dsh-workbuddy-xdpool 1.5.2 → 1.6.1

package/CHANGELOG.md

@@ -4,6 +4,92 @@
 
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 1.6.0 (2026-09-24)
+
+这一版修的都是「已装、已登录，插件却说找不到 App / 存不进去」这一类误报。
+
+### 一、WorkBuddy 装在非系统盘时找不到 App（社区反馈 + 本机复现）
+
+报错：`holds encrypted credentials but the desktop app could not provide the key`，
+但 App 明明装着并在运行。
+
+根因：Windows 只探测四个固定在**系统盘**的路径，而实际安装位置是自定义盘符 ——
+本机实测两个 App 都在非默认位置，且**国际版的文件名都不一样**：
+
+```
+D:\workbuddy\WorkBuddy.exe        国内版 5.5.3
+D:\workbuddyai\WorkBuddyAI.exe    国际版 5.6.2   ← 文件名都不同
+```
+
+修法（三层，按可靠性排序）：
+
+1. **读注册表**（最权威）——安装器自己记录的 `DisplayIcon` / `InstallLocation`，
+   不管装在哪个盘、目录叫什么、可执行文件叫什么都能找到；
+2. 环境变量 `WORKBUDDY_APP_EXECUTABLE`（用户显式指定，优先级最高）；
+3. 兜底枚举：`ProgramFiles` / `ProgramW6432` / `ProgramFiles(x86)` / `LOCALAPPDATA`，
+   **外加所有固定盘符**的 `Program Files`，再向下扫一层匹配 `workbuddy*` 目录。
+
+同时补上国际版可执行文件名 `WorkBuddyAI.exe` —— 它此前从未进过候选，
+所以哪怕路径对了也找不到。
+
+**实测验证**：注册表方案在本机正确发现两个 App，且用国内版 App 派生的密钥
+能解开国际版凭据（两个 App 共用同一个构建期密钥，`keyId` 完全匹配）。
+
+### 二、报错文案不再误导
+
+原文案暗示「去装 App」，而用户 App 就装着。现在区分两种情况，并给出真正可执行的指引：
+设置 `WORKBUDDY_APP_EXECUTABLE` 指向实际路径，并明说**重新登录无效**
+（凭据本身是好的，缺的是密钥）。
+
+### 三、读账号很慢 / 重新检测账号也报错
+
+每次读凭据都会 spawn App 并等待 10 秒超时；一旦失败，逐个凭据文件再来一遍。
+新增**失败负缓存**（60 秒）：一次失败后短期内不再重试，
+既让「扫描账号」瞬间返回，也保证装上/启动 App 后无需重启 DSH 就能恢复。
+
+### 四、「保留积分」保存报 `settings service unavailable; creditReserves was not saved`
+
+**这是我 1.5.0 引入的 bug**：校验写入了不存在的 API。
+本版 `dsh-settings` 暴露的是**按命名空间**的写入方法，没有 `set(key, value)`：
+
+```
+update(ns, patch, expectedRevision)    // 把 patch 合并进该命名空间的用户层
+replace(ns, section, expectedRevision)
+mutate(ns, ops, expectedRevision)
+```
+
+现在改用 `update(ns, { [key]: value })`。**「await + 回读校验」的理念保持不变**
+（它确实抓到了问题，只是抓错了原因）——写入后仍然回读文档比对，不一致就报错。
+
+### 测试
+
+188 → 195（新增 `app-location.test.ts` 7 例：注册表优先、override 优先、
+多盘符与文件名变体、macOS 仍走 bundle 而不碰注册表）。
+
+## 1.5.3 (2026-09-24)
+
+### 内核依赖对齐 DSH 实际版本，消除「需要 0.1.7」的歧义
+
+`devDependencies` 里十个 `@deepseek-ai/dsh-*` 包原先钉在最老的版本
+（`0.1.1-rc.2` / `0.1.2-rc.1`），而插件实际运行在 DSH Desktop 2.0.13 捆绑的
+**`0.1.5-rc.2`** 上——开发环境与运行环境不一致，正是姊妹项目踩过的那类坑
+（用旧类型构建、或反过来用新类型构建跑在旧内核上）。
+
+现在钉到 **`0.1.5-rc.2`**，与实际运行内核一致。`dsh-client-runtime` 例外：该包
+已停止发布（最后版本 `0.1.1-rc.2`），保持不动。
+
+**peerDependencies 未改**，仍是最宽的 `>=0.1.1-rc.1 <0.2.0`。实测（semver）该范围
+同时接受 `0.1.5-rc.2` 与 `0.1.7-rc.1`，比 `^0.1.5-rc.1`、`^0.1.5-0` 都广，所以
+插件本身从来没有版本不兼容——市场页面上那句「需要 DSH >=0.1.7-rc.1」是市场对
+预发布范围的判定方式所致，不是插件声明有误。
+
+内核 `0.1.7-rc.1` 目前只在 npm 的 `next` 通道（`latest` 仍是 `0.0.1-rc.1`），
+属于预发布；内核版本由 DSH Desktop 应用捆绑，需等官方发新版桌面端才能跟进。
+
+### 测试
+
+仍为 188 通过（本次只改依赖声明，无代码改动）。
+
 ## 1.5.2 (2026-09-24)
 
 ### 修掉测试对运行时区的依赖（发布流程在 CI 上红了）

package/lib/bin.js

@@ -2,8 +2,8 @@ import { createDecipheriv, createHash, randomUUID } from "node:crypto";
 import { copyFile, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { basename, join, resolve } from "node:path";
-import { execFile } from "node:child_process";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { execFile, execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import z from "@deepseek-ai/schemastery";
 import "@earendil-works/pi-ai";
 import "@earendil-works/pi-ai/api/openai-completions.lazy";
@@ -1642,8 +1642,15 @@ const SYMMETRIC_SCHEME = "sym-v1";
 const WORKBUDDY_APP_EXECUTABLE_ENV = "WORKBUDDY_APP_EXECUTABLE";
 /** How long the app is given to answer with its key payload. */
 const KEY_FETCH_TIMEOUT_MS = 1e4;
-/** File name of the WorkBuddy desktop executable on Windows. */
-const APP_EXECUTABLE_NAME = "WorkBuddy.exe";
+/**
+* Executable file names the desktop app ships under, in probe order.
+*
+* `WorkBuddyAI.exe` is the INTERNATIONAL build; both apps can be installed side
+* by side (observed on a real machine: `D:\\workbuddy\\WorkBuddy.exe` for the
+* domestic one and `D:\\workbuddyai\\WorkBuddyAI.exe` for the international one),
+* so the name cannot be assumed.
+*/
+const APP_EXECUTABLE_NAMES = ["WorkBuddy.exe", "WorkBuddyAI.exe"];
 /**
 * macOS bundles the desktop app may be installed as, in probe order.
 *
@@ -1752,6 +1759,23 @@ function openEncryptedField(field, key) {
 	return Buffer.concat([decipher.update(Buffer.from(ciphertext, "base64")), decipher.final()]).toString("utf8");
 }
 /**
+* The key id an encrypted field envelope demands, or undefined when the
+* envelope cannot be read.
+*
+* The account pool uses it to pick the right desktop build's key when more
+* than one build (domestic and international) is installed on the same machine:
+* each `.info` file names the key id its fields were sealed under, so the opener
+* must select the matching derived key rather than assume one build exists.
+*/
+function encryptedFieldKeyId(field) {
+	try {
+		const record = JSON.parse(Buffer.from(field.envelope, "base64").toString("utf8"));
+		return typeof record["keyId"] === "string" ? record["keyId"] : void 0;
+	} catch {
+		return;
+	}
+}
+/**
 * The executable inside a macOS app bundle, read from the bundle's own
 * `Info.plist`.
 *
@@ -1777,116 +1801,139 @@ function macosBundleExecutable(bundle) {
 	return join(bundle, "Contents", "MacOS", name);
 }
 /**
-* Candidate paths of the WorkBuddy desktop executable, in probe order.
+* Windows install locations recorded by the app's own uninstaller.
 *
-* The Windows build is the one that encrypts credentials, so Windows leads;
-* the macOS bundles are listed because the same native module ships there and
-* the encryption policy is enabled on macOS builds too (observed from 5.6.x),
-* and `undefined` entries (an unset env variable) are dropped.
-*
-* On macOS the executable name comes from each bundle (see
-* {@link macosBundleExecutable}) rather than being assembled from the app name.
-*
-* `readBundleExecutable` is injectable, in the same spirit as `platform`/`home`/
-* `env`: the macOS branch consults the real filesystem, so without a seam the
-* expected candidates would depend on whether the host machine happens to have
-* the app installed — and the test would pass on a developer's Mac while
-* failing in CI.
-*/
-function workbuddyAppExecutableCandidates(platform = process.platform, home = homedir(), env = process.env, readBundleExecutable = macosBundleExecutable) {
-	const candidates = [env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim()];
-	if (platform === "win32") {
-		const local = env["LOCALAPPDATA"]?.trim();
-		const programFiles = env["ProgramFiles"]?.trim();
-		const programFilesX86 = env["ProgramFiles(x86)"]?.trim();
-		candidates.push(local === void 0 || local === "" ? void 0 : join(local, "Programs", "WorkBuddy", APP_EXECUTABLE_NAME), local === void 0 || local === "" ? void 0 : join(local, "WorkBuddy", APP_EXECUTABLE_NAME), programFiles === void 0 || programFiles === "" ? void 0 : join(programFiles, "WorkBuddy", APP_EXECUTABLE_NAME), programFilesX86 === void 0 || programFilesX86 === "" ? void 0 : join(programFilesX86, "WorkBuddy", APP_EXECUTABLE_NAME));
-	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
-	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
-}
-/**
-* Bundle identifier PREFIXES the desktop app is signed with — `com.tencent.
-* workbuddy` (domestic, observed as `…workbuddy.mac`) and `com.workbuddy`
-* (international, observed as `com.workbuddy.workbuddy-ai`).
-*
-* Used to CONFIRM that a discovered bundle really is WorkBuddy before it is
-* launched. This matters because the discovery below scans directories and then
-* execs what it finds: every Electron app is built around a binary called
-* `Electron`, so a name-only match could pick a different product's bundle and
-* run it. The identifier is the app's own claim about itself, so it is the
-* check that makes the scan safe.
-*/
-const APP_BUNDLE_IDENTIFIER_PREFIXES = ["com.tencent.workbuddy", "com.workbuddy"];
-/**
-* Whether a bundle identifies itself as the WorkBuddy desktop app.
+* The registry is the authoritative answer: it survives a non-default drive, a
+* renamed folder and a differently-named executable, none of which any fixed
+* path list can predict. Real machines put the app at `D:\workbuddy\WorkBuddy.exe`
+* and `D:\workbuddyai\WorkBuddyAI.exe` — exactly the layouts a
+* `%ProgramFiles%\WorkBuddy\WorkBuddy.exe` probe cannot see, which is why the
+* plugin reported "the desktop app could not provide the key" for an app that was
+* installed and running.
 *
-* The match is on dot boundaries, so a hypothetical `com.workbuddyish` cannot
-* pass as `com.workbuddy`.
+* `DisplayIcon` is the field that actually carries the path (observed as
+* `D:\workbuddy\WorkBuddy.exe,0`); `InstallLocation` is usually empty for these
+* installers, so both are read and either may contribute.
 *
-* An unreadable or identifier-less plist is treated as NOT WorkBuddy: refusing
-* a candidate only costs a fallback to another path, whereas accepting the
-* wrong one would execute an unrelated application.
+* Returns [] on any failure — a missing registry key is the normal case on
+* non-Windows, not an error.
 */
-function isWorkbuddyBundle(bundle) {
-	let plist;
-	try {
-		plist = readFileSync(join(bundle, "Contents", "Info.plist"), "utf8");
-	} catch {
-		return false;
+function windowsRegistryAppPaths() {
+	if (process.platform !== "win32") return [];
+	const roots = [
+		["HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
+		["HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
+		["HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"]
+	];
+	const out = [];
+	for (const [root] of roots) {
+		let listing;
+		try {
+			listing = execFileSync("reg", [
+				"query",
+				root,
+				"/s",
+				"/v",
+				"DisplayName"
+			], {
+				encoding: "utf8",
+				timeout: 1e4,
+				windowsHide: true,
+				maxBuffer: 8388608
+			});
+		} catch {
+			continue;
+		}
+		const keys = listing.split(/\r?\n(?=HKEY_)/u).filter((block) => /WorkBuddy|CodeBuddy/iu.test(block));
+		for (const key of keys) {
+			const keyPath = /^(HKEY_[^\r\n]+)/u.exec(key)?.[1]?.trim();
+			if (keyPath === void 0) continue;
+			for (const name of ["DisplayIcon", "InstallLocation"]) try {
+				const value = execFileSync("reg", [
+					"query",
+					keyPath,
+					"/v",
+					name
+				], {
+					encoding: "utf8",
+					timeout: 5e3,
+					windowsHide: true
+				});
+				const raw = /REG_(?:SZ|EXPAND_SZ)\s+(.+)$/mu.exec(value)?.[1]?.trim();
+				if (raw === void 0 || raw === "") continue;
+				const cleaned = raw.replace(/^"/u, "").replace(/",-?\d+$/u, "").replace(/,-?\d+$/u, "").trim();
+				out.push(cleaned);
+			} catch {}
+		}
 	}
-	const identifier = /<key>\s*CFBundleIdentifier\s*<\/key>\s*<string>([^<]*)<\/string>/u.exec(plist)?.[1]?.trim().toLowerCase();
-	if (identifier === void 0 || identifier === "") return false;
-	return APP_BUNDLE_IDENTIFIER_PREFIXES.some((prefix) => identifier === prefix || identifier.startsWith(`${prefix}.`));
+	return out;
 }
 /**
-* Bundles of the desktop app found one level BELOW a macOS applications
-* directory.
+* Windows fallbacks for an app the registry did not cover: the well-known
+* per-user and machine-wide locations, plus every fixed drive's `Program Files`.
 *
-* Users do file apps into subfolders (`/Applications/IDE/WorkBuddy.app`), and
-* a hardcoded `/Applications/<name>` then reports the app as missing while it
-* is installed and signed in. The scan is deliberately ONE level deep and
-* matches the known bundle names only, so it stays predictable and cheap; each
-* candidate is then confirmed by {@link isWorkbuddyBundle} before use.
-*
-* Returns [] when the parent is absent or unreadable — a missing directory is
-* the normal case, not an error.
+* Drive enumeration matters because installing to a non-system drive is common
+* on Windows and no environment variable points there.
 */
-function macosNestedAppBundles(parent) {
-	let entries;
-	try {
-		entries = readdirSync(parent);
-	} catch {
-		return [];
-	}
-	const bundles = [];
-	for (const entry of entries) {
-		const nested = join(parent, entry);
-		for (const name of MACOS_APP_BUNDLE_NAMES) {
-			const bundle = join(nested, name);
-			try {
-				if (!statSync(bundle).isDirectory()) continue;
-			} catch {
-				continue;
-			}
-			if (isWorkbuddyBundle(bundle)) bundles.push(bundle);
+function windowsFallbackAppPaths(env) {
+	const out = [];
+	const roots = /* @__PURE__ */ new Set();
+	for (const key of [
+		"ProgramFiles",
+		"ProgramW6432",
+		"ProgramFiles(x86)",
+		"LOCALAPPDATA"
+	]) {
+		const value = env[key]?.trim();
+		if (value !== void 0 && value !== "") roots.add(value);
+	}
+	for (let code = 67; code <= 90; code += 1) {
+		const drive = String.fromCharCode(code) + ":\\";
+		try {
+			if (!existsSync(drive)) continue;
+		} catch {
+			continue;
 		}
-	}
-	return bundles;
+		roots.add(join(drive, "Program Files"));
+		roots.add(join(drive, "Program Files (x86)"));
+	}
+	for (const root of roots) for (const name of APP_EXECUTABLE_NAMES) {
+		out.push(join(root, "WorkBuddy", name));
+		out.push(join(root, "WorkBuddy AI", name));
+		out.push(join(root, "Programs", "WorkBuddy", name));
+	}
+	for (const root of roots) try {
+		for (const entry of readdirSync(root)) {
+			if (!/^(workbuddy|codebuddy)/iu.test(entry)) continue;
+			for (const name of APP_EXECUTABLE_NAMES) out.push(join(root, entry, name));
+		}
+	} catch {}
+	return out;
 }
 /**
-* The first candidate that exists as a file, or undefined when the desktop app
-* is not installed where this platform expects it.
+* Candidate paths of the WorkBuddy desktop executable, in probe order.
+*
+* Order is deliberate:
+*  1. the explicit override, because a user who set it knows where the app is;
+*  2. the registry, which is what the installer itself recorded;
+*  3. derived fallbacks (per-user, machine-wide, every fixed drive).
+*
+* Only the Windows branch consults the registry (it is the only platform with
+* one). macOS asks each bundle for its own `CFBundleExecutable` instead, because
+* the WorkBuddy bundles ship a binary named `Electron`, not after the app.
+*
+* `readBundleExecutable` and `registryPaths` are injectable in the same spirit as
+* `platform`/`home`/`env`: both consult the real machine, so without a seam the
+* expected candidates would depend on what happens to be installed where the
+* suite runs — passing on a developer's box and failing in CI.
 */
-function findWorkbuddyAppExecutable(platform = process.platform, home = homedir(), env = process.env) {
-	for (const candidate of workbuddyAppExecutableCandidates(platform, home, env)) try {
-		if (existsSync(candidate)) return candidate;
-	} catch {}
-	if (platform === "darwin") for (const parent of ["/Applications", join(home, "Applications")]) for (const bundle of macosNestedAppBundles(parent)) {
-		const executable = macosBundleExecutable(bundle);
-		if (executable === void 0) continue;
-		try {
-			if (existsSync(executable)) return executable;
-		} catch {}
-	}
+function workbuddyAppExecutableCandidates(platform = process.platform, home = homedir(), env = process.env, readBundleExecutable = macosBundleExecutable, registryPaths = windowsRegistryAppPaths) {
+	const candidates = [env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim()];
+	if (platform === "win32") {
+		candidates.push(...registryPaths());
+		candidates.push(...windowsFallbackAppPaths(env));
+	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
+	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
 }
 /**
 * Ask the installed desktop app for its key payload by running its own binary
@@ -1921,28 +1968,95 @@ function fetchAtRestKeyPayload(executable) {
 		});
 	});
 }
-/** Process-lifetime cache of the derived key; never persisted. */
-let cachedKey;
-let inflightKey;
 /**
-* The desktop app's at-rest field key, or undefined when it cannot be obtained
-* (app not installed, an older build without the native module, or a future
-* build that rotates the payload). Cached after the first success so the app is
-* spawned at most once per process; a failure is retried on the next call,
-* because the user may install or start the app between reads.
+* The desktop app's at-rest keys, indexed by the key id each derived key
+* reports (the first 16 hex of its SHA-256).
+*
+* More than one build can be installed on one machine — the domestic
+* `WorkBuddy.exe` and the international `WorkBuddyAI.exe` share a key id on the
+* builds seen here, but a future build may rotate it, and the discovery below
+* must keep working if they ever diverge. A field envelope names the key id it
+* was sealed under, so the opener selects the matching derived key instead of
+* assuming a single build exists. Cached per process and never persisted.
 */
-function readAtRestKey() {
-	if (cachedKey !== void 0) return Promise.resolve(cachedKey);
-	inflightKey ??= (async () => {
-		const executable = findWorkbuddyAppExecutable();
-		if (executable === void 0) return void 0;
-		const key = deriveAtRestKey(await fetchAtRestKeyPayload(executable));
-		cachedKey = key;
-		return key;
+const atRestKeyById = /* @__PURE__ */ new Map();
+let inflightKeys;
+/**
+* When the last full key sweep failed, and how long that failure is trusted.
+*
+* Without this, EVERY credential read spawned the app and waited out the
+* 10-second timeout before giving up — which is what made "rescan accounts" and
+* every status poll crawl on a machine where the app could not be found. A
+* failure is negative-cached briefly: long enough that a burst of reads costs
+* one sweep, short enough that installing or starting the app is picked up
+* without restarting DSH.
+*/
+let lastKeyFailureAtMs = 0;
+const KEY_FAILURE_BACKOFF_MS = 6e4;
+/**
+* Load every desktop build's key id into {@link atRestKeyById}.
+*
+* Mirrors the reference `provideTheKey` shape: probe EVERY candidate executable
+* (not just the first that exists) and keep the key each one yields. A build
+* that fails to answer — a timeout, a single-instance lock, an older build
+* without the native module — is skipped on its own and does NOT poison the
+* other builds, which is exactly the failure mode the single-candidate path
+* had: one bad spawn cached `undefined` for the whole process and every
+* encrypted field then reported "no app could be located".
+*/
+function ensureAtRestKeys() {
+	if (atRestKeyById.size > 0) return Promise.resolve();
+	if (Date.now() - lastKeyFailureAtMs < KEY_FAILURE_BACKOFF_MS) return Promise.resolve();
+	inflightKeys ??= (async () => {
+		const candidates = workbuddyAppExecutableCandidates().filter((candidate) => {
+			try {
+				return existsSync(candidate);
+			} catch {
+				return false;
+			}
+		});
+		if (candidates.length === 0) {
+			lastKeyFailureAtMs = Date.now();
+			return;
+		}
+		let anySuccess = false;
+		await Promise.all(candidates.map(async (executable) => {
+			try {
+				const key = deriveAtRestKey(await fetchAtRestKeyPayload(executable));
+				atRestKeyById.set(deriveAtRestKeyId(key), key);
+				anySuccess = true;
+			} catch {}
+		}));
+		if (anySuccess) lastKeyFailureAtMs = 0;
+		else lastKeyFailureAtMs = Date.now();
 	})().finally(() => {
-		inflightKey = void 0;
+		inflightKeys = void 0;
+	});
+	return inflightKeys;
+}
+/**
+* Synchronous key lookup for a key id already loaded by {@link ensureAtRestKeys}.
+*
+* The account pool warms the cache up front (via {@link readAtRestKey}) and then
+* opens each encrypted field through a synchronous closure, because the parser
+* runs `decrypt` inline. Lookups that race the warm-up, or ask for a key id no
+* installed build produced, return undefined and are reported as the
+* encrypted-but-unavailable error rather than a silently empty token.
+*/
+function atRestKeyFor(keyId) {
+	return atRestKeyById.get(keyId);
+}
+/**
+* Backwards-compatible single-key view: the first key any build provided.
+*
+* Kept so callers that do not yet carry a key id (and the legacy tests) still
+* resolve to a usable key on single-build machines. Multi-build callers should
+* prefer {@link readAtRestKeyById} and select by the field's own key id.
+*/
+function readAtRestKey() {
+	return ensureAtRestKeys().then(() => {
+		for (const key of atRestKeyById.values()) return key;
 	});
-	return inflightKey;
 }
 //#endregion
 //#region src/accounts.ts
@@ -2017,7 +2131,7 @@ const ENCRYPTED_CREDENTIAL_CODE = "ENCRYPTED_CREDENTIAL";
 var WorkBuddyEncryptedCredentialError = class extends Error {
 	code = ENCRYPTED_CREDENTIAL_CODE;
 	constructor(sourcePath) {
-		super(`workbuddy: ${sourcePath} holds encrypted credentials but the desktop app could not provide the key. Install the WorkBuddy desktop app (or point WORKBUDDY_APP_EXECUTABLE at it) — signing in again will not help.`);
+		super(`workbuddy: ${sourcePath} holds encrypted credentials, but no WorkBuddy desktop app could be located to provide the key. If the app IS installed, it is simply outside the paths this plugin probes — set WORKBUDDY_APP_EXECUTABLE to its full .exe path (then restart DSH) and the credential will open. Signing in again will not help: the credential itself is intact. Run \`dsh-workbuddy-xdpool doctor\` to see which paths were probed.`);
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
@@ -2201,10 +2315,13 @@ async function readCredential(path) {
 * error that would look like a corrupt file.
 */
 async function encryptedFieldOpener() {
-	const key = await readAtRestKey().catch(() => void 0);
-	if (key === void 0) return void 0;
+	await readAtRestKey().catch(() => void 0);
 	return (field) => {
 		if (!isEncryptedFieldWrapper(field)) throw new Error("workbuddy: not an encrypted field wrapper");
+		const keyId = encryptedFieldKeyId(field);
+		if (keyId === void 0) throw new Error("workbuddy: encrypted field has no key id");
+		const key = atRestKeyFor(keyId);
+		if (key === void 0) throw new Error("workbuddy: no at-rest key available for this encrypted field");
 		return openEncryptedField(field, key);
 	};
 }

package/lib/index.js

@@ -3,8 +3,8 @@ import z from "@deepseek-ai/schemastery";
 import { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { readFile, readdir } from "node:fs/promises";
 import { homedir } from "node:os";
-import { execFile } from "node:child_process";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { execFile, execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
@@ -1749,8 +1749,15 @@ const SYMMETRIC_SCHEME = "sym-v1";
 const WORKBUDDY_APP_EXECUTABLE_ENV = "WORKBUDDY_APP_EXECUTABLE";
 /** How long the app is given to answer with its key payload. */
 const KEY_FETCH_TIMEOUT_MS = 1e4;
-/** File name of the WorkBuddy desktop executable on Windows. */
-const APP_EXECUTABLE_NAME = "WorkBuddy.exe";
+/**
+* Executable file names the desktop app ships under, in probe order.
+*
+* `WorkBuddyAI.exe` is the INTERNATIONAL build; both apps can be installed side
+* by side (observed on a real machine: `D:\\workbuddy\\WorkBuddy.exe` for the
+* domestic one and `D:\\workbuddyai\\WorkBuddyAI.exe` for the international one),
+* so the name cannot be assumed.
+*/
+const APP_EXECUTABLE_NAMES = ["WorkBuddy.exe", "WorkBuddyAI.exe"];
 /**
 * macOS bundles the desktop app may be installed as, in probe order.
 *
@@ -1859,6 +1866,23 @@ function openEncryptedField(field, key) {
 	return Buffer.concat([decipher.update(Buffer.from(ciphertext, "base64")), decipher.final()]).toString("utf8");
 }
 /**
+* The key id an encrypted field envelope demands, or undefined when the
+* envelope cannot be read.
+*
+* The account pool uses it to pick the right desktop build's key when more
+* than one build (domestic and international) is installed on the same machine:
+* each `.info` file names the key id its fields were sealed under, so the opener
+* must select the matching derived key rather than assume one build exists.
+*/
+function encryptedFieldKeyId(field) {
+	try {
+		const record = JSON.parse(Buffer.from(field.envelope, "base64").toString("utf8"));
+		return typeof record["keyId"] === "string" ? record["keyId"] : void 0;
+	} catch {
+		return;
+	}
+}
+/**
 * The executable inside a macOS app bundle, read from the bundle's own
 * `Info.plist`.
 *
@@ -1884,116 +1908,139 @@ function macosBundleExecutable(bundle) {
 	return join(bundle, "Contents", "MacOS", name);
 }
 /**
-* Candidate paths of the WorkBuddy desktop executable, in probe order.
-*
-* The Windows build is the one that encrypts credentials, so Windows leads;
-* the macOS bundles are listed because the same native module ships there and
-* the encryption policy is enabled on macOS builds too (observed from 5.6.x),
-* and `undefined` entries (an unset env variable) are dropped.
-*
-* On macOS the executable name comes from each bundle (see
-* {@link macosBundleExecutable}) rather than being assembled from the app name.
-*
-* `readBundleExecutable` is injectable, in the same spirit as `platform`/`home`/
-* `env`: the macOS branch consults the real filesystem, so without a seam the
-* expected candidates would depend on whether the host machine happens to have
-* the app installed — and the test would pass on a developer's Mac while
-* failing in CI.
-*/
-function workbuddyAppExecutableCandidates(platform = process.platform, home = homedir(), env = process.env, readBundleExecutable = macosBundleExecutable) {
-	const candidates = [env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim()];
-	if (platform === "win32") {
-		const local = env["LOCALAPPDATA"]?.trim();
-		const programFiles = env["ProgramFiles"]?.trim();
-		const programFilesX86 = env["ProgramFiles(x86)"]?.trim();
-		candidates.push(local === void 0 || local === "" ? void 0 : join(local, "Programs", "WorkBuddy", APP_EXECUTABLE_NAME), local === void 0 || local === "" ? void 0 : join(local, "WorkBuddy", APP_EXECUTABLE_NAME), programFiles === void 0 || programFiles === "" ? void 0 : join(programFiles, "WorkBuddy", APP_EXECUTABLE_NAME), programFilesX86 === void 0 || programFilesX86 === "" ? void 0 : join(programFilesX86, "WorkBuddy", APP_EXECUTABLE_NAME));
-	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
-	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
-}
-/**
-* Bundle identifier PREFIXES the desktop app is signed with — `com.tencent.
-* workbuddy` (domestic, observed as `…workbuddy.mac`) and `com.workbuddy`
-* (international, observed as `com.workbuddy.workbuddy-ai`).
+* Windows install locations recorded by the app's own uninstaller.
 *
-* Used to CONFIRM that a discovered bundle really is WorkBuddy before it is
-* launched. This matters because the discovery below scans directories and then
-* execs what it finds: every Electron app is built around a binary called
-* `Electron`, so a name-only match could pick a different product's bundle and
-* run it. The identifier is the app's own claim about itself, so it is the
-* check that makes the scan safe.
-*/
-const APP_BUNDLE_IDENTIFIER_PREFIXES = ["com.tencent.workbuddy", "com.workbuddy"];
-/**
-* Whether a bundle identifies itself as the WorkBuddy desktop app.
+* The registry is the authoritative answer: it survives a non-default drive, a
+* renamed folder and a differently-named executable, none of which any fixed
+* path list can predict. Real machines put the app at `D:\workbuddy\WorkBuddy.exe`
+* and `D:\workbuddyai\WorkBuddyAI.exe` — exactly the layouts a
+* `%ProgramFiles%\WorkBuddy\WorkBuddy.exe` probe cannot see, which is why the
+* plugin reported "the desktop app could not provide the key" for an app that was
+* installed and running.
 *
-* The match is on dot boundaries, so a hypothetical `com.workbuddyish` cannot
-* pass as `com.workbuddy`.
+* `DisplayIcon` is the field that actually carries the path (observed as
+* `D:\workbuddy\WorkBuddy.exe,0`); `InstallLocation` is usually empty for these
+* installers, so both are read and either may contribute.
 *
-* An unreadable or identifier-less plist is treated as NOT WorkBuddy: refusing
-* a candidate only costs a fallback to another path, whereas accepting the
-* wrong one would execute an unrelated application.
+* Returns [] on any failure — a missing registry key is the normal case on
+* non-Windows, not an error.
 */
-function isWorkbuddyBundle(bundle) {
-	let plist;
-	try {
-		plist = readFileSync(join(bundle, "Contents", "Info.plist"), "utf8");
-	} catch {
-		return false;
+function windowsRegistryAppPaths() {
+	if (process.platform !== "win32") return [];
+	const roots = [
+		["HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
+		["HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
+		["HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"]
+	];
+	const out = [];
+	for (const [root] of roots) {
+		let listing;
+		try {
+			listing = execFileSync("reg", [
+				"query",
+				root,
+				"/s",
+				"/v",
+				"DisplayName"
+			], {
+				encoding: "utf8",
+				timeout: 1e4,
+				windowsHide: true,
+				maxBuffer: 8388608
+			});
+		} catch {
+			continue;
+		}
+		const keys = listing.split(/\r?\n(?=HKEY_)/u).filter((block) => /WorkBuddy|CodeBuddy/iu.test(block));
+		for (const key of keys) {
+			const keyPath = /^(HKEY_[^\r\n]+)/u.exec(key)?.[1]?.trim();
+			if (keyPath === void 0) continue;
+			for (const name of ["DisplayIcon", "InstallLocation"]) try {
+				const value = execFileSync("reg", [
+					"query",
+					keyPath,
+					"/v",
+					name
+				], {
+					encoding: "utf8",
+					timeout: 5e3,
+					windowsHide: true
+				});
+				const raw = /REG_(?:SZ|EXPAND_SZ)\s+(.+)$/mu.exec(value)?.[1]?.trim();
+				if (raw === void 0 || raw === "") continue;
+				const cleaned = raw.replace(/^"/u, "").replace(/",-?\d+$/u, "").replace(/,-?\d+$/u, "").trim();
+				out.push(cleaned);
+			} catch {}
+		}
 	}
-	const identifier = /<key>\s*CFBundleIdentifier\s*<\/key>\s*<string>([^<]*)<\/string>/u.exec(plist)?.[1]?.trim().toLowerCase();
-	if (identifier === void 0 || identifier === "") return false;
-	return APP_BUNDLE_IDENTIFIER_PREFIXES.some((prefix) => identifier === prefix || identifier.startsWith(`${prefix}.`));
+	return out;
 }
 /**
-* Bundles of the desktop app found one level BELOW a macOS applications
-* directory.
-*
-* Users do file apps into subfolders (`/Applications/IDE/WorkBuddy.app`), and
-* a hardcoded `/Applications/<name>` then reports the app as missing while it
-* is installed and signed in. The scan is deliberately ONE level deep and
-* matches the known bundle names only, so it stays predictable and cheap; each
-* candidate is then confirmed by {@link isWorkbuddyBundle} before use.
+* Windows fallbacks for an app the registry did not cover: the well-known
+* per-user and machine-wide locations, plus every fixed drive's `Program Files`.
 *
-* Returns [] when the parent is absent or unreadable — a missing directory is
-* the normal case, not an error.
+* Drive enumeration matters because installing to a non-system drive is common
+* on Windows and no environment variable points there.
 */
-function macosNestedAppBundles(parent) {
-	let entries;
-	try {
-		entries = readdirSync(parent);
-	} catch {
-		return [];
-	}
-	const bundles = [];
-	for (const entry of entries) {
-		const nested = join(parent, entry);
-		for (const name of MACOS_APP_BUNDLE_NAMES) {
-			const bundle = join(nested, name);
-			try {
-				if (!statSync(bundle).isDirectory()) continue;
-			} catch {
-				continue;
-			}
-			if (isWorkbuddyBundle(bundle)) bundles.push(bundle);
+function windowsFallbackAppPaths(env) {
+	const out = [];
+	const roots = /* @__PURE__ */ new Set();
+	for (const key of [
+		"ProgramFiles",
+		"ProgramW6432",
+		"ProgramFiles(x86)",
+		"LOCALAPPDATA"
+	]) {
+		const value = env[key]?.trim();
+		if (value !== void 0 && value !== "") roots.add(value);
+	}
+	for (let code = 67; code <= 90; code += 1) {
+		const drive = String.fromCharCode(code) + ":\\";
+		try {
+			if (!existsSync(drive)) continue;
+		} catch {
+			continue;
 		}
-	}
-	return bundles;
+		roots.add(join(drive, "Program Files"));
+		roots.add(join(drive, "Program Files (x86)"));
+	}
+	for (const root of roots) for (const name of APP_EXECUTABLE_NAMES) {
+		out.push(join(root, "WorkBuddy", name));
+		out.push(join(root, "WorkBuddy AI", name));
+		out.push(join(root, "Programs", "WorkBuddy", name));
+	}
+	for (const root of roots) try {
+		for (const entry of readdirSync(root)) {
+			if (!/^(workbuddy|codebuddy)/iu.test(entry)) continue;
+			for (const name of APP_EXECUTABLE_NAMES) out.push(join(root, entry, name));
+		}
+	} catch {}
+	return out;
 }
 /**
-* The first candidate that exists as a file, or undefined when the desktop app
-* is not installed where this platform expects it.
+* Candidate paths of the WorkBuddy desktop executable, in probe order.
+*
+* Order is deliberate:
+*  1. the explicit override, because a user who set it knows where the app is;
+*  2. the registry, which is what the installer itself recorded;
+*  3. derived fallbacks (per-user, machine-wide, every fixed drive).
+*
+* Only the Windows branch consults the registry (it is the only platform with
+* one). macOS asks each bundle for its own `CFBundleExecutable` instead, because
+* the WorkBuddy bundles ship a binary named `Electron`, not after the app.
+*
+* `readBundleExecutable` and `registryPaths` are injectable in the same spirit as
+* `platform`/`home`/`env`: both consult the real machine, so without a seam the
+* expected candidates would depend on what happens to be installed where the
+* suite runs — passing on a developer's box and failing in CI.
 */
-function findWorkbuddyAppExecutable(platform = process.platform, home = homedir(), env = process.env) {
-	for (const candidate of workbuddyAppExecutableCandidates(platform, home, env)) try {
-		if (existsSync(candidate)) return candidate;
-	} catch {}
-	if (platform === "darwin") for (const parent of ["/Applications", join(home, "Applications")]) for (const bundle of macosNestedAppBundles(parent)) {
-		const executable = macosBundleExecutable(bundle);
-		if (executable === void 0) continue;
-		try {
-			if (existsSync(executable)) return executable;
-		} catch {}
-	}
+function workbuddyAppExecutableCandidates(platform = process.platform, home = homedir(), env = process.env, readBundleExecutable = macosBundleExecutable, registryPaths = windowsRegistryAppPaths) {
+	const candidates = [env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim()];
+	if (platform === "win32") {
+		candidates.push(...registryPaths());
+		candidates.push(...windowsFallbackAppPaths(env));
+	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
+	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
 }
 /**
 * Ask the installed desktop app for its key payload by running its own binary
@@ -2028,28 +2075,95 @@ function fetchAtRestKeyPayload(executable) {
 		});
 	});
 }
-/** Process-lifetime cache of the derived key; never persisted. */
-let cachedKey;
-let inflightKey;
 /**
-* The desktop app's at-rest field key, or undefined when it cannot be obtained
-* (app not installed, an older build without the native module, or a future
-* build that rotates the payload). Cached after the first success so the app is
-* spawned at most once per process; a failure is retried on the next call,
-* because the user may install or start the app between reads.
+* The desktop app's at-rest keys, indexed by the key id each derived key
+* reports (the first 16 hex of its SHA-256).
+*
+* More than one build can be installed on one machine — the domestic
+* `WorkBuddy.exe` and the international `WorkBuddyAI.exe` share a key id on the
+* builds seen here, but a future build may rotate it, and the discovery below
+* must keep working if they ever diverge. A field envelope names the key id it
+* was sealed under, so the opener selects the matching derived key instead of
+* assuming a single build exists. Cached per process and never persisted.
 */
-function readAtRestKey() {
-	if (cachedKey !== void 0) return Promise.resolve(cachedKey);
-	inflightKey ??= (async () => {
-		const executable = findWorkbuddyAppExecutable();
-		if (executable === void 0) return void 0;
-		const key = deriveAtRestKey(await fetchAtRestKeyPayload(executable));
-		cachedKey = key;
-		return key;
+const atRestKeyById = /* @__PURE__ */ new Map();
+let inflightKeys;
+/**
+* When the last full key sweep failed, and how long that failure is trusted.
+*
+* Without this, EVERY credential read spawned the app and waited out the
+* 10-second timeout before giving up — which is what made "rescan accounts" and
+* every status poll crawl on a machine where the app could not be found. A
+* failure is negative-cached briefly: long enough that a burst of reads costs
+* one sweep, short enough that installing or starting the app is picked up
+* without restarting DSH.
+*/
+let lastKeyFailureAtMs = 0;
+const KEY_FAILURE_BACKOFF_MS = 6e4;
+/**
+* Load every desktop build's key id into {@link atRestKeyById}.
+*
+* Mirrors the reference `provideTheKey` shape: probe EVERY candidate executable
+* (not just the first that exists) and keep the key each one yields. A build
+* that fails to answer — a timeout, a single-instance lock, an older build
+* without the native module — is skipped on its own and does NOT poison the
+* other builds, which is exactly the failure mode the single-candidate path
+* had: one bad spawn cached `undefined` for the whole process and every
+* encrypted field then reported "no app could be located".
+*/
+function ensureAtRestKeys() {
+	if (atRestKeyById.size > 0) return Promise.resolve();
+	if (Date.now() - lastKeyFailureAtMs < KEY_FAILURE_BACKOFF_MS) return Promise.resolve();
+	inflightKeys ??= (async () => {
+		const candidates = workbuddyAppExecutableCandidates().filter((candidate) => {
+			try {
+				return existsSync(candidate);
+			} catch {
+				return false;
+			}
+		});
+		if (candidates.length === 0) {
+			lastKeyFailureAtMs = Date.now();
+			return;
+		}
+		let anySuccess = false;
+		await Promise.all(candidates.map(async (executable) => {
+			try {
+				const key = deriveAtRestKey(await fetchAtRestKeyPayload(executable));
+				atRestKeyById.set(deriveAtRestKeyId(key), key);
+				anySuccess = true;
+			} catch {}
+		}));
+		if (anySuccess) lastKeyFailureAtMs = 0;
+		else lastKeyFailureAtMs = Date.now();
 	})().finally(() => {
-		inflightKey = void 0;
+		inflightKeys = void 0;
+	});
+	return inflightKeys;
+}
+/**
+* Synchronous key lookup for a key id already loaded by {@link ensureAtRestKeys}.
+*
+* The account pool warms the cache up front (via {@link readAtRestKey}) and then
+* opens each encrypted field through a synchronous closure, because the parser
+* runs `decrypt` inline. Lookups that race the warm-up, or ask for a key id no
+* installed build produced, return undefined and are reported as the
+* encrypted-but-unavailable error rather than a silently empty token.
+*/
+function atRestKeyFor(keyId) {
+	return atRestKeyById.get(keyId);
+}
+/**
+* Backwards-compatible single-key view: the first key any build provided.
+*
+* Kept so callers that do not yet carry a key id (and the legacy tests) still
+* resolve to a usable key on single-build machines. Multi-build callers should
+* prefer {@link readAtRestKeyById} and select by the field's own key id.
+*/
+function readAtRestKey() {
+	return ensureAtRestKeys().then(() => {
+		for (const key of atRestKeyById.values()) return key;
 	});
-	return inflightKey;
 }
 //#endregion
 //#region src/accounts.ts
@@ -2124,7 +2238,7 @@ const ENCRYPTED_CREDENTIAL_CODE = "ENCRYPTED_CREDENTIAL";
 var WorkBuddyEncryptedCredentialError = class extends Error {
 	code = ENCRYPTED_CREDENTIAL_CODE;
 	constructor(sourcePath) {
-		super(`workbuddy: ${sourcePath} holds encrypted credentials but the desktop app could not provide the key. Install the WorkBuddy desktop app (or point WORKBUDDY_APP_EXECUTABLE at it) — signing in again will not help.`);
+		super(`workbuddy: ${sourcePath} holds encrypted credentials, but no WorkBuddy desktop app could be located to provide the key. If the app IS installed, it is simply outside the paths this plugin probes — set WORKBUDDY_APP_EXECUTABLE to its full .exe path (then restart DSH) and the credential will open. Signing in again will not help: the credential itself is intact. Run \`dsh-workbuddy-xdpool doctor\` to see which paths were probed.`);
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
@@ -2308,10 +2422,13 @@ async function readCredential(path) {
 * error that would look like a corrupt file.
 */
 async function encryptedFieldOpener() {
-	const key = await readAtRestKey().catch(() => void 0);
-	if (key === void 0) return void 0;
+	await readAtRestKey().catch(() => void 0);
 	return (field) => {
 		if (!isEncryptedFieldWrapper(field)) throw new Error("workbuddy: not an encrypted field wrapper");
+		const keyId = encryptedFieldKeyId(field);
+		if (keyId === void 0) throw new Error("workbuddy: encrypted field has no key id");
+		const key = atRestKeyFor(keyId);
+		if (key === void 0) throw new Error("workbuddy: no at-rest key available for this encrypted field");
 		return openEncryptedField(field, key);
 	};
 }
@@ -3103,10 +3220,10 @@ function createWorkBuddyAdapter(options) {
 		streamIdleTimeoutMs: WORKBUDDY_STREAM_IDLE_TIMEOUT_MS,
 		retryPolicy: resolveRetryPolicy(void 0, "dsh-workbuddy-xdpool retryPolicy"),
 		configuredMaxTokens: /* @__PURE__ */ new Map(),
+		modelErrors: /* @__PURE__ */ new Map(),
 		...REQUEST_IMAGE_BUDGETS,
 		piProvider: provider
 	};
-	Object.assign(profile, { modelErrors: /* @__PURE__ */ new Map() });
 	let profiles = /* @__PURE__ */ new Map([[providerId, profile]]);
 	return {
 		providerId,
@@ -6024,9 +6141,9 @@ function apply(ctx, config = {}) {
 	}
 	const setSetting = async (key, value, expected) => {
 		if (value === void 0) return;
-		const write = settingsService?.set;
-		if (write === void 0) throw new Error(`settings service unavailable; ${key} was not saved`);
-		await write.call(settingsService, key, value);
+		const update = settingsService?.update;
+		if (update === void 0) throw new Error(`settings service has no update(); ${key} was not saved`);
+		await update.call(settingsService, WORKBUDDY_POOL_SETTINGS_NS, { [key]: value });
 		if (expected !== void 0) {
 			const stored = current()[key];
 			if (!stableJsonEqual(stored, expected)) throw new Error(`settings field "${key}" was not persisted`);

package/package.json

@@ -2,11 +2,13 @@
   "name": "dsh-workbuddy-xdpool",
   "displayName": "DSH WorkBuddy XD Pool",
   "description": "Merge every locally signed-in WorkBuddy account into DeepSeek Harness as one auto-failing-over model pool (multi-account rotation, live credits, daily check-in and model catalog).",
-  "version": "1.5.2",
+  "version": "1.6.1",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-workbuddy-xdpool#readme",
-  "bugs": { "url": "https://github.com/XDTrees/dsh-workbuddy-xdpool/issues" },
+  "bugs": {
+    "url": "https://github.com/XDTrees/dsh-workbuddy-xdpool/issues"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/XDTrees/dsh-workbuddy-xdpool.git"
@@ -73,19 +75,19 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.5-rc.2",
     "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-credentials": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-launch-environment": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-settings": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-settings": "0.1.5-rc.2",
     "@deepseek-ai/schemastery": "3.18.2",
-    "@earendil-works/pi-ai": "0.84.3",
+    "@earendil-works/pi-ai": "0.85.1",
     "@types/node": "^26.4.1",
     "@types/react": "~18.3.31",
     "@types/react-dom": "~18.3.0",