dsh-connect-trae 4.4.6 → 4.4.7

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 4.4.7 (2026-10-24)
+
+> **4.4.6 把「读不出来的账号副本」改名留住了，但这件事一直是静默的——现在卡片会把它点名，
+> 包括未登录那一屏。被顶掉的账号「去哪了」，从此不必再去 `~/.dsh` 里翻文件名。**
+>
+> 这一版不改任何账号、刷新、镜像的行为：读不懂的文件依然被隔离、依然不被覆盖。
+> 改的是**看得见**：隔离发生的证据本来就在磁盘上，只是没人告诉用户它在那儿。
+
+### 新增
+
+- **隔离过的账号副本会被点名**（`feat(card)`）。
+  - 宿主侧新增 `TraeCredentialStore.quarantinedCopies()`：**扫描**副本文件旁边的
+    `.corrupt-*` 兄弟文件——不另设一本账，**证据本身就是证据**，用户删掉留存文件，提示也就跟着
+    消失，没有第二处状态要清理。报告内容是它原来的路径、现在的路径、字节数，以及
+    **能读成 JSON 时的账号数**（读不成就不猜：一个猜错的账号数比没有更糟）。
+  - 状态文档新增 `quarantined` 字段，**signed-in 与 signed-out 两种形状都带**。
+  - 卡片「诊断」栏新增一行「损坏副本留存」，点名那份留存文件。
+  - **未登录那一屏也显示同一条通知**：账号消失之后用户落地的正是那一屏，而那一屏根本不渲染分栏，
+    诊断栏根本看不到——只把通知放进诊断栏，等于没做。
+  - 一台健康的机器上什么都不显示：没有通知，也没有空盒子。
+
+### 测试
+
+- 新增 **9** 例：`tests/auth.spec.ts`（2 条——报告隔离文件、用户删掉后通知随之消失）、
+  `tests/web-status.spec.ts`（2 条——signed-out 与 signed-in 文档都带上通知）、
+  `tests/card-quarantine.spec.tsx`（5 条——诊断栏点名、未登录屏可见、账号数可读/不可读、健机器保持沉默）。
+- 全仓 **1093** 例 / 85 个测试文件通过，双 tsconfig 类型检查通过。
+
+### 文档
+
+- `README.md` / `README.en.md` 的诊断栏说明补上这一行新事实，以及「未登录那一屏也会显示」。
+
+> **给 #56 报告人的补充**：4.4.6 的隔离是静默的，所以「出现过隔离文件」这件事过去只能靠翻目录发现。
+> 4.4.7 之后，卡片会直接把那份文件指给你——如果你的 `~/.dsh` 下已经有 `.corrupt-*` 文件，
+> 升级后打开设置页就能看到它曾经存在，不必再自己找。
 ## 4.4.6 (2026-10-24)
 
 > **对齐宿主 DSH 0.2.1-rc.3（纯版本推进，插件代码零改动），并修掉账号链路上三处

package/README.en.md

@@ -36,7 +36,7 @@ A [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness) bund
 - **Enterprise is a separate billing channel, not an alias for CN** — the same CN credential, when it belongs to a `tob_online` tenant, is served by **two** gateways: the consumer pool (billed against personal credits) and the tenant pool (billed against the enterprise allowance). Same model, two payers, so **you** choose who pays; the plugin never guesses. `trae` never touches the enterprise gateway, and `trae-enterprise` **never falls back** — a refusal is reported as a refusal instead of quietly re-running on personal credits. Enterprise is **off by default**: a personal-only account cannot use the tenant pool, so shipping it enabled would mean handing everyone a provider that fails on first use.
 - **Any panel can be switched off on its own** — each tab carries its own checkbox (CN and international checked by default, enterprise not): unchecking **withdraws that provider from the DSH model picker entirely** (not merely hiding the tab) and stops all of its requests; checking it again restores it with the account, directory, picks, and context budgets intact. If you never use the international side, just uncheck it.
 - **Tabbed settings card** — the card's top carries a "Domestic / Enterprise / Global" tab bar; each tab holds its own account picker, usage overview, and model management. Account, directory, selection, and unsaved drafts are fully isolated per tab — switching accounts or refreshing models on one tab never touches the other side's runtime catalog or sessions. CN and enterprise share one CN credential pool but keep **separate account bindings and model picks**: the two rosters differ (`DeepSeek-V4.1-Flash` is listed only on the enterprise pool), so picks never overwrite each other.
-- **The card then splits into "Account / Models / Diagnostics"** (learned from the sibling `dsh-connect-workbuddy`). The region row above is the **scope** — which provider this whole card is about — while these are sections of that one card: Account covers who serves, what is left, the check-in and the pool; Models covers which models to tick, image input, the context budget and Save; Diagnostics read-only lists the panel, the provider id, the serving account, both token deadlines, the catalog/enabled model counts, whether the pool and the check-in are offered, and the **verbatim** text of this panel's last reported failure. The split exists because the two halves **commit differently**: an account change lands on the click, a catalog change is a draft until Save — so a single long column put the save button three screens away from what it saves. Switching sections never refetches, never drops a half-filled model draft, and never rebuilds the pool's log. A signed-out card renders no section strip, so its one screen of instructions cannot be hidden behind a tab the user cannot see. **The Models section lays every model out at once, with no inner scrollbar** — it is not a little window scrolling inside a page that already scrolls; the card's own page is the only scroll.
+- **The card then splits into "Account / Models / Diagnostics"** (learned from the sibling `dsh-connect-workbuddy`). The region row above is the **scope** — which provider this whole card is about — while these are sections of that one card: Account covers who serves, what is left, the check-in and the pool; Models covers which models to tick, image input, the context budget and Save; Diagnostics read-only lists the panel, the provider id, the serving account, both token deadlines, the catalog/enabled model counts, whether the pool and the check-in are offered, and the **verbatim** text of this panel's last reported failure. **As of 4.4.7 the diagnostics section carries one more line, "quarantined copies"**: a credential copy that could not be read — and was therefore renamed aside instead of being erased — is named there, together with how many accounts it still holds. "Where did the account I remember go?" is now answered by the card instead of by browsing `~/.dsh` for a file name; the signed-out screen shows the same notice, because that is the screen a user lands on after an account disappears. The split exists because the two halves **commit differently**: an account change lands on the click, a catalog change is a draft until Save — so a single long column put the save button three screens away from what it saves. Switching sections never refetches, never drops a half-filled model draft, and never rebuilds the pool's log. A signed-out card renders no section strip, so its one screen of instructions cannot be hidden behind a tab the user cannot see. **The Models section lays every model out at once, with no inner scrollbar** — it is not a little window scrolling inside a page that already scrolls; the card's own page is the only scroll.
 - **Multiplier in the model name** — model names show the credit multiplier in Trae's own menu format (e.g. `GLM-5.2 · x0.79`), updated with each directory refresh.
 - **Promotion badge** — Trae publishes its discount rules in the model directory (`activity_discount`: pay ratio, list price, off-peak windows with their time zone). The plugin judges them against **the clock at render time** and paints one capsule beside the model name (`5 折` / `off-peak 5 折` / `limited 5 折`), with the old price, the new price and the window on hover. Judging at render time is what keeps a night-time discount from still hanging there the next morning; when upstream says nothing is discounted right now no badge is painted, the multiplier is never used to guess a promotion, and no campaign without an end time is labelled "limited". It is information only: no request and no billing changes, and the international region (subscription) has no such data and therefore shows no badge. See [docs/PROMO_BADGE.md](docs/PROMO_BADGE.md).
 - **DSH local tool loop** — gets pending structured `tool_calls` from Trae `llm_utils_chat`, lets DSH execute its own local tools, then returns tool results to the model.

package/README.md

@@ -36,7 +36,7 @@
 - **企业版是独立计费通道，不是国内版的别名** —— 同一张 CN 凭据若属于 `tob_online` 租户，会被**两个**网关同时服务：消费池（扣个人积分）与租户池（扣企业额度）。同一模型、两种付费方，所以「谁付钱」由你显式选，插件不替你猜。`trae` 永不碰企业网关；`trae-enterprise` **不回落**，被拒绝就如实报错，不会悄悄改用个人额度重跑。企业版**默认关闭**——纯个人账号用不了企业池，默认放开等于塞一条一用就失败的 provider。
 - **可单独关闭任一面板** —— 三个 tab 各带一个勾选（国内版与国际版默认勾选，企业版默认不勾）：取消勾选即把该面板的供应商**整个从 DSH 模型选择器撤掉**（不是只藏起 tab），并且不再发起任何请求；重新勾选即恢复，账号、目录、勾选与上下文预算全部保留。用不到国际版就把国际版关掉即可。
 - **插件卡片 tab 切换** —— 设置卡片顶部为「国内版 / 企业版 / 国际版」三个 tab，各含独立的账号选择、用量概览与模型管理；每个 tab 的账号、目录、勾选与未保存草稿完全隔离——在一个 tab 里切账号或刷新模型，不会触碰另一边的运行时目录与会话。国内版与企业版共用同一份 CN 凭据池，但**各有各的账号绑定与模型勾选**：两个池的名录并不相同（`DeepSeek-V4.1-Flash` 只有企业池列），所以勾选互不覆盖。
-- **卡片内再按「账号 / 模型 / 诊断」分栏**（学自同族 `dsh-connect-workbuddy`）—— 上面那排地区是**作用域**（这张卡片讲的是哪个供应商），这一排是同一张卡片里的**分栏**：账号栏管「谁在服务、还剩多少、签到与账号池」，模型栏管「勾哪些模型、图片输入、上下文预算、保存」，诊断栏只读地列出面板名、供应商 id、服务账号、两种令牌到期时间、目录/已启用模型数、账号池与签到支持与否，以及本面板最近一次报错的**原文**。分栏的理由是**提交语义不同**：账号改动点一下即生效，模型改动是草稿、必须点「保存」——一列长页会把保存按钮放到离它要保存的东西三屏之外。切栏不重新拉取、不丢未保存的模型草稿、账号池日志也不重建；未登录时不出分栏，那一屏说明不会被看不见的 tab 藏起来。**模型栏把所有模型一次性铺开，没有内层滚动条**——不再是一个套在滚动页面里的小窗口，唯一滚动的就是卡片自己那一页。
+- **卡片内再按「账号 / 模型 / 诊断」分栏**（学自同族 `dsh-connect-workbuddy`）—— 上面那排地区是**作用域**（这张卡片讲的是哪个供应商），这一排是同一张卡片里的**分栏**：账号栏管「谁在服务、还剩多少、签到与账号池」，模型栏管「勾哪些模型、图片输入、上下文预算、保存」，诊断栏只读地列出面板名、供应商 id、服务账号、两种令牌到期时间、目录/已启用模型数、账号池与签到支持与否，以及本面板最近一次报错的**原文**。**4.4.7 起诊断栏还多一行「损坏副本留存」**：读不出来、因此被改名留存的账号副本会在这里被点名（连同它曾经保存了几个账号）——被顶掉的账号「去哪了」这个问题，从此不用再去 `~/.dsh` 里翻文件名；未登录那一屏也会显示同一条通知，因为账号消失之后用户落地的正是那一屏。分栏的理由是**提交语义不同**：账号改动点一下即生效，模型改动是草稿、必须点「保存」——一列长页会把保存按钮放到离它要保存的东西三屏之外。切栏不重新拉取、不丢未保存的模型草稿、账号池日志也不重建；未登录时不出分栏，那一屏说明不会被看不见的 tab 藏起来。**模型栏把所有模型一次性铺开，没有内层滚动条**——不再是一个套在滚动页面里的小窗口，唯一滚动的就是卡片自己那一页。
 - **账号池：自动选号 + 失败换号（默认关闭）** —— 本机读完几个账号后，「该用谁的额度」可以交给插件按规则排序：**先排除不可用的**（凭据被拒、套餐不覆盖、账号已不存在、限流未到重试时间、额度耗尽），再在可用账号里**优先快到期的那点额度**（与其放着过期，不如先花掉），最后才比总额、token 新鲜度，并以账号 id 兜底成**全序**（同样的输入永远得到同样的顺序，不会在两行之间来回抖）。三个面板**各有各的池**：国内版与企业版共用同一份 CN 凭据，但企业版只挑租户账号、国内版不会漂到租户号上。开着池时，发请求前先按上面的顺序选中一个账号，并且**真实请求失败会换下一个账号重试（最多 3 个）**——只有账号级失败才换（`401` 凭据被拒、额度耗尽、限流、上游 5xx）；模型 id 写错、请求本身不合法**不换号**，因为那不是账号的问题，换号只会把同一个错误烧两遍、还冤枉一个没机会服务的账号。换号失败的真相会写进池的探针记录，下一次排序直接把它排到后面，而每一次结论都能在卡片上看到：`可用` / `限流` / `额度耗尽` / `凭据被拒` / `套餐不覆盖` / `上游不提供` / `本次未测出`，以及「什么时候可以重试」。**关掉池就回到严格绑定**，不会有任何残留 override。卡片里的「全部测速」会把每个成员按目标模型各测一次，结果**边跑边显示**（一行一个答案，不等整批跑完），并落盘成下次排序的依据。
 
   > 池是**显式选择**：默认关闭。它不会替你在没打开池的情况下换账号——「换账号等于换人计费」，所以这件事只能由你点头。池打开后卡片会明确写出**当前是谁在付费**（Host 报告的是「下一个真正发送请求的账号」，不是保存的那个绑定）。

package/lib/client.js

@@ -1183,6 +1183,16 @@ window.__ModuleLoader__.load({
 .dsm-trae-searched-list li{display:flex;flex-direction:column;gap:1px;min-width:0}
 .dsm-trae-searched-list code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:11px;line-height:16px;color:var(--dsw-alias-label-secondary,#b8b8b8);word-break:break-all}
 .dsm-trae-searched-reason{color:var(--dsw-alias-label-tertiary,#999);font-size:11px}
+/* The quarantine notice: a copy that was kept aside instead of being erased.
+   It borrows the "probed paths" look but stands on its own class, because it
+   is a different KIND of fact — and because a screen may carry both. */
+.dsm-trae-quarantine{margin-top:8px;font-size:12px;line-height:18px;color:var(--dsw-alias-label-tertiary,#999)}
+.dsm-trae-quarantine>summary{cursor:pointer;color:var(--dsw-alias-label-secondary,#b8b8b8);user-select:none}
+.dsm-trae-quarantine-hint{margin:6px 0 4px;color:var(--dsw-alias-label-tertiary,#999)}
+.dsm-trae-quarantine-list{margin:0;padding:0;list-style:none;display:flex;flex-direction:column;gap:4px}
+.dsm-trae-quarantine-list li{display:flex;flex-direction:column;gap:1px;min-width:0}
+.dsm-trae-quarantine-list code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:11px;line-height:16px;color:var(--dsw-alias-label-secondary,#b8b8b8);word-break:break-all}
+.dsm-trae-quarantine-reason{color:var(--dsw-alias-label-tertiary,#999);font-size:11px}
 .dsm-trae-usage-cheer:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,#5686fe);outline-offset:2px}
 .dsm-trae-checkin{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:12px 16px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:14px;background:var(--dsw-alias-bg-layer-2,#24262c)}
 .dsm-trae-checkin-copy{display:flex;flex-direction:column;gap:2px;min-width:0}
@@ -5805,6 +5815,19 @@ window.__ModuleLoader__.load({
 														children: failures.join(" · ")
 													});
 												})()]
+											}),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+												className: "dsm-trae-diag-row",
+												children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+													className: "dsm-trae-diag-label",
+													children: t("row.diagQuarantine")
+												}), status.quarantined === void 0 || status.quarantined.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+													className: "dsm-trae-diag-value",
+													children: t("row.diagQuarantineNone")
+												}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+													className: "dsm-trae-diag-value dsm-trae-diag-bad dsm-trae-diag-mono",
+													children: status.quarantined.map((item) => item.quarantinedAs).join(" · ")
+												})]
 											})
 										]
 									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -5817,35 +5840,65 @@ window.__ModuleLoader__.load({
 									role: "status",
 									children: t("row.accountsLoading")
 								}) }) : null,
-								status.status === "signed-out" && !loading ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-									className: "dsm-trae-usage-text",
-									children: status.message ?? t("row.signedOutHint")
-								}), status.searched && status.searched.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("details", {
-									className: "dsm-trae-searched",
-									children: [
-										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("summary", { children: [
-											t("row.searchedTitle"),
-											" (",
-											status.searched.length,
-											")"
-										] }),
-										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-											className: "dsm-trae-searched-hint",
-											children: t("row.searchedHint")
-										}),
-										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
-											className: "dsm-trae-searched-list",
-											children: status.searched.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: item.path }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
-												className: "dsm-trae-searched-reason",
-												children: [
-													t(item.source === "cli" ? "row.sourceCli" : "row.sourceDesktop"),
-													" · ",
-													t(item.reason === "missing" ? "row.reasonMissing" : item.reason === "unreadable" ? "row.reasonUnreadable" : "row.reasonInvalid")
-												]
-											})] }, `${item.source}:${item.path}`))
-										})
-									]
-								}) : null] }) : null,
+								status.status === "signed-out" && !loading ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+										className: "dsm-trae-usage-text",
+										children: status.message ?? t("row.signedOutHint")
+									}),
+									status.quarantined && status.quarantined.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("details", {
+										className: "dsm-trae-quarantine",
+										open: true,
+										children: [
+											/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("summary", { children: [
+												t("row.quarantineTitle"),
+												" (",
+												status.quarantined.length,
+												")"
+											] }),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+												className: "dsm-trae-quarantine-hint",
+												children: t("row.quarantineHint")
+											}),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+												className: "dsm-trae-quarantine-list",
+												children: status.quarantined.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: item.quarantinedAs }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+													className: "dsm-trae-quarantine-reason",
+													children: [
+														item.accounts === void 0 ? t("row.quarantineAccountsUnknown") : t("row.quarantineAccounts", { count: item.accounts }),
+														" · ",
+														t("row.quarantineBytes", { bytes: item.bytes })
+													]
+												})] }, item.quarantinedAs))
+											})
+										]
+									}) : null,
+									status.searched && status.searched.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("details", {
+										className: "dsm-trae-searched",
+										children: [
+											/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("summary", { children: [
+												t("row.searchedTitle"),
+												" (",
+												status.searched.length,
+												")"
+											] }),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+												className: "dsm-trae-searched-hint",
+												children: t("row.searchedHint")
+											}),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+												className: "dsm-trae-searched-list",
+												children: status.searched.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: item.path }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+													className: "dsm-trae-searched-reason",
+													children: [
+														t(item.source === "cli" ? "row.sourceCli" : "row.sourceDesktop"),
+														" · ",
+														t(item.reason === "missing" ? "row.reasonMissing" : item.reason === "unreadable" ? "row.reasonUnreadable" : "row.reasonInvalid")
+													]
+												})] }, `${item.source}:${item.path}`))
+											})
+										]
+									}) : null
+								] }) : null,
 								status.status === "error" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 									className: "dsm-trae-usage-error",
 									children: status.message
@@ -6583,6 +6636,8 @@ window.__ModuleLoader__.load({
 			"row.diagRawOff": "not checked",
 			"row.diagFailures": "Last reported failure",
 			"row.diagNoFailures": "none",
+			"row.diagQuarantine": "Quarantined copies",
+			"row.diagQuarantineNone": "none",
 			"row.diagHint": "Everything above is read-only and can be quoted verbatim into a bug report. The values are this panel’s own last refresh, not a summary of it.",
 			"row.settingsWriteFailed": "The setting was not saved: {message}",
 			"row.signedOut": "Not signed in",
@@ -6590,6 +6645,11 @@ window.__ModuleLoader__.load({
 			"row.searchedTitle": "Paths checked",
 			"row.searchedHint": "No sign-in was found. These locations were probed; if your Trae stores its login elsewhere, please report the path.",
 			"row.searchedMore": "Show {count} more",
+			"row.quarantineTitle": "Quarantined credential copies",
+			"row.quarantineHint": "A credential copy could not be read, so the plugin did not overwrite it — it was renamed aside with its bytes intact. The accounts it held exist only in that file; delete it once you have them back.",
+			"row.quarantineAccounts": "{count} account(s)",
+			"row.quarantineAccountsUnknown": "account count unreadable",
+			"row.quarantineBytes": "{bytes} bytes",
 			"row.reasonMissing": "not found",
 			"row.reasonUnreadable": "unreadable",
 			"row.reasonInvalid": "unreadable format",
@@ -6953,6 +7013,8 @@ window.__ModuleLoader__.load({
 			"row.diagRawOff": "未检测",
 			"row.diagFailures": "最近一次报错",
 			"row.diagNoFailures": "无",
+			"row.diagQuarantine": "损坏副本留存",
+			"row.diagQuarantineNone": "无",
 			"row.diagHint": "以上全部只读，可整段原样贴进反馈。数值来自本面板最近一次刷新，不是概括。",
 			"row.settingsWriteFailed": "设置未能保存：{message}",
 			"row.signedOut": "未登录",
@@ -6960,6 +7022,11 @@ window.__ModuleLoader__.load({
 			"row.searchedTitle": "已检查的路径",
 			"row.searchedHint": "未找到登录信息。以下是插件探测过的位置；如果你的 Trae 把登录信息存在别处，请把该路径反馈给我们。",
 			"row.searchedMore": "展开其余 {count} 条",
+			"row.quarantineTitle": "被隔离的账号副本",
+			"row.quarantineHint": "有一份账号副本文件读不出来，插件没有覆盖它，而是改名留存（字节完整）。它曾经保存的账号只可能在那份文件里；确认已取回后删掉它即可不再提示。",
+			"row.quarantineAccounts": "含 {count} 个账号",
+			"row.quarantineAccountsUnknown": "账号数无法读取",
+			"row.quarantineBytes": "{bytes} 字节",
 			"row.reasonMissing": "文件不存在",
 			"row.reasonUnreadable": "无法读取",
 			"row.reasonInvalid": "格式无法识别",

package/lib/index.d.ts

@@ -1081,6 +1081,29 @@ interface TraeWebSearchPath {
   reason: 'missing' | 'unreadable' | 'invalid';
   message?: string;
 }
+/**
+ * A plugin-owned credential copy that was found unreadable and moved aside.
+ *
+ * Since 4.4.6 such a copy is quarantined (renamed aside, bytes intact)
+ * instead of being merged over, because merging over it would erase every
+ * account it carried. The copy then exists ONLY in that quarantine file — so
+ * the card says so, instead of the user discovering it by noticing accounts
+ * missing (issue #56).
+ *
+ * Only facts about the plugin's own file cross to the browser: its path, the
+ * size of the quarantine copy, and how many accounts it still shows. No token
+ * material, and no path outside DSH's own home.
+ */
+interface TraeWebQuarantine {
+  /** The live path the copy had before it was moved aside. */
+  file: string;
+  /** The quarantine copy's path; its name carries the moment it was taken. */
+  quarantinedAs: string;
+  /** Size of the quarantined copy in bytes (`0` when it could not be read). */
+  bytes: number;
+  /** Accounts the copy still shows, when it could be read as JSON. */
+  accounts?: number;
+}
 /**
  * Peel ONE `{get(): T}` live reference, the shape DSH 0.1.7 delivers a
  * volatile-marked settings field as (see {@link unwrapVolatileDeep}).
@@ -1229,6 +1252,12 @@ type TraeWebUsage = {
   accounts: readonly TraeWebAccount[];
   message?: string;
   searched?: readonly TraeWebSearchPath[];
+  /**
+   * Copies that were found unreadable and moved aside. Present on BOTH
+   * shapes on purpose: the signed-out screen is exactly where a user lands
+   * after a lost copy, so that is where the notice has to be.
+   */
+  quarantined?: readonly TraeWebQuarantine[];
   enabled?: boolean;
 } | {
   status: 'signed-in';
@@ -1249,6 +1278,12 @@ type TraeWebUsage = {
   accounts: readonly TraeWebAccount[];
   models: readonly TraeWebModel[];
   enabledModelIds: readonly string[];
+  /**
+   * Copies that were found unreadable and moved aside. Present on BOTH
+   * shapes on purpose: the signed-out screen is exactly where a user lands
+   * after a lost copy, so that is where the notice has to be.
+   */
+  quarantined?: readonly TraeWebQuarantine[];
   rawChat?: {
     state: 'disabled' | 'unchecked' | 'available' | 'protocol-gated' | 'authentication' | 'credit' | 'rate' | 'transport' | 'server';
     checkedAtMs?: number;
@@ -1786,6 +1821,34 @@ interface TraeCandidateFailure {
   reason: 'missing' | 'unreadable' | 'invalid';
   message?: string;
 }
+/**
+ * A plugin-owned copy that was found UNREADABLE and therefore moved aside.
+ *
+ * Since 4.4.6 a copy this build cannot parse is never merged over: it is
+ * renamed to `<file>.corrupt-<stamp>` (bytes intact, recoverable) and the merge
+ * restarts from a clean file. That trade — a quarantined copy instead of a
+ * silently emptied one — is only fair if the USER can see it happened, because
+ * the accounts the copy carried are, from that moment on, only in the
+ * quarantine file.
+ *
+ * This notice is what makes that visible: the card's diagnostics panel shows
+ * it, and so does the signed-out screen — which is exactly the state a user
+ * lands in after the loss (issue #56).
+ */
+interface TraeQuarantineNotice {
+  /** The live path the copy had before it was moved aside. */
+  file: string;
+  /** The quarantine copy's full path; its name carries the moment it was taken. */
+  quarantinedAs: string;
+  /** Size of the quarantined copy in bytes (`0` when it could not be read). */
+  bytes: number;
+  /**
+   * How many accounts the quarantined copy held, when it could still be read
+   * as JSON. A copy quarantined for being TORN cannot be counted, and this is
+   * then absent rather than guessed.
+   */
+  accounts?: number;
+}
 /**
  * Plugin-owned copy path for one region. Each region's store refreshes into
  * its own file so two simultaneously signed-in regions never overwrite each
@@ -2209,6 +2272,21 @@ declare class TraeCredentialStore {
    * files are skipped rather than propagated.
    */
   private readOwns;
+  /**
+   * The copies that were found unreadable and moved aside.
+   *
+   * SCANNED, not remembered: the quarantine file is itself the durable
+   * record (its name carries the moment it was taken), so the plugin does not
+   * keep a second, parallel ledger that could disagree with the disk. The
+   * notice therefore appears exactly as long as the evidence does — and
+   * disappears when the user deletes the quarantined copy, which is what
+   * "I have dealt with it" means.
+   *
+   * A notice is a FACT about the user's disk, never about their credentials:
+   * it names a path, a size and a count, and the path is the one the plugin
+   * owns (inside DSH's own home), never a Trae application directory.
+   */
+  quarantinedCopies(): Promise<TraeQuarantineNotice[]>;
   private refreshNow;
 }
 //#endregion

package/lib/index.js

@@ -4,9 +4,9 @@ import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completio
 import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { existsSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { copyFile, readFile, rename, rm, stat } from "node:fs/promises";
+import { copyFile, readFile, readdir, rename, rm, stat } from "node:fs/promises";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
@@ -2293,6 +2293,30 @@ async function writeOwn(path, credentials) {
 		dirMode: 448
 	});
 }
+/**
+* How many accounts a quarantined copy still shows, when it can be read at all.
+*
+* A copy is quarantined because this build could not PARSE it — but not every
+* unparseable copy is unreadable: a file whose JSON is intact yet carries a
+* version this build does not know still parses as JSON, and its account rows
+* are then countable. That number is what tells the user whether one account
+* or five went missing, so it is worth the attempt.
+*
+* A torn copy yields nothing: the count is then ABSENT rather than guessed,
+* because a wrong count is worse than no count.
+*/
+function countStoredAccounts(text) {
+	try {
+		const parsed = JSON.parse(text);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+		const document = parsed;
+		if (Array.isArray(document.credentials)) return document.credentials.length;
+		if (document.credential !== void 0) return 1;
+		return;
+	} catch {
+		return;
+	}
+}
 /** The key Trae stores the per-user region map under, beside the login itself. */
 const TRAE_USERTAG_STORAGE_KEY = "iCubeAuthInfo://usertag";
 /**
@@ -3115,6 +3139,54 @@ var TraeCredentialStore = class {
 		} catch {}
 		return copies;
 	}
+	/**
+	* The copies that were found unreadable and moved aside.
+	*
+	* SCANNED, not remembered: the quarantine file is itself the durable
+	* record (its name carries the moment it was taken), so the plugin does not
+	* keep a second, parallel ledger that could disagree with the disk. The
+	* notice therefore appears exactly as long as the evidence does — and
+	* disappears when the user deletes the quarantined copy, which is what
+	* "I have dealt with it" means.
+	*
+	* A notice is a FACT about the user's disk, never about their credentials:
+	* it names a path, a size and a count, and the path is the one the plugin
+	* owns (inside DSH's own home), never a Trae application directory.
+	*/
+	async quarantinedCopies() {
+		const notices = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const path of this.ownCandidates()) {
+			const directory = dirname(path);
+			const prefix = `${basename(path)}.corrupt-`;
+			let entries;
+			try {
+				entries = await readdir(directory);
+			} catch {
+				continue;
+			}
+			for (const name of entries) {
+				if (!name.startsWith(prefix)) continue;
+				const quarantinedAs = join(directory, name);
+				if (seen.has(quarantinedAs)) continue;
+				seen.add(quarantinedAs);
+				let bytes = 0;
+				let accounts;
+				try {
+					const text = await readFile(quarantinedAs, "utf8");
+					bytes = Buffer.byteLength(text);
+					accounts = countStoredAccounts(text);
+				} catch {}
+				notices.push({
+					file: path,
+					quarantinedAs,
+					bytes,
+					...accounts === void 0 ? {} : { accounts }
+				});
+			}
+		}
+		return notices;
+	}
 	async refreshNow(credential) {
 		if (credential.refreshToken === void 0 || credential.refreshExpiresAtMs !== void 0 && credential.refreshExpiresAtMs <= Date.now()) {
 			if (credential.expiresAtMs > Date.now() + 3e4) return credential;
@@ -8010,12 +8082,26 @@ async function traeWebUsage(deps, panel, options = {}) {
 	* would offer a binding that cannot work.
 	*/
 	const accounts = (await store.accounts()).filter((account) => panel !== "enterprise" || account.enterprise);
+	/**
+	* Copies that were found unreadable and moved aside (4.4.6+).
+	*
+	* Read ONCE per document and never allowed to fail it: a notice is a fact
+	* about the user's disk, and a card that failed to load would teach the user
+	* nothing about it. It is also the one piece of the document that explains a
+	* MISSING ACCOUNT, so it belongs on both shapes — the signed-out one
+	* especially, because that is where a lost copy leaves the user (issue #56).
+	*
+	* The scan is a directory listing beside the plugin's OWN files: cheap, and
+	* it reads nothing but file names and sizes.
+	*/
+	const quarantined = await Promise.resolve().then(() => store.quarantinedCopies()).catch(() => []);
 	if ((await store.status()).state !== "signed-in") {
 		const { failures } = await store.diagnose();
 		return {
 			status: "signed-out",
 			accounts,
 			enabled,
+			quarantined,
 			searched: failures.map((failure) => ({
 				path: failure.path,
 				edition: failure.edition,
@@ -8034,6 +8120,7 @@ async function traeWebUsage(deps, panel, options = {}) {
 			status: "signed-out",
 			accounts,
 			enabled,
+			quarantined,
 			message: safeMessage(error)
 		};
 	}
@@ -8050,6 +8137,7 @@ async function traeWebUsage(deps, panel, options = {}) {
 			...model.input === void 0 ? {} : { input: [...model.input] }
 		})),
 		enabledModelIds: [...deps.enabledModelIds(panel)],
+		quarantined,
 		...deps.rawDiagnostic === void 0 ? {} : { rawChat: deps.rawDiagnostic(panel) }
 	};
 	if (fast) {

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-trae",
   "displayName": "DSH Connect Trae",
   "description": "把本机登录的 Trae 模型接入 DeepSeek Harness：国内版与国际版双供应商并行，提供用量/积分概览与每日签到领取。",
-  "version": "4.4.6",
+  "version": "4.4.7",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",