fix(workbuddy): silent re-auth, update-resilient macOS discovery, model parity on all platforms

packages/adapters/codebuddy/src/acp-client.ts

@@ -22,6 +22,8 @@ export interface CodeBuddyClientHandlers {
 export interface CodeBuddyClient {
   initialize(): Promise<Record<string, unknown>>;
   open(cwd: string, sessionId?: string): Promise<Record<string, unknown>>;
+  /** Optional ACP authenticate: some native agents (WorkBuddy) support silent re-login. */
+  authenticate?(params: { methodId: string }): Promise<Record<string, unknown>>;
   configure(sessionId: string, configId: string, value: string): Promise<Record<string, unknown>>;
   prompt(sessionId: string, input: string): Promise<Record<string, unknown>>;
   cancel(sessionId: string): Promise<void>;
@@ -184,6 +186,13 @@ export class CodeBuddyAcpClient implements CodeBuddyClient {
     );
   }
 
+  /** ACP authenticate: resolves once the user completes the native flow (browser/QR). */
+  async authenticate(params: { methodId: string }) {
+    return record(
+      await this.#request(() => this.#connection.authenticate(params), "ACP authenticate", 600_000),
+    );
+  }
+
   async configure(sessionId: string, configId: string, value: string) {
     return record(
       await this.#request(

packages/adapters/workbuddy/src/discovery.ts

@@ -1,3 +1,5 @@
+import { readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
 import {
   harnessCandidates,
   targetPath,
@@ -16,6 +18,7 @@ const windowsRoots = [
   "${ProgramFiles}/WorkBuddy",
   "${ProgramFiles}/WorkBuddyAI",
 ];
+
 const macSpec: HarnessDiscoverySpec = {
   id: "workbuddy",
   command: "Electron",
@@ -29,6 +32,65 @@ const macSpec: HarnessDiscoverySpec = {
   },
 };
 
+export interface MacWorkBuddyScanDependencies {
+  readdirSync?: typeof readdirSync;
+  statSync?: typeof statSync;
+  roots?: readonly string[];
+}
+
+export type MacWorkBuddyScanFunctions = Required<Omit<MacWorkBuddyScanDependencies, "roots">>;
+
+const defaultScanDependencies = (): Required<Omit<MacWorkBuddyScanDependencies, "roots">> => ({
+  readdirSync,
+  statSync,
+});
+
+/**
+ * Auto-updates and bundle migrations rename the .app directory, so fixed
+ * canonical install roots miss renamed or staged copies. Every "WorkBuddy*.app"
+ * bundle under the standard Applications roots is a candidate; canonical names
+ * win first, then the most recently placed copy wins over stale ones.
+ */
+export function macWorkBuddyAppBundleDirectories(
+  platform: NodeJS.Platform = process.platform,
+  scan: MacWorkBuddyScanDependencies = {},
+): string[] {
+  if (platform !== "darwin") return [];
+  const paths = targetPath(platform);
+  const { readdirSync: list, statSync: metadata } = {
+    ...defaultScanDependencies(),
+    ...scan,
+  };
+  const roots = scan.roots ?? ["/Applications", paths.join(homedir(), "Applications")];
+  const bundles = new Map<string, number>();
+  for (const root of roots) {
+    let entries: string[];
+    try {
+      entries = list(root);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!/^WorkBuddy[ .\w-]*\.app$/iu.test(entry)) continue;
+      const bundle = paths.join(root, entry);
+      try {
+        metadata(paths.join(bundle, "Contents", "Info.plist"));
+        metadata(paths.join(bundle, "Contents", "MacOS"));
+        bundles.set(bundle, metadata(bundle).mtimeMs);
+      } catch {
+        continue;
+      }
+    }
+  }
+  const canonical = (bundle: string): number =>
+    /\/WorkBuddy(?: AI)?\.app$/iu.test(bundle) ? 1 : 0;
+  const scored = [...bundles].map(([bundle, mtime]) => ({
+    bundle,
+    rank: canonical(bundle) * 1e12 + mtime,
+  }));
+  return scored.sort((left, right) => right.rank - left.rank).map((entry) => entry.bundle);
+}
+
 /** Resolve only within the selected installation; never search PATH or another installation. */
 export function resolveWorkBuddyInstallDirectory(
   directory: string,
@@ -61,21 +123,23 @@ export function resolveWorkBuddyBundle(
   platform: NodeJS.Platform,
   isExecutable: (candidate: string) => boolean,
   explicitExecutable?: string,
+  scan: MacWorkBuddyScanDependencies = {},
 ): { executable: string; cli: string } | undefined {
-  const specs: HarnessDiscoverySpec[] =
-    platform === "darwin"
-      ? [macSpec]
-      : platform === "win32"
-        ? ["WorkBuddy AI", "WorkBuddy", "WorkBuddyAI"].map((command) => ({
-            id: "workbuddy",
-            command,
-            installRoots: { windows: windowsRoots },
-          }))
-        : [];
   const paths = targetPath(platform);
   const candidates = explicitExecutable
     ? [{ candidate: explicitExecutable, source: "configured" as const }]
-    : specs.flatMap((spec) => harnessCandidates(spec, { environment, platform }));
+    : platform === "darwin"
+      ? [
+          ...specsFor(platform).flatMap((spec) =>
+            harnessCandidates(spec, { environment, platform }),
+          ),
+          // Renamed/staged app bundles (update migrations) that the fixed roots miss.
+          ...macWorkBuddyAppBundleDirectories(platform, scan).map((bundle) => ({
+            candidate: paths.join(bundle, "Contents", "MacOS", "Electron"),
+            source: "install-root" as const,
+          })),
+        ]
+      : specsFor(platform).flatMap((spec) => harnessCandidates(spec, { environment, platform }));
   for (const { candidate, source } of candidates) {
     // A random Electron on PATH is not WorkBuddy; Windows .cmd shims are not Electron runtimes.
     if (platform === "darwin" && source !== "install-root" && !explicitExecutable) continue;
@@ -90,3 +154,14 @@ export function resolveWorkBuddyBundle(
   }
   return undefined;
 }
+
+function specsFor(platform: NodeJS.Platform): HarnessDiscoverySpec[] {
+  if (platform === "darwin") return [macSpec];
+  if (platform === "win32")
+    return ["WorkBuddy AI", "WorkBuddy", "WorkBuddyAI"].map((command) => ({
+      id: "workbuddy",
+      command,
+      installRoots: { windows: windowsRoots },
+    }));
+  return [];
+}

packages/adapters/workbuddy/src/product-models.ts

@@ -1,6 +1,8 @@
-import { readFile, stat } from "node:fs/promises";
+import { readFile, lstat } from "node:fs/promises";
+import { homedir } from "node:os";
 import path from "node:path";
 import { modelRef } from "@codexhost/adapter-codebuddy";
+import { targetPath } from "@codexhost/harness-discovery";
 import type { HarnessModelCatalog } from "@codexhost/harness-adapter";
 import {
   HARNESS_MODEL_LABEL_MAX_LENGTH,
@@ -66,7 +68,7 @@ export function parseWorkBuddyProductModels(value: unknown): WorkBuddyProductMod
 }
 
 async function readProductJson(file: string): Promise<unknown | undefined> {
-  const metadata = await stat(file);
+  const metadata = await lstat(file);
   if (!metadata.isFile() || metadata.size <= 0 || metadata.size > MAX_PRODUCT_SNAPSHOT_BYTES)
     return;
   return JSON.parse(await readFile(file, "utf8"));
@@ -78,6 +80,45 @@ function bundledFallbackProductPath(invocation: ReturnType<typeof workBuddyInvoc
   return path.join(path.dirname(path.dirname(cli)), "product.json");
 }
 
+/**
+ * The desktop app caches its server product config (which carries the full
+ * model list including subscription models) under its own config root. When
+ * neither ACC_PRODUCT_CONFIG_PATH nor a bundled product.json exists, read that
+ * cache read-only so the CLI-side catalog matches the native app. Permission
+ * rules mirror command.ts bundledProductConfigPath: user-owned, non-world/group
+ * readable, no symlinks.
+ */
+export async function appCacheProductPath(
+  environment: NodeJS.ProcessEnv,
+  platform: NodeJS.Platform,
+): Promise<string | undefined> {
+  if (platform !== "darwin" && platform !== "win32") return;
+  const paths = targetPath(platform);
+  const home = environment.HOME || environment.USERPROFILE || homedir();
+  const root = paths.join(home, ".workbuddy");
+  const candidate = paths.join(root, "cache", "acc-product-config-v3.json");
+  try {
+    const uid = process.getuid?.();
+    for (const directory of [root, paths.dirname(candidate)]) {
+      const metadata = await lstat(directory);
+      if (!metadata.isDirectory() || metadata.isSymbolicLink()) return;
+      if (platform !== "win32") {
+        if ((metadata.mode & 0o022) !== 0) return;
+        if (uid !== undefined && metadata.uid !== uid) return;
+      }
+    }
+    const metadata = await lstat(candidate);
+    if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size <= 0) return;
+    if (platform !== "win32") {
+      if ((metadata.mode & 0o077) !== 0) return;
+      if (uid !== undefined && metadata.uid !== uid) return;
+    }
+    return candidate;
+  } catch {
+    return;
+  }
+}
+
 export async function loadWorkBuddyProductModels(
   environment: NodeJS.ProcessEnv,
 ): Promise<WorkBuddyProductModel[]> {
@@ -101,9 +142,18 @@ export async function loadWorkBuddyProductModels(
     }
   }
   const fallback = bundledFallbackProductPath(invocation);
-  if (!fallback) return [];
+  if (fallback) {
+    try {
+      const parsed = parseWorkBuddyProductModels(await readProductJson(fallback));
+      if (parsed.length > 0) return parsed;
+    } catch {
+      // Fall through to the app-side cache below.
+    }
+  }
+  const appCache = await appCacheProductPath(productEnvironment, process.platform);
+  if (!appCache) return [];
   try {
-    return parseWorkBuddyProductModels(await readProductJson(fallback));
+    return parseWorkBuddyProductModels(await readProductJson(appCache));
   } catch {
     return [];
   }

packages/adapters/workbuddy/src/workbuddy-adapter.ts

@@ -2,6 +2,7 @@ import {
   CodeBuddyAcpClient,
   CodeBuddyAdapter,
   type CodeBuddyAdapterOptions,
+  type CodeBuddyClient,
 } from "@codexhost/adapter-codebuddy";
 import type {
   HarnessInspection,
@@ -25,34 +26,57 @@ export type WorkBuddyAdapterOptions = Omit<
 > & {
   productModels?: () => Promise<readonly WorkBuddyProductModel[]>;
   platform?: NodeJS.Platform;
+  /** Seconds to wait for the user to finish a native browser/QR login before giving up. */
+  authenticationTimeoutMs?: number;
 };
 
+/** The WorkBuddy CLI advertises exactly these methods (WeChat, external, iOA, selfhosted). */
+const AUTHENTICATION_METHOD_ID = "internal";
+const DEFAULT_AUTHENTICATION_TIMEOUT_MS = 10 * 60_000;
+
+function isAuthenticationRequired(error: unknown): boolean {
+  // super.inspect() reports failures as plain HarnessError objects, not Error instances.
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    (error as { code?: unknown }).code === "authenticationRequired"
+  );
+}
+
 export class WorkBuddyAdapter extends CodeBuddyAdapter {
   readonly #productModels: () => Promise<readonly WorkBuddyProductModel[]>;
+  readonly #authenticationTimeoutMs: number;
+  #authentication: Promise<boolean> | undefined;
 
   constructor(options: WorkBuddyAdapterOptions = {}) {
-    const { productModels, platform = process.platform, ...codeBuddyOptions } = options;
+    const {
+      productModels,
+      authenticationTimeoutMs = DEFAULT_AUTHENTICATION_TIMEOUT_MS,
+      ...codeBuddyOptions
+    } = options;
     const environment = { ...(codeBuddyOptions.environment ?? process.env) };
-    const windowsProfile = {
-      ...WORKBUDDY_RUNTIME_PROFILE,
-      allowUnlistedModelSelection: true,
-    };
     super({
       ...codeBuddyOptions,
-      profile: platform === "win32" ? windowsProfile : WORKBUDDY_RUNTIME_PROFILE,
+      // Product-file Models stay selectable even when ACP omits them from option rows.
+      profile: { ...WORKBUDDY_RUNTIME_PROFILE, allowUnlistedModelSelection: true },
       invocationFactory: workBuddyInvocation,
       clientFactory:
         codeBuddyOptions.clientFactory ??
         ((clientOptions) => new CodeBuddyAcpClient(clientOptions, undefined, workBuddyInvocation)),
     });
-    this.#productModels =
-      platform === "win32"
-        ? (productModels ?? (() => loadWorkBuddyProductModels(environment)))
-        : async () => [];
+    this.#productModels = productModels ?? (() => loadWorkBuddyProductModels(environment));
+    this.#authenticationTimeoutMs = authenticationTimeoutMs;
   }
 
   override async inspect(input: InspectHarnessInput = {}): Promise<HarnessInspection> {
-    const inspection = await super.inspect(input);
+    let inspection = await super.inspect(input);
+    if (inspection.status === "unavailable" && isAuthenticationRequired(inspection.error)) {
+      // Requirement: an installed WorkBuddy must never strand the user on a manual
+      // login. A silent native authenticate (browser/QR) runs once per adapter,
+      // then inspection retries transparently; failure keeps the original result.
+      if (await this.#authenticateOnce(input))
+        inspection = await super.inspect({ ...input, refresh: true });
+    }
     if (inspection.status !== "ready") return inspection;
     const productModels = await this.#productModels().catch(() => []);
     if (productModels.length === 0) return inspection;
@@ -62,6 +86,49 @@ export class WorkBuddyAdapter extends CodeBuddyAdapter {
     });
   }
 
+  /** One in-flight native login per adapter; later callers await the same attempt. */
+  #authenticateOnce(input: InspectHarnessInput): Promise<boolean> {
+    const attempt = this.#authentication ?? this.#authenticate(input);
+    this.#authentication = attempt.finally(() => {
+      if (this.#authentication === attempt) this.#authentication = undefined;
+    });
+    return attempt;
+  }
+
+  async #authenticate(input: InspectHarnessInput): Promise<boolean> {
+    const cwd = input.cwd ?? process.cwd();
+    let client: CodeBuddyClient | undefined;
+    try {
+      client = this.#clientFactory()({
+        cwd,
+        environment: this.options.environment ?? process.env,
+        ephemeral: true,
+        handlers: {
+          update: () => {},
+          fault: () => {},
+          permission: async () => ({ outcome: { outcome: "cancelled" } }),
+          question: async () => ({ outcome: "cancelled" }),
+        },
+      });
+      await client.initialize();
+      if (!client.authenticate) return false;
+      await client.authenticate({ methodId: AUTHENTICATION_METHOD_ID });
+      return true;
+    } catch {
+      return false;
+    } finally {
+      await client?.close().catch(() => {});
+    }
+  }
+
+  /** The parent keeps its factory private; mirror its defaulting rules exactly. */
+  #clientFactory(): NonNullable<CodeBuddyAdapterOptions["clientFactory"]> {
+    return (
+      this.options.clientFactory ??
+      ((clientOptions) => new CodeBuddyAcpClient(clientOptions, undefined, workBuddyInvocation))
+    );
+  }
+
   override async open(input: OpenSessionInput): Promise<HarnessResult<HarnessSession>> {
     if (
       input.kind === "create" &&