dsh-agy-link 0.4.42 → 0.4.44

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## 0.4.44 (2026-10-09)
+
+### English
+
+- **Fix: a conversation stalled on a tool step no longer dead-ends after a host restart.** Continuation spans resolve their run from an **in-memory** `RunRegistry`; after DSH restarts (or the run is evicted) the recording is gone, and `stream()` used to fail that turn — and every retry of it — with "agy run … is no longer available (server restarted?) — please resend your message", an advice that could never succeed because the stale tool result stays at the end of the message list. The adapter now logs a warning and falls back to fresh-turn prompt assembly instead: the history digest carries the recorded tool result, and the session's `sessions.json` binding still points at the same agy conversation, so the next turn heals the conversation with no user action. Related hardening in the same change: (1) the `agy_tool` mirror now bypasses DSH's auto-review / permission gates via a `tools/pre-execute` hook (it only replays output agy already executed — routing it through the reviewer caused redundant review LLM calls, timeouts, and crashes on reviewer tool-call endings); (2) review-mode calls (`REVIEW_POLICY` system prompt) and calls with explicit `tools: []` are treated as auxiliary and never cut spans on tools; (3) on Windows, `.mjs`/`.js`/`.cjs` bins are spawned via `process.execPath` instead of failing with `EFTYPE` (this also makes the full test suite pass natively on Windows — the 33 pre-existing platform failures are gone). (PR #40)
+- **Add: hide models from the DSH model picker (`hiddenModels`).** The Antigravity settings section (below account-pool scheduling) now renders a "Model visibility" row with one toggle per known model: hidden models disappear from the `/model` picker, everything else stays visible (deny-list semantics, so newly discovered models appear by default). Hiding is picker-only by design — `resolveModel` still accepts hidden ids, so in-flight sessions and direct model references keep working, and no catalog-cache invalidation is needed. The list is served from `/status` (`catalogModels` + `hiddenModels`) through the same sanitizer that feeds `listModels`, so the UI and the picker can never disagree; writes go through the existing `POST /config` allowlist (validated as an array of model ids) and persist to the runtime-overrides file immediately. `DSH_AGY_HIDDEN_MODELS` (comma-separated) also works as an env fallback. The plugin now also emits the payload-free `llm/adapters-updated` event whenever picker output can change (`hiddenModels` writes, boot-probe discovery, re-login, manual quota refresh) — the webview picker caches its catalog snapshot and only re-reads after that event, so without it toggles would not show up until the next app restart. (PR #39)
+- **Fix: the Windows node-shim spawn merged from #40 now really runs the script instead of booting a second app instance.** `process.execPath` is the Electron binary in the packaged desktop host, so the `isNode` branch now sets `ELECTRON_RUN_AS_NODE=1`; plain node ignores the variable, so POSIX and the test suite are unaffected.
+
+### 中文 (Chinese)
+
+- **修复：停在工具步骤上的会话在宿主重启后不再进入死胡同。** 续接 span 依赖的 run 录像存放在**纯内存**的 `RunRegistry` 里;DSH 重启(或录像被淘汰)后录像即消失，`stream()` 会让该轮失败——而且每次重试都失败，报 "agy run … is no longer available (server restarted?) — please resend your message"。这个"请重发消息"的建议永远不可能成功：失效的工具结果始终钉在消息列表末尾，续接检测每轮都命中同一个 runId。现在适配器会记录一条警告并**回退到全新轮次的 prompt 组装**：历史 digest 携带已记录的工具结果，会话在 `sessions.json` 里的 conversation 绑定仍指向同一个 agy 会话，下一轮即自动自愈，无需用户做任何事。同一批提交中的相关加固:(1) `agy_tool` 镜像现在通过 `tools/pre-execute` 钩子绕过 DSH 的 auto-review / 权限门(它只是重放 agy 已经执行过的输出——送审会导致重复审查 LLM 调用、审查超时，以及审查员以 tool-calls 结尾时的崩溃);(2) 审查模式调用(`REVIEW_POLICY` 系统提示)与显式 `tools: []` 的调用按辅助调用对待，不再在工具步骤上切分 span;(3) Windows 下 `.mjs`/`.js`/`.cjs` 形式的 bin 改为经 `process.execPath` 启动，不再触发 `EFTYPE`(这也让整个测试套件在 Windows 上原生全绿——33 个既有平台失败清零)。（PR #40）
+- **新增：在 DSH 模型选择器中隐藏指定模型（`hiddenModels`）。** Antigravity 设置区（号池调度下方）新增"模型显示"一行，每个已知模型一个开关：关闭的模型从 `/model` 选择器中消失，其余照常显示（黑名单语义——新发现的模型默认可见）。隐藏只作用于选择器：`resolveModel` 仍接受被隐藏的模型 id，进行中的会话与直接引用不受影响，也无需清空模型目录缓存。模型列表由 `/status`（`catalogModels` + `hiddenModels`）提供，与 `listModels` 共用同一清洗逻辑，UI 与选择器永远不会不一致；写入走现有 `POST /config` 白名单（校验必须是模型 id 数组），立即持久化到 runtime-overrides 文件。环境变量 `DSH_AGY_HIDDEN_MODELS`（逗号分隔）亦可作为回退。插件现在会在所有会影响选择器输出的时机发出无负载的 `llm/adapters-updated` 事件（`hiddenModels` 写入、启动探测发现模型、重新登录、手动刷新额度）——webview 的模型选择器缓存目录快照、只在该事件后重读，缺少它时开关要到下次重启应用才会生效。（PR #39）
+- **修复：合入自 #40 的 Windows node 脚本启动现在真正执行脚本，而不是再启动一个 App 实例。** 打包桌面端里 `process.execPath` 是 Electron 二进制，因此 `isNode` 分支现在会设置 `ELECTRON_RUN_AS_NODE=1`；纯 node 会忽略该变量，POSIX 与测试不受影响。
+
+## 0.4.43 (2026-10-06)
+
+### English
+
+
+- **Fix (Windows): Chinese tool output is no longer mangled (issue #37).** Windows pipes carry bytes in the child's console code page: on a zh-CN system agy captures pwsh output as CP936 (GBK), and the plugin decoded every stream as UTF-8 — so the Chinese refusal text arrived as mojibake, and because that text is what agy stores in its conversation database the damage was permanent. stdout/stderr are now read as raw bytes and decoded **per line** through the console code page (`chcp` probe → GBK/Big5/Shift_JIS/EUC-KR/Windows-125x), falling back to UTF-8 whenever a line is valid UTF-8; POSIX behaviour is bit-for-bit unchanged (the probe returns `utf-8`). Lines — not chunks — are the decoding unit because a multi-byte character can straddle a chunk boundary but never a newline.
+- **Fix: `dsh plugin add git+https://…` installs now build the plugin (issue #38).** `dist/` is not committed and only `prepack` existed, which never runs for git dependencies — so a hub/git install produced a package without `dist/` and failed to load. A `prepare` script now builds on git installs (npm/pnpm install devDependencies for git deps first); npm consumers are unaffected because `prepare` does not run for published tarballs. The install also aborted **earlier** than that: `@deepseek-ai/dsh-client-locale` was declared as a **non-optional** peer, so npm's automatic peer installation tried to fetch the unpublished `@deepseek-ai/dsh-paths@^0.0.1-rc.1` chain from the public registry and failed with a 404 — every `@deepseek-ai/*` peer is now optional (the host provides them at runtime and the bundle keeps them external), matching how third-party DSH plugins declare theirs.
+- **Fix: the live "User location is not supported for the API use" refusal is now recognized, explained and routed around.** agy exits 3 with a `FAILED_PRECONDITION (code 400)` result envelope for this refusal, but the classifier only knew the older issue-#32 wording — so it surfaced as a bare `PROCESS_EXIT`, the sticky account never moved, and every retry hit the same unsupported location (hence the recurring failure). The signature is now matched, the failure carries a dedicated, retryable `ELIGIBILITY` code plus the actionable hint, and the refused account is rotated off the sticky pointer before the error surfaces (no cooldown penalty) — the automatic retry is then served by an account whose own proxy/egress region is supported.
+- **Add: rotation now drains the account whose quota expires soonest (use-it-or-lose-it).** Sequential fallback used to advance in pool order, which could leave an account sitting on 60 % of a 5-hour window that resets in 20 minutes — that residual is discarded at the reset, so it was wasted. When the sticky account is drained (hard quota, cooldown, silent timeout) the next account is now the eligible one whose quota window refreshes **soonest** (5-hour window or weekly cap, whichever comes first); ties and accounts with no quota metadata yet keep the previous cyclic order, so a drained slot never bounces back to the primary, and rotation still never cools an account down on its own.
+- **Fix: quota exhaustion and silent timeouts now retry onto the next account instead of dead-ending.** A hard server-issued quota / rate-limit refusal was classified as the generic `AGY_ERROR`, which the provider retry policy never retried — the account cooled down and the sticky pointer advanced, but the turn still surfaced a user-visible error while a healthy account sat idle. It now carries a dedicated, retryable `RATE_LIMIT` code, so the automatic retry is served by the next account in the pool. Deterministic `AGY_ERROR`s (bad region, empty request, pool fully cooled) deliberately stay single-shot. A **silent** timeout (no stdout event at all — unreachable Google or a wedged credential) now rotates the sticky pointer to the next account for the retry *without* a cooldown, so one account's black hole cannot masquerade as "all accounts in cooldown". Finally, `autoFallbackModel` is no longer useless: the hardcoded `gemini-3.5/3.6-flash` list downgraded *within* the exhausted family (all Gemini models share one quota pool), so a drained Google family could never be rescued — it now fails over across families (Gemini ⇄ Claude ⇄ GPT-OSS), which have separate quotas.
+- **Fix: Antigravity console and chat toolbar now immediately display the active account when switching or after quota exhaustion.** When an account exhausted its 5h or weekly quota or hit rate limits, the scheduler advanced to the next backup account, but `lastActiveAccountId` was not proactively updated, leaving the console showing an outdated badge or no badge at all. `recordFailure` and `updateAccountQuotas` now proactively advance the active pointer immediately, self-heal client badges away from cooldown/quarantined accounts, clean up pointers when accounts are deleted/disabled/quarantined, and the chat toolbar button now visibly displays the active account alias (`AGY · <alias>`) in real-time. Furthermore, caller-aborted runs (`outcome.aborted`) are exempt from recording rate-limit failures, preventing ghost cooldowns (`"agy run aborted by caller"`) from poisoning pool rotation, and any historical abort cooldowns are automatically purged on startup.
+- **Fix & Add: Mermaid diagram rendering with bundled local assets and universal block sniffing.** DSH renders fences with unknown grammar (like `mermaid`) as localized code blocks (labeled "代码块" in Chinese or "Code block" in English) with stripped or non-standard language attributes. Diagram detection now universally scans `.md-code-block` elements, filters known programming languages, and sniffs Mermaid diagrams from the content. Furthermore, `mermaid.min.js` (v11.17.2) is now served directly from the local plugin endpoint (`/plugins/agy-link/mermaid.min.js`), completely eliminating external CDN timeouts, failures, or blocking.
+- **Fix: code cards referenced a non-existent font token, so the code font silently fell back to the hardcoded stack.** `ROW_CSS` spelled the DSH code-font token as `--dsw-font-family-code`, but the real token is `--ds-font-family-code` (no `w`). The mistyped name has zero definitions anywhere in DSH, so every `var(--dsw-font-family-code, <fallback>)` resolved to its hardcoded fallback (`ui-monospace, SFMono-Regular, Menlo, Consolas, monospace`), which carries no CJK coverage — Chinese text inside agy tool cards rendered in the OS default (SimSun / Microsoft YaHei) instead of the host's configured code font. The three affected selectors are `.agy-tv-card` (whose `font-family` is inherited by the header, copy button and body), `.agy-tv-preview` and `.agy-tv-diff-stat`.
+- **Fix: tool-hop continuations no longer re-attach every historical screenshot.** When a continuation carried no new image, the prompt builder fell back to collecting attachments from *all* earlier user turns, so the same 4–5 UI screenshots were re-staged and re-referenced on every step (observed: 61 staged files for 5 unique images in one session). Image forwarding is now watermark-aware (`SessionBinding.sentImageIds`): only attachments the current agy conversation has not seen are staged. Staged files are also keyed by attachment id instead of call index, so a legitimate re-reuse overwrites rather than accumulates.
+- **Fix: account / model switches now transfer the prior conversation properly.** A brand-new agy conversation (account switch, model switch, post-compaction re-seed) used to be seeded with only `digestMaxChars` (8K), silently dropping most of a long session. First contact now uses the new `contextTransferMaxChars` budget (default 660K, sized for 1M-token-class models), and the attachments that carry the visual context ride along once via the same image watermark.
+
+### 中文 (Chinese)
+
+
+- **修复（Windows）：中文工具输出不再乱码（issue #37）。** Windows 管道里的字节使用**子进程的控制台代码页**：中文系统上 agy 捕获到的 pwsh 输出是 CP936（GBK），而插件把整条流按 UTF-8 解码——中文报错于是变成乱码；又因为这段文本正是 agy 写入会话库的内容，损坏不可追回。现在 stdout/stderr 以**原始字节**读取并按**行**用控制台代码页解码（`chcp` 探测 → GBK/Big5/Shift_JIS/EUC-KR/Windows-125x），凡是合法的 UTF-8 行仍按 UTF-8 处理；POSIX 行为逐字节不变（探测直接返回 `utf-8`）。以「行」而非「块」为解码单位，是因为多字节字符可能跨块但绝不会跨换行。
+- **修复：`dsh plugin add git+https://…` 安装现在会构建插件（issue #38）。** 仓库里没有提交 `dist/`，而只有 `prepack`——它**不会**在 git 依赖安装时执行，所以市场/git 安装得到的包没有 `dist/`，加载失败。现在新增 `prepare` 脚本，git 安装时会构建（npm/pnpm 会先为 git 依赖安装 devDependencies）；从 npm 安装的用户不受影响，因为 `prepare` 不会对已发布的 tarball 执行。安装其实在更早一步就已经失败：`@deepseek-ai/dsh-client-locale` 曾被声明为**非可选** peer，npm 的自动 peer 安装因此去公共 registry 拉取未发布的 `@deepseek-ai/dsh-paths@^0.0.1-rc.1` 依赖链并报 404 —— 现在所有 `@deepseek-ai/*` peer 都标为 optional（运行时由宿主提供，打包时保持 external），与第三方 DSH 插件的声明方式一致。
+- **修复：线上「User location is not supported for the API use」区域拒绝现在被正确识别、解释并绕开。** 该拒绝报文是 agy 以退出码 3 + `FAILED_PRECONDITION (code 400)` 结果信封抛出的，而分类器只认得 issue #32 时期的旧措辞——于是它被当成裸 `PROCESS_EXIT`，粘性账号也不会移动，每次重试都撞同一个不支持的地区，所以你会觉得"总是出现这个问题"。现在该签名已被匹配，失败会带专用且**可重试**的 `ELIGIBILITY` 错误码与可操作提示，同时在错误抛出前把被拒账号从粘性指针上换掉（**不扣冷却**），自动重试就会落到代理/出口地区受支持的账号上。
+- **新增：轮换优先使用「快过期」的账号（不用就浪费）。** 顺次兜底此前按号池顺序推进，可能让某账号 5 小时窗口里还剩 60%、20 分钟后就要刷新——这部分余量在刷新时会被直接丢弃，等于白扔。现在当粘性账号耗尽（硬限流 / 冷却 / 静默超时）时，轮换目标改为**额度窗口刷新最近**的可用账号（5 小时窗口与周额度取更早者）；时间相同或尚无额度信息时沿用原有循环顺序，既避免耗尽后回弹到主账号，也保证轮换本身不会给账号扣冷却。
+- **修复：额度耗尽与静默超时不再「直接失败」，而是自动重试到下一个账号。** 服务器硬性限流/额度拒绝此前被归为通用 `AGY_ERROR`，而重试策略从不重试该错误码——账号确实进了冷却、粘性指针也确实推进了，但这一轮仍然把错误抛给用户，明明还有健康账号闲着。现在它使用独立的可重试错误码 `RATE_LIMIT`，自动重试即由池中下一个账号接管。确定性的 `AGY_ERROR`（区域不可用、空请求、全池冷却）刻意保持不重试。**静默超时**（全程零 stdout 事件——连不上 Google 或凭证卡死）现在会推进粘性指针到下一个账号供重试，且**不给账号扣冷却**，避免单个账号的黑洞被误报成「所有账号都在冷却」。另外 `autoFallbackModel` 不再是废功能：原先硬编码的 `gemini-3.5/3.6-flash` 是**同族内**降级（所有 Gemini 模型共用一个额度池），Google 族耗尽时永远救不回来；现在改为**跨族兜底**（Gemini ⇄ Claude ⇄ GPT-OSS，各自独立额度）。
+- **修复：账号额度用尽或切号后，Antigravity 控制台与会话工具栏即时准确展示当前使用账号。** 当首选账号 5 小时/周额度用尽或触发限流冷却时，调度器虽能在内部切到次选账号，但此前 `lastActiveAccountId` 未被主动更新，导致管理控制台的绿色「当前使用」徽标停留在旧账号上或未点亮。现在 `recordFailure` 与 `updateAccountQuotas` 在耗尽时主动推进激活指针，前端直接信赖后端权威计算的当前账号；会话顶栏按钮直接常驻显示当前账号（如 `AGY · g98`），一目了然；同时修复了用户主动中断（Stop / 插话抢占）被误判为限流并给账号扣上“幽灵冷却”（`"agy run aborted by caller"`）的严重缺陷，启动时自动清理历史幽灵冷却。
+- **修复与新增：Mermaid 图表离线本地直出与通用代码块识别。** DSH 的 Markdown 渲染管线没有 Mermaid 语法高亮，未识别的围栏会被渲染为“代码块”（英文 "Code block"）且语言标识可能丢失或非标准。探测机制现升级为全覆盖扫描 `.md-code-block`，排除常见编程语言后智能探测图表语法；并将 `mermaid.min.js` (v11.17.2) 随插件本地内置并由插件端口直出（`/plugins/agy-link/mermaid.min.js`），彻底告别外网 CDN 超时、连接挂起或被阻断导致的图表无法渲染问题。
+- **修复：代码卡片引用了一个不存在的字体 token，导致代码字体静默回落到硬编码兜底栈。** `ROW_CSS` 里把 DSH 的代码字体 token 写成了 `--dsw-font-family-code`，而真实 token 是 `--ds-font-family-code`（无 `w`）。这个拼错的名称在整个 DSH 代码库里零定义，因此每一处 `var(--dsw-font-family-code, <兜底>)` 都取到硬编码兜底值 `ui-monospace, SFMono-Regular, Menlo, Consolas, monospace`——该栈不含中文字形，导致 agy 工具卡片里的中文以系统默认字体（宋体 / 微软雅黑）渲染，而非宿主配置的代码字体。受影响的三个选择器是 `.agy-tv-card`（其 `font-family` 会向下继承到标题栏、复制按钮与正文）、`.agy-tv-preview` 与 `.agy-tv-diff-stat`。
+- **修复：工具往返续跑不再重复附加全部历史截图。** 当续跑请求里没有新图片时，提示词组装会回退成收集**全部**历史 user 轮次的附件，于是同样的 4～5 张 UI 截图在每一步都被重新落盘、重新引用（实测一个会话 61 个暂存文件只有 5 份唯一内容）。图片转发现在按水位去重（`SessionBinding.sentImageIds`）：只暂存当前 agy 会话还没见过的附件。暂存文件名也改为按 attachment id 而不是调用序号，合法重用会覆盖而不是堆积。
+- **修复：切换账号 / 切换模型后能正确带上此前的对话上下文。** 新建 agy 会话（切账号、切模型、压缩后重播种）此前只用 `digestMaxChars`（8K）做种子摘要，长会话的历史被大量丢掉。首次接入现在使用新的 `contextTransferMaxChars` 预算（默认 660K，面向 1M token 级模型），承载视觉上下文的图片也会通过同一水位机制补发一次。
+
+
 ## 0.4.42 (2026-09-30)
 
 ### English
@@ -20,7 +65,8 @@
 - **Fix (macOS): recurring "create login keychain" password popup.** Pool accounts run with an isolated HOME, and macOS has **no login keychain inside it** (`security default-keychain` → "A default keychain could not be found"), so agy's keyring save triggered the `system.keychain.create.loginkc` password dialog on every ~hourly token refresh; denying it fell back to the on-disk token (auth kept working — exit status 45/154 in agy logs). The plugin now provisions a throwaway per-account keychain and sets it as the default under that HOME — idempotently at boot, before every spawn and before every login — so keyring writes are silent and truly per-account.
 - **Fix: transient network errors no longer flag accounts as "needs re-login".** Both flagging paths were too eager: the run-failure path matched any message containing `/auth/i` (e.g. `oauth2.googleapis.com … i/o timeout` transport noise) and the token-refresh path flagged **any** `token endpoint 400` — including captive-portal / proxy error pages. Both now require an authoritative OAuth state (`invalid_grant` / `invalid_client` / `revoked` / `disabled` / `unauthorized_client`) and transport-shaped failures are exempt — even a genuine AUTH classification is not trusted when the message is transport-shaped. A false flag also **removed the account from pool rotation** (`selectAccount` skips authRequired), so this was silent capacity loss plus a scary badge that the next manual quota refresh would immediately disprove.
 - **Add: flagged accounts self-heal in the background.** `markAuthRequired` now stamps `authMarkedAt`; after 10 minutes the background poll includes the flagged account for one token verification — if the stored refresh token still works the flag clears itself (previously this required a manual 刷新额度 click); if it is truly dead the flag is re-stamped. Risk-control exposure: at most one token-endpoint call per 10 minutes per flagged account.
-- **Add: "In use" badge in the Antigravity console.** Each account card now shows a green zap badge when the sticky scheduler is currently routing runs to it (per model family, from the pool's `activeAccountIds`), answering "which account is agy using right now" at a glance. Localized (zh/en/pt-BR/es).
+- **Add: "In use" badge in the Antigravity console.** Exactly **one** account card shows the green zap badge: the account of the most recent agy spawn (`lastActiveAccountId`), localized (zh/en/pt-BR/es). The per-family scheduler pointers (`activeAccountIds`) are an internal scheduling detail and can legitimately sit on families that are not running anything — deriving the badge from them lit up two cards at once, which reads as "two accounts in use".
+- **Fix: a steer replacement now waits for the run it killed to exit.** A new prompt arriving while a run is live preempts that run and resumes the same agy conversation (`--conversation <id>`); the replacement spawn previously raced the abort, so two agy processes could briefly append to one conversation. The spawn now waits (bounded, 3.5 s) for the aborted run to settle.
 ## 0.4.40 (2026-09-28)
 
 ### English
@@ -38,7 +84,8 @@
 - **修复（macOS）：反复弹出“创建登录钥匙串”密码框。** 池账号使用隔离 HOME，而隔离 HOME 里**没有登录钥匙串**（`security default-keychain` → "A default keychain could not be found"），agy 每次约每小时的 token 续期写入都会触发 `system.keychain.create.loginkc` 密码弹窗；取消后回退磁盘 token（认证不受影响——agy 日志里的 exit status 45/154 即此）。插件现在会为每个池账号预置一个专属的一次性钥匙串并设为该 HOME 的默认——在启动时、每次拉起前、每次登录前幂等执行——钥匙串写入从此静默，且真正做到按账号隔离。
 - **修复：瞬时网络错误不再把账号标记为「需重新登录」（误判修复）。** 两条标记路径都过于激进：run 失败路径会匹配任何包含 `/auth/i` 的报错（比如 `oauth2.googleapis.com … i/o timeout` 这种纯传输噪音）；token 刷新路径会把**任何** `token endpoint 400` 都当成认证死亡——包括代理/门户返回的错误页。现在两条路径都要求出现权威的 OAuth 状态（`invalid_grant` / `invalid_client` / `revoked` / `disabled` / `unauthorized_client`），传输型失败一律豁免——即使带 AUTH 分类，只要报错文本是传输形态也不标记。误判的代价不只是吓人的徽标：被标记的账号会被调度器**排除出轮换**，等于静默损失一个账号，直到手动「刷新额度」把它证伪。
 - **新增：被标记的账号后台自动复验。** `markAuthRequired` 现在会记录 `authMarkedAt`；10 分钟后后台轮询会把该账号放进来做一次 token 验证——刷新令牌若仍可用，标记自动清除（以前必须手动点「刷新额度」）；若真的失效则重新盖章。风控代价：每个被标记账号至多每 10 分钟一次 token endpoint 调用。
-- **新增：控制台「当前使用」标识。** 账号卡片现在会显示绿色 ⚡「当前使用」徽标（基于号池调度器的 `activeAccountIds`，按模型族标注），一眼看出 agy 当前正在用哪个账号。四种语言（zh/en/pt-BR/es）均已本地化。
+- **新增：控制台「当前使用」标识。** 现在**只会有一张**账号卡片显示绿色 ⚡「当前使用」徽标：最近一次真正拉起 agy 的账号（`lastActiveAccountId`），四种语言（zh/en/pt-BR/es）均已本地化。按模型族的调度指针（`activeAccountIds`）只是内部调度细节，可能停在当前并没有跑任何东西的模型族上——用它做徽标会一次点亮两张卡，看起来像"两个账号在用"。
+- **修复：插话（steer）替换进程现在会等被抢占的 run 真正退出。** run 还在跑时来一条新提示词会抢占该 run 并续用同一个 agy 会话（`--conversation <id>`）；此前替换进程与 abort 存在竞争，极端情况下会有两个 agy 进程短暂同时往同一个会话追加。现在拉起前会有界等待（3.5 秒）被抢占的 run 收尾。
 ## 0.4.40 (2026-09-28)
 
 ### 中文 (Chinese)

package/README.md

@@ -133,6 +133,7 @@ dsh plugin --profile web add dsh-agy-link
 | `permissionMode` | `DSH_AGY_MODE` | `skip` | 权限模式：`skip`（无人值守执行）/ `plan` / `accept-edits` |
 | `defaultModel` | `DSH_AGY_DEFAULT_MODEL` | `(agy 默认)` | 默认模型 slug |
 | `defaultEffort` | `DSH_AGY_DEFAULT_EFFORT` | `(模型默认)` | 思考预算：`low` / `medium` / `high` |
+| `hiddenModels` | `DSH_AGY_HIDDEN_MODELS` | `[]` | 在 `/model` 选择器中隐藏的模型 slug 列表（黑名单语义，新模型默认可见；建议直接在设置面板"模型显示"中点选管理） |
 | `timeoutMs` | `DSH_AGY_TIMEOUT_MS` | `600000` | 单轮活跃看门狗超时（毫秒） |
 | `workspaceRoot` | `DSH_AGY_WORKSPACE_ROOT` | 会话 cwd | agy 工作区根目录（默认跟随当前会话工作区） |
 
@@ -269,6 +270,7 @@ dsh plugin --profile web add dsh-agy-link
 | `permissionMode` | `DSH_AGY_MODE` | `skip` | `skip` (unattended execution) / `plan` / `accept-edits` |
 | `defaultModel` | `DSH_AGY_DEFAULT_MODEL` | `(agy default)` | Default model slug |
 | `defaultEffort` | `DSH_AGY_DEFAULT_EFFORT` | `(model default)` | Thinking budget: `low` / `medium` / `high` |
+| `hiddenModels` | `DSH_AGY_HIDDEN_MODELS` | `[]` | Model slugs hidden from the `/model` picker (deny-list, newly discovered models stay visible; manage them via the "Model visibility" row in the settings panel) |
 | `timeoutMs` | `DSH_AGY_TIMEOUT_MS` | `600000` | Activity watchdog timeout in milliseconds |
 | `workspaceRoot` | `DSH_AGY_WORKSPACE_ROOT` | session cwd | Working directory root |