDY_CONNECT_VERSION = "0.7.5";
+const WORKBUDDY_CONNECT_VERSION = "0.7.7";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -508,6 +508,13 @@ declare class WorkBuddyUpstreamClient {
    * advertises is exactly the one its own requests can use. The international
    * variant has no CLI identity, so it keeps the App-shaped UA.
    *
+   * The same split has an account-identity axis (issue #123): an enterprise
+   * account must also present `X-User-Id` + `X-Enterprise-Id`, or the gateway
+   * answers with the personal roster. CN sends that pair via
+   * {@link identityHeaders} whenever the credential carries both halves; the
+   * international gateway's split was never measured against account headers,
+   * so it keeps its documented shape.
+   *
    * Membership is the `cli` roster intersected with the usable rows (see
    * {@link parseModelCatalog}); the promo badges the product document does
    * not carry are merged in from a best-effort console read — see

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as validAppVersion, A as extractDisplayErrorMessage, B as randomSentinel, C as WORKBUDDY_VARIANTS, D as WORKBUDDY_UPDATE_PATH, F as prepareCnChatBody, G as readCliVersion, H as FALLBACK_CN_APP_VERSION, I as prepareInternationalChatBody, J as WORKBUDDY_APP_VERSION_FILENAME, K as resolveChatIdentity, L as regionOf, M as normalizeCredits, N as parseModelCatalog, O as WorkBuddyUpstreamClient, P as prepareChatBody, Q as resolveAppVersion, R as PROBE_EFFORT_CANDIDATES, S as CN_VARIANT, U as chatUserAgent, V as CN_APP_VERSION_FILENAME, W as fallbackChatIdentity, X as installedAppVersion, Y as appUserAgent, Z as readBundleVersion, _ as desktopAuthCandidatesFor, a as readHostHeartbeat, b as atRestKeyProviderFor, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as WORKBUDDY_AUTH_FILENAME, g as defaultDesktopAuthPath, h as defaultDesktopAuthCandidates, i as processStartTimeMs, j as modelWithCurrentPromotion, k as classifyUpstreamError, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as WORKBUDDY_AUTH_FILE_ENV, q as validCliVersion, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as parseWorkBuddyAuth, w as variantFor, x as AI_VARIANT, y as workbuddyOwnAuthPath, z as probeModel } from "./host-heartbeat-CvtbpuQi.js";
+import { $ as validAppVersion, A as extractDisplayErrorMessage, B as randomSentinel, C as WORKBUDDY_VARIANTS, D as WORKBUDDY_UPDATE_PATH, F as prepareCnChatBody, G as readCliVersion, H as FALLBACK_CN_APP_VERSION, I as prepareInternationalChatBody, J as WORKBUDDY_APP_VERSION_FILENAME, K as resolveChatIdentity, L as regionOf, M as normalizeCredits, N as parseModelCatalog, O as WorkBuddyUpstreamClient, P as prepareChatBody, Q as resolveAppVersion, R as PROBE_EFFORT_CANDIDATES, S as CN_VARIANT, U as chatUserAgent, V as CN_APP_VERSION_FILENAME, W as fallbackChatIdentity, X as installedAppVersion, Y as appUserAgent, Z as readBundleVersion, _ as desktopAuthCandidatesFor, a as readHostHeartbeat, b as atRestKeyProviderFor, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as WORKBUDDY_AUTH_FILENAME, g as defaultDesktopAuthPath, h as defaultDesktopAuthCandidates, i as processStartTimeMs, j as modelWithCurrentPromotion, k as classifyUpstreamError, l as FALLBACK_WORKBUDDY_AI_MODELS, m as WorkBuddyCredentialStore, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as WORKBUDDY_AUTH_FILE_ENV, q as validCliVersion, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as parseWorkBuddyAuth, w as variantFor, x as AI_VARIANT, y as workbuddyOwnAuthPath, z as probeModel } from "./host-heartbeat-FytEpUGO.js";
 import z from "@deepseek-ai/schemastery";
 import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { dirname, join, resolve } from "node:path";
@@ -1159,7 +1159,7 @@ var WorkBuddyProbeService = class {
 //#region src/pi-ai-guard.ts
 /**
 * Confirm the pi-ai copy this plugin actually loaded is the generation the DSH
-* 0.2.0-rc.2 host was built against.
+* 0.2.1-rc.1 host was built against.
 *
 * #92's failure mode: a pnpm profile with `nodeLinker: hoisted` and
 * `autoInstallPeers: false` installs no peer for us, so a co-installed
@@ -1178,7 +1178,7 @@ var WorkBuddyProbeService = class {
 * @module dsh-workbuddy-connect/pi-ai-guard
 */
 /** The pi-ai generation this plugin is built and tested against. */
-const REQUIRED_PI_AI_VERSION = "0.87.1";
+const REQUIRED_PI_AI_VERSION = "1.3.0";
 /**
 * Read the version of the pi-ai copy Node resolves for *this* module.
 *
@@ -1225,7 +1225,7 @@ function resolvedPiAiVersion() {
 */
 function piAiVersionWarning(resolved) {
 	const version = arguments.length === 0 ? resolvedPiAiVersion() : resolved;
-	if (version === void 0 || version === "0.87.1") return void 0;
+	if (version === void 0 || version === "1.3.0") return void 0;
 	return `loaded @earendil-works/pi-ai ${version}, but this plugin is built for ${REQUIRED_PI_AI_VERSION}. The wrong copy is being resolved — check the profile's pi-ai install (a pnpm profile with nodeLinker "hoisted" and autoInstallPeers false can expose another package's older copy). Reinstalling the plugin so it installs its own ${REQUIRED_PI_AI_VERSION} copy resolves it`;
 }
 //#endregion

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-connect",
   "displayName": "DSH WorkBuddy Connect",
   "description": "将 WorkBuddy 桌面 App 包含的模型自动接入 DeepSeek Harness — bring WorkBuddy desktop app models into DeepSeek Harness with zero configuration.",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "author": "corrinehu",
   "keywords": [
     "dsh-plugin",
@@ -67,42 +67,42 @@
     }
   },
   "dependencies": {
-    "@earendil-works/pi-ai": "0.87.1"
+    "@earendil-works/pi-ai": "1.3.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-atomic-write": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-attachment": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-home-paths": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-settings": "0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.2",
+    "@deepseek-ai/cordis": "^4.0.5",
+    "@deepseek-ai/dsh-atomic-write": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.5",
     "react": "^18.2.0"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.4",
-    "@deepseek-ai/dsh-atomic-write": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-attachment": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-model-selection": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-credentials": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-authorization": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-launch-environment": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-home-paths": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-settings": "0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.2",
-    "@earendil-works/pi-ai": "0.87.1",
+    "@deepseek-ai/cordis": "^4.0.5",
+    "@deepseek-ai/dsh-atomic-write": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-model-selection": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-authorization": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.5",
+    "@earendil-works/pi-ai": "1.3.0",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",
     "@types/react-test-renderer": "^18.3.1",