# Changelog

## 0.3.0 — 2026-10-19

- Support Config-based settings on Desktop `0.2.1-rc.2` without calling the removed `installSection()` API. Verify settings edits without remounting, restart persistence, and provider writes that preserve sibling routes through an isolated `dsh` profile. Keep one configuration listener on the plugin owner when Settings is replaced.
- Add opt-in CN personal-account growth check-in, with an independent switch and localized confirmation/failure status. Query official current-day activity before reporting, and confirm completion only from the official activity record.
- Persist report admission before sending, enforce the Shanghai day boundary, and limit verification retries across restarts and credential reimports. Unknown report outcomes are not resent. Preserve existing billing check-in behavior.
- Retain settings sections for legacy hosts and wait for gateway shutdown during plugin disposal. Restart DSH after upgrading; account data requires no migration.

- Repair startup daily check-in by using the account adapter’s persisted local-day confirmation instead of calling an absent method. Skip disabled accounts and overlapping scheduler cycles, refresh credits after success, and keep credit or travel failures from preventing later accounts’ check-ins.
- Cancel the initial background wait on shutdown. Add offline startup, restart, next-day, retry, eligibility, and overlapping-trigger regressions.

## 0.2.6 — 2026-10-03

- Fix model-route writes against current DSH settings service APIs by reading the `llm-pi-ai` entry through `settings.describe()` and retaining path-level `settings.mutate()` writes.
- Keep Desktop settings actions working through every official bridge path: accept the explicit `Origin: dsh-app://app`, the older app `Referer` fallback, and the final forwarded form where the bridge removes both `Origin` and `Referer` by sending a preserved client request marker.
- Keep explicit cross-origin origins, missing markers, invalid markers, and missing hosts rejected.
- Preserve the encrypted desktop-credential scan safeguards: malformed display metadata falls back to the credential filename, encrypted tokens are never imported, and the settings page shows actionable guidance instead of rendering malformed entries.
- Add regressions for settings API writes, all Desktop same-origin forms, invalid request markers, and the real desktop scan POST request.

## 0.2.5 — 2026-09-23

- Prevent desktop credential scans from returning encrypted nickname objects that crash the settings page. Invalid display metadata now falls back to the credential filename, and the client ignores malformed scan entries instead of rendering objects as React children.
- Reject encrypted access/refresh tokens during scanning and import, with guidance to use browser authorization. Scans remain read-only; encrypted data is neither decrypted nor saved as a usable token.
- Show an explicit message when no desktop credentials are found. Plaintext credential import remains supported, with encrypted display metadata omitted.
- Align the host and health endpoint version with the package version. Add regressions for encrypted desktop metadata, import rejection, and scan interactions in the settings renderer.

## 0.2.4 — 2026-09-21

- Select the configured realm before the gateway listens, then verify the realm using the launched API key before reporting the gateway as running. Failed confirmation stops the process instead of serving a different region.
- Store and restore the active realm in the configured account directory. Emit readiness only after the HTTP socket is bound.
- Cover startup failure, interrupted setup, explicit region overrides, persistence, and a real offline gateway restart.
- Apply settings synchronously in the host test fixture so disabled autostart cannot launch a real gateway during unit tests.

## 0.2.3 — 2026-09-19

- Treat a stored domestic check-in as current only when its confirmation date is today; yesterday's status now expires automatically at the local day boundary.
- Refresh domestic account credits immediately after a successful or already-claimed check-in and return the updated account snapshot to the settings page.
- Apply account snapshots from completed operations immediately in the client, so check-in and credit changes appear without waiting for the polling interval.
- Clarify that daily check-in and growth-task credit claiming are separate upstream operations; the latter can take longer because it runs multiple task requests.

- Classify upstream code 11140 as an account-level WorkBuddy restriction when the official client also fails. Temporarily cool and rotate the affected account, preserve the upstream trace, and avoid describing it as a prompt/content error or invalid local API key.
- Keep SSL disconnects, connection resets, and timeouts from cooling the entire account pool. Retain bounded same-realm attempts, authentication cooldowns, and per-model rate limits.
- Share read-only credential eligibility between account listings and pool counts; expired cooldowns become eligible despite historical errors. Scope account endpoint counts to the requested realm.
- Preserve readable upstream explanations and record exhausted-pool failures as HTTP 503 in usage logs.
- Add offline regressions for content rejection, both client protocols, network retry, authentication guards, and account availability. Restart DSH after upgrading; account data requires no migration.

## 0.2.2 — 2026-09-17

- Persist HTTP 429 / business-code 6004 limits per account and model, using the upstream reset time and UTC offset, then Retry-After, then a configurable 300-second fallback (`WB_RATE_LIMIT_FALLBACK_SECONDS`). Other models remain eligible.
- Try other eligible accounts in the same realm at most once per request. Skip restricted account/model pairs until their deadline; when all are restricted, return 429 with the earliest reset time instead of repeatedly probing or reporting a generic unavailable pool.
- Show active model restrictions and estimated recovery times on account cards. Preserve restrictions across restarts, credential reimports, and enable toggles.
- Replace v0.2.1's pool-wide limit assumption and cooldown bypass. Several accounts returning 429 does not prove a shared IP limit; their individual reset times can differ.
- Preserve upstream error bodies for Chat Completions and Responses clients, including HTTP 400 carrying business code 6004. Retain bounded 502/503/504 failover and existing authentication/network error handling.
- Add offline regression coverage for three distinct reset times, persistence, model isolation, concurrent saves, realm isolation, and both client protocols. Keep `v0.2.1` unchanged for rollback.

## 0.2.1 — 2026-09-17

- Stop a single rate-limited request from locking the whole account pool out for five minutes. A 429 cooled the account it touched for 300 seconds, and the failover path tries every candidate within one request, so three accounts answering 429 once each put the entire pool in cooldown — after which every request failed in about 20 ms with `no usable account for realm 'intl'` until the cooldowns lapsed. When *every* candidate answers 429, the limit is pool-wide (the accounts share one egress, so rotating did not help) and the cooldown is now 30 seconds.
- Give a fully cooled pool one attempt instead of refusing outright: the account closest to recovery is tried once per request, so a limit that clears in seconds no longer reads as a hard failure. The per-request attempt bound is unchanged, so this cannot stampede the upstream.

## 0.2.0 — 2026-09-17

- Restore realm switching fixes omitted from v0.1.4: confirm the gateway realm before saving, read models for the selected realm, and update automatic provider routes.
- Apply confirmed settings immediately and discard background reads started before a settings write. Display the gateway and model catalog realms separately.
- Rebuild the settings page on the Jet Hub style system (`iJetLi/deepseek-harness-codearts`): one injected stylesheet and `dsw-wb-*` classes over the theme's `--dsw-alias-*` tokens, replacing the per-element inline `style` objects. Adds a brand header, rounded cards with hover feedback, a status badge, account cards, and a per-section toolbar.
- Harden the settings page against a malformed `/state` reading: a gateway state outside `running` / `starting` / `stopped` / `failed` now renders as stopped instead of emitting a `data-tone` no stylesheet matches. Render-phase failures have no error boundary, so this class of bug blanks the whole settings panel.
- Fix realm switching never taking effect. The host half cached the settings thunk's *value* inside `setSource`, which `installSection` calls only when the settings provider attaches or detaches; a committed change afterwards fires `onChange` alone. The section therefore stayed frozen on the realm it mounted with — the picker never echoed a switch, the account and model reads kept querying the old realm, and the CN-only controls never appeared. The thunk is now re-read on attach, on every committed change, and immediately after a write.
- Report credits to the cent, preferring the upstream's `*Precise` fields (measured on a real account: 2415 reported as 2415.78) and rounding the sum. Expired packages are now summed separately instead of into the usable balance, which they inflated.
- Distinguish the bulk credit refresh from the per-account one; both previously carried the same label side by side, so refreshing one account looked like refreshing all of them.
- Show a claim badge on CN account cards, with the confirmation time in its tooltip.

## 0.1.4 — 2026-09-16

- Fix a regression in 0.1.3: HTTP 502/503/504 on multiple accounts applied account cooldowns and made the caller's next retry fail with `no usable account`.
- Keep failover bounded by the request's tried-account set without cooling down accounts for these upstream gateway errors. Preserve cooldowns for authentication failures, rate limiting, and network exceptions.
- Add a regression reproducing three upstream failures followed by a caller retry two seconds later.

## 0.1.3 — 2026-09-16

- Treat upstream HTTP 502/503/504 during model connection setup as account-failover candidates, alongside 401/403/429 and network errors. Previously these gateway errors immediately failed the request without trying another available account.
- With only one account, return the upstream 502/503/504 without cooling down that account, so a caller retry is not blocked.
- Preserve bounded attempts, same-realm selection, and session rebinding. Errors after streaming begins are not replayed; an upstream-wide outage may still fail every account.
- Add offline regression tests for APISIX 502 → 504 → success, exhausted accounts, non-retryable HTTP 400, existing auth/rate-limit failover, and bounded single-account attempts.
- Keep `v0.1.2` and `v0.1.1` available for rollback.

## 0.1.2 — 2026-09-16

- Add credit refresh, CN check-in, growth-task requests, and account enable/disable controls to the settings integration.
- Refresh credits after desktop import and CN check-in; persist confirmed claim state, including upstream HTTP errors carrying code `10001`.
- Detect desktop credential directories by platform and support `WORKBUDDY_DESKTOP_AUTH_DIR`. macOS/Linux discovery has offline tests but no real-device verification.
- Render HTTP 2xx/3xx access logs from stderr as ordinary logs, preserving error highlighting for failed requests.
- Correct account-card control nesting, localized labels, and nested operation failure reporting; give account operations longer than the regular read timeout.
- Align package, plugin, and health versions; add Python account regression tests and release packaging checks.
- Rewrite Chinese and English installation and usage documentation, including fixed-tag upgrades and rollback to `v0.1.1`.

## 0.1.1

Existing release tag retained unchanged. Use it to restore the earlier plugin code; see the README for rollback commands and backup requirements.