cortico-world-workbuddy 0.1.7 → 0.3.4

package/SECURITY.md

@@ -11,34 +11,47 @@ judge the risk before installing.
 | `%LOCALAPPDATA%\CodeBuddyExtension\Data\Public\auth\workbuddy-desktop.info` | To learn your WorkBuddy login | `auth.accessToken`, `auth.refreshToken`, `auth.expiresAt`, `auth.domain`, `account` |
 | `%APPDATA%\WorkBuddy*\*.json` (if present) | Older WorkBuddy builds store the login here | same fields when stored in plain text |
 | `%LOCALAPPDATA%\CodeBuddyExtension\Data\Public\auth` (fallback) | Same as above, directory scan | same fields |
-| `C:\Program Files\WorkBuddy\WorkBuddy.exe` | Only to ask the app for its own at-rest key | the key payload printed by the app's own `loggerGet()` binding; never stored |
-| `<Coopanion data>\home\companion\config.json` | Read/write `worlds.workbuddy` | region, model id, `prefer` flag |
+| `WorkBuddy.exe` / `WorkBuddy AI.exe` (known install locations) | Only to ask the app for its own at-rest key | the key payload printed by the app's own `loggerGet()` binding; never stored |
+| `<Coopanion data>\home\companion\config.json` | Read `worlds.workbuddy` | model id, `envPrompt` / `safeOnly` flags |
 
 The token is decrypted in memory only when the file is encrypted, is used only as the
 `Authorization: Bearer` header for WorkBuddy's own endpoints, and is never written anywhere except
 the Coopanion deployment `.env` if you paste one in the account panel yourself (the framework's
-`storeSecret`).
+`storeSecret`). Refresh tokens are never sent with chat requests.
 
 ## Where data goes
 
-Only two hosts, both WorkBuddy's:
+By default, only these two hosts, both WorkBuddy's:
 
-- `https://copilot.tencent.com` — model catalogue and chat completions (region `cn`)
-- `https://www.codebuddy.cn` — credit balance (region `cn`)
-- `https://www.workbuddy.ai` — catalogue, chat, credits (region `global`)
+- `https://copilot.tencent.com` — model catalogue and chat completions
+- `https://www.codebuddy.cn` — credit balance
 
-Nothing else. No logs contain tokens: every log line goes through `maskToken()`.
+If you set `worlds.workbuddy.baseUrl` (a proxy or mirror), **every** request — catalogue,
+chat and credit balance — goes to that host instead, and the token is sent there too. That is
+your own configuration choice, not a default. No other hosts are contacted. No logs contain
+tokens: every log line goes through `maskToken()`.
 
 ## What it writes
 
-- `<Coopanion data>/worlds/workbuddy/workbuddy-catalog.json` — cached model list, no credentials.
-- `worlds.workbuddy.*` in the companion config (region, model, `prefer`, `envPrompt`).
-- **Host files, only when the start-page button is injected:** `resources/app/build/console/index.html`
-  (one extra `<script>` line before the app bundle) and `resources/app/build/console/workbuddy-home.js`.
-  The original `index.html` is kept as `index.html.workbuddy-backup` next to it.
-  Undo with `node scripts/host-inject.mjs --restore`, or delete `workbuddy-home.js` and the
-  one-line reference by hand. A Coopanion update that replaces `build/console` simply removes the
-  injection; the extension puts it back on the next start.
+- `<Coopanion data>/home/companion/data/workbuddy-catalog.json` — cached model list, no credentials.
+- `<Coopanion data>/home/companion/data/workbuddy-usage.jsonl` and `workbuddy-balance.json` — local
+  usage ledger and credit snapshot, no tokens.
+- `worlds.workbuddy.*` in the companion config (model, `envPrompt`, `safeOnly`).
+- The deployment `.env` — only when you paste a token or clear it in the Account panel
+  (the sentinels `wb-cleared` / `wb-auto` are written there; a real token only if you pasted one).
+
+**Coopanion program files are never touched by the running extension.** Since 0.3.0 it does not
+inject anything into `resources/app/build/console` and keeps no backup of host files. Coopanion's
+own uninstall route removes only the package; it does not run extension cleanup code. After
+uninstalling, run `node scripts/clean-workbuddy.mjs --check`, then `--clean`, from the source tree.
+That explicit command removes only the `worlds.workbuddy` config block, the three data files above,
+and the `accessToken` line in `.env`; it preserves every other setting and secret and never prints
+the token. Ordinary `stop()` and restart never delete usage data.
+
+If you upgraded from 0.2.x, an old one-line `<script>` reference, `workbuddy-home.js` and
+`index.html.workbuddy-backup` may still be left over from that older version. Remove them once with
+`node scripts/clean-legacy-injection.mjs --clean` (`--check` lists what it would touch). Neither
+cleanup script runs automatically, and the extension never re-adds the injection.
 
 ## Reporting a vulnerability
 

package/describe.json

@@ -23,10 +23,10 @@
     },
     {
       "name": "wb_select_model",
-      "description": "Select which WorkBuddy model wb_chat should use by default. The id must come from wb_list_models. Refused when worlds.workbuddy.safeOnly is on and the model is outside the safe list. Persists across restarts.",
+      "description": "Select which WorkBuddy model wb_chat should use by default. The id must come from wb_list_models. Persists across restarts.",
       "summary": {
-        "zh": "选择 wb_chat 默认调用的 WorkBuddy 模型。",
-        "en": "Selects the default WorkBuddy model for wb_chat."
+        "zh": "选择 wb_chat 默认使用的 WorkBuddy 模型，选择会持久保存。",
+        "en": "Selects the default WorkBuddy model for wb_chat; the choice persists across restarts."
       },
       "tags": [
         "write"
@@ -47,10 +47,10 @@
     },
     {
       "name": "wb_chat",
-      "description": "Ask the selected WorkBuddy model a single-turn question and return its answer. Requires the WorkBuddy desktop app to be running; otherwise the call fails with a not-detected message. This spends the user's own WorkBuddy credits at the model's multiplier; keep prompts concise. Use the model parameter only to override the selected model for one call.",
+      "description": "Ask the selected WorkBuddy model a single-turn question and return its answer. This spends the user's own WorkBuddy credits at the model's multiplier; keep prompts concise. Use the model parameter only to override the selected model for one call. Requires the WorkBuddy desktop app to be running.",
       "summary": {
-        "zh": "用选中的 WorkBuddy 模型回答一个单轮问题（消耗本人账号积分）。",
-        "en": "Asks the selected WorkBuddy model a single-turn question (spends your own credits)."
+        "zh": "向当前选中的 WorkBuddy 模型发一句单轮提问并取回答，会消耗用户自己的 WorkBuddy 积分。",
+        "en": "Asks the selected WorkBuddy model a single-turn question; spends the user's own WorkBuddy credits."
       },
       "tags": [
         "write"
@@ -81,8 +81,8 @@
       "name": "wb_credits",
       "description": "Show the remaining WorkBuddy credit balance of the signed-in account (read-only). Requires the WorkBuddy desktop app to be running.",
       "summary": {
-        "zh": "只读查询当前账号的 WorkBuddy 积分余额。",
-        "en": "Read-only check of the WorkBuddy credit balance."
+        "zh": "读取当前 WorkBuddy 账号的剩余积分与各积分包的已用/剩余（只读）。",
+        "en": "Shows remaining WorkBuddy credits and per-package usage (read-only)."
       },
       "tags": [
         "read"
@@ -103,5 +103,5 @@
       }
     }
   ],
-  "envPrompt": "## WorkBuddy bridge\n\nThis machine has a WorkBuddy desktop sign-in bridged in (region: {{workbuddy.region}}; signed in: {{workbuddy.authed}}).\nThe model catalog holds {{workbuddy.catalogSize}} models. The currently selected model is `{{workbuddy.model}}` with default credit multiplier {{workbuddy.multiplier}}.\nWorkBuddy desktop main process: {{workbuddy.process}}. Relay-first switch: {{workbuddy.priority}}.\nSpent today through the bridge: {{workbuddy.todayCredit}} credits / {{workbuddy.todayTokens}} tokens (locally recorded).\nThe multiplier above already includes any time-limited discount or free window that is active right now; `wb_list_models` also marks which offers are active and their hours.\n\n- Use `wb_list_models` to see every model with its multiplier before choosing; prefer low-multiplier models for casual tasks.\n- Safe-list gate: {{workbuddy.safeOnly}}. When it is `on`, only the models WorkBuddy publishes as public chat models are callable — `disabled` entries, internal routing aliases (`auto`, `fast-model`, `balanced-model`, `deep-model`), media/code models and delisted ones are refused. Do not try to work around a refusal; tell the user why and offer a safe model instead. `wb_list_models` with `all=true` shows the refused ones with reasons.\n- Use `wb_select_model` when the user asks to switch the WorkBuddy model.\n- `wb_chat` only works while the WorkBuddy desktop main process is running; otherwise it returns「未检测到 WorkBuddy 主进程」. Every call spends the user's own credits at that model's multiplier.\n- `wb_credits` is read-only and costs nothing (also requires the desktop process).\n\n### Relay first: {{workbuddy.priority}}\n\n- Switch `on` **and** process `running`: every user turn that expects a conversational answer (question, chat, writing, reasoning, rewrite, translation, summary) must be answered by a WorkBuddy model first — call `wb_chat` (omit `model` to use `{{workbuddy.model}}`), then speak the returned answer back in your own voice and name the model that answered. Only fall back to your own model if the call fails.\n- Switch `off` (default): do not call `wb_chat`; answer with your own model. If the user explicitly asks for WorkBuddy, `wb_chat` is still allowed — the desktop process must be running.\n- Tool errors and empty answers are not a reason to flip the switch; just say what happened.\n"
+  "envPrompt": "## WorkBuddy bridge\n\nThis machine has a signed-in WorkBuddy desktop app bridged in (signed in: {{workbuddy.authed}}).\nThe model catalog holds {{workbuddy.catalogSize}} models. The currently selected model is `{{workbuddy.model}}` with default credit multiplier {{workbuddy.multiplier}}.\nWorkBuddy desktop main process: {{workbuddy.process}}.\nSpent today through the bridge: {{workbuddy.todayCredit}} credits / {{workbuddy.todayTokens}} tokens (locally recorded).\nThe multiplier above is the model's own price plus any time-limited price change this bridge can verify at the moment (including free windows). An offer that only shows a badge may not change the price; `wb_list_models` marks which offers are active and their hours.\n\n- Use `wb_list_models` to see every model with its multiplier before choosing; prefer low-multiplier models for casual tasks.\n- Safe-list gate: {{workbuddy.safeOnly}}. When it is `on`, only the models WorkBuddy publishes as public chat models are callable — `disabled` entries, internal routing aliases (`auto`, `fast-model`, `balanced-model`, `deep-model`), media/code models and delisted ones are refused. Do not try to work around a refusal; tell the user why and offer a safe model instead. `wb_list_models` with `all=true` shows the refused ones with reasons.\n- Use `wb_select_model` when the user asks to switch the WorkBuddy model.\n- `wb_chat` only works while the WorkBuddy desktop main process is running; otherwise it returns「未检测到 WorkBuddy 主进程」. Every call spends the user's own credits at that model's multiplier. Call it when the user asks for WorkBuddy or when a WorkBuddy model would clearly help; do not route every turn through it.\n- `wb_credits` is read-only and costs nothing (also requires the desktop process)."
 }

package/dist/webui.js

@@ -21,7 +21,6 @@ var TEXT = {
     source: "\u6765\u6E90",
     token: "Token\uFF08\u63A9\u7801\uFF09",
     account: "\u8D26\u53F7",
-    region: "\u533A\u57DF",
     upstream: "\u4E0A\u6E38",
     rediscover: "\u91CD\u65B0\u68C0\u6D4B\u672C\u673A\u767B\u5F55",
     pasteToken: "\u624B\u52A8\u7C98\u8D34 access token",
@@ -34,34 +33,25 @@ var TEXT = {
     lastError: "\u6700\u8FD1\u9519\u8BEF",
     models: "\u4E2A\u6A21\u578B",
     currentModel: "\u5F53\u524D\u6A21\u578B",
-    priorityTitle: "\u4E2D\u8F6C\u7AD9\u4F18\u5148",
-    priorityLabel: "\u662F\u5426\u542F\u7528Workbuddy",
-    priorityDesc: "\u4E0E\u300C\u5F00\u59CB\u300D\u9875\u7684\u300C\u4E2D\u8F6C\u7AD9\u4F18\u5148\u300D\u6309\u94AE\u662F\u540C\u4E00\u4EFD\u72B6\u6001\uFF1A\u6253\u5F00\u540E\u684C\u5BA0\u6BCF\u8F6E\u5BF9\u8BDD\u4F18\u5148\u8C03\u7528 WorkBuddy \u7684\u6A21\u578B\uFF0C\u5173\u95ED\u5219\u5B8C\u5168\u8DF3\u8FC7 WorkBuddy\u3002\u9700\u8981 WorkBuddy \u684C\u9762\u7AEF\u4E3B\u8FDB\u7A0B\u5728\u8FD0\u884C\u3002",
     procRunning: "WorkBuddy \u4E3B\u8FDB\u7A0B\uFF1A\u8FD0\u884C\u4E2D",
     procStopped: "WorkBuddy \u4E3B\u8FDB\u7A0B\uFF1A\u672A\u68C0\u6D4B\u5230",
-    noProcess: "\u672A\u68C0\u6D4B\u5230Workbuddy",
-    enabledOn: "\u5DF2\u5F00\u542F\uFF1A\u684C\u5BA0\u4F18\u5148\u8D70 WorkBuddy \u6A21\u578B",
-    enabledOff: "\u5DF2\u5173\u95ED\uFF1A\u684C\u5BA0\u8DF3\u8FC7 WorkBuddy",
-    hostOk: "\u5F00\u59CB\u9875\u6309\u94AE\uFF1A\u5DF2\u6CE8\u5165",
-    hostBroken: "\u5F00\u59CB\u9875\u6309\u94AE\uFF1A\u672A\u6CE8\u5165\uFF08\u5BBF\u4E3B\u5347\u7EA7\u53EF\u80FD\u8986\u76D6\u4E86\u63A7\u5236\u53F0\u6587\u4EF6\uFF09",
-    hostUnknown: "\u5F00\u59CB\u9875\u6309\u94AE\uFF1A\u72B6\u6001\u672A\u77E5",
-    repair: "\u91CD\u65B0\u6CE8\u5165\u5F00\u59CB\u9875\u6309\u94AE",
-    repairing: "\u6B63\u5728\u91CD\u65B0\u6CE8\u5165\u2026",
-    repaired: "\u5DF2\u4FEE\u590D\uFF0C\u91CD\u65B0\u6253\u5F00\u63A7\u5236\u53F0\u5373\u53EF\u770B\u5230\u6309\u94AE",
-    repairFail: "\u4FEE\u590D\u5931\u8D25",
-    usageTitle: "\u7528\u91CF",
-    usageDesc: "\u672C\u673A\u8BB0\u8D26\u7684\u8C03\u7528\u7528\u91CF\u4E0E WorkBuddy \u79EF\u5206\u5305\u4F59\u989D\u3002\u79EF\u5206\u53D6\u4E0A\u6E38\u6BCF\u6B21\u8C03\u7528\u56DE\u4F20\u7684\u771F\u5B9E\u6263\u8D39\uFF08\u53EF\u80FD\u4E3A 0\uFF09\uFF0C\u500D\u7387\u6309\u76EE\u5F55 + \u9650\u65F6\u4F18\u60E0\u5B9E\u65F6\u8BA1\u7B97\u3002",
+    usageTitle: "\u7528\u91CF\u4E0E\u6210\u672C",
+    usageDesc: "\u7ECF\u7531 WorkBuddy \u6D88\u8017\u7684 token \u4E0E\u79EF\u5206\uFF08\u672C\u5730\u8BB0\u8D26\uFF09\uFF1A\u79EF\u5206\u53D6\u4E0A\u6E38\u6BCF\u6B21\u8C03\u7528\u56DE\u4F20\u7684\u771F\u5B9E\u6263\u8D39\uFF08\u53EF\u80FD\u4E3A 0\uFF09\uFF0Ctoken \u53D6\u540C\u4E00\u6BB5 SSE \u7684 usage\uFF1B\u500D\u7387\u6309\u76EE\u5F55 + \u9650\u65F6\u4F18\u60E0\u5B9E\u65F6\u8BA1\u7B97\u3002",
     usageRefresh: "\u5237\u65B0\u4F59\u989D",
     usageClear: "\u6E05\u7A7A\u672C\u5730\u8D26\u672C",
     usageCleared: "\u672C\u5730\u8D26\u672C\u5DF2\u6E05\u7A7A",
     metricCalls: "\u8C03\u7528",
+    metricFailed: "\u5931\u8D25",
     metricCredit: "\u79EF\u5206",
     metricInput: "\u8F93\u5165 tok",
     metricOutput: "\u8F93\u51FA tok",
+    metricCached: "\u7F13\u5B58\u547D\u4E2D",
+    metricTotal: "\u5171 tok",
     spanToday: "\u4ECA\u5929",
     spanWeek: "\u8FD1 7 \u5929",
     spanMonth: "\u8FD1 30 \u5929",
-    byModel: "\u6309\u6A21\u578B",
+    spanAll: "\u5168\u90E8",
+    byModel: "\u6309\u6A21\u578B\uFF08\u8FD1 30 \u5929\uFF09",
     balanceTitle: "\u79EF\u5206\u5305\u4F59\u989D",
     colPkgName: "\u79EF\u5206\u5305",
     colPkgRemain: "\u5269\u4F59",
@@ -107,7 +97,6 @@ var TEXT = {
     source: "Source",
     token: "Token (masked)",
     account: "Account",
-    region: "Region",
     upstream: "Upstream",
     rediscover: "Re-detect local sign-in",
     pasteToken: "Paste an access token manually",
@@ -120,34 +109,25 @@ var TEXT = {
     lastError: "Last error",
     models: "models",
     currentModel: "Current model",
-    priorityTitle: "Relay first",
-    priorityLabel: "Enable Workbuddy",
-    priorityDesc: "Same state as the \u201CRelay first\u201D button on the Home page: when on, the pet asks a WorkBuddy model first every turn; when off, WorkBuddy is skipped entirely. Requires the WorkBuddy desktop main process.",
     procRunning: "WorkBuddy process: running",
     procStopped: "WorkBuddy process: not detected",
-    noProcess: "Workbuddy not detected",
-    enabledOn: "On: the pet asks WorkBuddy first",
-    enabledOff: "Off: the pet skips WorkBuddy",
-    hostOk: "Home button: injected",
-    hostBroken: "Home button: not injected (a host update may have replaced the console files)",
-    hostUnknown: "Home button: unknown",
-    repair: "Re-inject the home button",
-    repairing: "Re-injecting\u2026",
-    repaired: "Fixed. Reopen the console to see the button",
-    repairFail: "Repair failed",
-    usageTitle: "Usage",
-    usageDesc: "Locally recorded call usage plus the WorkBuddy credit balance. Credits come from the per-call figure the upstream returns (may be 0); multipliers combine the catalog with time-limited offers in real time.",
+    usageTitle: "Usage & cost",
+    usageDesc: "Tokens and credits spent through WorkBuddy (locally recorded): credits are the per-call figure the upstream returns (may be 0), tokens come from the same SSE usage block; multipliers combine the catalog with time-limited offers in real time.",
     usageRefresh: "Refresh balance",
     usageClear: "Clear local ledger",
     usageCleared: "Local ledger cleared",
     metricCalls: "Calls",
+    metricFailed: "Failed",
     metricCredit: "Credits",
     metricInput: "Input tok",
     metricOutput: "Output tok",
+    metricCached: "Cached",
+    metricTotal: "Total tok",
     spanToday: "Today",
     spanWeek: "Last 7 days",
     spanMonth: "Last 30 days",
-    byModel: "By model",
+    spanAll: "All",
+    byModel: "By model (last 30 days)",
     balanceTitle: "Credit packages",
     colPkgName: "Package",
     colPkgRemain: "Remaining",
@@ -210,9 +190,10 @@ function mountModels(ctx) {
   const head = ui.rowbar();
   const refreshBtn = ui.button(s.refresh, { variant: "primary" });
   const stateChip = ui.chip("", "plain");
+  const procChip = ui.chip("", "plain");
   const currentChip = ui.chip("", "accent");
   const allBox = ui.checkbox(s.showAllModels, { checked: false });
-  head.append(refreshBtn, stateChip, currentChip, allBox.el);
+  head.append(refreshBtn, stateChip, procChip, currentChip, allBox.el);
   sheet.body.append(head);
   const errLine = ui.msgline();
   sheet.body.append(errLine);
@@ -227,6 +208,7 @@ function mountModels(ctx) {
     const safeCount = models.filter((m) => m.safety?.allow).length;
     stateChip.textContent = `${s.lastRefresh}: ${fmtTs(state?.catalogAt, s)} \xB7 ${safeCount}/${models.length} ${s.models} \xB7 ${state?.safeOnly === false ? s.safeOnlyOff : s.safeOnlyOn}`;
     currentChip.textContent = `${s.currentModel}: ${state?.model || "\u2014"}`;
+    procChip.textContent = state?.running ? s.procRunning : s.procStopped;
   }
   function pickable(m) {
     if (state?.safeOnly === false) return true;
@@ -366,7 +348,6 @@ function mountAccount(ctx) {
       { k: s.source, v: state?.tokenSource ?? "\u2014" },
       { k: s.token, v: state?.tokenMask ?? "\u2014" },
       { k: s.account, v: state?.account?.name ?? "\u2014" },
-      { k: s.region, v: state?.region ?? "\u2014" },
       { k: s.upstream, v: state?.baseUrl ?? "\u2014" }
     ];
     if (state?.lastError) rows.push({ k: s.lastError, v: state.lastError });
@@ -429,83 +410,14 @@ function mountAccount(ctx) {
     errLine.textContent = String(err?.message ?? err);
   });
 }
-function mountPriority(ctx) {
-  const s = strings(ctx);
-  const { ui } = ctx;
-  const sheet = ui.sheet({ title: s.priorityTitle, desc: s.priorityDesc });
-  ctx.root.append(sheet.el);
-  const statusLine = ui.msgline();
-  const hostLine = ui.msgline();
-  const hostBar = ui.actions();
-  const repairBtn = ui.button(s.repair, {
-    size: "sm",
-    variant: "plain",
-    onClick: async () => {
-      repairBtn.disabled = true;
-      hostLine.textContent = s.repairing;
-      try {
-        const r = await ctx.invoke("repair");
-        hostLine.textContent = r?.ok ? s.repaired : `${s.repairFail}\uFF1A${r?.error ?? r?.hostUi?.reason ?? ""}`;
-        ui.toast(r?.ok ? s.repaired : s.repairFail, r?.ok ? "ok" : "bad");
-        await load();
-      } catch (err) {
-        hostLine.textContent = `${s.repairFail}\uFF1A${String(err?.message ?? err)}`;
-        ui.toast(s.repairFail, "bad");
-      } finally {
-        repairBtn.disabled = false;
-      }
-    }
-  });
-  hostBar.append(repairBtn);
-  function apply(r) {
-    if (!r) return;
-    box.setChecked(r.prefer === true);
-    statusLine.textContent = r.running ? s.procRunning : s.procStopped;
-    const host = r.hostUi;
-    if (!host) {
-      hostLine.textContent = s.hostUnknown;
-      hostBar.style.display = "none";
-      return;
-    }
-    hostLine.textContent = host.ok ? s.hostOk : `${s.hostBroken}\uFF08${host.label ?? host.reason}\uFF09`;
-    hostBar.style.display = host.ok ? "none" : "";
-  }
-  const box = ui.checkbox(s.priorityLabel, {
-    checked: false,
-    title: s.priorityDesc,
-    onChange: async (checked) => {
-      try {
-        const r = await ctx.invoke("set", [checked]);
-        if (r?.ok) {
-          apply(r);
-          ui.toast(checked ? s.enabledOn : s.enabledOff);
-        } else {
-          apply(r);
-          box.setChecked(false);
-          ui.toast(r?.error ?? s.noProcess, "bad");
-        }
-      } catch (err) {
-        box.setChecked(false);
-        ui.toast(String(err?.message ?? err), "bad");
-      }
-    }
-  });
-  sheet.body.append(box.el, statusLine, hostLine, hostBar);
-  async function load() {
-    apply(await ctx.invoke("state"));
-  }
-  ctx.stream({
-    message: () => load().catch(() => {
-    })
-  });
-  load().catch((err) => {
-    statusLine.textContent = String(err?.message ?? err);
-  });
-}
 function fmtNum(n) {
   if (typeof n !== "number" || !Number.isFinite(n)) return "\u2014";
   return String(Math.round(n * 100) / 100);
 }
+function fmtCredit(bucket) {
+  const known = fmtNum(bucket?.credit);
+  return (bucket?.creditUnknown ?? 0) > 0 ? `${known} + ?` : known;
+}
 function mountUsage(ctx) {
   const s = strings(ctx);
   const { ui } = ctx;
@@ -521,13 +433,22 @@ function mountUsage(ctx) {
   const errLine = ui.msgline();
   sheet.body.append(errLine);
   const overview = ui.table({
-    head: ["", s.metricCalls, s.metricCredit, s.metricInput, s.metricOutput],
+    head: [
+      "",
+      s.metricCalls,
+      s.metricFailed,
+      s.metricCredit,
+      s.metricInput,
+      s.metricOutput,
+      s.metricCached,
+      s.metricTotal
+    ],
     maxHeight: "220px"
   });
   sheet.body.append(overview.el);
   const modelSection = ui.section(s.byModel);
   const modelTable = ui.table({
-    head: [s.colModel, s.metricCalls, s.metricCredit, s.metricInput, s.metricOutput],
+    head: [s.colModel, s.metricCalls, s.metricFailed, s.metricCredit, s.metricInput, s.metricOutput, s.metricTotal],
     maxHeight: "260px"
   });
   modelSection.append(modelTable.el);
@@ -553,21 +474,43 @@ function mountUsage(ctx) {
   let state = null;
   function spanRow(label, bucket) {
     const b = bucket ?? {};
-    return [label, String(b.calls ?? 0), fmtNum(b.credit), fmtNum(b.prompt), fmtNum(b.completion)];
+    return [
+      label,
+      String(b.calls ?? 0),
+      String(b.failed ?? 0),
+      fmtCredit(b),
+      fmtNum(b.prompt),
+      fmtNum(b.completion),
+      fmtNum(b.cached),
+      fmtNum(b.total)
+    ];
   }
   function render() {
     const totals = state?.summary?.totals ?? {};
-    todayChip.textContent = `${s.todayCredit}: ${fmtNum(totals.today?.credit)} \xB7 ${s.todayTokens}: ${fmtNum(
+    todayChip.textContent = `${s.todayCredit}: ${fmtCredit(totals.today)} \xB7 ${s.todayTokens}: ${fmtNum(
       (totals.today?.prompt ?? 0) + (totals.today?.completion ?? 0)
     )}`;
     balanceChip.textContent = `${s.balanceTitle}: ${fmtNum(state?.balance?.total)}`;
-    const spans = [spanRow(s.spanToday, totals.today), spanRow(s.spanWeek, totals.week), spanRow(s.spanMonth, totals.month)];
+    const spans = [
+      spanRow(s.spanToday, totals.today),
+      spanRow(s.spanWeek, totals.week),
+      spanRow(s.spanMonth, totals.month),
+      spanRow(s.spanAll, totals.all)
+    ];
     overview.clear();
     for (const row of spans) overview.addRow(row);
     const byModel = state?.summary?.byModel ?? [];
     modelTable.clear(byModel.length > 0 ? void 0 : s.noData);
     for (const m of byModel) {
-      modelTable.addRow([m.model, String(m.calls ?? 0), fmtNum(m.credit), fmtNum(m.prompt), fmtNum(m.completion)]);
+      modelTable.addRow([
+        m.model,
+        String(m.calls ?? 0),
+        String(m.failed ?? 0),
+        fmtCredit(m),
+        fmtNum(m.prompt),
+        fmtNum(m.completion),
+        fmtNum(m.total)
+      ]);
     }
     const packages = state?.balance?.packages ?? [];
     pkgTable.clear(packages.length > 0 ? void 0 : s.noData);
@@ -612,7 +555,9 @@ function mountUsage(ctx) {
       recentTable.addRow([
         when,
         r.model ?? "\u2014",
-        fmtNum(r.totalTokens ?? (r.promptTokens ?? 0) + (r.completionTokens ?? 0)),
+        // 账本里的字段名就是 total/prompt/completion（不是 totalTokens），
+        // 以前这里恒读出 0，最近调用表的 token 列一直是 0。
+        fmtNum(r.total ?? (r.prompt ?? 0) + (r.completion ?? 0)),
         r.ok === false ? "\u2014" : fmtNum(r.credit),
         typeof r.durationMs === "number" ? `${r.durationMs} ms` : "\u2014"
       ]);
@@ -662,7 +607,6 @@ var client_default = {
   panels: {
     models: { mount: mountModels },
     account: { mount: mountAccount },
-    priority: { mount: mountPriority },
     usage: { mount: mountUsage }
   }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortico-world-workbuddy",
-  "version": "0.1.7",
+  "version": "0.3.4",
   "type": "module",
   "description": "把 Windows 端已登录的 WorkBuddy 客户端模型桥接进 Coopanion：读取本机登录态，列出模型目录与默认积分倍率，供 Coo 调用。",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "locales": {
       "zh": {
         "displayName": "WorkBuddy 桥接",
-        "description": "把本机已登录的 WorkBuddy 客户端（国内版 / 国际版）模型接入 Coopanion，面板中可选模型并显示其默认积分倍率。"
+        "description": "把本机已登录的 WorkBuddy 客户端模型接入 Coopanion，面板中可选模型并显示其默认积分倍率。"
       },
       "en": {
         "displayName": "WorkBuddy Bridge",
@@ -49,16 +49,17 @@
     "CHANGELOG.md",
     "describe.json",
     "scripts",
+    "!scripts/visual",
     "LICENSE",
-    "SECURITY.md",
-    "ENV_PROMPT.md"
+    "SECURITY.md"
   ],
   "scripts": {
-    "build:web": "esbuild src/webui/client.js --bundle --format=esm --outfile=dist/webui.js",
+    "build:web": "node scripts/build-web.mjs",
     "selfcheck": "node scripts/selfcheck.mjs",
-    "host-inject": "node scripts/host-inject.mjs",
     "verify": "node scripts/verify-ui.mjs --runs 3",
-    "prepack": "npm run build:web"
+    "prepack": "node scripts/build-web.mjs --strict",
+    "gen:describe": "node scripts/gen-describe.mjs",
+    "contract": "node scripts/contract.mjs"
   },
   "author": {
     "name": "大肥鱼 (aechoa215)",
@@ -77,6 +78,6 @@
     "win32"
   ],
   "devDependencies": {
-    "esbuild": "^0.24.2"
+    "esbuild": "0.28.2"
   }
 }

package/scripts/build-web.mjs

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+/**
+ * 重建 `dist/webui.js`（面板产物）。
+ *
+ * 为什么不用 `esbuild` 直接当 script：`prepack` 会在别人机器上跑，
+ * 那里可能没有 `npm install` 过（没有 node_modules/esbuild），直接调 `esbuild` 会
+ * `'esbuild' is not recognized`，整条 `npm pack` 就失败了。
+ *
+ * 解析顺序：
+ *   1. 本包的 devDependency（`node_modules/esbuild`，版本由 lock 固定，CI 用这个）；
+ *   2. 宿主 Coopanion 自带的那份（`--config.strict-dep-builds` 之外的本机兜底）；
+ *   3. 都没有：`dist/webui.js` 已存在就警告并退出 0（产物已随包提交），否则报错。
+ *
+ * `--strict`：找不到 esbuild 时**不允许**沿用旧产物（返回 1）。
+ * `prepack` 走 strict —— 否则没装依赖的机器会静默把过期 dist 发布出去（审查报告第 6 条）。
+ *
+ * 用法：node scripts/build-web.mjs [--verbose] [--strict]
+ */
+
+import { existsSync, mkdirSync, readFileSync as readTextSync, statSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const pkgDir = fileURLToPath(new URL('..', import.meta.url));
+const verbose = process.argv.includes('--verbose');
+const strict = process.argv.includes('--strict');
+const entry = join(pkgDir, 'src', 'webui', 'client.js');
+const outfile = join(pkgDir, 'dist', 'webui.js');
+const args = [entry, '--bundle', '--format=esm', `--outfile=${outfile}`, '--log-level=warning'];
+
+/**
+ * 宿主 Coopanion 的 app 目录（只用来兜底取它自带的 esbuild）。
+ * 按「存在 build/console/index.html」判定，探测失败返回空串。
+ */
+function hostAppRoot() {
+  const local = process.env.LOCALAPPDATA || '';
+  const candidates = [
+    local && join(local, 'Programs', 'Coopanion', 'resources', 'app'),
+    process.env.ProgramFiles && join(process.env.ProgramFiles, 'Coopanion', 'resources', 'app'),
+    process.env['ProgramFiles(x86)'] && join(process.env['ProgramFiles(x86)'], 'Coopanion', 'resources', 'app'),
+  ].filter(Boolean);
+  return candidates.find((dir) => existsSync(join(dir, 'build', 'console', 'index.html'))) ?? '';
+}
+
+/** 找到可用的 esbuild 启动脚本（bin/esbuild 是 JS 包装，用 node 跑）。 */
+function resolveEsbuild() {
+  const require = createRequire(import.meta.url);
+  const candidates = [];
+  try {
+    candidates.push(require.resolve('esbuild/bin/esbuild'));
+  } catch {
+    /* 本地没装 devDependencies，走宿主兜底 */
+  }
+  const appRoot = process.env.COOPANION_APP_ROOT || hostAppRoot();
+  if (appRoot) candidates.push(join(appRoot, 'node_modules', 'esbuild', 'bin', 'esbuild'));
+
+  for (const bin of candidates) {
+    if (!existsSync(bin)) continue;
+    // 版本号在同一目录的 package.json 里
+    let version = 'unknown';
+    try {
+      version = JSON.parse(readTextSync(join(dirname(bin), '..', 'package.json'), 'utf8')).version;
+    } catch {
+      /* 版本读不到不影响构建 */
+    }
+    return { bin, version };
+  }
+  return null;
+}
+
+const found = resolveEsbuild();
+if (!found) {
+  console.error('✗ 找不到 esbuild（本地 devDependencies 与宿主都没装）。');
+  console.error('  先跑一次 `npm ci`（有 lockfile，锁的是 devDependency 的 esbuild）再重试。');
+  if (!existsSync(outfile)) process.exit(1);
+  if (strict) {
+    console.error('✗ --strict：拒绝沿用已有的 dist/webui.js（可能是过期产物）。');
+    process.exit(1);
+  }
+  console.warn('! 非 strict 模式：沿用已有的 dist/webui.js（本地开发可以，发布不行）。');
+  process.exit(0);
+}
+
+if (verbose) console.log(`· esbuild ${found.version}：${found.bin}`);
+mkdirSync(join(pkgDir, 'dist'), { recursive: true });
+const result = spawnSync(process.execPath, [found.bin, ...args], { cwd: pkgDir, encoding: 'utf8' });
+if (result.stdout) process.stdout.write(result.stdout);
+if (result.stderr) process.stderr.write(result.stderr);
+if (result.status !== 0) {
+  console.error(`✗ esbuild 失败（退出码 ${result.status}）`);
+  process.exit(1);
+}
+
+const size = statSync(outfile).size;
+console.log(`✓ dist/webui.js 已重建（esbuild ${found.version}，${size} 字节）`);

package/scripts/clean-legacy-injection.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/**
+ * 一次性迁移工具：清理 0.2.x 主页注入留在宿主 `build/console` 里的三样东西。
+ *
+ * 0.3.0 起扩展本体**不再改写宿主任何文件**，所以这个脚本不由扩展自动执行：
+ * 装过 0.2.x 的用户主动跑一次即可。它只删本扩展自己留下的东西：
+ *   - `index.html` 里引用 `workbuddy-home.js` 的那一行 `<script>`
+ *   - `workbuddy-home.js`
+ *   - `index.html.workbuddy-backup`
+ * 绝不用备份覆盖 `index.html`（避免把宿主升级过的文件降级），也不碰其余内容。
+ *
+ * 用法：
+ *   node scripts/clean-legacy-injection.mjs --check   # 只列出会动的项，不改文件
+ *   node scripts/clean-legacy-injection.mjs --clean   # 执行清理（幂等）
+ *   COOPANION_APP_ROOT=<...>/resources/app            # 显式指定宿主位置
+ */
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { findAppRoot } from './lib/app-root.mjs';
+
+const pkgDir = fileURLToPath(new URL('..', import.meta.url));
+const checkOnly = process.argv.includes('--check');
+const doClean = process.argv.includes('--clean');
+if (checkOnly === doClean) {
+  console.error('用法：node scripts/clean-legacy-injection.mjs --check | --clean（二选一）');
+  process.exit(2);
+}
+
+const appRoot = process.env.COOPANION_APP_ROOT || findAppRoot({ packageDir: pkgDir });
+if (!appRoot) {
+  console.error('✗ 找不到 Coopanion 的 resources/app（可设 COOPANION_APP_ROOT 指定）');
+  process.exit(2);
+}
+const consoleDir = join(appRoot, 'build', 'console');
+const htmlPath = join(consoleDir, 'index.html');
+if (!existsSync(htmlPath)) {
+  console.error(`✗ 找不到 ${htmlPath}`);
+  process.exit(2);
+}
+
+/** 只认「引用了 workbuddy-home.js 的 script 行」，其他一行都不动。 */
+const INJECT_LINE = /<script[^>]*workbuddy-home\.js/i;
+
+const text = readFileSync(htmlPath, 'utf8');
+const newline = text.includes('\r\n') ? '\r\n' : '\n';
+const lines = text.split(/\r?\n/);
+const kept = lines.filter((line) => !INJECT_LINE.test(line));
+const removedLines = lines.length - kept.length;
+
+const files = [
+  join(consoleDir, 'workbuddy-home.js'),
+  join(consoleDir, 'index.html.workbuddy-backup'),
+].filter((p) => existsSync(p));
+
+console.log(`宿主：${consoleDir}`);
+console.log(`index.html 注入引用行：${removedLines} 行`);
+for (const p of files) console.log(`残留文件：${p}`);
+
+if (removedLines === 0 && files.length === 0) {
+  console.log('✓ 已经是干净的，无需清理（扩展本体不会重新注入）');
+  process.exit(0);
+}
+if (checkOnly) {
+  console.log('（--check：以上为待清理项，未做任何改动；执行请加 --clean）');
+  process.exit(0);
+}
+
+if (removedLines > 0) {
+  writeFileSync(htmlPath, kept.join(newline), 'utf8');
+  console.log(`✓ 已剥掉 ${removedLines} 行注入引用（保留原有 ${newline === '\r\n' ? 'CRLF' : 'LF'} 换行风格）`);
+}
+for (const p of files) {
+  rmSync(p, { force: true });
+  console.log(`✓ 已删除 ${p}`);
+}
+console.log('✓ 清理完成；扩展本体不会重新注入，卸载也不需要还原。');