dsh-connect-workbuddy 4.0.0 → 4.3.0

package/lib/client.js

@@ -70,12 +70,47 @@ window.__ModuleLoader__.load({
 		* splitting them would duplicate the guards and invite them to drift apart.
 		*/
 		const WORKBUDDY_POOL_PATH = "/plugins/dsh-connect-workbuddy/pool";
+		/**
+		* Plugin-owned OAuth sign-in endpoint: one session step per call.
+		*
+		* `?action=start` asks the upstream for a login state and returns the URL to
+		* open; `?action=poll` (+ `loginId` in the body) reports whether the user
+		* finished, and on success persists the account into the vault. POST +
+		* loopback-only like the card's other mutations: the poll carries the login
+		* binding, and the Host-side session state must not be settable by another
+		* origin.
+		*/
+		const WORKBUDDY_OAUTH_PATH = "/plugins/dsh-connect-workbuddy/oauth";
 		/** Query parameter selecting which pool batch action a request means. */
 		const WORKBUDDY_POOL_ACTION_PARAM = "action";
+		/** How long the card waits between polls while the user is scanning. */
+		const OAUTH_POLL_INTERVAL_MS = 2e3;
+		/**
+		* Plugin-owned account transfer endpoint: the batch export / import of
+		* credentials between machines and between tools of the SAME format family.
+		*
+		* `?action=export` POSTs account ids, answers a JSON ARRAY of credential
+		* records; `?action=preview` POSTs file text, answers a token-free listing;
+		* `?action=import` POSTs file text plus selected indexes, merges into the
+		* vault. POST + loopback-only like every other mutation: the file content is
+		* arbitrary user data and export carries token material.
+		*/
+		const WORKBUDDY_TRANSFER_PATH = "/plugins/dsh-connect-workbuddy/transfer";
 		/** Address one region's pool endpoint with an action. */
 		function withWorkBuddyRegionAndAction(path, region, action) {
 			return `${withWorkBuddyRegion(path, region)}&${WORKBUDDY_POOL_ACTION_PARAM}=${action}`;
 		}
+		/**
+		* Address one region's endpoint for ANY route that dispatches on `action`.
+		*
+		* The OAuth and transfer routes reject a request with no action (400), so
+		* their callers must build the URL here rather than with
+		* {@link withWorkBuddyRegion} — a request missing the parameter fails the same
+		* way whether the omission was a mistake or not.
+		*/
+		function withWorkBuddyRouteAction(path, region, action) {
+			return `${withWorkBuddyRegion(path, region)}&${WORKBUDDY_POOL_ACTION_PARAM}=${action}`;
+		}
 		/** Query parameter naming the region a card request addresses. */
 		const WORKBUDDY_REGION_PARAM = "region";
 		/** Every region, in card tab order. */
@@ -614,6 +649,40 @@ window.__ModuleLoader__.load({
 			}
 		}
 		//#endregion
+		//#region src/client/BusyOverlay.tsx
+		/**
+		* The veil. Deliberately NOT a modal dialog: it carries no focusable control
+		* and no dismissal — there is nothing for the user to decide, only a step to
+		* wait through. `aria-busy` plus a polite live region state that to screen
+		* readers, which is the whole accessibility contract a wait screen needs.
+		*/
+		function BusyOverlay({ message, hint, visible }) {
+			if (!visible) return null;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: "dsm-workbuddy-veil",
+				role: "status",
+				"aria-busy": "true",
+				"aria-live": "polite",
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dsm-workbuddy-veil-card",
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-workbuddy-veil-spinner",
+							"aria-hidden": "true"
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-workbuddy-veil-text",
+							children: message
+						}),
+						hint === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-workbuddy-veil-hint",
+							children: hint
+						})
+					]
+				})
+			});
+		}
+		//#endregion
 		//#region src/client/ndjson.ts
 		/**
 		* Read a newline-delimited JSON body, one object at a time.
@@ -1091,7 +1160,7 @@ window.__ModuleLoader__.load({
 		* section implying the feature exists.
 		*/
 		function AccountPool(props) {
-			const { t, region, pool, settingsScope, siblingBusy, onBusyChange, onSaved, onRefresh, onRescan, rescanning, onSelectAccount, selectingAccount } = props;
+			const { t, region, pool, settingsScope, siblingBusy, onBusyChange, onSaved, onRefresh, onRescan, rescanning, onSelectAccount, selectingAccount, accountTools } = props;
 			const [draft, setDraft] = (0, react.useState)(null);
 			const [saving, setSaving] = (0, react.useState)(false);
 			const [saveError, setSaveError] = (0, react.useState)(void 0);
@@ -1116,6 +1185,24 @@ window.__ModuleLoader__.load({
 				memberAccountIds: pool?.memberAccountIds ?? []
 			};
 			const active = draftRegion === region && draft !== null ? draft : saved;
+			/**
+			* Whether the pool is RUNNING right now, which is the SAVED value.
+			*
+			* `active` is the user's draft and only becomes reality at Save. Using it for
+			* the parts that DESCRIBE the running pool made the card state a mode that had
+			* not taken effect yet: flipping the switch off (unsaved) revealed the manual
+			* picker while the pool was still ranking every request, so the picker showed
+			* the rotated account as "in use" and a selection made there was overridden by
+			* the very pool the user was looking at — the "shows A, bills B" trap this
+			* section keeps guarding against. The mirror case was milder but the same
+			* class of wrong: turning the pool ON (unsaved) hid the picker while the manual
+			* account was still the one being billed.
+			*
+			* Everything that reports pool state reads this; only the switch itself (its
+			* controlled value) and `dirty` read the draft, because those two ARE about
+			* the pending edit.
+			*/
+			const poolRunning = saved.enabled;
 			const dirty = draftRegion === region && draft !== null && (draft.enabled !== saved.enabled || draft.targetModelId !== saved.targetModelId || draft.probeInputTokens !== saved.probeInputTokens || !sameIds(draft.memberAccountIds, saved.memberAccountIds));
 			/**
 			* Membership that actually resolves to a local sign-in — what a batch runs on.
@@ -1367,6 +1454,118 @@ window.__ModuleLoader__.load({
 				region,
 				t
 			]);
+			/** The account whose per-row action is in flight; gates every row's buttons. */
+			const [rowBusyAccountId, setRowBusyAccountId] = (0, react.useState)(void 0);
+			/**
+			* Which per-row action is running, for the veil's scenario line.
+			*
+			* A removal and a test both set `rowBusyAccountId`, but they mean different
+			* things to the person watching ("this account is going away" versus "this
+			* account is being measured") — and the veil exists precisely to say which.
+			*/
+			const [rowBusyAction, setRowBusyAction] = (0, react.useState)(void 0);
+			/**
+			* Test ONE account from its row.
+			*
+			* Same Host rule as the batch (testOne reuses the batch's probe), the same
+			* log vocabulary, and the same refresh-after — a row result must read exactly
+			* like the batch result it replaces.
+			*/
+			const runRowTest = (0, react.useCallback)(async (accountId) => {
+				setRowBusyAccountId(accountId);
+				setRowBusyAction("test");
+				setActionError(void 0);
+				const url = withWorkBuddyRegionAndAction(WORKBUDDY_POOL_PATH, region, "test") + "&accountId=" + encodeURIComponent(accountId);
+				try {
+					const response = await fetch(url, {
+						method: "POST",
+						headers: { accept: "application/json" },
+						credentials: "same-origin"
+					});
+					const body = await response.json().catch(() => void 0);
+					if (!response.ok) throw new Error(poolFailureText(t, {
+						status: response.status,
+						reason: body?.reason,
+						error: body?.error
+					}));
+					if (!mounted.current) return;
+					const row = body?.rows?.[0];
+					if (row === void 0) {
+						setActionError(t("row.poolLogTestRowMalformed", { accountName: t("row.accountUnnamed") }));
+						return;
+					}
+					const outcome = row.result?.outcome;
+					if (outcome === void 0) appendLog(t("row.poolLogTestRowMalformed", { accountName: row.accountName === "" ? t("row.accountUnnamed") : row.accountName }), "warn");
+					else appendLog(t("row.poolLogTestRow", {
+						accountName: row.accountName === "" ? t("row.accountUnnamed") : row.accountName,
+						outcome: outcomeText(t, outcome)
+					}), outcomeOk(outcome) ? "ok" : "warn");
+					onRefresh?.();
+				} catch (error) {
+					const message = error instanceof Error ? error.message : t("row.requestFailed");
+					if (mounted.current) {
+						setActionError(message);
+						appendLog(t("row.poolLogBatchFailed", { message }), "error");
+					}
+				} finally {
+					if (mounted.current) {
+						setRowBusyAccountId(void 0);
+						setRowBusyAction(void 0);
+					}
+				}
+			}, [
+				appendLog,
+				onRefresh,
+				region,
+				t
+			]);
+			/**
+			* Remove ONE account from its row, via the Host.
+			*
+			* The Host dismisses the account (and deletes its vault entry when it has
+			* one), so the row stays gone across rescans. The desktop app is not signed
+			* out. The message below still distinguishes the two cases, because "there
+			* was no plugin-stored copy" is worth saying: it tells the user the account
+			* comes from the app itself rather than from an OAuth sign-in or an import.
+			*/
+			const runRowRemove = (0, react.useCallback)(async (accountId, accountName) => {
+				setRowBusyAccountId(accountId);
+				setRowBusyAction("remove");
+				setActionError(void 0);
+				const url = withWorkBuddyRegionAndAction(WORKBUDDY_POOL_PATH, region, "remove") + "&accountId=" + encodeURIComponent(accountId);
+				try {
+					const response = await fetch(url, {
+						method: "POST",
+						headers: { accept: "application/json" },
+						credentials: "same-origin"
+					});
+					const body = await response.json().catch(() => void 0);
+					if (!response.ok) throw new Error(poolFailureText(t, {
+						status: response.status,
+						reason: body?.reason,
+						error: body?.error
+					}));
+					if (!mounted.current) return;
+					appendLog(body?.removed === true ? t("row.poolRowRemoved", { accountName: accountName === "" ? t("row.accountUnnamed") : accountName }) : t("row.poolRowRemoveDesktopOnly", { accountName: accountName === "" ? t("row.accountUnnamed") : accountName }), body?.removed === true ? "ok" : "info");
+					await onRefresh?.();
+				} catch (error) {
+					const message = error instanceof Error ? error.message : t("row.requestFailed");
+					if (mounted.current) {
+						setActionError(message);
+						appendLog(t("row.poolLogBatchFailed", { message }), "error");
+					}
+				} finally {
+					if (mounted.current) {
+						setRowBusyAccountId(void 0);
+						setRowBusyAction(void 0);
+					}
+				}
+			}, [
+				appendLog,
+				onRefresh,
+				region,
+				t
+			]);
 			if (pool === void 0) return null;
 			/**
 			* Where the target model came from, and which model it is.
@@ -1390,7 +1589,15 @@ window.__ModuleLoader__.load({
 			*/
 			const currentAccount = pool.accounts.find((account) => account.current);
 			const currentName = currentAccount === void 0 ? void 0 : currentAccount.accountName === "" ? t("row.accountUnnamed") : currentAccount.accountName;
-			return (0, react.createElement)("section", { className: "dsm-workbuddy-pool" }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-head" }, (0, react.createElement)("h3", { className: "dsm-workbuddy-pool-title" }, t("row.poolTitle")), currentName === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-current-badge" }, t("row.poolCurrentHeader", { account: currentName }))), !active.enabled && onSelectAccount !== void 0 && pool.accounts.length > 0 ? (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, t("row.poolManualAccountLabel")), (0, react.createElement)("span", null, t("row.poolManualAccountHint"))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("select", {
+			return (0, react.createElement)("section", { className: "dsm-workbuddy-pool" }, rowBusyAction === "remove" ? (0, react.createElement)(BusyOverlay, {
+				visible: true,
+				message: t("row.poolRowRemoving"),
+				hint: t("row.veilHintList")
+			}) : null, saving ? (0, react.createElement)(BusyOverlay, {
+				visible: true,
+				message: t("row.poolSaving"),
+				hint: t("row.veilHintList")
+			}) : null, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-head" }, (0, react.createElement)("h3", { className: "dsm-workbuddy-pool-title" }, t("row.poolTitle")), currentName === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-current-badge" }, t("row.poolCurrentHeader", { account: currentName }))), !poolRunning && onSelectAccount !== void 0 && pool.accounts.length > 0 ? (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, t("row.poolManualAccountLabel")), (0, react.createElement)("span", null, t("row.poolManualAccountHint"))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("select", {
 				className: "dsm-workbuddy-pool-select dsm-workbuddy-pool-account-select",
 				value: currentAccount?.accountId ?? "",
 				disabled: selectingAccount === true,
@@ -1423,7 +1630,7 @@ window.__ModuleLoader__.load({
 				className: "dsm-btn dsm-btn-outline",
 				disabled: rescanning === true,
 				onClick: onRescan
-			}, rescanning === true ? t("row.accountsScanning") : t("row.accountsRescan")))), !active.enabled ? (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolEnabledHint")) : null, active.enabled && usable.length === 0 ? (0, react.createElement)("p", {
+			}, rescanning === true ? t("row.accountsScanning") : t("row.accountsRescan")))), !poolRunning ? (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolEnabledHint")) : null, poolRunning && usable.length === 0 ? (0, react.createElement)("p", {
 				className: "dsm-workbuddy-pool-warn",
 				role: "status"
 			}, `${t("row.poolNoCandidate")} ${t("row.poolNoCandidateHint")}`) : null, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-members" }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-members-head" }, (0, react.createElement)("div", null, (0, react.createElement)("h4", { className: "dsm-workbuddy-pool-members-title" }, t("row.poolMembersTitle")), (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolMembersHint"))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-members-actions" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-hint" }, t("row.poolSelectedCount", {
@@ -1439,13 +1646,22 @@ window.__ModuleLoader__.load({
 				className: "dsm-btn dsm-btn-outline dsm-workbuddy-pool-small-btn",
 				disabled: effectiveMembers.length === 0 || !canEditPool,
 				onClick: () => selectAll(false)
-			}, t("row.poolSelectNone")))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-table" }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-row dsm-workbuddy-pool-row-head" }, (0, react.createElement)("span", null, t("row.poolColumnAccount")), (0, react.createElement)("span", null, t("row.poolColumnCredits")), (0, react.createElement)("span", null, t("row.poolColumnProbe")), pool.checkinSupported ? (0, react.createElement)("span", null, t("row.poolColumnCheckin")) : null), ...pool.accounts.map((account) => renderAccountRow({
+			}, t("row.poolSelectNone")))), (0, react.createElement)("div", { className: `dsm-workbuddy-pool-table${pool.checkinSupported ? " dsm-workbuddy-pool-table-checkin" : ""}` }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-row dsm-workbuddy-pool-row-head" }, (0, react.createElement)("span", null, t("row.poolColumnAccount")), (0, react.createElement)("span", null, t("row.poolColumnCredits")), (0, react.createElement)("span", null, t("row.poolColumnProbe")), pool.checkinSupported ? (0, react.createElement)("span", null, t("row.poolColumnCheckin")) : null, (0, react.createElement)("span", null)), ...pool.accounts.map((account) => renderAccountRow({
 				t,
 				account,
 				checked: active.memberAccountIds.includes(account.accountId),
 				canEdit: canEditPool,
 				checkinSupported: pool.checkinSupported,
-				onToggle: (next) => toggleMember(account.accountId, next)
+				onToggle: (next) => toggleMember(account.accountId, next),
+				busy: rowBusyAccountId !== void 0,
+				testDisabled: pool.targetModelSource === "none" || pool.targetModelSource === "stale",
+				targetHint: pool.targetModelSource === "none" ? t("row.poolTargetNone") : pool.targetModelSource === "stale" ? t("row.poolTargetStale", { model: pool.staleTargetModelId ?? "" }) : void 0,
+				onTest: () => {
+					runRowTest(account.accountId);
+				},
+				onRemove: () => {
+					runRowRemove(account.accountId, account.accountName);
+				}
 			}))), effectiveMembers.length === 0 ? (0, react.createElement)("p", {
 				className: "dsm-workbuddy-pool-warn",
 				role: "status"
@@ -1483,7 +1699,8 @@ window.__ModuleLoader__.load({
 				},
 				onDiscard: discard,
 				appendLog,
-				targetProvenance
+				targetProvenance,
+				...accountTools === void 0 ? {} : { accountTools }
 			}), (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolRegionNote")), renderLog({
 				t,
 				log,
@@ -1496,7 +1713,7 @@ window.__ModuleLoader__.load({
 		}
 		/** One account's row. */
 		function renderAccountRow(input) {
-			const { t, account, checked, canEdit, checkinSupported, onToggle } = input;
+			const { t, account, checked, canEdit, checkinSupported, onToggle, busy, testDisabled, targetHint, onTest, onRemove } = input;
 			const name = account.accountName === "" ? t("row.accountUnnamed") : account.accountName;
 			const excluded = exclusionText(t, account.excludedBy);
 			const probe = account.probe;
@@ -1537,11 +1754,24 @@ window.__ModuleLoader__.load({
 			}, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-main" }, probeLine), probeLabel === void 0 && age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe-prov" }, probeLabel === void 0 ? null : (0, react.createElement)("span", { className: probeLabel.className }, probeLabel.text), probeLabel === void 0 || age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-sep" }, "·"), age === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-prov-age" }, age))), checkinSupported ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checkin" }, account.checkedInToday === void 0 ? (0, react.createElement)("span", {
 				className: "dsm-workbuddy-pool-unknown",
 				title: t("row.poolNeverTested")
-			}, t("row.poolCheckinUnknown")) : account.checkedInToday ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checked" }, t("row.poolCheckedIn")) : t("row.poolNotCheckedIn")) : null);
+			}, t("row.poolCheckinUnknown")) : account.checkedInToday ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checked" }, t("row.poolCheckedIn")) : t("row.poolNotCheckedIn")) : null, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-row-actions" }, (0, react.createElement)("button", {
+				type: "button",
+				className: "dsm-btn dsm-btn-outline dsm-workbuddy-pool-small-btn",
+				disabled: busy || testDisabled,
+				title: testDisabled ? targetHint : void 0,
+				onClick: onTest
+			}, t("row.poolRowTest")), (0, react.createElement)("button", {
+				type: "button",
+				className: "dsm-btn dsm-btn-outline dsm-workbuddy-pool-small-btn",
+				disabled: busy,
+				title: t("row.poolRowRemoveHint"),
+				"aria-label": t("row.poolRowRemoveAria", { accountName: name }),
+				onClick: onRemove
+			}, t("row.poolRowRemove"))));
 		}
 		/** The preference editor plus its save/discard actions. */
 		function renderSettings(input) {
-			const { t, pool, active, dirty, saving, siblingBusy, saveError, settingsScope, onEdit, onSave, onDiscard, targetProvenance } = input;
+			const { t, pool, active, dirty, saving, siblingBusy, saveError, settingsScope, onEdit, onSave, onDiscard, targetProvenance, accountTools } = input;
 			const canEdit = settingsScope !== void 0;
 			const toggle = (label, hint, checked, onChange, disabled = false) => (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, label), (0, react.createElement)("span", null, hint)), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("label", { className: "sw" }, (0, react.createElement)("input", {
 				type: "checkbox",
@@ -1549,7 +1779,7 @@ window.__ModuleLoader__.load({
 				disabled: disabled || !canEdit,
 				onChange: (event) => onChange(event.currentTarget.checked)
 			}), (0, react.createElement)("span", { className: "sw-track" }))));
-			return (0, react.createElement)("div", { className: "dsm-workbuddy-pool-settings-wrap" }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-head" }, (0, react.createElement)("h3", { className: "dsm-workbuddy-pool-title" }, t("row.poolSettingsTitle")), dirty ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-dirty" }, t("row.poolDirty")) : null), (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolSettingsHint")), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-settings" }, toggle(t("row.poolEnabled"), t("row.poolEnabledHint"), active.enabled, (next) => onEdit((current) => ({
+			return (0, react.createElement)("div", { className: "dsm-workbuddy-pool-settings-wrap" }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-head" }, (0, react.createElement)("h3", { className: "dsm-workbuddy-pool-title" }, t("row.poolSettingsTitle")), dirty ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-dirty" }, t("row.poolDirty")) : null), accountTools === void 0 ? null : (0, react.createElement)("div", { className: "dsm-workbuddy-pool-tools" }, accountTools), (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolSettingsHint")), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-settings" }, toggle(t("row.poolEnabled"), t("row.poolEnabledHint"), active.enabled, (next) => onEdit((current) => ({
 				...current,
 				enabled: next
 			}))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, t("row.poolTargetLabel")), (0, react.createElement)("span", null, targetProvenance === null ? null : `${targetProvenance} `, t("row.poolTargetHint"))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("select", {
@@ -1621,6 +1851,690 @@ window.__ModuleLoader__.load({
 			}, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-log-time" }, formatClock$1(entry.atMs)), (0, react.createElement)("span", { className: `dsm-workbuddy-pool-log-text dsm-workbuddy-pool-log-${entry.tone}` }, entry.text)))));
 		}
 		//#endregion
+		//#region src/client/OAuthSignIn.tsx
+		/**
+		* The card's OAuth QR sign-in section: one resting bar row plus a dialog
+		* opened by the sign-in button.
+		*
+		* 参考：workbuddy2api-panel 的「添加账号」弹窗交互形态 —— 静态入口一行，
+		*   点开后弹窗内分步走：获取授权链接 → 自动打开浏览器 → 弹窗内显示链接
+		*   与等待状态 → 完成/失败回填结果。本实现沿用该步骤划分；弹窗样式直接
+		*   用本项目导出/导入弹框的类（dsm-workbuddy-transfer-dialog），不引入
+		*   第二套视觉。
+		* 改动：自动打开浏览器。弹窗拦截的规避方式是「用户手势内同步 window.open
+		*   占位，拿到授权 URL 后再导航」——点击「获取授权链接」的那一刻浏览器
+		*   仍认定这是用户激活的手势链，占位窗口不会被拦；若 Host 环境连占位都
+		*   拦（返回 null），降级为弹窗内手动「打开登录页」链接，功能不损失。
+		*
+		* 轮询循环压成一个组件内 effect：按 `OAUTH_POLL_INTERVAL_MS` 节奏问 Host
+		*   「完成了吗」，完成即停。所有状态就地管理，零跨组件往返；Host 重启
+		*   导致 loginId 失效会得到 done+error，与超时同一条文案路径。
+		*
+		* @module dsh-connect-workbuddy/client/OAuthSignIn
+		*/
+		/** Seconds since the login started, for the waiting line. */
+		function elapsedSeconds(sinceMs, nowMs) {
+			return Math.max(0, Math.floor((nowMs - sinceMs) / 1e3));
+		}
+		/** Copy the sign-in URL to the clipboard; true on success. */
+		async function copyUrl(url) {
+			try {
+				await navigator.clipboard.writeText(url);
+				return true;
+			} catch {
+				return false;
+			}
+		}
+		/**
+		* The section. Rendered on BOTH sign-in states: a signed-out machine gains
+		* its first account here; a signed-in one can add another without leaving
+		* the card.
+		*/
+		function OAuthSignIn({ t, region, onAdded }) {
+			const [phase, setPhase] = (0, react.useState)({ kind: "idle" });
+			const [dialogOpen, setDialogOpen] = (0, react.useState)(false);
+			const [copied, setCopied] = (0, react.useState)(false);
+			const [pollTick, setPollTick] = (0, react.useState)(0);
+			const [nowMs, setNowMs] = (0, react.useState)(() => Date.now());
+			const mounted = (0, react.useRef)(true);
+			(0, react.useEffect)(() => {
+				mounted.current = true;
+				return () => {
+					mounted.current = false;
+				};
+			}, []);
+			const waiting = phase.kind === "waiting";
+			(0, react.useEffect)(() => {
+				if (!waiting || phase.kind !== "waiting") return;
+				const expiresAtMs = phase.expiresAtMs;
+				const timer = setInterval(() => {
+					if (!mounted.current) return;
+					const now = Date.now();
+					setNowMs(now);
+					if (now > expiresAtMs) setPhase({
+						kind: "finished",
+						message: "error",
+						error: t("row.oauthTimedOut")
+					});
+				}, 1e3);
+				return () => {
+					clearInterval(timer);
+				};
+			}, [
+				waiting,
+				phase,
+				t
+			]);
+			(0, react.useEffect)(() => {
+				if (phase.kind !== "waiting") return;
+				const { loginId } = phase;
+				let cancelled = false;
+				const timer = setTimeout(() => {
+					(async () => {
+						try {
+							const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_OAUTH_PATH, region, "poll"), {
+								method: "POST",
+								headers: {
+									"content-type": "application/json",
+									accept: "application/json"
+								},
+								credentials: "same-origin",
+								body: JSON.stringify({ loginId })
+							});
+							const body = await response.json();
+							if (cancelled || !mounted.current) return;
+							if (!response.ok || !body || typeof body !== "object") {
+								setPhase({
+									kind: "finished",
+									message: "error",
+									error: `HTTP ${response.status}`
+								});
+								return;
+							}
+							if (!body.done) {
+								setPollTick((tick) => tick + 1);
+								return;
+							}
+							if (typeof body.error === "string" && body.error !== "") setPhase({
+								kind: "finished",
+								message: "error",
+								error: body.error
+							});
+							else {
+								const accountName = body.accountName ?? "";
+								setPhase({
+									kind: "syncing",
+									accountName
+								});
+								await onAdded?.();
+								if (cancelled || !mounted.current) return;
+								setPhase({
+									kind: "finished",
+									message: "added",
+									accountName
+								});
+							}
+						} catch {
+							setPollTick((tick) => tick + 1);
+						}
+					})();
+				}, OAUTH_POLL_INTERVAL_MS);
+				return () => {
+					cancelled = true;
+					clearTimeout(timer);
+				};
+			}, [
+				onAdded,
+				phase,
+				pollTick,
+				region
+			]);
+			/**
+			* Open a placeholder window WITHOUT `noopener`, and deliberately so.
+			*
+			* `noopener` is the correct feature for a link whose destination never needs
+			* a handle — and that is exactly why it is wrong here. Per the spec, a
+			* `window.open` call carrying `noopener` opens the tab but returns `null`
+			* (MDN: "the new window will not have access to the originating window via
+			* `Window.opener` and returns `null`"). The placeholder exists ONLY to be
+			* navigated once the Host answers, so the handle IS the point: passing
+			* `noopener` made `placeholder` null, the navigation was skipped, and every
+			* sign-in left an empty `about:blank` tab behind instead of the sign-in page.
+			*
+			* The security property is kept, just established on the handle instead of
+			* through the feature: `opener = null` is applied to the placeholder before
+			* anything is loaded into it, so the destination still cannot reach back
+			* through `window.opener`. `noreferrer` is dropped for the same reason —
+			* the spec makes it imply `noopener`, so it would reintroduce the null.
+			* Nothing is lost: the placeholder is same-origin and empty until navigated,
+			* and the referrer would only ever have been the settings page.
+			*/
+			function openPlaceholder() {
+				const placeholder = window.open("", "_blank");
+				if (placeholder !== null) placeholder.opener = null;
+				return placeholder;
+			}
+			/**
+			* Fetch the authorization URL AND open the browser in one gesture chain.
+			* The placeholder window is opened synchronously — inside the click's user
+			* activation, before any await — so popup blocking cannot intervene; the
+			* URL is navigated once the Host answers. A blocked placeholder (null)
+			* degrades to the manual link inside the dialog, losing nothing but the
+			* convenience.
+			*/
+			const start = async (placeholder) => {
+				setPhase({ kind: "opening" });
+				setCopied(false);
+				try {
+					const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_OAUTH_PATH, region, "start"), {
+						method: "POST",
+						headers: { accept: "application/json" },
+						credentials: "same-origin"
+					});
+					const body = await response.json();
+					if (!mounted.current) {
+						placeholder?.close();
+						return;
+					}
+					if (!response.ok || typeof body.loginId !== "string" || typeof body.verificationUri !== "string") {
+						placeholder?.close();
+						setPhase({
+							kind: "finished",
+							message: "error",
+							error: body.error ?? `HTTP ${response.status}`
+						});
+						return;
+					}
+					if (placeholder !== null) placeholder.location.href = body.verificationUri;
+					setPhase({
+						kind: "waiting",
+						loginId: body.loginId,
+						verificationUri: body.verificationUri,
+						startedAtMs: Date.now(),
+						expiresAtMs: Date.now() + (typeof body.expiresIn === "number" && body.expiresIn > 0 ? body.expiresIn : 600) * 1e3
+					});
+					setNowMs(Date.now());
+				} catch (error) {
+					placeholder?.close();
+					if (mounted.current) setPhase({
+						kind: "finished",
+						message: "error",
+						error: error instanceof Error ? error.message : String(error)
+					});
+				}
+			};
+			/** Open the dialog and begin the login in the same click: the placeholder
+			* window must be created synchronously to count as a user gesture. */
+			const beginSignIn = () => {
+				setDialogOpen(true);
+				start(openPlaceholder());
+			};
+			/** Re-open the sign-in page from the waiting dialog (no new session).
+			*
+			* Here `noopener,noreferrer` IS right: this is a one-way navigation to a
+			* third-party page and nothing needs a handle on it — the contrast with
+			* {@link openPlaceholder} is the whole distinction. */
+			const reopen = () => {
+				if (phase.kind !== "waiting") return;
+				window.open(phase.verificationUri, "_blank", "noopener,noreferrer");
+			};
+			/**
+			* The three strings that NAME the sign-in method, per region.
+			*
+			* CN signs in by scanning a QR code with the WorkBuddy app; the international
+			* build signs in on a web page. Every other line in this section (waiting,
+			* cancel, done, copy) is about the flow, not the method, so it stays shared —
+			* splitting it too would let the two regions drift apart for no gain.
+			*/
+			const titleKey = region === "cn" ? "row.oauthTitle" : "row.oauthTitleGlobal";
+			const startKey = region === "cn" ? "row.oauthStart" : "row.oauthStartGlobal";
+			const finishText = phase.kind === "finished" ? phase.message === "added" ? t("row.oauthDone", { accountName: phase.accountName === "" || phase.accountName === void 0 ? t("row.accountUnnamed") : phase.accountName }) : phase.message === "cancelled" ? t("row.oauthCancelled") : t("row.oauthError", { message: phase.error ?? "" }) : "";
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: "dsm-workbuddy-bar",
+				"aria-label": t(titleKey),
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(BusyOverlay, {
+						visible: phase.kind === "syncing",
+						message: t("row.oauthSyncing"),
+						hint: t("row.veilHintList")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsm-workbuddy-bar-label",
+						children: t(titleKey)
+					}),
+					phase.kind === "finished" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: `dsm-workbuddy-bar-status ${phase.message === "added" ? "dsm-workbuddy-bar-ok" : "dsm-workbuddy-bar-error"}`,
+						children: finishText
+					}) : phase.kind === "waiting" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsm-workbuddy-bar-status",
+						children: t("row.oauthOpened")
+					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dsm-workbuddy-bar-actions",
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: "dsm-btn dsm-btn-outline",
+							disabled: phase.kind === "opening",
+							onClick: beginSignIn,
+							children: phase.kind === "opening" ? t("row.oauthStarting") : t(startKey)
+						})
+					}),
+					dialogOpen ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dsm-workbuddy-transfer-dialog",
+						role: "dialog",
+						"aria-label": t(titleKey),
+						children: phase.kind === "opening" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.oauthStarting") }) : phase.kind === "waiting" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.oauthOpenHint") }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dsm-workbuddy-oauth-url",
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+									href: phase.verificationUri,
+									target: "_blank",
+									rel: "noopener noreferrer",
+									children: phase.verificationUri
+								})
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+								className: "dsm-workbuddy-hint",
+								children: [
+									t("row.oauthWaiting", { seconds: elapsedSeconds(phase.startedAtMs, nowMs) }),
+									" ",
+									t("row.oauthExpires", { minutes: Math.max(1, Math.round((phase.expiresAtMs - nowMs) / 6e4)) })
+								]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dsm-workbuddy-transfer-dialog-actions",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsm-btn dsm-btn-outline",
+										onClick: () => {
+											copyUrl(phase.verificationUri).then((ok) => {
+												if (mounted.current) setCopied(ok);
+											});
+										},
+										children: copied ? t("row.oauthCopied") : t("row.oauthCopy")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsm-btn dsm-btn-outline",
+										onClick: reopen,
+										children: t("row.oauthReopen")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsm-btn dsm-btn-outline",
+										onClick: () => {
+											setPhase({
+												kind: "finished",
+												message: "cancelled"
+											});
+										},
+										children: t("row.oauthCancel")
+									})
+								]
+							})
+						] }) : phase.kind === "finished" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: `${phase.message === "added" ? "dsm-workbuddy-bar-ok" : phase.message === "error" ? "dsm-workbuddy-bar-error" : ""}`,
+							children: finishText
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "dsm-workbuddy-transfer-dialog-actions",
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "dsm-btn dsm-btn-outline",
+								onClick: () => {
+									setDialogOpen(false);
+								},
+								children: t("row.oauthDialogClose")
+							})
+						})] }) : null
+					}) : null
+				]
+			});
+		}
+		//#endregion
+		//#region src/client/AccountTransfer.tsx
+		/**
+		* The card's account-transfer section: batch export / import of the region's
+		* stored credentials, in the file format shared with sibling credential
+		* managers for the same upstream.
+		*
+		* 参考：扫码登录小节（OAuthSignIn）的组件形态 —— 单个 section、就地管理
+		*   全部状态（busy / 结果行 / 错误）、零跨组件往返。导出弹框的交互（多选
+		*   账号 → 下载 JSON）与导入弹框（选文件 → 脱敏预览 → 勾选 → 导入）沿用
+		*   通行实现的步骤划分；预览只含展示字段与 hasToken 布尔量，token 明文
+		*   永不进入浏览器。
+		*
+		* 导出用 <a download> Blob：卡片运行在设置页 iframe 里，无宿主保存对话框
+		*   可用；a[download] 同源下载是沙箱内最可靠的方式。
+		*
+		* @module dsh-connect-workbuddy/client/AccountTransfer
+		*/
+		/** Build the default export file name: workbuddy-accounts-YYYY-MM-DD.json. */
+		function exportFileName() {
+			const pad = (value) => String(value).padStart(2, "0");
+			const d = /* @__PURE__ */ new Date();
+			return `workbuddy-accounts-${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}.json`;
+		}
+		/** Download a JSON array as a local file (no host save dialog inside the iframe). */
+		function downloadJson(fileName, data) {
+			const blob = new Blob([JSON.stringify(data, null, 2)], { type: "application/json" });
+			const url = URL.createObjectURL(blob);
+			const anchor = document.createElement("a");
+			anchor.href = url;
+			anchor.download = fileName;
+			document.body.appendChild(anchor);
+			anchor.click();
+			anchor.remove();
+			URL.revokeObjectURL(url);
+		}
+		/** The section. Rendered on both sign-in states — a signed-out machine can
+		* still import a file exported elsewhere; export without accounts answers
+		* the error line. */
+		function AccountTransfer({ t, region, accounts, onChanged }) {
+			const [phase, setPhase] = (0, react.useState)({ kind: "idle" });
+			const [dialog, setDialog] = (0, react.useState)(void 0);
+			const [selected, setSelected] = (0, react.useState)(/* @__PURE__ */ new Set());
+			const [preview, setPreview] = (0, react.useState)(void 0);
+			const [importSelected, setImportSelected] = (0, react.useState)(/* @__PURE__ */ new Set());
+			const fileInput = (0, react.useRef)(null);
+			/**
+			* The text of the file the user just picked.
+			*
+			* Held here rather than re-read from the input at import time: the picker
+			* is a bare system dialog that closes immediately (see the import button),
+			* so between preview and confirm there is no dialog on screen holding the
+			* File. Re-reading `fileInput.current.files` would also break the moment
+			* anything clears the input — and it must be cleared after every pick, or
+			* choosing the SAME file twice fires no change event.
+			*/
+			const importText = (0, react.useRef)("");
+			const mounted = (0, react.useRef)(true);
+			(0, react.useEffect)(() => {
+				mounted.current = true;
+				return () => {
+					mounted.current = false;
+				};
+			}, []);
+			const closeDialog = () => {
+				setDialog(void 0);
+				setSelected(/* @__PURE__ */ new Set());
+				setPreview(void 0);
+				setImportSelected(/* @__PURE__ */ new Set());
+			};
+			const runExport = async () => {
+				if (selected.size === 0) return;
+				setPhase({ kind: "exporting" });
+				try {
+					const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_TRANSFER_PATH, region, "export"), {
+						method: "POST",
+						headers: {
+							"content-type": "application/json",
+							accept: "application/json"
+						},
+						credentials: "same-origin",
+						body: JSON.stringify({ accountIds: [...selected] })
+					});
+					const body = await response.json();
+					if (!mounted.current) return;
+					if (!response.ok || !Array.isArray(body.accounts)) {
+						setPhase({
+							kind: "error",
+							message: body.error ?? `HTTP ${response.status}`
+						});
+						return;
+					}
+					downloadJson(exportFileName(), body.accounts);
+					closeDialog();
+					setPhase({
+						kind: "done",
+						message: t("row.transferExported", {
+							count: body.accounts.length,
+							fileName: exportFileName()
+						})
+					});
+				} catch (error) {
+					if (mounted.current) setPhase({
+						kind: "error",
+						message: error instanceof Error ? error.message : String(error)
+					});
+				}
+			};
+			const readImportFile = async (file) => {
+				setPhase({ kind: "importing" });
+				try {
+					const text = await file.text();
+					importText.current = text;
+					const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_TRANSFER_PATH, region, "preview"), {
+						method: "POST",
+						headers: {
+							"content-type": "application/json",
+							accept: "application/json"
+						},
+						credentials: "same-origin",
+						body: JSON.stringify({ text })
+					});
+					const body = await response.json();
+					if (!mounted.current) return;
+					if (!response.ok || !Array.isArray(body.accounts)) {
+						setPhase({
+							kind: "error",
+							message: body.error ?? `HTTP ${response.status}`
+						});
+						return;
+					}
+					setPreview(body);
+					setImportSelected(new Set(body.accounts.filter((entry) => entry.hasToken).map((entry) => entry.index)));
+					setPhase({ kind: "idle" });
+				} catch (error) {
+					if (mounted.current) setPhase({
+						kind: "error",
+						message: error instanceof Error ? error.message : String(error)
+					});
+				}
+			};
+			const runImport = async () => {
+				if (preview === void 0 || importSelected.size === 0 || importText.current === "") return;
+				setPhase({ kind: "importing" });
+				try {
+					const text = importText.current;
+					const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_TRANSFER_PATH, region, "import"), {
+						method: "POST",
+						headers: {
+							"content-type": "application/json",
+							accept: "application/json"
+						},
+						credentials: "same-origin",
+						body: JSON.stringify({
+							text,
+							indexes: [...importSelected]
+						})
+					});
+					const body = await response.json();
+					if (!mounted.current) return;
+					if (!response.ok || typeof body.imported !== "number") {
+						setPhase({
+							kind: "error",
+							message: body.error ?? `HTTP ${response.status}`
+						});
+						return;
+					}
+					closeDialog();
+					const message = t("row.transferImported", {
+						imported: body.imported,
+						skipped: body.skipped ?? 0
+					});
+					setPhase({
+						kind: "refreshing",
+						message
+					});
+					await onChanged?.();
+					if (!mounted.current) return;
+					setPhase({
+						kind: "done",
+						message
+					});
+				} catch (error) {
+					if (mounted.current) setPhase({
+						kind: "error",
+						message: error instanceof Error ? error.message : String(error)
+					});
+				}
+			};
+			const busy = phase.kind === "exporting" || phase.kind === "importing" || phase.kind === "refreshing";
+			/** The veil's scenario line: what is happening, in the user's terms. */
+			const veilMessage = phase.kind === "exporting" ? t("row.transferExporting") : phase.kind === "importing" || phase.kind === "refreshing" ? t("row.transferImporting") : "";
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: "dsm-workbuddy-bar",
+				"aria-label": t("row.transferTitle"),
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(BusyOverlay, {
+						visible: busy,
+						message: veilMessage,
+						...busy ? { hint: t("row.veilHintList") } : {}
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsm-workbuddy-bar-label",
+						children: t("row.transferTitle")
+					}),
+					phase.kind === "done" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsm-workbuddy-bar-status dsm-workbuddy-bar-ok",
+						children: phase.message
+					}) : phase.kind === "error" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsm-workbuddy-bar-status dsm-workbuddy-bar-error",
+						children: t("row.transferError", { message: phase.message })
+					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dsm-workbuddy-bar-actions",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: "dsm-btn dsm-btn-outline",
+							disabled: busy || accounts.length === 0,
+							onClick: () => {
+								setSelected(/* @__PURE__ */ new Set());
+								setDialog("export");
+							},
+							children: t("row.transferExport")
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: "dsm-btn dsm-btn-outline",
+							disabled: busy,
+							onClick: () => {
+								fileInput.current?.click();
+							},
+							children: t("row.transferImport")
+						})]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+						ref: fileInput,
+						type: "file",
+						accept: "application/json,.json",
+						className: "dsm-workbuddy-transfer-file",
+						onChange: (event) => {
+							const file = event.target.files?.[0];
+							event.target.value = "";
+							if (file !== void 0) {
+								setPreview(void 0);
+								setImportSelected(/* @__PURE__ */ new Set());
+								setDialog("import");
+								readImportFile(file);
+							}
+						}
+					}),
+					dialog === "export" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dsm-workbuddy-transfer-dialog",
+						role: "dialog",
+						"aria-label": t("row.transferExport"),
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.transferExportPick", { total: accounts.length }) }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dsm-workbuddy-hint",
+								children: t("row.transferHint")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+								className: "dsm-workbuddy-transfer-list",
+								children: accounts.map((account) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+										type: "checkbox",
+										checked: selected.has(account.id),
+										onChange: (event) => {
+											const next = new Set(selected);
+											if (event.target.checked) next.add(account.id);
+											else next.delete(account.id);
+											setSelected(next);
+										}
+									}),
+									" ",
+									account.accountName === "" ? t("row.accountUnnamed") : account.accountName
+								] }) }, account.id))
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dsm-workbuddy-transfer-dialog-actions",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "dsm-btn dsm-btn-outline",
+									onClick: closeDialog,
+									children: t("row.transferCancel")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "dsm-btn dsm-btn-outline",
+									disabled: selected.size === 0 || phase.kind === "exporting",
+									onClick: () => {
+										runExport();
+									},
+									children: phase.kind === "exporting" ? t("row.transferExporting") : t("row.transferExportConfirm", { count: selected.size })
+								})]
+							})
+						]
+					}) : null,
+					dialog === "import" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dsm-workbuddy-transfer-dialog",
+						role: "dialog",
+						"aria-label": t("row.transferImport"),
+						children: preview === void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.transferPreviewing") }) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.transferPreviewTotal", { total: preview.total }) }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+								className: "dsm-workbuddy-transfer-list",
+								children: preview.accounts.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+										type: "checkbox",
+										disabled: !entry.hasToken,
+										checked: importSelected.has(entry.index),
+										onChange: (event) => {
+											const next = new Set(importSelected);
+											if (event.target.checked) next.add(entry.index);
+											else next.delete(entry.index);
+											setImportSelected(next);
+										}
+									}),
+									" ",
+									entry.nickname !== "" ? entry.nickname : entry.email !== "" ? entry.email : entry.uid !== "" ? entry.uid : t("row.transferEntryUnknown"),
+									entry.hasToken ? "" : ` — ${t("row.transferNoToken")}`
+								] }) }, entry.index))
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dsm-workbuddy-transfer-dialog-actions",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "dsm-btn dsm-btn-outline",
+									onClick: closeDialog,
+									children: t("row.transferCancel")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "dsm-btn dsm-btn-outline",
+									disabled: importSelected.size === 0 || phase.kind === "importing",
+									onClick: () => {
+										runImport();
+									},
+									children: phase.kind === "importing" ? t("row.transferImporting") : t("row.transferImportConfirm", { count: importSelected.size })
+								})]
+							})
+						] })
+					}) : null
+				]
+			});
+		}
+		//#endregion
 		//#region src/native-modality.ts
 		/**
 		* Reviewed vendor classifications, keyed by EXACT model id (never a prefix).
@@ -1845,7 +2759,9 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-pool-warn{margin:0;padding:9px 11px;border-radius:9px;font-size:12px;line-height:17px;color:var(--dsw-alias-state-warn-primary,#f59e0b);background:rgba(245,158,11,.09);border:1px solid rgba(245,158,11,.3)}
 .dsm-workbuddy-pool-error{margin:0;font-size:12px;line-height:17px;color:var(--dsw-alias-state-error-primary,#ef4444);white-space:pre-line}
 .dsm-workbuddy-pool-table{border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:12px;overflow:hidden;background:var(--dsw-alias-bg-layer-2,#24262c)}
-.dsm-workbuddy-pool-row{display:grid;grid-template-columns:1.6fr 1fr 1.3fr .9fr;gap:10px;align-items:center;padding:10px 14px;border-top:1px solid var(--dsw-alias-border-l1,#2c2d31);font-size:13px;color:var(--dsw-alias-label-secondary,#c6c9d0)}
+.dsm-workbuddy-pool-row{display:grid;grid-template-columns:1.6fr 1fr 1.3fr .9fr .8fr;gap:10px;align-items:center;padding:10px 14px;border-top:1px solid var(--dsw-alias-border-l1,#2c2d31);font-size:13px;color:var(--dsw-alias-label-secondary,#c6c9d0)}
+/* No check-in column (the international region): the freed track goes to the actions. */
+.dsm-workbuddy-pool-table:not(.dsm-workbuddy-pool-table-checkin) .dsm-workbuddy-pool-row{grid-template-columns:1.6fr 1fr 1.3fr 1.7fr}
 .dsm-workbuddy-pool-row:first-child{border-top:0}
 .dsm-workbuddy-pool-row-head{padding:8px 14px;background:var(--dsw-alias-bg-layer-3,#2a2c33);color:var(--dsw-alias-label-tertiary,#999);font-size:11px;font-weight:600;letter-spacing:.02em;text-transform:uppercase}
 .dsm-workbuddy-pool-row-current{background:rgba(86,134,254,.07)}
@@ -1889,6 +2805,12 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-pool-settings-wrap{display:flex;flex-direction:column;gap:10px}
 .dsm-workbuddy-pool-dirty{font-size:12px;line-height:18px;font-weight:500;color:var(--dsw-alias-state-warn-primary,#f59e0b)}
 .dsm-workbuddy-pool-settings{display:flex;flex-direction:column;gap:1px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:12px;overflow:hidden;background:var(--dsw-alias-bg-layer-2,#24262c)}
+/* QR sign-in + export/import, hosted inside the pool settings block.
+   The block's own bordered rows belong to the SAVED preferences, so these
+   get their own container: same rhythm (12px 14px) so the two read as one
+   group, but a dashed edge marking them as immediate actions rather than
+   drafts the Save button below would commit. */
+.dsm-workbuddy-pool-tools{display:flex;flex-direction:column;gap:2px;border:1px dashed var(--dsw-alias-border-l2,#3a3d45);border-radius:12px;padding:4px 10px}
 .dsm-workbuddy-pool-set{display:flex;align-items:flex-start;justify-content:space-between;gap:16px;padding:12px 14px;border-top:1px solid var(--dsw-alias-border-l1,#2c2d31)}
 .dsm-workbuddy-pool-set:first-child{border-top:0}
 .dsm-workbuddy-pool-set-copy{display:flex;flex-direction:column;gap:3px;min-width:0;flex:1}
@@ -1918,6 +2840,9 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-pool-log-error{color:var(--dsw-alias-state-error-primary,#ef4444)}
 .dsm-workbuddy-pool-log-info{color:var(--dsw-alias-label-secondary,#c6c9d0)}
 .dsm-workbuddy-pool-log-empty{padding:14px;font-size:12px;color:var(--dsw-alias-label-tertiary,#999)}
+/* Per-row actions (test / remove), right side of each pool row. */
+.dsm-workbuddy-pool-row-actions{display:flex;gap:6px;align-items:center;justify-content:flex-end;flex:none}
+.dsm-workbuddy-pool-row-actions .dsm-workbuddy-pool-small-btn{padding:2px 10px;font-size:12px}
 @media (max-width:760px){.dsm-workbuddy-pool-row{grid-template-columns:1fr 1fr;row-gap:6px}.dsm-workbuddy-pool-select{max-width:180px}}
 /* Pool switch, namespaced under .dsm-workbuddy-pool so it cannot collide with host styles. */
 .dsm-workbuddy-pool .sw{position:relative;display:inline-block;width:38px;height:22px;flex:none;cursor:pointer}
@@ -1928,6 +2853,63 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-pool .sw input:checked+.sw-track::after{transform:translateX(16px)}
 .dsm-workbuddy-pool .sw input:disabled+.sw-track{opacity:.4}
 .dsm-workbuddy-pool .sw input:disabled{cursor:default}
+/* Account action bars: QR sign-in and export/import.
+   One row each — label, live status, actions — instead of a padded block
+   per feature. The bar is the resting height; only an open dialog (below)
+   grows vertically, so the card does not scroll past a wall of chrome to
+   reach the buttons. Status text shares the row rather than claiming its own,
+   and is what truncates first when the card is narrow. */
+.dsm-workbuddy-bar{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin:8px 0;padding:0}
+.dsm-workbuddy-bar-label{flex:none;margin:0;font-size:12px;font-weight:600;color:var(--dsw-alias-label-secondary,#c6c9d0)}
+.dsm-workbuddy-bar-status{flex:1 1 auto;min-width:0;margin:0;font-size:12px;line-height:18px;color:var(--dsw-alias-label-primary,#e8e9ed);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.dsm-workbuddy-bar-hint{color:var(--dsw-alias-label-tertiary,#999)}
+.dsm-workbuddy-bar-actions{display:flex;gap:8px;flex:none;margin-left:auto}
+.dsm-workbuddy-bar a{color:var(--dsw-alias-brand-primary,#5686fe);text-decoration:none}
+.dsm-workbuddy-bar a:hover{text-decoration:underline}
+.dsm-workbuddy-bar-ok{color:var(--dsw-alias-state-success-primary,#22a06b)}
+.dsm-workbuddy-bar-error{color:var(--dsw-alias-state-error-primary,#ef4444)}
+/* Secondary text inside the transfer DIALOG (not a bar): the privacy note
+   shown when credentials leave the machine. Kept independent of the bar
+   classes so the dialog does not depend on the bar's layout to be readable. */
+.dsm-workbuddy-hint{color:var(--dsw-alias-label-tertiary,#999)}
+/* The transfer dialog is deliberately a block: it holds a scrollable account
+   list and per-entry checkboxes, which cannot live in a one-row bar. */
+.dsm-workbuddy-transfer-dialog{margin-top:8px;padding:10px 12px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:10px;background:var(--dsw-alias-bg-secondary,transparent)}
+.dsm-workbuddy-transfer-dialog p{margin:0 0 8px;font-size:12px;line-height:18px;color:var(--dsw-alias-label-primary,#e8e9ed)}
+.dsm-workbuddy-transfer-dialog-actions{display:flex;gap:8px;justify-content:flex-end;flex-wrap:wrap}
+.dsm-workbuddy-transfer-list{list-style:none;margin:0 0 8px;padding:0;max-height:180px;overflow-y:auto}
+.dsm-workbuddy-transfer-list label{display:flex;align-items:center;gap:6px;font-size:12px;color:var(--dsw-alias-label-primary,#e8e9ed);cursor:pointer;padding:2px 0}
+.dsm-workbuddy-transfer-list input[type="checkbox"]{flex:none}
+.dsm-workbuddy-transfer input[type="file"]{font-size:12px;color:var(--dsw-alias-label-primary,#e8e9ed);margin-bottom:8px}
+/* The import picker's input is driven by the 「import」 button, so it must not
+   render as a visible field: hide it from layout AND from assistive tech (the
+   button carries the accessible name). Not display:none alone — that also
+   removes it from the tab order in some engines, which is fine here, but the
+   clip-based form is the one that reliably keeps programmatic .click() working
+   across browsers. */
+.dsm-workbuddy-transfer-file{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}
+/* The sign-in URL inside the OAuth dialog: long https links must wrap rather
+   than push the dialog wide — break-all, since URLs have no soft wrap points. */
+.dsm-workbuddy-oauth-url{word-break:break-all;overflow-wrap:anywhere}
+.dsm-workbuddy-oauth-url a{color:var(--dsw-alias-brand-primary,#5686fe);text-decoration:none}
+.dsm-workbuddy-oauth-url a:hover{text-decoration:underline}
+/* The shared busy veil: a fixed overlay for operations whose result only shows
+   up after the list re-read (remove / import / sign-in).
+   It is NOT a modal: no control, no dismissal — only "this is running" and
+   "here is why nothing moved yet". Fixed positioning so it covers the card
+   regardless of which section started the operation, and a semi-transparent
+   backdrop so the table stays visible underneath — the user is watching a
+   specific row change, and hiding it would defeat the point. */
+.dsm-workbuddy-veil{position:fixed;inset:0;z-index:60;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.38);cursor:progress}
+.dsm-workbuddy-veil-card{display:flex;flex-direction:column;align-items:center;gap:8px;max-width:min(340px,80vw);padding:16px 20px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:12px;background:var(--dsw-alias-bg-primary,#1b1c20);box-shadow:0 8px 28px rgba(0,0,0,.35)}
+.dsm-workbuddy-veil-text{font-size:13px;line-height:20px;color:var(--dsw-alias-label-primary,#e8e9ed);text-align:center}
+.dsm-workbuddy-veil-hint{font-size:12px;line-height:18px;color:var(--dsw-alias-label-tertiary,#999);text-align:center}
+/* The spinner is the one thing that proves the UI is alive when the row under
+   it has not changed yet — which is precisely the confusion the veil exists to
+   remove. Reduced-motion users get the static ring instead of a rotation. */
+.dsm-workbuddy-veil-spinner{width:18px;height:18px;border:2px solid var(--dsw-alias-border-l2,#3a3d45);border-top-color:var(--dsw-alias-brand-primary,#5686fe);border-radius:50%;animation:dsm-workbuddy-veil-spin .7s linear infinite}
+@keyframes dsm-workbuddy-veil-spin{to{transform:rotate(360deg)}}
+@media (prefers-reduced-motion: reduce){.dsm-workbuddy-veil-spinner{animation:none}}
 `;
 		/**
 		* Composer credit readout styles, injected by the readout component itself.
@@ -2557,8 +3539,18 @@ window.__ModuleLoader__.load({
 				accounts: [],
 				selectionExplicit: false
 			};
+			/**
+			* Whether the ACTIVE region knows of any account at all.
+			*
+			* This is the poll's precondition in place of `status === 'signed-in'`. The
+			* signed-in flag means "a credential resolves", which is false for a region
+			* whose accounts exist but none is usable yet — exactly the state an import
+			* or a fresh OAuth sign-in creates. Polling on it meant those regions never
+			* refreshed, so the list stayed empty until the card was reopened.
+			*/
+			const hasAccounts = status.status !== "error" && status.accounts.length > 0;
 			(0, react.useEffect)(() => {
-				if (!open || status.status !== "signed-in") return;
+				if (!open || !hasAccounts) return;
 				const controller = new AbortController();
 				const timer = window.setInterval(() => {
 					refreshUsage(activeRegion, controller.signal);
@@ -2588,6 +3580,7 @@ window.__ModuleLoader__.load({
 			*/
 			const rescanAccounts = async () => {
 				setBusy(true);
+				setAccountError(void 0);
 				try {
 					const response = await fetch(withWorkBuddyRegion(WORKBUDDY_ACCOUNTS_REFRESH_PATH, activeRegion), {
 						method: "POST",
@@ -2596,7 +3589,10 @@ window.__ModuleLoader__.load({
 					});
 					const body = await response.json();
 					if (!response.ok || !Array.isArray(body.accounts)) throw new Error(`HTTP ${response.status}`);
+					if (body.dismissalsCleared === false) setAccountError(t("row.rescanHidesKept"));
 					await refreshUsage(activeRegion);
+				} catch (error) {
+					if (mounted.current) setAccountError(error instanceof Error ? error.message : t("row.requestFailed"));
 				} finally {
 					if (mounted.current) setBusy(false);
 				}
@@ -2945,6 +3941,27 @@ window.__ModuleLoader__.load({
 				searched
 			});
 			status.status === "error" || status.selectionExplicit;
+			/**
+			* Account-adding and account-migration controls, defined ONCE and rendered
+			* in both sign-in states: inside the pool settings block when an account
+			* exists, and in the signed-out branch when it does not (the pool section is
+			* not rendered there at all). Two JSX copies would be free to drift, and the
+			* two states are the same feature — a user who learns these controls in one
+			* must find them in the same order in the other.
+			*/
+			const accountTools = /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(OAuthSignIn, {
+				t,
+				region: activeRegion,
+				onAdded: () => refreshUsage(activeRegion)
+			}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountTransfer, {
+				t,
+				region: activeRegion,
+				onChanged: () => refreshUsage(activeRegion),
+				accounts: status.status === "error" ? [] : status.accounts.map((account) => ({
+					id: account.id,
+					accountName: account.accountName
+				}))
+			})] });
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
 				className: `dsm-plugin-card${open ? " dsm-plugin-card-open" : ""}`,
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
@@ -3045,6 +4062,11 @@ window.__ModuleLoader__.load({
 								className: "dsm-workbuddy-usage-hint",
 								children: t("row.reloginHint")
 							}) : null,
+							accountError === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dsm-workbuddy-account-error",
+								role: "alert",
+								children: accountError
+							}),
 							selectionLost ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 								className: "dsm-workbuddy-usage-hint",
 								children: t("row.selectionLostHint")
@@ -3091,12 +4113,11 @@ window.__ModuleLoader__.load({
 										switchAccount(accountId);
 									},
 									selectingAccount: switchingAccount,
+									accountTools,
 									siblingBusy: saving || togglingRegion !== void 0,
 									onBusyChange: setPoolBusy,
 									onSaved: async () => await refreshUsage(activeRegion) !== void 0,
-									onRefresh: () => {
-										refreshUsage(activeRegion);
-									}
+									onRefresh: () => refreshUsage(activeRegion)
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("section", {
 									className: "dsm-workbuddy-models",
@@ -3329,6 +4350,10 @@ window.__ModuleLoader__.load({
 										children: busy ? t("row.accountsScanning") : t("row.accountsRescan")
 									})
 								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "dsm-workbuddy-pool-tools",
+									children: accountTools
+								}),
 								searched.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SearchedPaths, {
 									items: searched,
 									t
@@ -3940,6 +4965,7 @@ window.__ModuleLoader__.load({
 			"row.sourceDsh": "plugin copy",
 			"row.searchedMore": "Show the {count} path(s) that were not found",
 			"row.reloginHint": "If errors occur, sign back in to the WorkBuddy app.",
+			"row.rescanHidesKept": "The accounts you removed are still hidden: the plugin could not update its own list file. On Windows this is usually a file lock — close antivirus or sync tools that may be holding files in the DSH profile, then try again.",
 			"row.credentialRejectedTitle": "WorkBuddy refused this account's token",
 			"row.credentialRejectedIntro": "The token for \"{accountName}\" is no longer accepted by the upstream, so credits and check-in are unavailable. Signing in again only helps if the problem is the token itself — here is what actually applies:",
 			"row.credentialRejectedSwitch": "Another sign-in on this machine answered the upstream: \"{accountName}\". Switching to it fixes this — no need to sign in again.",
@@ -4006,6 +5032,43 @@ window.__ModuleLoader__.load({
 			"row.probeFailedStatus": "✗ Test failed (HTTP {status})",
 			"row.probeError": "Could not run the test: {message}",
 			"row.cheer": "Star on GitHub",
+			"row.oauthTitle": "Add an account by QR sign-in",
+			"row.oauthStart": "Sign in with QR code",
+			"row.oauthStarting": "Opening…",
+			"row.oauthOpenHint": "Open the sign-in page and confirm — the account is added here automatically when you finish:",
+			"row.oauthOpened": "Opened. Waiting for you to finish…",
+			"row.oauthWaiting": "Waiting for the sign-in to finish… ({seconds}s)",
+			"row.oauthExpires": "The sign-in window expires in about {minutes} min.",
+			"row.oauthCancel": "Cancel",
+			"row.oauthCancelled": "Sign-in cancelled.",
+			"row.oauthTimedOut": "The sign-in timed out — start again when ready.",
+			"row.oauthDone": "Added “{accountName}”. Pick it above to use it.",
+			"row.oauthError": "Sign-in failed: {message}",
+			"row.oauthCopy": "Copy link",
+			"row.oauthCopied": "Link copied",
+			"row.oauthReopen": "Open page again",
+			"row.oauthDialogClose": "Close",
+			"row.oauthTitleGlobal": "Add an account by web sign-in",
+			"row.oauthStartGlobal": "Sign in on the web",
+			"row.veilHintList": "The list refreshes as soon as this finishes.",
+			"row.oauthSyncing": "Adding the account…",
+			"row.transferTitle": "Export / import accounts",
+			"row.transferHint": "Move accounts between computers as a JSON file. The file carries the credentials — keep it private. The format is shared with other WorkBuddy credential managers.",
+			"row.transferExport": "Export accounts",
+			"row.transferExporting": "Exporting…",
+			"row.transferExportPick": "Choose the accounts to export ({total} available):",
+			"row.transferExportConfirm": "Export {count} account(s)",
+			"row.transferExported": "Exported {count} account(s) to {fileName}.",
+			"row.transferImport": "Import accounts",
+			"row.transferImporting": "Importing…",
+			"row.transferPreviewing": "Reading the file…",
+			"row.transferPreviewTotal": "{total} account(s) in the file — untick what should stay out. Accounts already stored here are overwritten by the import.",
+			"row.transferImportConfirm": "Import {count} account(s)",
+			"row.transferImported": "Imported {imported} account(s); {skipped} skipped (no token, or belongs to the other region).",
+			"row.transferEntryUnknown": "unknown account",
+			"row.transferNoToken": "no token in this record",
+			"row.transferCancel": "Cancel",
+			"row.transferError": "Transfer failed: {message}",
 			"row.poolTitle": "Account pool",
 			"row.poolNoCandidate": "No account in this pool can be used right now.",
 			"row.poolNoCandidateHint": "Members are rate-limited, out of credits, rejected, or unreachable. Rate limits, drained quotas and transient failures return to the pool on their own — at the time the upstream states, or after a 30-minute fallback. Only a rejected credential needs a new sign-in.",
@@ -4104,6 +5167,13 @@ window.__ModuleLoader__.load({
 			"row.poolCurrentHeader": "In use: {account}",
 			"row.poolNotMember": "Not in pool",
 			"row.poolUnsavedMembers": "Selection changed — save to apply",
+			"row.poolRowTest": "Test",
+			"row.poolRowRemove": "Remove",
+			"row.poolRowRemoveHint": "Remove this account from the list. The WorkBuddy desktop app is not signed out — it keeps its own sign-in. Removing only hides the account here; 「Detect accounts again」 brings it back.",
+			"row.poolRowRemoveAria": "Remove the stored credential of {accountName}",
+			"row.poolRowRemoved": "{accountName}: hidden from the list. 「Detect accounts again」 re-adds it; the desktop app stays signed in.",
+			"row.poolRowRemoving": "Removing the account…",
+			"row.poolRowRemoveDesktopOnly": "{accountName}: hidden from the list — this account comes from the desktop app's own sign-in, which is left untouched. 「Detect accounts again」 re-adds it.",
 			"row.showCreditsCn": "Show WB CN credits in the composer",
 			"row.showCreditsGlobal": "Show WB AI credits in the composer",
 			"row.showCreditsCnHint": "Show the domestic (WB CN) credit balance in the composer toolbar, but only while this session uses a WB CN model. Click it for per-account balances and a manual refresh (refreshes by itself every 5 minutes).",
@@ -4155,6 +5225,7 @@ window.__ModuleLoader__.load({
 			"row.sourceDsh": "插件副本",
 			"row.searchedMore": "显示另外 {count} 条「不存在」的路径",
 			"row.reloginHint": "出现错误，重新登录 WorkBuddy APP 即可。",
+			"row.rescanHidesKept": "已删除的账号仍是隐藏状态：插件没能更新自己的名单文件。Windows 上通常是文件被占用——请关闭可能正在占用 DSH 配置目录的杀毒/同步工具后重试。",
 			"row.credentialRejectedTitle": "WorkBuddy 拒绝了这个账号的 token",
 			"row.credentialRejectedIntro": "「{accountName}」的 token 已不被上游接受，所以积分与签到都用不了。重新登录只在「确实是 token 的问题」时才有用——当前实际适用的是下面这一条：",
 			"row.credentialRejectedSwitch": "本机另一个账号「{accountName}」刚刚实测可用，切换到它即可恢复，不必重新登录。",
@@ -4221,6 +5292,43 @@ window.__ModuleLoader__.load({
 			"row.probeFailedStatus": "✗ 测试失败（HTTP {status}）",
 			"row.probeError": "无法执行测试：{message}",
 			"row.cheer": "鼓励一下",
+			"row.oauthTitle": "扫码添加账号",
+			"row.oauthStart": "扫码登录",
+			"row.oauthStarting": "正在打开…",
+			"row.oauthOpenHint": "打开登录页并完成确认——完成后账号会自动出现在这里：",
+			"row.oauthOpened": "已打开，等待你完成登录…",
+			"row.oauthWaiting": "正在等待登录完成…（{seconds} 秒）",
+			"row.oauthExpires": "登录窗口约 {minutes} 分钟后过期。",
+			"row.oauthCancel": "取消",
+			"row.oauthCancelled": "已取消登录。",
+			"row.oauthTimedOut": "登录超时——请重新开始。",
+			"row.oauthDone": "已添加「{accountName}」。在上方选中它即可使用。",
+			"row.oauthError": "登录失败：{message}",
+			"row.oauthCopy": "复制链接",
+			"row.oauthCopied": "已复制链接",
+			"row.oauthReopen": "重新打开页面",
+			"row.oauthDialogClose": "关闭",
+			"row.oauthTitleGlobal": "网页登录添加账号",
+			"row.oauthStartGlobal": "网页登录",
+			"row.veilHintList": "完成后列表会立即刷新。",
+			"row.oauthSyncing": "正在添加账号…",
+			"row.transferTitle": "导出 / 导入账号",
+			"row.transferHint": "用 JSON 文件在电脑之间迁移账号。文件里是账号凭据——请妥善保管。该格式与同类 WorkBuddy 凭据管理工具通用。",
+			"row.transferExport": "导出账号",
+			"row.transferExporting": "正在导出…",
+			"row.transferExportPick": "选择要导出的账号（共 {total} 个）：",
+			"row.transferExportConfirm": "导出 {count} 个账号",
+			"row.transferExported": "已导出 {count} 个账号到 {fileName}。",
+			"row.transferImport": "导入账号",
+			"row.transferImporting": "正在导入…",
+			"row.transferPreviewing": "正在读取文件…",
+			"row.transferPreviewTotal": "文件中共 {total} 个账号——不需要的请取消勾选。导入会覆盖这里已存储的同名账号。",
+			"row.transferImportConfirm": "导入 {count} 个账号",
+			"row.transferImported": "已导入 {imported} 个账号；跳过 {skipped} 个（缺 token，或属于另一个区域）。",
+			"row.transferEntryUnknown": "未知账号",
+			"row.transferNoToken": "此记录没有 token",
+			"row.transferCancel": "取消",
+			"row.transferError": "传输失败：{message}",
 			"row.poolTitle": "账号池",
 			"row.poolNoCandidate": "账号池里目前没有可用的账号。",
 			"row.poolNoCandidateHint": "成员要么在限流冷却中、要么积分耗尽、要么凭据被拒、要么上游无响应。限流、积分耗尽与瞬时故障都会自动回池——按上游给出的恢复时间，没给时间就按 30 分钟兜底，不需要你操作；只有「凭据被拒」需要重新登录。",
@@ -4319,6 +5427,13 @@ window.__ModuleLoader__.load({
 			"row.poolCurrentHeader": "当前使用：{account}",
 			"row.poolNotMember": "未入池",
 			"row.poolUnsavedMembers": "勾选已改动 —— 保存后生效",
+			"row.poolRowTest": "测试",
+			"row.poolRowRemove": "删除",
+			"row.poolRowRemoveHint": "把这个账号从列表中移除。桌面 App 不会被退出登录——它保留自己的登录状态。移除只是暂时隐藏，点「重新检测账号」即可找回。",
+			"row.poolRowRemoveAria": "删除 {accountName} 的已存凭据",
+			"row.poolRowRemoved": "{accountName}：已从列表中隐藏。点「重新检测账号」会重新加入，桌面 App 的登录不受影响。",
+			"row.poolRowRemoving": "正在删除账号…",
+			"row.poolRowRemoveDesktopOnly": "{accountName}：已从列表中隐藏——这个账号来自桌面 App 自己的登录，该登录未被改动。点「重新检测账号」会重新加入。",
 			"row.showCreditsCn": "在对话框显示 WB CN 积分",
 			"row.showCreditsGlobal": "在对话框显示 WB AI 积分",
 			"row.showCreditsCnHint": "在对话输入框工具栏显示国内版（WB CN）剩余积分，仅当本会话使用 WB CN 模型时出现。点击可看各账号余额并手动刷新（每 5 分钟也会自动刷新）。",