dsh-connect-workbuddy 4.0.0 → 4.2.0

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as macosNestedAppBundles, A as workbuddyOwnAuthPath, B as parseUpstreamModel, C as defaultDesktopAuthDirs, D as legacyWorkbuddyOwnAuthPath, E as isEncryptedCredentialError, F as classifyUpstreamError, G as deriveAtRestKey, H as regionOf, I as declaredTools, J as findWorkbuddyAppExecutable, K as deriveAtRestKeyId, L as isCredentialRejectedError, M as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, N as WorkBuddyCredentialRejectedError, O as parseWorkBuddyAuth, P as WorkBuddyUpstreamClient, Q as macosBundleExecutable, R as parseCreditMultiplier, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as WORKBUDDY_APP_EXECUTABLE_ENV, V as prepareChatBody, W as clearAtRestKeyCache, X as isEncryptedFieldWrapper, Z as isWorkbuddyBundle, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as openEncryptedField, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, j as CREDENTIAL_REJECTED_CODE, k as workbuddyAccountId, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as workbuddyAppExecutableCandidates, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as fetchAtRestKeyPayload, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as readAtRestKey, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as parseReasoning } from "./host-heartbeat-vvVjdY_q.js";
+import { $ as isWorkbuddyBundle, A as workbuddyAccountId, B as parseCreditMultiplier, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, H as parseUpstreamModel, I as classifyUpstreamError, J as deriveAtRestKeyId, K as clearAtRestKeyCache, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as isEncryptedFieldWrapper, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as prepareChatBody, V as parseReasoning, W as regionOf, X as findWorkbuddyAppExecutable, Y as fetchAtRestKeyPayload, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as macosBundleExecutable, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as workbuddyAppExecutableCandidates, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as openEncryptedField, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, q as deriveAtRestKey, r as isHeartbeatProcessAlive, rt as readAtRestKey, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosNestedAppBundles, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-C4TXu8ew.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -2337,7 +2337,7 @@ async function checkinOne(target, deps) {
 		return {
 			...base,
 			status: "failed",
-			message: messageOf(error)
+			message: messageOf$1(error)
 		};
 	}
 	if (credential === void 0) return {
@@ -2367,7 +2367,7 @@ async function checkinOne(target, deps) {
 		return {
 			...base,
 			status: "failed",
-			message: messageOf(error)
+			message: messageOf$1(error)
 		};
 	}
 }
@@ -2413,7 +2413,7 @@ async function testOne(target, modelId, deps) {
 			result: {
 				modelId,
 				outcome: "credential-rejected",
-				message: messageOf(error)
+				message: messageOf$1(error)
 			}
 		};
 	}
@@ -2477,7 +2477,7 @@ function defaultWait(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 /** A safe message from an unknown throwable, bounded in length. */
-function messageOf(error) {
+function messageOf$1(error) {
 	return (error instanceof Error ? error.message : String(error)).slice(0, 300);
 }
 /**
@@ -2689,6 +2689,469 @@ function resolveTargetModel(catalog, preferredId) {
 	};
 }
 //#endregion
+//#region src/oauth.ts
+/**
+* OAuth QR sign-in: add a WorkBuddy account by scanning a code, without the
+* desktop app.
+*
+* 参考：WorkBuddy OAuth 采集的通行实现（对照官网 cockpit 的
+*   `oauth_start` / `oauth_poll`）：
+*   向 `{billing_base}{API_PREFIX}/auth/state?platform={platform}` 申请一个
+*   state，用户在浏览器打开授权页完成登录，客户端轮询
+*   `{billing_base}{API_PREFIX}/auth/token?state={state}` 换取凭据，再以
+*   Bearer 调 `{API_PREFIX}/login/account` 拉取账号资料。三步的 URL 形态、
+*   响应字段双拼写（camelCase/snake_case）容错、以及「区域必须绑定会话」的
+*   约定均沿用该实现。
+* 改动：端点按本插件 `upstream.ts` 的区域约定路由 —— CN 为
+*   `https://www.codebuddy.cn`；国际版按凭据域分家（`workbuddy.ai` 与
+*   `codebuddy.ai` 两把钥匙各自签发，混用会被网关拒绝），插件发起登录时
+*   还没有凭据，因此由用户显式传基址，缺省 `https://www.workbuddy.ai`。
+*   登录结果不落独立账号库，而是交给宿主写入统一凭据库（`src/auth.ts` 的
+*   vault），与桌面端扫描到的账号共用一套发现/选择/刷新机制。
+*
+* 会话状态只在进程内（`LoginSession`）：PKCE 类 state 与登录进度不落盘，
+* 拿到凭据即终结。刷新凭据仍走 `refreshToken`（上游 refresh 端点），此处
+* 只负责首次取凭据。
+*
+* @module dsh-connect-workbuddy/oauth
+*/
+/** The CN billing base; matches `upstream.ts`'s CN_BILLING_BASE. */
+const CN_BILLING_BASE = "https://www.codebuddy.cn";
+/** Default international base; the desktop app's gateway. */
+const GLOBAL_BILLING_BASE = "https://www.workbuddy.ai";
+/** Upstream plugin API prefix shared by both regions. */
+const API_PREFIX = "/v2/plugin";
+/** In-process session map. Deliberately not persisted: a restart cancels. */
+const sessions = /* @__PURE__ */ new Map();
+/**
+* The billing base a login for `region` should start from.
+*
+* CN is single-homed. The international product signs in through either of
+* two brand domains (see `upstream.ts` `globalBase`); the caller may pin
+* one with `explicitBase` — a token issued at one domain is refused by the
+* other, so the choice must be made BEFORE the state is issued, not after.
+*/
+function oauthBillingBase(region, explicitBase) {
+	if (region === "cn") return CN_BILLING_BASE;
+	const trimmed = explicitBase?.trim();
+	if (trimmed !== void 0 && trimmed !== "") return normalizeBase(trimmed);
+	return GLOBAL_BILLING_BASE;
+}
+/** trim + strip one trailing slash; no scheme invented (see upstream.ts). */
+function normalizeBase(base) {
+	return base.trim().replace(/\/+$/, "");
+}
+/**
+* Start one login: ask the upstream for a state and return the URL the user
+* opens to scan/confirm. The session is bound to `region` AND `base`;
+* both are checked on every poll.
+*
+* Never throws for an upstream refusal — the error becomes the returned
+* `error` — because the card renders the reason inline rather than through
+* an exception path.
+*/
+async function oauthStart(region, options) {
+	const base = normalizeBase(oauthBillingBase(region, options?.base));
+	const doFetch = options?.fetchImpl ?? fetch;
+	let response;
+	try {
+		response = await doFetch(`${base}${API_PREFIX}/auth/state?platform=workbuddy`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"Accept": "application/json"
+			},
+			body: "{}",
+			signal: AbortSignal.timeout(3e4)
+		});
+	} catch (error) {
+		return { error: `could not reach ${base} to start the sign-in (${messageOf(error)})` };
+	}
+	const document = await readJson(response);
+	if (document === void 0) return { error: `the sign-in service answered with a non-JSON body (http ${response.status})` };
+	const data = envelopeData(document);
+	const state = firstString(data, ["state", "State"]);
+	if (state === "") return { error: `the sign-in service did not issue a state (http ${response.status})` };
+	const authUrl = firstString(data, [
+		"authUrl",
+		"auth_url",
+		"url",
+		"Url"
+	]) || `${base}/login?state=${encodeURIComponent(state)}`;
+	const loginId = `wbo_${randomUUID().replaceAll("-", "")}`;
+	sessions.set(loginId, {
+		region,
+		base,
+		state,
+		expiresAtMs: Date.now() + 6e5,
+		done: false
+	});
+	return {
+		loginId,
+		verificationUri: authUrl,
+		expiresIn: 600
+	};
+}
+/**
+* Poll once for a login's outcome.
+*
+* Ordering matters and mirrors the reference implementation: the session's
+* region/base binding is checked BEFORE any I/O, so a poll that names the
+* wrong tab never reaches the network, and an unknown id fails without a
+* request too.
+*/
+async function oauthPoll(loginId, region, options) {
+	const session = sessions.get(loginId);
+	if (session === void 0) return {
+		done: true,
+		error: "sign-in session not found; start a new one"
+	};
+	if (session.region !== region) return {
+		done: true,
+		error: "sign-in session belongs to another region tab"
+	};
+	if (session.done) return terminalOf(session);
+	if (Date.now() > session.expiresAtMs) {
+		session.done = true;
+		session.error = "the sign-in timed out; start again";
+		sessions.delete(loginId);
+		return {
+			done: true,
+			error: session.error
+		};
+	}
+	const doFetch = options?.fetchImpl ?? fetch;
+	let response;
+	try {
+		response = await doFetch(`${session.base}${API_PREFIX}/auth/token?state=${encodeURIComponent(session.state)}`, {
+			method: "GET",
+			headers: { "Accept": "application/json" },
+			signal: AbortSignal.timeout(3e4)
+		});
+	} catch {
+		return { done: false };
+	}
+	const document = await readJson(response);
+	if (document === void 0) return { done: false };
+	const code = typeof document["code"] === "number" ? document["code"] : -1;
+	if (code !== 0 && code !== 200) return { done: false };
+	const data = envelopeData(document);
+	const accessToken = firstString(data, [
+		"accessToken",
+		"access_token",
+		"AccessToken"
+	]);
+	if (accessToken === "") return { done: false };
+	session.done = true;
+	try {
+		const account = await collectAccount(session, accessToken, data, doFetch);
+		sessions.delete(loginId);
+		return {
+			done: true,
+			account
+		};
+	} catch (error) {
+		session.error = messageOf(error);
+		sessions.delete(loginId);
+		return {
+			done: true,
+			error: session.error
+		};
+	}
+}
+/** Terminal view of a session, for a poll that arrives after completion. */
+function terminalOf(session) {
+	if (session.result !== void 0) return {
+		done: true,
+		account: session.result
+	};
+	return {
+		done: true,
+		error: session.error ?? "the sign-in ended without a result"
+	};
+}
+/** Fetch the account profile and assemble the success value. */
+async function collectAccount(session, accessToken, tokenData, doFetch) {
+	const headers = {
+		"Authorization": `Bearer ${accessToken}`,
+		"Accept": "application/json"
+	};
+	const domain = firstString(tokenData, ["domain", "Domain"]);
+	if (domain !== "") headers["X-Domain"] = domain;
+	let profile = {};
+	try {
+		const document = await readJson(await doFetch(`${session.base}${API_PREFIX}/login/account`, {
+			method: "GET",
+			headers,
+			signal: AbortSignal.timeout(3e4)
+		}));
+		if (document !== void 0) profile = envelopeData(document);
+	} catch {}
+	const uid = firstString(profile, [
+		"uid",
+		"Uid",
+		"userId",
+		"UserID"
+	]);
+	const nickname = optionalString(profile, [
+		"nickname",
+		"NickName",
+		"nickname",
+		"ScreenName"
+	]);
+	const uin = optionalString(profile, ["uin", "Uin"]);
+	const enterpriseId = optionalString(profile, ["enterpriseId", "EnterpriseId"]);
+	const expiresAtMs = expiryMs(tokenData, ["expiresAt", "expires_at"], ["expiresIn", "expires_in"]) ?? 0;
+	const refreshExpiresAtMs = expiryMs(tokenData, ["refreshExpiresAt", "refresh_expires_at"], ["refreshExpiresIn", "refresh_expires_in"]);
+	return {
+		accessToken,
+		refreshToken: firstString(tokenData, [
+			"refreshToken",
+			"refresh_token",
+			"RefreshToken"
+		]),
+		expiresAtMs,
+		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
+		domain: domain !== "" ? domain : firstString(profile, ["domain", "Domain"]),
+		uid,
+		...nickname === void 0 ? {} : { nickname },
+		...uin === void 0 ? {} : { uin },
+		...enterpriseId === void 0 ? {} : { enterpriseId }
+	};
+}
+/** Parse a JSON body; undefined for non-JSON (the caller decides severity). */
+async function readJson(response) {
+	try {
+		const text = await response.text();
+		const parsed = JSON.parse(text);
+		if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) return parsed;
+	} catch {}
+}
+/** The envelope's `data` object; a non-object data is an empty one. */
+function envelopeData(document) {
+	const data = document["data"];
+	return typeof data === "object" && data !== null && !Array.isArray(data) ? data : {};
+}
+/** First non-empty string among `keys`, else ''. */
+function firstString(source, keys) {
+	for (const key of keys) {
+		const value = source[key];
+		if (typeof value === "string" && value.trim() !== "") return value.trim();
+		if (typeof value === "number" && Number.isFinite(value)) return String(value);
+	}
+	return "";
+}
+/** First non-empty string among `keys`, else undefined. */
+function optionalString(source, keys) {
+	const value = firstString(source, keys);
+	return value === "" ? void 0 : value;
+}
+/**
+* An expiry field that may arrive as an absolute timestamp (s or ms) or as a
+* relative TTL in seconds — the same tolerance `auth.ts` `expiryToMs` and
+* the reference implementation's `norm_ts` apply.
+*/
+function expiryMs(source, absoluteKeys, ttlKeys) {
+	for (const key of absoluteKeys) {
+		const value = source[key];
+		if (typeof value === "number" && value > 0) return value > 0xe8d4a51000 ? value : value * 1e3;
+		if (typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value))) {
+			const parsed = Number(value);
+			return parsed > 0xe8d4a51000 ? parsed : parsed * 1e3;
+		}
+	}
+	for (const key of ttlKeys) {
+		const value = source[key];
+		if (typeof value === "number" && value > 0) return Date.now() + value * 1e3;
+	}
+}
+/** Human message from a thrown error, for the card's inline display. */
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+//#region src/transfer.ts
+/**
+* Account transfer: the export / import file format shared with sibling
+* credential managers for the same upstream.
+*
+* 参考：通行实现 —— 文件是一个 JSON 数组，每项为一条凭据记录，顶层字段
+*   snake_case（`access_token` / `refresh_token` / `uid` / `nickname` /
+*   `email` / `domain` / `expiresAt`(ms) / `refreshExpiresAt` / `auth_raw`），
+*   导入按 `uid` 去重（同 uid 覆盖），缺 `access_token` 的记录跳过；预览只
+*   回脱敏字段（含 `hasToken` 布尔量），不回明文。解析函数不依赖文件系统，
+*   便于无 UI 环境单测；落库由 Host 侧的 store 完成。
+* 互通：`expiresAt` 一族按契约是**毫秒**（由 auth_raw 的原始认证文档携带）；
+*   本插件的 vault 文档 `expiresAt` 是秒 —— 换算只发生在导出/导入边界。
+*   导出时 `auth_raw` 直接携带本插件 vault 文档的 `{auth, account}` 双键块，
+*   与桌面认证文件同构，供写入桌面认证文件的工具原样消费。
+*
+* @module dsh-connect-workbuddy/transfer
+*/
+/**
+* Parse transfer-file text: a JSON array, every element an object.
+*
+* The error strings carry the position (1-based item number) because a file
+* from another tool can be big, and "第 N 项" is what lets the user find the
+* broken record in their editor.
+*/
+function parseTransferFile(text) {
+	if (text.trim() === "") throw new Error("transfer file is empty");
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (error) {
+		throw new Error("transfer file is not valid JSON: " + (error instanceof Error ? error.message : String(error)));
+	}
+	if (!Array.isArray(parsed)) throw new Error("transfer file must be a JSON array of account records");
+	for (const [index, item] of parsed.entries()) if (typeof item !== "object" || item === null || Array.isArray(item)) throw new Error("transfer file item " + (index + 1) + " is not an account object");
+	return parsed;
+}
+/** One string field of a record, tolerating the sibling format's odd shapes. */
+function displayString(value) {
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	return "";
+}
+/** Whether a record carries a usable token, envelope-shaped or plain. */
+function hasToken(record) {
+	const token = record["access_token"];
+	return typeof token === "string" && token !== "";
+}
+/**
+* The transfer file's desensitized preview: display fields only.
+*
+* Fields come from EXTERNAL files, so a display field may hold an object or an
+* array (a sibling tool can store the desktop app's encrypted-wrapper nickname
+* verbatim); every preview field is normalized to a string or emptied rather
+* than letting a non-renderable value reach the card.
+*/
+function previewTransferFile(text) {
+	const records = parseTransferFile(text);
+	return {
+		accounts: records.map((record, index) => ({
+			index,
+			uid: displayString(record["uid"]),
+			nickname: displayString(record["nickname"]),
+			email: displayString(record["email"]),
+			hasToken: hasToken(record)
+		})),
+		total: records.length
+	};
+}
+/**
+* Project one vault credential into the shared transfer record shape.
+*
+* `expiresAt` is emitted in MILLISECONDS — the transfer contract's unit and
+* the sibling tools' display field — while the vault document stores seconds.
+* `auth_raw` carries the vault's nested `{auth, account}` document so a tool
+* that writes desktop auth files can consume it verbatim.
+*/
+function transferRecordOf(credential, vaultDocument) {
+	return {
+		access_token: credential.accessToken,
+		...credential.refreshToken !== "" ? { refresh_token: credential.refreshToken } : {},
+		...credential.uid !== "" ? { uid: credential.uid } : {},
+		...credential.nickname !== void 0 ? { nickname: credential.nickname } : {},
+		...credential.domain !== "" ? { domain: credential.domain } : {},
+		...credential.expiresAtMs > 0 ? { expiresAt: credential.expiresAtMs } : {},
+		...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAt: credential.refreshExpiresAtMs },
+		auth_raw: vaultDocument
+	};
+}
+/**
+* Recover `uin` from a record's `auth_raw` document.
+*
+* `uin` is the billing identity the account id derives from
+* (`uin ?? uid ?? nickname`), but it is NOT one of the transfer format's
+* contract fields — sibling exports carry it only inside `auth_raw`
+* (the original auth document, whose `account` object holds it). Restoring it
+* is what makes an exported-and-re-imported account converge on the SAME
+* vault id instead of duplicating under a uid-derived id. Both document
+* shapes are honored: the nested `{auth, account}` block this plugin
+* exports, and a record whose `auth_raw.account` came straight from a
+* desktop file.
+*/
+function uinOfRaw(raw) {
+	if (typeof raw !== "object" || raw === null) return void 0;
+	const root = raw;
+	const uin = displayString((typeof root["account"] === "object" && root["account"] !== null ? root["account"] : root)["uin"]);
+	return uin === "" ? void 0 : uin;
+}
+/**
+* Project one transfer record into a vault credential, or undefined when the
+* record carries no token (the importer's skip rule).
+*
+* `uid` empty is tolerated at THIS layer because a token-only record still
+* describes a usable credential; the Host's region gate and the store's
+* account id (`uin ?? uid ?? nickname`) decide whether it is representable.
+* An unopenable `auth_raw` is ignored — the flat fields above are the
+* contract, `auth_raw` is extra fidelity for the write-back path.
+*/
+function credentialOfTransferRecord(record) {
+	const accessToken = record["access_token"];
+	if (typeof accessToken !== "string" || accessToken === "") return void 0;
+	const refreshToken = typeof record["refresh_token"] === "string" ? record["refresh_token"] : "";
+	const expiresAtMs = typeof record["expiresAt"] === "number" && Number.isFinite(record["expiresAt"]) && record["expiresAt"] > 0 ? record["expiresAt"] : 0;
+	const refreshExpiresAtMs = typeof record["refreshExpiresAt"] === "number" && Number.isFinite(record["refreshExpiresAt"]) && record["refreshExpiresAt"] > 0 ? record["refreshExpiresAt"] : void 0;
+	const uin = uinOfRaw(record["auth_raw"]);
+	return {
+		accessToken,
+		refreshToken,
+		expiresAtMs,
+		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
+		domain: typeof record["domain"] === "string" ? record["domain"] : "",
+		uid: displayString(record["uid"]),
+		...record["nickname"] !== void 0 ? { nickname: displayString(record["nickname"]) } : {},
+		...uin === void 0 ? {} : { uin }
+	};
+}
+/**
+* Pure merge: fold selected records into a CHANGES map keyed by account id.
+*
+* Mirrors the sibling merger's contract: a record with the same account id
+* OVERWRITES the stored entry (the imported tokens replace what is stored —
+* re-importing a re-login must refresh it; the write layer stores the record
+* atomically, so "overwrite" needs no knowledge of the incumbent), and a
+* record without a token is skipped. The region gate lives HERE rather than
+* in the route so it is testable without a Host: a record whose login domain
+* maps to the other region's tab is skipped, because the two regions'
+* providers are parallel stacks and a cross-region import would cross-bill.
+*
+* The caller writes one vault file per map entry, so a selection that is
+* already stored rewrites those files with identical content — idempotent,
+* and the steady state of importing the same file twice.
+*/
+function mergeTransferRecords(records, indexes, region, knownRegionOfDomain) {
+	const changes = /* @__PURE__ */ new Map();
+	let imported = 0;
+	let skipped = 0;
+	for (const index of indexes) {
+		const record = records[index];
+		if (record === void 0) {
+			skipped += 1;
+			continue;
+		}
+		const credential = credentialOfTransferRecord(record);
+		if (credential === void 0) {
+			skipped += 1;
+			continue;
+		}
+		if (knownRegionOfDomain(credential.domain) !== region) {
+			skipped += 1;
+			continue;
+		}
+		const id = workbuddyAccountId(credential);
+		changes.set(id, credential);
+		imported += 1;
+	}
+	return {
+		changes,
+		imported,
+		skipped
+	};
+}
+//#endregion
 //#region src/account-pool-store.ts
 /**
 * The account pool's RUNTIME store: measured facts, on disk, outside settings.
@@ -2872,14 +3335,59 @@ const WORKBUDDY_PROBE_PATH = "/plugins/dsh-connect-workbuddy/probe";
 * splitting them would duplicate the guards and invite them to drift apart.
 */
 const WORKBUDDY_POOL_PATH = "/plugins/dsh-connect-workbuddy/pool";
+/**
+* Plugin-owned OAuth sign-in endpoint: one session step per call.
+*
+* `?action=start` asks the upstream for a login state and returns the URL to
+* open; `?action=poll` (+ `loginId` in the body) reports whether the user
+* finished, and on success persists the account into the vault. POST +
+* loopback-only like the card's other mutations: the poll carries the login
+* binding, and the Host-side session state must not be settable by another
+* origin.
+*/
+const WORKBUDDY_OAUTH_PATH = "/plugins/dsh-connect-workbuddy/oauth";
 /** Query parameter selecting which pool batch action a request means. */
 const WORKBUDDY_POOL_ACTION_PARAM = "action";
+/** Read the OAuth action off a request URL; unknown/absent means undefined. */
+function oauthActionOf(url) {
+	const at = url.indexOf("?");
+	if (at === -1) return void 0;
+	const value = new URLSearchParams(url.slice(at + 1)).get(WORKBUDDY_POOL_ACTION_PARAM);
+	return value === "start" || value === "poll" ? value : void 0;
+}
 /** Read the pool action off a request URL; unknown/absent means undefined. */
 function poolActionOf(url) {
 	const at = url.indexOf("?");
 	if (at === -1) return void 0;
 	const value = new URLSearchParams(url.slice(at + 1)).get(WORKBUDDY_POOL_ACTION_PARAM);
-	return value === "checkin" || value === "test" ? value : void 0;
+	return value === "checkin" || value === "test" || value === "remove" ? value : void 0;
+}
+/** Query parameter naming ONE pool account a per-row request addresses. */
+const WORKBUDDY_POOL_ACCOUNT_PARAM = "accountId";
+/**
+* Plugin-owned account transfer endpoint: the batch export / import of
+* credentials between machines and between tools of the SAME format family.
+*
+* `?action=export` POSTs account ids, answers a JSON ARRAY of credential
+* records; `?action=preview` POSTs file text, answers a token-free listing;
+* `?action=import` POSTs file text plus selected indexes, merges into the
+* vault. POST + loopback-only like every other mutation: the file content is
+* arbitrary user data and export carries token material.
+*/
+const WORKBUDDY_TRANSFER_PATH = "/plugins/dsh-connect-workbuddy/transfer";
+/** Read the transfer action off a request URL; unknown/absent means undefined. */
+function transferActionOf(url) {
+	const at = url.indexOf("?");
+	if (at === -1) return void 0;
+	const value = new URLSearchParams(url.slice(at + 1)).get(WORKBUDDY_POOL_ACTION_PARAM);
+	return value === "export" || value === "preview" || value === "import" ? value : void 0;
+}
+/** Read the per-row account id off a request URL, when the action takes one. */
+function poolAccountIdOf(url) {
+	const at = url.indexOf("?");
+	if (at === -1) return void 0;
+	const value = new URLSearchParams(url.slice(at + 1)).get(WORKBUDDY_POOL_ACCOUNT_PARAM);
+	return value !== null && value !== "" ? value : void 0;
 }
 /** Query parameter naming the region a card request addresses. */
 const WORKBUDDY_REGION_PARAM = "region";
@@ -3039,6 +3547,23 @@ function json(res, status, body) {
 	});
 	res.end(payload);
 }
+/**
+* A JSON response that must never be cached.
+*
+* Used for every answer that carries live credentials — the transfer export
+* hands the browser real access and refresh tokens. Without `no-store` such a
+* response is eligible for the browser's HTTP cache, where a token can outlive
+* the session on disk.
+*/
+function jsonPrivate(res, status, body) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"Content-Type": "application/json",
+		"Content-Length": Buffer.byteLength(payload),
+		"Cache-Control": "no-store"
+	});
+	res.end(payload);
+}
 /** Request-body cap for the probe route: model ids only, never content. */
 const PROBE_BODY_LIMIT = 65536;
 /**
@@ -3508,12 +4033,60 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				const action = poolActionOf(req.url ?? "/");
-				if (action === void 0) return json(res, 400, { error: "action must be checkin or test" });
+				if (action === void 0) return json(res, 400, { error: "action must be checkin, test, or remove" });
 				const pool = deps.pool;
 				if (pool === void 0) return json(res, 503, {
 					reason: "pool-unavailable",
 					error: "account pool unavailable"
 				});
+				const rowAccountId = poolAccountIdOf(req.url ?? "/");
+				if (action === "remove") {
+					if (pool.removeOne === void 0) return json(res, 503, {
+						reason: "pool-unavailable",
+						error: "per-account removal unavailable"
+					});
+					if (rowAccountId === void 0) return json(res, 400, { error: "accountId must name the account to remove" });
+					if (!isVaultAccountId(rowAccountId)) return json(res, 400, { error: "accountId is not a well-formed account id" });
+					try {
+						json(res, 200, {
+							action: "remove",
+							accountId: rowAccountId,
+							removed: await pool.removeOne(region, rowAccountId)
+						});
+					} catch (error) {
+						json(res, 500, {
+							reason: "pool-failed",
+							error: safeMessage(error)
+						});
+					}
+					return;
+				}
+				if (action === "test" && rowAccountId !== void 0) {
+					if (pool.testOne === void 0) return json(res, 503, {
+						reason: "pool-unavailable",
+						error: "per-account test unavailable"
+					});
+					try {
+						const row = await pool.testOne(region, rowAccountId);
+						if (row === void 0) return json(res, 409, {
+							action: "test",
+							modelId: void 0,
+							rows: [],
+							reason: "no-free-model",
+							error: "no zero-multiplier model in this region; refresh the catalog or set a target model"
+						});
+						json(res, 200, {
+							action: "test",
+							rows: [row]
+						});
+					} catch (error) {
+						json(res, 500, {
+							reason: "pool-failed",
+							error: safeMessage(error)
+						});
+					}
+					return;
+				}
 				try {
 					const savedMembers = pool.preferences(region).memberAccountIds;
 					if ((await pool.effectiveMemberAccountIds?.(region).catch(() => void 0) ?? savedMembers).length === 0) {
@@ -3645,6 +4218,69 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 				}
 			}
 		});
+		const disposeOAuth = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_OAUTH_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				const region = requestRegion(req, res);
+				if (region === void 0) return;
+				const action = oauthActionOf(req.url ?? "/");
+				if (action === void 0) return json(res, 400, { error: "action must be start or poll" });
+				const oauth = deps.oauth;
+				if (oauth === void 0) return json(res, 503, {
+					reason: "oauth-unavailable",
+					error: "OAuth sign-in is not available in this build"
+				});
+				try {
+					if (action === "start") {
+						json(res, 200, await oauth.start(region));
+						return;
+					}
+					const body = await readJsonBody(req);
+					if (typeof body.loginId !== "string" || body.loginId === "") return json(res, 400, { error: "loginId must be a non-empty string" });
+					json(res, 200, await oauth.poll(region, body.loginId));
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
+		const disposeTransfer = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_TRANSFER_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				const region = requestRegion(req, res);
+				if (region === void 0) return;
+				const action = transferActionOf(req.url ?? "/");
+				if (action === void 0) return json(res, 400, { error: "action must be export, preview, or import" });
+				const transfer = deps.transfer;
+				if (transfer === void 0) return json(res, 503, {
+					reason: "transfer-unavailable",
+					error: "account transfer is not available in this build"
+				});
+				try {
+					if (action === "export") {
+						const body = await readJsonBody(req);
+						const accountIds = Array.isArray(body.accountIds) ? body.accountIds.filter((id) => typeof id === "string" && id !== "") : [];
+						if (accountIds.length === 0) return json(res, 400, { error: "accountIds must be a non-empty array of strings" });
+						const answer = await transfer.exportAccounts(region, accountIds);
+						if (answer.accounts.length === 0) return json(res, 409, { error: "none of the named accounts was found in this region" });
+						return jsonPrivate(res, 200, answer);
+					}
+					const body = await readJsonBody(req);
+					if (typeof body.text !== "string" || body.text.trim() === "") return json(res, 400, { error: "text must be the transfer file's JSON content" });
+					if (action === "preview") return json(res, 200, await transfer.previewImport(region, body.text));
+					const indexes = Array.isArray(body.indexes) ? body.indexes.filter((value) => typeof value === "number" && Number.isInteger(value) && value >= 0) : [];
+					if (indexes.length === 0) return json(res, 400, { error: "indexes must name at least one file entry to import" });
+					return json(res, 200, await transfer.importAccounts(region, body.text, indexes));
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
 		return () => {
 			disposeRefresh();
 			disposeCheckin();
@@ -3653,6 +4289,8 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			disposeAccountCredits();
 			disposeProbe();
 			disposePool();
+			disposeOAuth();
+			disposeTransfer();
 			disposeDiagWrite();
 		};
 	}, "dsh-connect-workbuddy: Web status route");
@@ -4391,7 +5029,138 @@ function apply(ctx, config) {
 				await writePoolProbes(region, probeUpdatesOf(rows));
 				return rows;
 			},
-			catalog: (region) => displayModels(current(), region)
+			catalog: (region) => displayModels(current(), region),
+			/**
+			* Test ONE account against the region's target model.
+			*
+			* The per-row button's Host half. Reuses the batch's probe dependency
+			* (same client, same probe size, same quota-refresh input) so a row
+			* result and a batch result are the SAME measurement — only the
+			* persistence is scoped to one id instead of every member.
+			*
+			* Returns undefined when the region cannot name a target model (the
+			* same refusal the batch route reports as 409) — the card says so
+			* rather than pretending a test ran.
+			*/
+			testOne: async (region, accountId) => {
+				const target = regionTargetModel(region);
+				if (target === void 0) return void 0;
+				const store = stacks[region].store;
+				const credential = await store.credentialFor(accountId).catch(() => void 0);
+				if (credential === void 0) return {
+					accountId,
+					accountName: "",
+					result: {
+						modelId: target,
+						outcome: "credential-rejected",
+						status: 0,
+						message: "no stored credential for this account"
+					}
+				};
+				const accountName = (await store.accounts().catch(() => [])).find((account) => account.id === accountId)?.accountName ?? "";
+				const result = await poolRunnerDeps(region).probe(credential, target);
+				await writePoolProbes(region, probeUpdatesOf([{
+					accountId,
+					accountName,
+					result
+				}]));
+				return {
+					accountId,
+					accountName,
+					result
+				};
+			},
+			/**
+			* Forget ONE account's plugin-stored credential (the vault entry; the
+			* desktop app's files are never touched). The card rescans afterwards,
+			* so the row disappears the moment the write lands.
+			*/
+			removeOne: async (region, accountId) => stacks[region].store.removeAccount(accountId)
+		},
+		/**
+		* OAuth QR sign-in for this card. The session lives in `src/oauth.ts`
+		* (in-process, keyed by loginId); the Host's only extra duty is
+		* persisting the finished credential into the region's vault — the same
+		* store the request path reads, so the account is selectable the moment
+		* the poll answers.
+		*/
+		oauth: {
+			async start(region) {
+				return oauthStart(region);
+			},
+			async poll(region, loginId) {
+				const answer = await oauthPoll(loginId, region);
+				if (!answer.done) return answer;
+				if ("error" in answer) return answer;
+				const store = stacks[region].store;
+				const accountId = await store.addOAuthAccount({
+					accessToken: answer.account.accessToken,
+					refreshToken: answer.account.refreshToken,
+					expiresAtMs: answer.account.expiresAtMs,
+					...answer.account.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs: answer.account.refreshExpiresAtMs },
+					domain: answer.account.domain,
+					uid: answer.account.uid,
+					...answer.account.nickname === void 0 ? {} : { nickname: answer.account.nickname },
+					...answer.account.uin === void 0 ? {} : { uin: answer.account.uin },
+					...answer.account.enterpriseId === void 0 ? {} : { enterpriseId: answer.account.enterpriseId }
+				}).catch((error) => {
+					throw new Error("the account was signed in but could not be saved: " + (error instanceof Error ? error.message : String(error)));
+				});
+				return {
+					done: true,
+					accountId,
+					accountName: (await store.accounts().catch(() => [])).find((account) => account.id === accountId)?.accountName ?? answer.account.nickname ?? ""
+				};
+			}
+		},
+		/**
+		* Batch credential export / import, in the transfer file format the
+		* sibling credential managers share. The Host owns every byte of the
+		* vault; the route only ferries parsed answers.
+		*/
+		transfer: {
+			async exportAccounts(region, accountIds) {
+				const store = stacks[region].store;
+				const accounts = await store.accounts().catch(() => []);
+				const wanted = new Set(accountIds);
+				const records = [];
+				for (const account of accounts) {
+					if (!wanted.has(account.id)) continue;
+					const credential = await store.credentialFor(account.id).catch(() => void 0);
+					if (credential === void 0) continue;
+					records.push(transferRecordOf(credential, {
+						auth: {
+							accessToken: credential.accessToken,
+							refreshToken: credential.refreshToken,
+							expiresAt: credential.expiresAtMs > 0 ? Math.floor(credential.expiresAtMs / 1e3) : 0,
+							...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAt: Math.floor(credential.refreshExpiresAtMs / 1e3) },
+							...credential.lastRefreshAtMs === void 0 ? {} : { lastRefreshTime: Math.floor(credential.lastRefreshAtMs / 1e3) },
+							domain: credential.domain
+						},
+						account: {
+							uid: credential.uid,
+							...credential.enterpriseId === void 0 ? {} : { enterpriseId: credential.enterpriseId },
+							...credential.nickname === void 0 ? {} : { nickname: credential.nickname },
+							...credential.uin === void 0 ? {} : { uin: credential.uin }
+						}
+					}));
+				}
+				return { accounts: records };
+			},
+			async previewImport(region, text) {
+				return previewTransferFile(text);
+			},
+			async importAccounts(region, text, indexes) {
+				const { changes, imported, skipped } = mergeTransferRecords(parseTransferFile(text), indexes, region, (domain) => knownRegionOf(domain));
+				const store = stacks[region].store;
+				for (const [id, credential] of changes) await store.addOAuthAccount(credential).catch((error) => {
+					throw new Error("imported account " + id + " could not be stored: " + (error instanceof Error ? error.message : String(error)));
+				});
+				return {
+					imported,
+					skipped
+				};
+			}
 		}
 	}));
 	/**
@@ -4619,6 +5388,15 @@ function apply(ctx, config) {
 		creditsSnapshotAt[region] = Date.now();
 		return rows;
 	}
+	/**
+	* The model a per-row test would use right now: the SAME resolution the
+	* batch route performs (`resolveTargetModel` over the region's displayed
+	* catalog and the saved preference), so a row test and a batch test never
+	* measure different models. Undefined mirrors the route's 409 states.
+	*/
+	const regionTargetModel = (region) => {
+		return resolveTargetModel(displayModels(current(), region), poolPreferencesOf(current(), region).targetModelId).modelId;
+	};
 	/** One region's pool preferences, with the schema's defaults applied. */
 	const poolPreferencesOf = (config, region) => {
 		const pool = regionStateOf(config, region).pool;
@@ -4800,4 +5578,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };