dsh-connect-workbuddy 4.0.0 → 4.2.0

package/lib/client.js

@@ -70,12 +70,47 @@ window.__ModuleLoader__.load({
 		* splitting them would duplicate the guards and invite them to drift apart.
 		*/
 		const WORKBUDDY_POOL_PATH = "/plugins/dsh-connect-workbuddy/pool";
+		/**
+		* Plugin-owned OAuth sign-in endpoint: one session step per call.
+		*
+		* `?action=start` asks the upstream for a login state and returns the URL to
+		* open; `?action=poll` (+ `loginId` in the body) reports whether the user
+		* finished, and on success persists the account into the vault. POST +
+		* loopback-only like the card's other mutations: the poll carries the login
+		* binding, and the Host-side session state must not be settable by another
+		* origin.
+		*/
+		const WORKBUDDY_OAUTH_PATH = "/plugins/dsh-connect-workbuddy/oauth";
 		/** Query parameter selecting which pool batch action a request means. */
 		const WORKBUDDY_POOL_ACTION_PARAM = "action";
+		/** How long the card waits between polls while the user is scanning. */
+		const OAUTH_POLL_INTERVAL_MS = 2e3;
+		/**
+		* Plugin-owned account transfer endpoint: the batch export / import of
+		* credentials between machines and between tools of the SAME format family.
+		*
+		* `?action=export` POSTs account ids, answers a JSON ARRAY of credential
+		* records; `?action=preview` POSTs file text, answers a token-free listing;
+		* `?action=import` POSTs file text plus selected indexes, merges into the
+		* vault. POST + loopback-only like every other mutation: the file content is
+		* arbitrary user data and export carries token material.
+		*/
+		const WORKBUDDY_TRANSFER_PATH = "/plugins/dsh-connect-workbuddy/transfer";
 		/** Address one region's pool endpoint with an action. */
 		function withWorkBuddyRegionAndAction(path, region, action) {
 			return `${withWorkBuddyRegion(path, region)}&${WORKBUDDY_POOL_ACTION_PARAM}=${action}`;
 		}
+		/**
+		* Address one region's endpoint for ANY route that dispatches on `action`.
+		*
+		* The OAuth and transfer routes reject a request with no action (400), so
+		* their callers must build the URL here rather than with
+		* {@link withWorkBuddyRegion} — a request missing the parameter fails the same
+		* way whether the omission was a mistake or not.
+		*/
+		function withWorkBuddyRouteAction(path, region, action) {
+			return `${withWorkBuddyRegion(path, region)}&${WORKBUDDY_POOL_ACTION_PARAM}=${action}`;
+		}
 		/** Query parameter naming the region a card request addresses. */
 		const WORKBUDDY_REGION_PARAM = "region";
 		/** Every region, in card tab order. */
@@ -1091,7 +1126,7 @@ window.__ModuleLoader__.load({
 		* section implying the feature exists.
 		*/
 		function AccountPool(props) {
-			const { t, region, pool, settingsScope, siblingBusy, onBusyChange, onSaved, onRefresh, onRescan, rescanning, onSelectAccount, selectingAccount } = props;
+			const { t, region, pool, settingsScope, siblingBusy, onBusyChange, onSaved, onRefresh, onRescan, rescanning, onSelectAccount, selectingAccount, accountTools } = props;
 			const [draft, setDraft] = (0, react.useState)(null);
 			const [saving, setSaving] = (0, react.useState)(false);
 			const [saveError, setSaveError] = (0, react.useState)(void 0);
@@ -1367,6 +1402,98 @@ window.__ModuleLoader__.load({
 				region,
 				t
 			]);
+			/** The account whose per-row action is in flight; gates every row's buttons. */
+			const [rowBusyAccountId, setRowBusyAccountId] = (0, react.useState)(void 0);
+			/**
+			* Test ONE account from its row.
+			*
+			* Same Host rule as the batch (testOne reuses the batch's probe), the same
+			* log vocabulary, and the same refresh-after — a row result must read exactly
+			* like the batch result it replaces.
+			*/
+			const runRowTest = (0, react.useCallback)(async (accountId) => {
+				setRowBusyAccountId(accountId);
+				setActionError(void 0);
+				const url = withWorkBuddyRegionAndAction(WORKBUDDY_POOL_PATH, region, "test") + "&accountId=" + encodeURIComponent(accountId);
+				try {
+					const response = await fetch(url, {
+						method: "POST",
+						headers: { accept: "application/json" },
+						credentials: "same-origin"
+					});
+					const body = await response.json().catch(() => void 0);
+					if (!response.ok) throw new Error(poolFailureText(t, {
+						status: response.status,
+						reason: body?.reason,
+						error: body?.error
+					}));
+					if (!mounted.current) return;
+					const row = body?.rows?.[0];
+					if (row === void 0) {
+						setActionError(t("row.poolLogTestRowMalformed", { accountName: t("row.accountUnnamed") }));
+						return;
+					}
+					const outcome = row.result?.outcome;
+					if (outcome === void 0) appendLog(t("row.poolLogTestRowMalformed", { accountName: row.accountName === "" ? t("row.accountUnnamed") : row.accountName }), "warn");
+					else appendLog(t("row.poolLogTestRow", {
+						accountName: row.accountName === "" ? t("row.accountUnnamed") : row.accountName,
+						outcome: outcomeText(t, outcome)
+					}), outcomeOk(outcome) ? "ok" : "warn");
+					onRefresh?.();
+				} catch (error) {
+					const message = error instanceof Error ? error.message : t("row.requestFailed");
+					if (mounted.current) {
+						setActionError(message);
+						appendLog(t("row.poolLogBatchFailed", { message }), "error");
+					}
+				} finally {
+					if (mounted.current) setRowBusyAccountId(void 0);
+				}
+			}, [
+				appendLog,
+				onRefresh,
+				region,
+				t
+			]);
+			/**
+			* Remove ONE account's plugin-stored credential from its row. The Host only
+			* ever deletes the vault entry; a desktop sign-in reappears on the next
+			* rescan, and the message below says which of the two happened.
+			*/
+			const runRowRemove = (0, react.useCallback)(async (accountId, accountName) => {
+				setRowBusyAccountId(accountId);
+				setActionError(void 0);
+				const url = withWorkBuddyRegionAndAction(WORKBUDDY_POOL_PATH, region, "remove") + "&accountId=" + encodeURIComponent(accountId);
+				try {
+					const response = await fetch(url, {
+						method: "POST",
+						headers: { accept: "application/json" },
+						credentials: "same-origin"
+					});
+					const body = await response.json().catch(() => void 0);
+					if (!response.ok) throw new Error(poolFailureText(t, {
+						status: response.status,
+						reason: body?.reason,
+						error: body?.error
+					}));
+					if (!mounted.current) return;
+					appendLog(body?.removed === true ? t("row.poolRowRemoved", { accountName: accountName === "" ? t("row.accountUnnamed") : accountName }) : t("row.poolRowRemoveDesktopOnly", { accountName: accountName === "" ? t("row.accountUnnamed") : accountName }), body?.removed === true ? "ok" : "info");
+					onRefresh?.();
+				} catch (error) {
+					const message = error instanceof Error ? error.message : t("row.requestFailed");
+					if (mounted.current) {
+						setActionError(message);
+						appendLog(t("row.poolLogBatchFailed", { message }), "error");
+					}
+				} finally {
+					if (mounted.current) setRowBusyAccountId(void 0);
+				}
+			}, [
+				appendLog,
+				onRefresh,
+				region,
+				t
+			]);
 			if (pool === void 0) return null;
 			/**
 			* Where the target model came from, and which model it is.
@@ -1439,13 +1566,22 @@ window.__ModuleLoader__.load({
 				className: "dsm-btn dsm-btn-outline dsm-workbuddy-pool-small-btn",
 				disabled: effectiveMembers.length === 0 || !canEditPool,
 				onClick: () => selectAll(false)
-			}, t("row.poolSelectNone")))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-table" }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-row dsm-workbuddy-pool-row-head" }, (0, react.createElement)("span", null, t("row.poolColumnAccount")), (0, react.createElement)("span", null, t("row.poolColumnCredits")), (0, react.createElement)("span", null, t("row.poolColumnProbe")), pool.checkinSupported ? (0, react.createElement)("span", null, t("row.poolColumnCheckin")) : null), ...pool.accounts.map((account) => renderAccountRow({
+			}, t("row.poolSelectNone")))), (0, react.createElement)("div", { className: `dsm-workbuddy-pool-table${pool.checkinSupported ? " dsm-workbuddy-pool-table-checkin" : ""}` }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-row dsm-workbuddy-pool-row-head" }, (0, react.createElement)("span", null, t("row.poolColumnAccount")), (0, react.createElement)("span", null, t("row.poolColumnCredits")), (0, react.createElement)("span", null, t("row.poolColumnProbe")), pool.checkinSupported ? (0, react.createElement)("span", null, t("row.poolColumnCheckin")) : null, (0, react.createElement)("span", null)), ...pool.accounts.map((account) => renderAccountRow({
 				t,
 				account,
 				checked: active.memberAccountIds.includes(account.accountId),
 				canEdit: canEditPool,
 				checkinSupported: pool.checkinSupported,
-				onToggle: (next) => toggleMember(account.accountId, next)
+				onToggle: (next) => toggleMember(account.accountId, next),
+				busy: rowBusyAccountId !== void 0,
+				testDisabled: pool.targetModelSource === "none" || pool.targetModelSource === "stale",
+				targetHint: pool.targetModelSource === "none" ? t("row.poolTargetNone") : pool.targetModelSource === "stale" ? t("row.poolTargetStale", { model: pool.staleTargetModelId ?? "" }) : void 0,
+				onTest: () => {
+					runRowTest(account.accountId);
+				},
+				onRemove: () => {
+					runRowRemove(account.accountId, account.accountName);
+				}
 			}))), effectiveMembers.length === 0 ? (0, react.createElement)("p", {
 				className: "dsm-workbuddy-pool-warn",
 				role: "status"
@@ -1483,7 +1619,8 @@ window.__ModuleLoader__.load({
 				},
 				onDiscard: discard,
 				appendLog,
-				targetProvenance
+				targetProvenance,
+				...accountTools === void 0 ? {} : { accountTools }
 			}), (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolRegionNote")), renderLog({
 				t,
 				log,
@@ -1496,7 +1633,7 @@ window.__ModuleLoader__.load({
 		}
 		/** One account's row. */
 		function renderAccountRow(input) {
-			const { t, account, checked, canEdit, checkinSupported, onToggle } = input;
+			const { t, account, checked, canEdit, checkinSupported, onToggle, busy, testDisabled, targetHint, onTest, onRemove } = input;
 			const name = account.accountName === "" ? t("row.accountUnnamed") : account.accountName;
 			const excluded = exclusionText(t, account.excludedBy);
 			const probe = account.probe;
@@ -1537,11 +1674,24 @@ window.__ModuleLoader__.load({
 			}, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-main" }, probeLine), probeLabel === void 0 && age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-prov" }, probeLabel === void 0 ? null : (0, react.createElement)("span", { className: probeLabel.className }, probeLabel.text), probeLabel === void 0 || age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-sep" }, "·"), age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-age" }, age))), checkinSupported ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checkin" }, account.checkedInToday === void 0 ? (0, react.createElement)("span", {
 				className: "dsm-workbuddy-pool-unknown",
 				title: t("row.poolNeverTested")
-			}, t("row.poolCheckinUnknown")) : account.checkedInToday ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checked" }, t("row.poolCheckedIn")) : t("row.poolNotCheckedIn")) : null);
+			}, t("row.poolCheckinUnknown")) : account.checkedInToday ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checked" }, t("row.poolCheckedIn")) : t("row.poolNotCheckedIn")) : null, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-row-actions" }, (0, react.createElement)("button", {
+				type: "button",
+				className: "dsm-btn dsm-btn-outline dsm-workbuddy-pool-small-btn",
+				disabled: busy || testDisabled,
+				title: testDisabled ? targetHint : void 0,
+				onClick: onTest
+			}, t("row.poolRowTest")), (0, react.createElement)("button", {
+				type: "button",
+				className: "dsm-btn dsm-btn-outline dsm-workbuddy-pool-small-btn",
+				disabled: busy,
+				title: t("row.poolRowRemoveHint"),
+				"aria-label": t("row.poolRowRemoveAria", { accountName: name }),
+				onClick: onRemove
+			}, t("row.poolRowRemove"))));
 		}
 		/** The preference editor plus its save/discard actions. */
 		function renderSettings(input) {
-			const { t, pool, active, dirty, saving, siblingBusy, saveError, settingsScope, onEdit, onSave, onDiscard, targetProvenance } = input;
+			const { t, pool, active, dirty, saving, siblingBusy, saveError, settingsScope, onEdit, onSave, onDiscard, targetProvenance, accountTools } = input;
 			const canEdit = settingsScope !== void 0;
 			const toggle = (label, hint, checked, onChange, disabled = false) => (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, label), (0, react.createElement)("span", null, hint)), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("label", { className: "sw" }, (0, react.createElement)("input", {
 				type: "checkbox",
@@ -1549,7 +1699,7 @@ window.__ModuleLoader__.load({
 				disabled: disabled || !canEdit,
 				onChange: (event) => onChange(event.currentTarget.checked)
 			}), (0, react.createElement)("span", { className: "sw-track" }))));
-			return (0, react.createElement)("div", { className: "dsm-workbuddy-pool-settings-wrap" }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-head" }, (0, react.createElement)("h3", { className: "dsm-workbuddy-pool-title" }, t("row.poolSettingsTitle")), dirty ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-dirty" }, t("row.poolDirty")) : null), (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolSettingsHint")), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-settings" }, toggle(t("row.poolEnabled"), t("row.poolEnabledHint"), active.enabled, (next) => onEdit((current) => ({
+			return (0, react.createElement)("div", { className: "dsm-workbuddy-pool-settings-wrap" }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-head" }, (0, react.createElement)("h3", { className: "dsm-workbuddy-pool-title" }, t("row.poolSettingsTitle")), dirty ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-dirty" }, t("row.poolDirty")) : null), accountTools === void 0 ? null : (0, react.createElement)("div", { className: "dsm-workbuddy-pool-tools" }, accountTools), (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolSettingsHint")), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-settings" }, toggle(t("row.poolEnabled"), t("row.poolEnabledHint"), active.enabled, (next) => onEdit((current) => ({
 				...current,
 				enabled: next
 			}))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, t("row.poolTargetLabel")), (0, react.createElement)("span", null, targetProvenance === null ? null : `${targetProvenance} `, t("row.poolTargetHint"))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("select", {
@@ -1621,6 +1771,534 @@ window.__ModuleLoader__.load({
 			}, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-log-time" }, formatClock$1(entry.atMs)), (0, react.createElement)("span", { className: `dsm-workbuddy-pool-log-text dsm-workbuddy-pool-log-${entry.tone}` }, entry.text)))));
 		}
 		//#endregion
+		//#region src/client/OAuthSignIn.tsx
+		/**
+		* The card's OAuth QR sign-in section.
+		*
+		* 参考：扫码登录的通行形态 —— 发起登录 → 打开授权页 →
+		*   轮询到完成为止 → 展示结果。本实现把轮询循环压成一个组件内 effect：
+		*   打开授权页的是用户点击的链接（浏览器标签页，非弹窗），组件只负责
+		*   按 `OAUTH_POLL_INTERVAL_MS` 节奏问 Host「完成了吗」，完成即停。
+		*
+		* 为什么不用 window.open：卡片运行在 Harness 的设置页 iframe/沙箱里，弹窗
+		*   会被拦截；把授权 URL 渲染成普通链接（target=_blank rel=noopener）是
+		*   沙箱内最可靠的方式，用户也可以复制链接到手机上继续（URL 即登录态）。
+		*
+		* 所有状态就地管理，零跨组件往返：取消 = 停止轮询 + 清理 loginId；
+		* Host 重启导致 loginId 失效会得到 done+error，与超时同一条文案路径。
+		*
+		* @module dsh-connect-workbuddy/client/OAuthSignIn
+		*/
+		/** Seconds since the login started, for the waiting line. */
+		function elapsedSeconds(sinceMs, nowMs) {
+			return Math.max(0, Math.floor((nowMs - sinceMs) / 1e3));
+		}
+		/**
+		* The section. Rendered on BOTH sign-in states: a signed-out machine gains
+		* its first account here; a signed-in one can add another without leaving
+		* the card.
+		*/
+		function OAuthSignIn({ t, region }) {
+			const [phase, setPhase] = (0, react.useState)({ kind: "idle" });
+			const [pollTick, setPollTick] = (0, react.useState)(0);
+			const [nowMs, setNowMs] = (0, react.useState)(() => Date.now());
+			const mounted = (0, react.useRef)(true);
+			(0, react.useEffect)(() => {
+				mounted.current = true;
+				return () => {
+					mounted.current = false;
+				};
+			}, []);
+			const waiting = phase.kind === "waiting";
+			(0, react.useEffect)(() => {
+				if (!waiting || phase.kind !== "waiting") return;
+				const expiresAtMs = phase.expiresAtMs;
+				const timer = setInterval(() => {
+					if (!mounted.current) return;
+					const now = Date.now();
+					setNowMs(now);
+					if (now > expiresAtMs) setPhase({
+						kind: "finished",
+						message: "error",
+						error: t("row.oauthTimedOut")
+					});
+				}, 1e3);
+				return () => {
+					clearInterval(timer);
+				};
+			}, [waiting, phase]);
+			(0, react.useEffect)(() => {
+				if (phase.kind !== "waiting") return;
+				const { loginId } = phase;
+				let cancelled = false;
+				const timer = setTimeout(() => {
+					(async () => {
+						try {
+							const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_OAUTH_PATH, region, "poll"), {
+								method: "POST",
+								headers: {
+									"content-type": "application/json",
+									accept: "application/json"
+								},
+								credentials: "same-origin",
+								body: JSON.stringify({ loginId })
+							});
+							const body = await response.json();
+							if (cancelled || !mounted.current) return;
+							if (!response.ok || !body || typeof body !== "object") {
+								setPhase({
+									kind: "finished",
+									message: "error",
+									error: `HTTP ${response.status}`
+								});
+								return;
+							}
+							if (!body.done) {
+								setPollTick((tick) => tick + 1);
+								return;
+							}
+							if (typeof body.error === "string" && body.error !== "") setPhase({
+								kind: "finished",
+								message: "error",
+								error: body.error
+							});
+							else setPhase({
+								kind: "finished",
+								message: "added",
+								accountName: body.accountName ?? ""
+							});
+						} catch {
+							setPollTick((tick) => tick + 1);
+						}
+					})();
+				}, OAUTH_POLL_INTERVAL_MS);
+				return () => {
+					cancelled = true;
+					clearTimeout(timer);
+				};
+			}, [
+				phase,
+				pollTick,
+				region
+			]);
+			const start = async () => {
+				setPhase({ kind: "opening" });
+				try {
+					const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_OAUTH_PATH, region, "start"), {
+						method: "POST",
+						headers: { accept: "application/json" },
+						credentials: "same-origin"
+					});
+					const body = await response.json();
+					if (!mounted.current) return;
+					if (!response.ok || typeof body.loginId !== "string" || typeof body.verificationUri !== "string") {
+						setPhase({
+							kind: "finished",
+							message: "error",
+							error: body.error ?? `HTTP ${response.status}`
+						});
+						return;
+					}
+					setPhase({
+						kind: "waiting",
+						loginId: body.loginId,
+						verificationUri: body.verificationUri,
+						startedAtMs: Date.now(),
+						expiresAtMs: Date.now() + (typeof body.expiresIn === "number" && body.expiresIn > 0 ? body.expiresIn : 600) * 1e3
+					});
+					setNowMs(Date.now());
+				} catch (error) {
+					if (mounted.current) setPhase({
+						kind: "finished",
+						message: "error",
+						error: error instanceof Error ? error.message : String(error)
+					});
+				}
+			};
+			if (phase.kind === "finished") {
+				const text = phase.message === "added" ? t("row.oauthDone", { accountName: phase.accountName === "" || phase.accountName === void 0 ? t("row.accountUnnamed") : phase.accountName }) : phase.message === "cancelled" ? t("row.oauthCancelled") : t("row.oauthError", { message: phase.error ?? "" });
+				return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+					className: "dsm-workbuddy-bar",
+					"aria-label": t("row.oauthTitle"),
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: `dsm-workbuddy-bar-status ${phase.message === "added" ? "dsm-workbuddy-bar-ok" : "dsm-workbuddy-bar-error"}`,
+						children: text
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: "dsm-btn dsm-btn-outline",
+						onClick: () => {
+							setPhase({ kind: "idle" });
+						},
+						children: t("row.oauthStart")
+					})]
+				});
+			}
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: "dsm-workbuddy-bar",
+				"aria-label": t("row.oauthTitle"),
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					className: "dsm-workbuddy-bar-label",
+					children: t("row.oauthTitle")
+				}), phase.kind === "waiting" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+						className: "dsm-workbuddy-bar-status",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+								href: phase.verificationUri,
+								target: "_blank",
+								rel: "noopener noreferrer",
+								children: t("row.oauthOpen")
+							}),
+							" — ",
+							t("row.oauthOpened")
+						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+						className: "dsm-workbuddy-bar-hint",
+						children: [
+							t("row.oauthWaiting", { seconds: elapsedSeconds(phase.startedAtMs, nowMs) }),
+							" ",
+							t("row.oauthExpires", { minutes: Math.max(1, Math.round((phase.expiresAtMs - nowMs) / 6e4)) })
+						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: "dsm-btn dsm-btn-outline",
+						onClick: () => {
+							setPhase({
+								kind: "finished",
+								message: "cancelled"
+							});
+						},
+						children: t("row.oauthCancel")
+					})
+				] }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+					type: "button",
+					className: "dsm-btn dsm-btn-outline",
+					disabled: phase.kind === "opening",
+					onClick: () => {
+						start();
+					},
+					children: phase.kind === "opening" ? t("row.oauthStarting") : t("row.oauthStart")
+				})]
+			});
+		}
+		//#endregion
+		//#region src/client/AccountTransfer.tsx
+		/**
+		* The card's account-transfer section: batch export / import of the region's
+		* stored credentials, in the file format shared with sibling credential
+		* managers for the same upstream.
+		*
+		* 参考：扫码登录小节（OAuthSignIn）的组件形态 —— 单个 section、就地管理
+		*   全部状态（busy / 结果行 / 错误）、零跨组件往返。导出弹框的交互（多选
+		*   账号 → 下载 JSON）与导入弹框（选文件 → 脱敏预览 → 勾选 → 导入）沿用
+		*   通行实现的步骤划分；预览只含展示字段与 hasToken 布尔量，token 明文
+		*   永不进入浏览器。
+		*
+		* 导出用 <a download> Blob：卡片运行在设置页 iframe 里，无宿主保存对话框
+		*   可用；a[download] 同源下载是沙箱内最可靠的方式。
+		*
+		* @module dsh-connect-workbuddy/client/AccountTransfer
+		*/
+		/** Build the default export file name: workbuddy-accounts-YYYY-MM-DD.json. */
+		function exportFileName() {
+			const pad = (value) => String(value).padStart(2, "0");
+			const d = /* @__PURE__ */ new Date();
+			return `workbuddy-accounts-${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}.json`;
+		}
+		/** Download a JSON array as a local file (no host save dialog inside the iframe). */
+		function downloadJson(fileName, data) {
+			const blob = new Blob([JSON.stringify(data, null, 2)], { type: "application/json" });
+			const url = URL.createObjectURL(blob);
+			const anchor = document.createElement("a");
+			anchor.href = url;
+			anchor.download = fileName;
+			document.body.appendChild(anchor);
+			anchor.click();
+			anchor.remove();
+			URL.revokeObjectURL(url);
+		}
+		/** The section. Rendered on both sign-in states — a signed-out machine can
+		* still import a file exported elsewhere; export without accounts answers
+		* the error line. */
+		function AccountTransfer({ t, region, accounts }) {
+			const [phase, setPhase] = (0, react.useState)({ kind: "idle" });
+			const [dialog, setDialog] = (0, react.useState)(void 0);
+			const [selected, setSelected] = (0, react.useState)(/* @__PURE__ */ new Set());
+			const [preview, setPreview] = (0, react.useState)(void 0);
+			const [importSelected, setImportSelected] = (0, react.useState)(/* @__PURE__ */ new Set());
+			const fileInput = (0, react.useRef)(null);
+			const mounted = (0, react.useRef)(true);
+			(0, react.useEffect)(() => {
+				mounted.current = true;
+				return () => {
+					mounted.current = false;
+				};
+			}, []);
+			const closeDialog = () => {
+				setDialog(void 0);
+				setSelected(/* @__PURE__ */ new Set());
+				setPreview(void 0);
+				setImportSelected(/* @__PURE__ */ new Set());
+			};
+			const runExport = async () => {
+				if (selected.size === 0) return;
+				setPhase({ kind: "exporting" });
+				try {
+					const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_TRANSFER_PATH, region, "export"), {
+						method: "POST",
+						headers: {
+							"content-type": "application/json",
+							accept: "application/json"
+						},
+						credentials: "same-origin",
+						body: JSON.stringify({ accountIds: [...selected] })
+					});
+					const body = await response.json();
+					if (!mounted.current) return;
+					if (!response.ok || !Array.isArray(body.accounts)) {
+						setPhase({
+							kind: "error",
+							message: body.error ?? `HTTP ${response.status}`
+						});
+						return;
+					}
+					downloadJson(exportFileName(), body.accounts);
+					closeDialog();
+					setPhase({
+						kind: "done",
+						message: t("row.transferExported", {
+							count: body.accounts.length,
+							fileName: exportFileName()
+						})
+					});
+				} catch (error) {
+					if (mounted.current) setPhase({
+						kind: "error",
+						message: error instanceof Error ? error.message : String(error)
+					});
+				}
+			};
+			const readImportFile = async (file) => {
+				setPhase({ kind: "importing" });
+				try {
+					const text = await file.text();
+					const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_TRANSFER_PATH, region, "preview"), {
+						method: "POST",
+						headers: {
+							"content-type": "application/json",
+							accept: "application/json"
+						},
+						credentials: "same-origin",
+						body: JSON.stringify({ text })
+					});
+					const body = await response.json();
+					if (!mounted.current) return;
+					if (!response.ok || !Array.isArray(body.accounts)) {
+						setPhase({
+							kind: "error",
+							message: body.error ?? `HTTP ${response.status}`
+						});
+						return;
+					}
+					setPreview(body);
+					setImportSelected(new Set(body.accounts.filter((entry) => entry.hasToken).map((entry) => entry.index)));
+					setPhase({ kind: "idle" });
+				} catch (error) {
+					if (mounted.current) setPhase({
+						kind: "error",
+						message: error instanceof Error ? error.message : String(error)
+					});
+				}
+			};
+			const runImport = async () => {
+				if (preview === void 0 || importSelected.size === 0 || fileInput.current?.files?.[0] === void 0) return;
+				setPhase({ kind: "importing" });
+				try {
+					const text = await fileInput.current.files[0].text();
+					const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_TRANSFER_PATH, region, "import"), {
+						method: "POST",
+						headers: {
+							"content-type": "application/json",
+							accept: "application/json"
+						},
+						credentials: "same-origin",
+						body: JSON.stringify({
+							text,
+							indexes: [...importSelected]
+						})
+					});
+					const body = await response.json();
+					if (!mounted.current) return;
+					if (!response.ok || typeof body.imported !== "number") {
+						setPhase({
+							kind: "error",
+							message: body.error ?? `HTTP ${response.status}`
+						});
+						return;
+					}
+					closeDialog();
+					setPhase({
+						kind: "done",
+						message: t("row.transferImported", {
+							imported: body.imported,
+							skipped: body.skipped ?? 0
+						})
+					});
+				} catch (error) {
+					if (mounted.current) setPhase({
+						kind: "error",
+						message: error instanceof Error ? error.message : String(error)
+					});
+				}
+			};
+			const busy = phase.kind === "exporting" || phase.kind === "importing";
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: "dsm-workbuddy-bar",
+				"aria-label": t("row.transferTitle"),
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsm-workbuddy-bar-label",
+						children: t("row.transferTitle")
+					}),
+					phase.kind === "done" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsm-workbuddy-bar-status dsm-workbuddy-bar-ok",
+						children: phase.message
+					}) : phase.kind === "error" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsm-workbuddy-bar-status dsm-workbuddy-bar-error",
+						children: t("row.transferError", { message: phase.message })
+					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dsm-workbuddy-bar-actions",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: "dsm-btn dsm-btn-outline",
+							disabled: busy || accounts.length === 0,
+							onClick: () => {
+								setSelected(/* @__PURE__ */ new Set());
+								setDialog("export");
+							},
+							children: t("row.transferExport")
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: "dsm-btn dsm-btn-outline",
+							disabled: busy,
+							onClick: () => {
+								setPreview(void 0);
+								setImportSelected(/* @__PURE__ */ new Set());
+								setDialog("import");
+							},
+							children: t("row.transferImport")
+						})]
+					}),
+					dialog === "export" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dsm-workbuddy-transfer-dialog",
+						role: "dialog",
+						"aria-label": t("row.transferExport"),
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.transferExportPick", { total: accounts.length }) }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dsm-workbuddy-hint",
+								children: t("row.transferHint")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+								className: "dsm-workbuddy-transfer-list",
+								children: accounts.map((account) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+										type: "checkbox",
+										checked: selected.has(account.id),
+										onChange: (event) => {
+											const next = new Set(selected);
+											if (event.target.checked) next.add(account.id);
+											else next.delete(account.id);
+											setSelected(next);
+										}
+									}),
+									" ",
+									account.accountName === "" ? t("row.accountUnnamed") : account.accountName
+								] }) }, account.id))
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dsm-workbuddy-transfer-dialog-actions",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "dsm-btn dsm-btn-outline",
+									onClick: closeDialog,
+									children: t("row.transferCancel")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "dsm-btn dsm-btn-outline",
+									disabled: selected.size === 0 || phase.kind === "exporting",
+									onClick: () => {
+										runExport();
+									},
+									children: phase.kind === "exporting" ? t("row.transferExporting") : t("row.transferExportConfirm", { count: selected.size })
+								})]
+							})
+						]
+					}) : null,
+					dialog === "import" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dsm-workbuddy-transfer-dialog",
+						role: "dialog",
+						"aria-label": t("row.transferImport"),
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.transferImportPick") }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								ref: fileInput,
+								type: "file",
+								accept: "application/json,.json",
+								disabled: busy,
+								onChange: (event) => {
+									const file = event.target.files?.[0];
+									if (file !== void 0) readImportFile(file);
+								}
+							}),
+							preview === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.transferPreviewTotal", { total: preview.total }) }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+									className: "dsm-workbuddy-transfer-list",
+									children: preview.accounts.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+											type: "checkbox",
+											disabled: !entry.hasToken,
+											checked: importSelected.has(entry.index),
+											onChange: (event) => {
+												const next = new Set(importSelected);
+												if (event.target.checked) next.add(entry.index);
+												else next.delete(entry.index);
+												setImportSelected(next);
+											}
+										}),
+										" ",
+										entry.nickname !== "" ? entry.nickname : entry.email !== "" ? entry.email : entry.uid !== "" ? entry.uid : t("row.transferEntryUnknown"),
+										entry.hasToken ? "" : ` — ${t("row.transferNoToken")}`
+									] }) }, entry.index))
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									className: "dsm-workbuddy-transfer-dialog-actions",
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsm-btn dsm-btn-outline",
+										onClick: closeDialog,
+										children: t("row.transferCancel")
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsm-btn dsm-btn-outline",
+										disabled: importSelected.size === 0 || phase.kind === "importing",
+										onClick: () => {
+											runImport();
+										},
+										children: phase.kind === "importing" ? t("row.transferImporting") : t("row.transferImportConfirm", { count: importSelected.size })
+									})]
+								})
+							] })
+						]
+					}) : null
+				]
+			});
+		}
+		//#endregion
 		//#region src/native-modality.ts
 		/**
 		* Reviewed vendor classifications, keyed by EXACT model id (never a prefix).
@@ -1845,7 +2523,9 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-pool-warn{margin:0;padding:9px 11px;border-radius:9px;font-size:12px;line-height:17px;color:var(--dsw-alias-state-warn-primary,#f59e0b);background:rgba(245,158,11,.09);border:1px solid rgba(245,158,11,.3)}
 .dsm-workbuddy-pool-error{margin:0;font-size:12px;line-height:17px;color:var(--dsw-alias-state-error-primary,#ef4444);white-space:pre-line}
 .dsm-workbuddy-pool-table{border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:12px;overflow:hidden;background:var(--dsw-alias-bg-layer-2,#24262c)}
-.dsm-workbuddy-pool-row{display:grid;grid-template-columns:1.6fr 1fr 1.3fr .9fr;gap:10px;align-items:center;padding:10px 14px;border-top:1px solid var(--dsw-alias-border-l1,#2c2d31);font-size:13px;color:var(--dsw-alias-label-secondary,#c6c9d0)}
+.dsm-workbuddy-pool-row{display:grid;grid-template-columns:1.6fr 1fr 1.3fr .9fr .8fr;gap:10px;align-items:center;padding:10px 14px;border-top:1px solid var(--dsw-alias-border-l1,#2c2d31);font-size:13px;color:var(--dsw-alias-label-secondary,#c6c9d0)}
+/* No check-in column (the international region): the freed track goes to the actions. */
+.dsm-workbuddy-pool-table:not(.dsm-workbuddy-pool-table-checkin) .dsm-workbuddy-pool-row{grid-template-columns:1.6fr 1fr 1.3fr 1.7fr}
 .dsm-workbuddy-pool-row:first-child{border-top:0}
 .dsm-workbuddy-pool-row-head{padding:8px 14px;background:var(--dsw-alias-bg-layer-3,#2a2c33);color:var(--dsw-alias-label-tertiary,#999);font-size:11px;font-weight:600;letter-spacing:.02em;text-transform:uppercase}
 .dsm-workbuddy-pool-row-current{background:rgba(86,134,254,.07)}
@@ -1889,6 +2569,12 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-pool-settings-wrap{display:flex;flex-direction:column;gap:10px}
 .dsm-workbuddy-pool-dirty{font-size:12px;line-height:18px;font-weight:500;color:var(--dsw-alias-state-warn-primary,#f59e0b)}
 .dsm-workbuddy-pool-settings{display:flex;flex-direction:column;gap:1px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:12px;overflow:hidden;background:var(--dsw-alias-bg-layer-2,#24262c)}
+/* QR sign-in + export/import, hosted inside the pool settings block.
+   The block's own bordered rows belong to the SAVED preferences, so these
+   get their own container: same rhythm (12px 14px) so the two read as one
+   group, but a dashed edge marking them as immediate actions rather than
+   drafts the Save button below would commit. */
+.dsm-workbuddy-pool-tools{display:flex;flex-direction:column;gap:2px;border:1px dashed var(--dsw-alias-border-l2,#3a3d45);border-radius:12px;padding:4px 10px}
 .dsm-workbuddy-pool-set{display:flex;align-items:flex-start;justify-content:space-between;gap:16px;padding:12px 14px;border-top:1px solid var(--dsw-alias-border-l1,#2c2d31)}
 .dsm-workbuddy-pool-set:first-child{border-top:0}
 .dsm-workbuddy-pool-set-copy{display:flex;flex-direction:column;gap:3px;min-width:0;flex:1}
@@ -1918,6 +2604,9 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-pool-log-error{color:var(--dsw-alias-state-error-primary,#ef4444)}
 .dsm-workbuddy-pool-log-info{color:var(--dsw-alias-label-secondary,#c6c9d0)}
 .dsm-workbuddy-pool-log-empty{padding:14px;font-size:12px;color:var(--dsw-alias-label-tertiary,#999)}
+/* Per-row actions (test / remove), right side of each pool row. */
+.dsm-workbuddy-pool-row-actions{display:flex;gap:6px;align-items:center;justify-content:flex-end;flex:none}
+.dsm-workbuddy-pool-row-actions .dsm-workbuddy-pool-small-btn{padding:2px 10px;font-size:12px}
 @media (max-width:760px){.dsm-workbuddy-pool-row{grid-template-columns:1fr 1fr;row-gap:6px}.dsm-workbuddy-pool-select{max-width:180px}}
 /* Pool switch, namespaced under .dsm-workbuddy-pool so it cannot collide with host styles. */
 .dsm-workbuddy-pool .sw{position:relative;display:inline-block;width:38px;height:22px;flex:none;cursor:pointer}
@@ -1928,6 +2617,34 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-pool .sw input:checked+.sw-track::after{transform:translateX(16px)}
 .dsm-workbuddy-pool .sw input:disabled+.sw-track{opacity:.4}
 .dsm-workbuddy-pool .sw input:disabled{cursor:default}
+/* Account action bars: QR sign-in and export/import.
+   One row each — label, live status, actions — instead of a padded block
+   per feature. The bar is the resting height; only an open dialog (below)
+   grows vertically, so the card does not scroll past a wall of chrome to
+   reach the buttons. Status text shares the row rather than claiming its own,
+   and is what truncates first when the card is narrow. */
+.dsm-workbuddy-bar{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin:8px 0;padding:0}
+.dsm-workbuddy-bar-label{flex:none;margin:0;font-size:12px;font-weight:600;color:var(--dsw-alias-label-secondary,#c6c9d0)}
+.dsm-workbuddy-bar-status{flex:1 1 auto;min-width:0;margin:0;font-size:12px;line-height:18px;color:var(--dsw-alias-label-primary,#e8e9ed);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.dsm-workbuddy-bar-hint{color:var(--dsw-alias-label-tertiary,#999)}
+.dsm-workbuddy-bar-actions{display:flex;gap:8px;flex:none;margin-left:auto}
+.dsm-workbuddy-bar a{color:var(--dsw-alias-brand-primary,#5686fe);text-decoration:none}
+.dsm-workbuddy-bar a:hover{text-decoration:underline}
+.dsm-workbuddy-bar-ok{color:var(--dsw-alias-state-success-primary,#22a06b)}
+.dsm-workbuddy-bar-error{color:var(--dsw-alias-state-error-primary,#ef4444)}
+/* Secondary text inside the transfer DIALOG (not a bar): the privacy note
+   shown when credentials leave the machine. Kept independent of the bar
+   classes so the dialog does not depend on the bar's layout to be readable. */
+.dsm-workbuddy-hint{color:var(--dsw-alias-label-tertiary,#999)}
+/* The transfer dialog is deliberately a block: it holds a scrollable account
+   list and per-entry checkboxes, which cannot live in a one-row bar. */
+.dsm-workbuddy-transfer-dialog{margin-top:8px;padding:10px 12px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:10px;background:var(--dsw-alias-bg-secondary,transparent)}
+.dsm-workbuddy-transfer-dialog p{margin:0 0 8px;font-size:12px;line-height:18px;color:var(--dsw-alias-label-primary,#e8e9ed)}
+.dsm-workbuddy-transfer-dialog-actions{display:flex;gap:8px;justify-content:flex-end;flex-wrap:wrap}
+.dsm-workbuddy-transfer-list{list-style:none;margin:0 0 8px;padding:0;max-height:180px;overflow-y:auto}
+.dsm-workbuddy-transfer-list label{display:flex;align-items:center;gap:6px;font-size:12px;color:var(--dsw-alias-label-primary,#e8e9ed);cursor:pointer;padding:2px 0}
+.dsm-workbuddy-transfer-list input[type="checkbox"]{flex:none}
+.dsm-workbuddy-transfer input[type="file"]{font-size:12px;color:var(--dsw-alias-label-primary,#e8e9ed);margin-bottom:8px}
 `;
 		/**
 		* Composer credit readout styles, injected by the readout component itself.
@@ -2945,6 +3662,25 @@ window.__ModuleLoader__.load({
 				searched
 			});
 			status.status === "error" || status.selectionExplicit;
+			/**
+			* Account-adding and account-migration controls, defined ONCE and rendered
+			* in both sign-in states: inside the pool settings block when an account
+			* exists, and in the signed-out branch when it does not (the pool section is
+			* not rendered there at all). Two JSX copies would be free to drift, and the
+			* two states are the same feature — a user who learns these controls in one
+			* must find them in the same order in the other.
+			*/
+			const accountTools = /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(OAuthSignIn, {
+				t,
+				region: activeRegion
+			}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountTransfer, {
+				t,
+				region: activeRegion,
+				accounts: status.status === "error" ? [] : status.accounts.map((account) => ({
+					id: account.id,
+					accountName: account.accountName
+				}))
+			})] });
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
 				className: `dsm-plugin-card${open ? " dsm-plugin-card-open" : ""}`,
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
@@ -3091,6 +3827,7 @@ window.__ModuleLoader__.load({
 										switchAccount(accountId);
 									},
 									selectingAccount: switchingAccount,
+									accountTools,
 									siblingBusy: saving || togglingRegion !== void 0,
 									onBusyChange: setPoolBusy,
 									onSaved: async () => await refreshUsage(activeRegion) !== void 0,
@@ -3329,6 +4066,10 @@ window.__ModuleLoader__.load({
 										children: busy ? t("row.accountsScanning") : t("row.accountsRescan")
 									})
 								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "dsm-workbuddy-pool-tools",
+									children: accountTools
+								}),
 								searched.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SearchedPaths, {
 									items: searched,
 									t
@@ -4006,6 +4747,37 @@ window.__ModuleLoader__.load({
 			"row.probeFailedStatus": "✗ Test failed (HTTP {status})",
 			"row.probeError": "Could not run the test: {message}",
 			"row.cheer": "Star on GitHub",
+			"row.oauthTitle": "Add an account by QR sign-in",
+			"row.oauthStart": "Sign in with QR code",
+			"row.oauthStarting": "Opening…",
+			"row.oauthOpenHint": "Open the sign-in page and confirm — the account is added here automatically when you finish:",
+			"row.oauthOpen": "Open sign-in page",
+			"row.oauthOpened": "Opened. Waiting for you to finish…",
+			"row.oauthWaiting": "Waiting for the sign-in to finish… ({seconds}s)",
+			"row.oauthExpires": "The sign-in window expires in about {minutes} min.",
+			"row.oauthCancel": "Cancel",
+			"row.oauthCancelled": "Sign-in cancelled.",
+			"row.oauthTimedOut": "The sign-in timed out — start again when ready.",
+			"row.oauthDone": "Added “{accountName}”. Pick it above to use it.",
+			"row.oauthError": "Sign-in failed: {message}",
+			"row.oauthUnavailable": "QR sign-in is not offered by this build of the plugin.",
+			"row.transferTitle": "Export / import accounts",
+			"row.transferHint": "Move accounts between computers as a JSON file. The file carries the credentials — keep it private. The format is shared with other WorkBuddy credential managers.",
+			"row.transferExport": "Export accounts",
+			"row.transferExporting": "Exporting…",
+			"row.transferExportPick": "Choose the accounts to export ({total} available):",
+			"row.transferExportConfirm": "Export {count} account(s)",
+			"row.transferExported": "Exported {count} account(s) to {fileName}.",
+			"row.transferImport": "Import accounts",
+			"row.transferImporting": "Importing…",
+			"row.transferImportPick": "Choose a JSON file exported from this or a compatible tool:",
+			"row.transferPreviewTotal": "{total} account(s) in the file — untick what should stay out. Accounts already stored here are overwritten by the import.",
+			"row.transferImportConfirm": "Import {count} account(s)",
+			"row.transferImported": "Imported {imported} account(s); {skipped} skipped (no token, or belongs to the other region).",
+			"row.transferEntryUnknown": "unknown account",
+			"row.transferNoToken": "no token in this record",
+			"row.transferCancel": "Cancel",
+			"row.transferError": "Transfer failed: {message}",
 			"row.poolTitle": "Account pool",
 			"row.poolNoCandidate": "No account in this pool can be used right now.",
 			"row.poolNoCandidateHint": "Members are rate-limited, out of credits, rejected, or unreachable. Rate limits, drained quotas and transient failures return to the pool on their own — at the time the upstream states, or after a 30-minute fallback. Only a rejected credential needs a new sign-in.",
@@ -4104,6 +4876,12 @@ window.__ModuleLoader__.load({
 			"row.poolCurrentHeader": "In use: {account}",
 			"row.poolNotMember": "Not in pool",
 			"row.poolUnsavedMembers": "Selection changed — save to apply",
+			"row.poolRowTest": "Test",
+			"row.poolRowRemove": "Remove",
+			"row.poolRowRemoveHint": "Forget this account's plugin-stored credential. A desktop-app sign-in reappears on the next scan — only the plugin's own copy is deleted.",
+			"row.poolRowRemoveAria": "Remove the stored credential of {accountName}",
+			"row.poolRowRemoved": "{accountName}: removed from the plugin's storage.",
+			"row.poolRowRemoveDesktopOnly": "{accountName}: nothing plugin-stored to remove — this account comes from the desktop app's own sign-in.",
 			"row.showCreditsCn": "Show WB CN credits in the composer",
 			"row.showCreditsGlobal": "Show WB AI credits in the composer",
 			"row.showCreditsCnHint": "Show the domestic (WB CN) credit balance in the composer toolbar, but only while this session uses a WB CN model. Click it for per-account balances and a manual refresh (refreshes by itself every 5 minutes).",
@@ -4221,6 +4999,37 @@ window.__ModuleLoader__.load({
 			"row.probeFailedStatus": "✗ 测试失败（HTTP {status}）",
 			"row.probeError": "无法执行测试：{message}",
 			"row.cheer": "鼓励一下",
+			"row.oauthTitle": "扫码添加账号",
+			"row.oauthStart": "扫码登录",
+			"row.oauthStarting": "正在打开…",
+			"row.oauthOpenHint": "打开登录页并完成确认——完成后账号会自动出现在这里：",
+			"row.oauthOpen": "打开登录页",
+			"row.oauthOpened": "已打开，等待你完成登录…",
+			"row.oauthWaiting": "正在等待登录完成…（{seconds} 秒）",
+			"row.oauthExpires": "登录窗口约 {minutes} 分钟后过期。",
+			"row.oauthCancel": "取消",
+			"row.oauthCancelled": "已取消登录。",
+			"row.oauthTimedOut": "登录超时——请重新开始。",
+			"row.oauthDone": "已添加「{accountName}」。在上方选中它即可使用。",
+			"row.oauthError": "登录失败：{message}",
+			"row.oauthUnavailable": "当前版本的插件不支持扫码登录。",
+			"row.transferTitle": "导出 / 导入账号",
+			"row.transferHint": "用 JSON 文件在电脑之间迁移账号。文件里是账号凭据——请妥善保管。该格式与同类 WorkBuddy 凭据管理工具通用。",
+			"row.transferExport": "导出账号",
+			"row.transferExporting": "正在导出…",
+			"row.transferExportPick": "选择要导出的账号（共 {total} 个）：",
+			"row.transferExportConfirm": "导出 {count} 个账号",
+			"row.transferExported": "已导出 {count} 个账号到 {fileName}。",
+			"row.transferImport": "导入账号",
+			"row.transferImporting": "正在导入…",
+			"row.transferImportPick": "选择本插件或同类工具导出的 JSON 文件：",
+			"row.transferPreviewTotal": "文件中共 {total} 个账号——不需要的请取消勾选。导入会覆盖这里已存储的同名账号。",
+			"row.transferImportConfirm": "导入 {count} 个账号",
+			"row.transferImported": "已导入 {imported} 个账号；跳过 {skipped} 个（缺 token，或属于另一个区域）。",
+			"row.transferEntryUnknown": "未知账号",
+			"row.transferNoToken": "此记录没有 token",
+			"row.transferCancel": "取消",
+			"row.transferError": "传输失败：{message}",
 			"row.poolTitle": "账号池",
 			"row.poolNoCandidate": "账号池里目前没有可用的账号。",
 			"row.poolNoCandidateHint": "成员要么在限流冷却中、要么积分耗尽、要么凭据被拒、要么上游无响应。限流、积分耗尽与瞬时故障都会自动回池——按上游给出的恢复时间，没给时间就按 30 分钟兜底，不需要你操作；只有「凭据被拒」需要重新登录。",
@@ -4319,6 +5128,12 @@ window.__ModuleLoader__.load({
 			"row.poolCurrentHeader": "当前使用：{account}",
 			"row.poolNotMember": "未入池",
 			"row.poolUnsavedMembers": "勾选已改动 —— 保存后生效",
+			"row.poolRowTest": "测试",
+			"row.poolRowRemove": "删除",
+			"row.poolRowRemoveHint": "删除插件保存的这个账号凭据。桌面 App 的登录不会被删除——下次扫描它还会出现；只有插件自己的副本会被移除。",
+			"row.poolRowRemoveAria": "删除 {accountName} 的已存凭据",
+			"row.poolRowRemoved": "{accountName}：已从插件存储中移除。",
+			"row.poolRowRemoveDesktopOnly": "{accountName}：没有插件存储的凭据可删——这个账号来自桌面 App 自己的登录。",
 			"row.showCreditsCn": "在对话框显示 WB CN 积分",
 			"row.showCreditsGlobal": "在对话框显示 WB AI 积分",
 			"row.showCreditsCnHint": "在对话输入框工具栏显示国内版（WB CN）剩余积分，仅当本会话使用 WB CN 模型时出现。点击可看各账号余额并手动刷新（每 5 分钟也会自动刷新）。",