dsh-connect-agnes-token-plan 0.12.1 → 0.13.0

package/CHANGELOG.md

@@ -21,6 +21,57 @@
 
 **代价是没有任何门禁会拦住上面那些错误**，包括把账本条目整段抄进来。所以纪律靠本节的判据自查；改动本文件后手工跑一次 `node test/docs.test.mjs`，确认没碰坏其它检查（如发布版本陈述）。
 
+## [Unreleased]
+
+## [0.13.0] — 2026-10-21
+
+本版新增 **AgnesCode 扫码登录**：桌面端没装、没登录也能用这条线。另外修了促销标丢失、并发记录丢失、令牌被悄悄改写三处问题，并扩大了凭据脱敏面。
+
+### 新增：AgnesCode 扫码登录——不用先装桌面端
+
+- **增（插件卡）**：AgnesCode 那一栏多一个「扫码登录」入口。点了会打开浏览器到 AgnesCode 登录页，你扫码（已登录就点继续）后，浏览器把一次性授权码交给插件，插件换回与桌面端同款的登录态。
+- **增（登录流程）**：等待期间可以「取消等待」——取消只是不再等了，已经扫成功的那次登录照样会被保存下来。
+- **修（登录流程）**：浏览器打不开时立刻回报「打不开浏览器」，不再干等到超时；换码失败时显示服务端给的可读原因（例如「授权码无效」），不再是一句没头绪的失败。
+
+### 修复：桌面端的促销标不再整条丢掉
+
+- **修（面板）**：桌面端模型列表里的促销标（如「限时七折」）此前在列表重建时整个丢失，这一列于是永远是空的。现在重建后仍带出促销标，没有促销文案时按「没有」处理。
+
+### 修复：同时发生的记录不再丢一部分
+
+- **修（面板）**：短时间内多条用量与限频记录一起写入时，只有部分能落盘（实测五次并发只留下一到三条），面板上的数字看着在涨、实际丢着。现在写入按顺序排队，记录条数与实际发生的一致。
+
+### 修复：令牌不再被悄悄改写
+
+- **修（面板）**：平台发来的登录令牌此前在读取时会被去掉首尾空白，令牌因此被改写，表现为一次查无出处的 401。现在按原样读取。
+
+### 修复：凭据脱敏面扩大
+
+- **修（面板与日志）**：脱敏原先只认几种键名和前缀。现在也按值的形状认：Basic 认证整段、Cookie、JSON 里没加引号的凭据字段、client_secret / code_verifier 这类键名。普通句子原样保留，不会把诊断信息一起吃掉。
+
+### 修复：插件卡把密码说成了两处都在用
+
+- **修（插件卡·中英文界面）**：介绍此前写「令牌到期自动重登（需 `AGNES_PASSWORD`）」，读起来像 AgnesCode 桌面端的令牌也要靠密码续期。实际是两件事：`AGNES_PASSWORD` 只在**重登 Agnes 控制台**时用到；桌面端的令牌到期是重新读取桌面应用自己的登录态，不需要密码。现在两种语言都把这两句分开说清。
+
+## [0.12.2] — 2026-10-19
+
+本版三件事：**插件卡顶栏收成一行**，卡片底部不再多留一块空白；**中文介绍换写成「装上能得到什么」**，与英文卡片说同一件事；以及**装上后 README 里指向 `docs/` 的链接不再全部断掉**。
+
+### 界面：插件卡顶栏收成一行，卡片底部不再多留一块空白
+
+- **改（面板）**：三个 tab 与「更新于 / 令牌状态 / 刷新 / 返回会话」原来是上下两行，tab 那一行的右半边一直空着，卡片白占一整行高度。现在 tab 与这些状态同处一行，底下的分隔线也由这一行统一画。
+- **改（面板）**：卡片底部原来自己留 56px 内边距，外面再加宿主的一层，合计约 104px 空白。现在只剩宿主那一层。
+
+### 变更：中文介绍改说「装上能得到什么」
+
+- **改（插件卡·中文界面）**：介绍此前按功能面罗列（额度面板 → 四个开关 → 桌面端上游），读起来像一份变更日志。现在先说「一键接入 + 自动填好」，额度窗口与桌面端接入降为后半句的补充。
+- **修（插件卡·英文界面）**：系统语言是英文时，介绍此前退回 package.json 里那段写给开发者的长描述，与中文卡片不是同一份文案。现在两种语言说的是同一件事。
+
+### 修复：装上后 README 里指向 docs/ 的链接不再断掉
+
+- **修（安装后的文档）**：README 有 22 处指向 `docs/` 的链接，而 `files` 白名单里一直没有 `docs`——插件装好后点这些链接全是 404。现在 `docs/` 随包一起发。
+- 影响面：`package.json`、`locale/zh.json`、`locale/en.json`、`test/package.test.mjs`。
+
 ## [0.12.1] — 2026-10-19
 
 本版两条主线：**修掉面板会「僵住」的一类故障**——首次读数失败后它不再永久停止刷新；以及**把插件卡上的介绍文案改成讲「你能拿到什么」**，并补正 README 里一句默认做不到的承诺（自动重登需要 `AGNES_PASSWORD`）。

package/README.md

@@ -68,6 +68,8 @@
 - 两条上游**互不借用**：`agnescode` 的会话只读它自己的路由、绝不画控制台窗口，反之亦然；切到**别的 provider**（其它插件）的模型时胶囊直接消失，也不再发任何请求；
 - 读不到时**保留上一次数字并标「上次数据」**，不会清零或伪装成 0%；余额里的 `0` 是「烧完了」的读数（红色告警），`—` 才是「这次没读到」——这个区别是刻意的。
 
+![AgnesCode 积分余额胶囊（点开读数卡）](assets/agnescode-usage-capsule.png)
+
 ## 边界
 
 - 面板**不代你操作账务**——不改套餐、不代扣额度、不碰 Key 明文；数据来自 Agnes 控制台自己的 API，与网页控制台口径一致。
@@ -114,7 +116,7 @@ npm run doctor:json     # 机器读：JSON（可进你的巡检 / 工单脚本
 - [docs/API.md](docs/API.md) — 路由与控制台端点
 - [docs/AGNES-API.md](docs/AGNES-API.md) — Agnes 接口全集（控制台额度侧 + 推理侧）
 - [docs/TESTING.md](docs/TESTING.md) — 测试体系
-- [docs/PITFALLS.md](docs/PITFALLS.md) — 真实踩坑（57 条）
+- [docs/PITFALLS.md](docs/PITFALLS.md) — 真实踩坑（61 条）
 - [CHANGELOG.md](CHANGELOG.md) — 版本变化
 
 AI 协作会话请先读 [AGENTS.md](AGENTS.md)。人类贡献者先读 [SETUP.md](docs/SETUP.md) 与 [ARCHITECTURE.md](docs/ARCHITECTURE.md) §2 理解结构与改动代价，改代码前再读 [AGENTS.md](AGENTS.md) 的红线与 [TESTING.md](docs/TESTING.md) 的 `npm test` 门禁。

package/client.js

@@ -240,6 +240,12 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			"agnescode.bffBase": "接口地址 {base}",
 			"agnescode.notLogged": "未关联——请先在 AgnesCode 桌面端登录（微信扫码），再点「检测本机登录态」。",
 			"agnescode.harvestWindowsOnly": "本机登录态采集目前仅支持 Windows（macOS / Linux 未实现）。",
+			"agnescode.login": "扫码登录",
+			"agnescode.cancelLogin": "取消等待",
+			"agnescode.loginCancelled": "已取消等待。若已在 App 中完成扫码，登录仍会在后台完成并生效。",
+			"agnescode.loginOk": "扫码登录成功。",
+			"agnescode.loginFail": "扫码登录失败：{error}",
+			"agnescode.loginHint": "无需桌面 App——浏览器打开登录页，用 AgnesCode App 扫码即可（macOS / Linux 可用）。",
 			"agnescode.downloadCta": "下载 AgnesCode 桌面客户端，领取限时积分 →",
 			"agnescode.balanceLabel": "积分余额",
 			"agnescode.balanceTimeLabel": "时效",
@@ -494,6 +500,12 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			"agnescode.bffBase": "API base {base}",
 			"agnescode.notLogged": "Not linked — sign in inside the AgnesCode desktop App (WeChat scan) first, then run the detection.",
 			"agnescode.harvestWindowsOnly": "Local login-state detection currently supports Windows only (macOS / Linux not implemented).",
+			"agnescode.login": "Scan-to-sign-in",
+			"agnescode.cancelLogin": "Cancel waiting",
+			"agnescode.loginCancelled": "Waiting cancelled. If the scan was completed, the login still finishes in the background.",
+			"agnescode.loginOk": "Scan-to-sign-in succeeded.",
+			"agnescode.loginFail": "Scan-to-sign-in failed: {error}",
+			"agnescode.loginHint": "No desktop App needed — the browser opens the login page for the AgnesCode App to scan (works on macOS / Linux).",
 			"agnescode.downloadCta": "Download the AgnesCode desktop client and claim your limited-time credits →",
 			"agnescode.balanceLabel": "Credit balance",
 			"agnescode.balanceTimeLabel": "Time-limited",
@@ -641,7 +653,7 @@ var dsh_connect_agnes_token_plan_client = (function() {
 //#endregion
 //#region src/client/http.ts
 /** One POST with the panel's fixed request shape; the parsed body or null. */
-	async function postRaw(path, payload) {
+	async function postRaw(path, payload, signal) {
 		const response = await fetch(path, {
 			method: "POST",
 			headers: {
@@ -649,7 +661,8 @@ var dsh_connect_agnes_token_plan_client = (function() {
 				accept: "application/json"
 			},
 			cache: "no-store",
-			body: JSON.stringify(payload)
+			body: JSON.stringify(payload),
+			...signal !== void 0 ? { signal } : {}
 		});
 		const body = await response.json().catch(() => null);
 		return {
@@ -658,12 +671,12 @@ var dsh_connect_agnes_token_plan_client = (function() {
 		};
 	}
 	/** POST and return the parsed body, or null when the response is not JSON. */
-	function postJson(path, payload) {
-		return postRaw(path, payload).then(({ body }) => body);
+	function postJson(path, payload, signal) {
+		return postRaw(path, payload, signal).then(({ body }) => body);
 	}
 	/** POST and demand `ok:true`; refuse by throwing the Host's own wording. */
-	async function postJsonOrThrow(path, payload) {
-		const { status, body } = await postRaw(path, payload);
+	async function postJsonOrThrow(path, payload, signal) {
+		const { status, body } = await postRaw(path, payload, signal);
 		if (body === null || body.ok !== true) throw new Error(typeof body?.error === "string" ? body.error : `HTTP ${status}`);
 		return body;
 	}
@@ -959,9 +972,9 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			},
 			header: {
 				display: "flex",
-				alignItems: "center",
+				alignItems: "stretch",
 				gap: 12,
-				padding: "12px 0 10px"
+				borderBottom: "1px solid var(--dsw-alias-border-l1)"
 			},
 			scroll: {
 				flex: 1,
@@ -969,12 +982,10 @@ var dsh_connect_agnes_token_plan_client = (function() {
 				overflowY: "auto",
 				overflowX: "hidden"
 			},
-			content: { padding: "6px 0 56px" },
+			content: { padding: "6px 0 0" },
 			tabBar: {
 				display: "flex",
-				gap: 4,
-				borderBottom: "1px solid var(--dsw-alias-border-l1)",
-				marginBottom: 4
+				gap: 4
 			},
 			tab: {
 				appearance: "none",
@@ -982,6 +993,8 @@ var dsh_connect_agnes_token_plan_client = (function() {
 				border: "none",
 				borderBottom: "2px solid transparent",
 				padding: "8px 12px",
+				display: "flex",
+				alignItems: "center",
 				fontSize: 13,
 				color: "var(--dsw-alias-label-secondary)",
 				cursor: "pointer"
@@ -996,6 +1009,14 @@ var dsh_connect_agnes_token_plan_client = (function() {
 				fontSize: 12
 			},
 			spacer: { flex: 1 },
+			cluster: {
+				display: "inline-flex",
+				alignItems: "center",
+				gap: 12,
+				justifyContent: "flex-end",
+				flexWrap: "wrap",
+				alignSelf: "center"
+			},
 			button: BUTTON,
 			sectionTitle: {
 				margin: "22px 0 10px",
@@ -3140,12 +3161,6 @@ var dsh_connect_agnes_token_plan_client = (function() {
 		}
 		const renderLimit = (text) => h("span", { style: S.planLimit }, text);
 		const renderEntry = (entry) => {
-			const limits = entry.limits ?? {};
-			const windowHours = Number(limits.requestsWindowH);
-			const limitItems = [];
-			if (limits.requests5h !== void 0 && limits.requests5h > 0) limitItems.push(renderLimit(`${count(limits.requests5h)}${tt("quota.unit.requests")} / ${windowHours > 0 ? windowHours : 5}h`));
-			if (limits.requestsWeekly !== void 0 && limits.requestsWeekly > 0) limitItems.push(renderLimit(`${count(limits.requestsWeekly)}${tt("quota.unit.requests")} / ${tt("quota.perWeek")}`));
-			if (limits.imagesDaily !== void 0 && limits.imagesDaily > 0) limitItems.push(renderLimit(`${count(limits.imagesDaily)}${tt("quota.unit.images")} / ${tt("quota.perDay")}`));
 			return h("div", { style: S.planCycle }, h("span", { style: S.planCycleLabel }, cycleLabel(entry.billingCycle, tt)), entry.priceMinor !== void 0 && entry.priceMinor > 0 ? h("span", { style: S.planPrice }, money(entry.priceMinor, entry.currency)) : null);
 		};
 		return h("div", { style: S.planGrid }, Array.from(tiers.entries()).map(([tierName, entries]) => h("div", {
@@ -3622,10 +3637,12 @@ var dsh_connect_agnes_token_plan_client = (function() {
 		const [error, setError] = useState(null);
 		const [updatedAt, setUpdatedAt] = useState(0);
 		const [harvestBusy, setHarvestBusy] = useState(false);
+		const [loginBusy, setLoginBusy] = useState(false);
 		const [note, setNote] = useState(null);
 		const alive = useRef(true);
 		const generation = useRef(0);
 		const inFlight = useRef(null);
+		const loginAbort = useRef(null);
 		const load = useCallback(async () => {
 			generation.current += 1;
 			const mine = generation.current;
@@ -3748,6 +3765,34 @@ var dsh_connect_agnes_token_plan_client = (function() {
 				setState(body);
 			}
 		}, []);
+		const login = useCallback(async () => {
+			const controller = new AbortController();
+			loginAbort.current = controller;
+			setLoginBusy(true);
+			setNote(null);
+			try {
+				const body = await postJson(AGNESCODE_PATH, { action: "login" }, controller.signal);
+				if (alive.current) {
+					retireInFlight();
+					if (body !== null) setState(body);
+					if (body?.ok === true) setNote(tt("agnescode.loginOk"));
+					else setNote(format(tt("agnescode.loginFail"), { error: typeof body?.error === "string" && body.error !== "" ? body.error : tt("agnescode.loadErrorDetail") }));
+				}
+			} catch (why) {
+				if (alive.current) {
+					if (loginAbort.current === controller && controller.signal.aborted) setNote(tt("agnescode.loginCancelled"));
+					else setNote(format(tt("agnescode.error"), { error: why instanceof Error ? why.message : String(why) }));
+				}
+			} finally {
+				if (loginAbort.current === controller) loginAbort.current = null;
+				if (alive.current) setLoginBusy(false);
+			}
+		}, [tt]);
+		const cancelLogin = useCallback(() => {
+			loginAbort.current?.abort();
+			if (alive.current) setLoginBusy(false);
+		}, []);
+		const loginDisabled = harvestBusy || loginBusy;
 		const enabled = state?.enabled === true;
 		const view = agnescodeView(state, error);
 		const loggedIn = view.linked;
@@ -3777,8 +3822,13 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			type: "button",
 			style: S.button,
 			onClick: () => void harvest(),
-			disabled: harvestBusy
-		}, harvestBusy ? tt("agnescode.harvesting") : tt("agnescode.harvest"))), state?.bffBase !== void 0 && state?.bffBase !== "" || typeof state?.expiresAtMs === "number" && state.expiresAtMs > 0 ? h("div", null, h("div", { style: {
+			disabled: loginDisabled
+		}, harvestBusy ? tt("agnescode.harvesting") : tt("agnescode.harvest")), h("button", {
+			type: "button",
+			style: S.button,
+			onClick: () => void (loginBusy ? cancelLogin() : login()),
+			disabled: !loginBusy && loginDisabled
+		}, loginBusy ? tt("agnescode.cancelLogin") : tt("agnescode.login"))), state?.bffBase !== void 0 && state?.bffBase !== "" || typeof state?.expiresAtMs === "number" && state.expiresAtMs > 0 ? h("div", null, h("div", { style: {
 			...S.quotaFoot,
 			marginTop: 8,
 			color: "var(--dsw-alias-label-secondary)"
@@ -3806,14 +3856,23 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			type: "button",
 			style: S.button,
 			onClick: () => void harvest(),
-			disabled: harvestBusy
-		}, harvestBusy ? tt("agnescode.harvesting") : tt("agnescode.harvest"))), h("div", { style: {
+			disabled: loginDisabled
+		}, harvestBusy ? tt("agnescode.harvesting") : tt("agnescode.harvest")), h("button", {
+			type: "button",
+			style: S.button,
+			onClick: () => void (loginBusy ? cancelLogin() : login()),
+			disabled: !loginBusy && loginDisabled
+		}, loginBusy ? tt("agnescode.cancelLogin") : tt("agnescode.login"))), h("div", { style: {
 			...S.muted,
 			fontSize: 12,
 			marginTop: 6
-		} }, tt("agnescode.harvestWindowsOnly"))), h(Switch, {
+		} }, tt("agnescode.harvestWindowsOnly")), h("div", { style: {
+			...S.muted,
+			fontSize: 12,
+			marginTop: 2
+		} }, tt("agnescode.loginHint"))), h(Switch, {
 			checked: enabled,
-			disabled: harvestBusy,
+			disabled: loginDisabled,
 			onChange: () => void toggle(!enabled),
 			label: tt("agnescode.switch"),
 			title: tt("agnescode.switchTip"),
@@ -4388,6 +4447,25 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			triggerRef
 		]);
 	}
+	function usePillPopover() {
+		const [popoverId] = useState(nextPopoverId);
+		const [open, setOpen] = useState(false);
+		const close = useCallback(() => setOpen(false), []);
+		const rootRef = useRef(null);
+		const cardRef = useRef(null);
+		const triggerRef = useRef(null);
+		usePopoverClose(open, close, rootRef);
+		usePopoverFocus(open, cardRef, triggerRef);
+		return {
+			popoverId,
+			open,
+			setOpen,
+			close,
+			rootRef,
+			cardRef,
+			triggerRef
+		};
+	}
 	/**
 	* The shared shell: the tier dot, the upstream prefix, the reading — and, when
 	* the variant passed a toggle, the click affordance around it: a pointer
@@ -4457,14 +4535,7 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			stale ? tt("composer.stale") : null
 		].filter(Boolean).join(" · ");
 		const windowText = (label, pct) => `${label} ${percentText(pct)}`;
-		const [popoverId] = useState(nextPopoverId);
-		const [open, setOpen] = useState(false);
-		const close = useCallback(() => setOpen(false), []);
-		const rootRef = useRef(null);
-		const cardRef = useRef(null);
-		const triggerRef = useRef(null);
-		usePopoverClose(open, close, rootRef);
-		usePopoverFocus(open, cardRef, triggerRef);
+		const { popoverId, open, setOpen, rootRef, cardRef, triggerRef } = usePillPopover();
 		const popoverRows = [
 			h("div", {
 				key: "title",
@@ -4600,14 +4671,7 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			why,
 			stale ? tt("composer.stale") : null
 		].filter(Boolean).join(" · ");
-		const [popoverId] = useState(nextPopoverId);
-		const [open, setOpen] = useState(false);
-		const close = useCallback(() => setOpen(false), []);
-		const rootRef = useRef(null);
-		const cardRef = useRef(null);
-		const triggerRef = useRef(null);
-		usePopoverClose(open, close, rootRef);
-		usePopoverFocus(open, cardRef, triggerRef);
+		const { popoverId, open, setOpen, rootRef, cardRef, triggerRef } = usePillPopover();
 		const popoverRows = [
 			h("div", {
 				key: "bal-title",
@@ -4977,7 +5041,7 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			bare: true,
 			hasSnapshot: false
 		}) : h("div", { style: S.empty }, failure === null ? tt("panel.loading") : h("div", null, h("div", { role: "alert" }, guidance ?? format(tt("panel.error"), { error: failure.message }))));
-		const body = h("div", null, tabBar, activeTab === "quota" && shapeWarnings.length > 0 ? h("div", {
+		const body = h("div", null, activeTab === "quota" && shapeWarnings.length > 0 ? h("div", {
 			style: S.formError,
 			role: "status"
 		}, format(tt("panel.shapeDrift"), { detail: shapeWarnings.map((entry) => `${tt("shape.api")} ${entry.api} ${tt("shape.missing")} ${entry.missing}`).join("; ") })) : null, activeTab === "quota" ? h("div", {
@@ -5118,7 +5182,7 @@ var dsh_connect_agnes_token_plan_client = (function() {
 		return h("div", {
 			style: S.page,
 			"data-dsh-plugin": PANEL_ID
-		}, h("div", { style: S.headerBar }, h("div", { style: S.header }, h("span", { style: S.updated }, stamp), plan.authChip ? authChip : null, h("span", { style: S.spacer }), plan.staleWarning && failure && data ? h("span", {
+		}, h("div", { style: S.headerBar }, h("div", { style: S.header }, tabBar, h("span", { style: S.spacer }), h("span", { style: S.cluster }, h("span", { style: S.updated }, stamp), plan.authChip ? authChip : null, plan.staleWarning && failure && data ? h("span", {
 			style: S.error,
 			role: "status",
 			title: failure.message
@@ -5130,9 +5194,12 @@ var dsh_connect_agnes_token_plan_client = (function() {
 			} : S.button,
 			disabled: refresh === null,
 			onClick: () => refresh?.()
-		}, refreshing && plan.refresh === "snapshot" ? tt("panel.refreshing") : tt("panel.refresh")), onClose ? h("button", {
+		}, refreshing && plan.refresh === "snapshot" ? tt("panel.refreshing") : tt("panel.refresh"))), onClose ? h("button", {
 			type: "button",
-			style: S.button,
+			style: {
+				...S.button,
+				alignSelf: "center"
+			},
 			onClick: () => onClose()
 		}, tt("panel.back")) : null)), h("div", { style: S.scroll }, h("div", { style: S.content }, body)));
 	}