dsh-connect-workbuddy 4.2.0 → 4.3.1

package/lib/client.js

@@ -309,6 +309,23 @@ window.__ModuleLoader__.load({
 		* fallback and must not import Node-only host code.
 		*/
 		const WORKBUDDY_SETTINGS_NS = "workbuddy";
+		/**
+		* Every namespace spelling the browser half follows when looking for the
+		* settings form the Host actually serves, in preference order.
+		*
+		* `describe()` keys a form by its Loader entry id, and the profile patch picks
+		* that id — so the plugin must ASK rather than assume. The observed spellings
+		* are the bare package name, the `include:`-wrapped id the live Desktop host
+		* uses, and the declared name as the last resort. `configForms.whileServed`
+		* follows all of them and re-runs when the mirror arrives, which is what keeps
+		* the binding correct on a host whose mirror populates after `apply` (the
+		* 4.3.0 readout defect, issue #46).
+		*/
+		const WORKBUDDY_SETTINGS_NAMESPACE_CANDIDATES = [
+			"dsh-connect-workbuddy",
+			"include:dsh-connect-workbuddy",
+			WORKBUDDY_SETTINGS_NS
+		];
 		//#endregion
 		//#region src/client/account-selection.ts
 		/**
@@ -649,6 +666,40 @@ window.__ModuleLoader__.load({
 			}
 		}
 		//#endregion
+		//#region src/client/BusyOverlay.tsx
+		/**
+		* The veil. Deliberately NOT a modal dialog: it carries no focusable control
+		* and no dismissal — there is nothing for the user to decide, only a step to
+		* wait through. `aria-busy` plus a polite live region state that to screen
+		* readers, which is the whole accessibility contract a wait screen needs.
+		*/
+		function BusyOverlay({ message, hint, visible }) {
+			if (!visible) return null;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: "dsm-workbuddy-veil",
+				role: "status",
+				"aria-busy": "true",
+				"aria-live": "polite",
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dsm-workbuddy-veil-card",
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-workbuddy-veil-spinner",
+							"aria-hidden": "true"
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-workbuddy-veil-text",
+							children: message
+						}),
+						hint === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-workbuddy-veil-hint",
+							children: hint
+						})
+					]
+				})
+			});
+		}
+		//#endregion
 		//#region src/client/ndjson.ts
 		/**
 		* Read a newline-delimited JSON body, one object at a time.
@@ -1151,6 +1202,24 @@ window.__ModuleLoader__.load({
 				memberAccountIds: pool?.memberAccountIds ?? []
 			};
 			const active = draftRegion === region && draft !== null ? draft : saved;
+			/**
+			* Whether the pool is RUNNING right now, which is the SAVED value.
+			*
+			* `active` is the user's draft and only becomes reality at Save. Using it for
+			* the parts that DESCRIBE the running pool made the card state a mode that had
+			* not taken effect yet: flipping the switch off (unsaved) revealed the manual
+			* picker while the pool was still ranking every request, so the picker showed
+			* the rotated account as "in use" and a selection made there was overridden by
+			* the very pool the user was looking at — the "shows A, bills B" trap this
+			* section keeps guarding against. The mirror case was milder but the same
+			* class of wrong: turning the pool ON (unsaved) hid the picker while the manual
+			* account was still the one being billed.
+			*
+			* Everything that reports pool state reads this; only the switch itself (its
+			* controlled value) and `dirty` read the draft, because those two ARE about
+			* the pending edit.
+			*/
+			const poolRunning = saved.enabled;
 			const dirty = draftRegion === region && draft !== null && (draft.enabled !== saved.enabled || draft.targetModelId !== saved.targetModelId || draft.probeInputTokens !== saved.probeInputTokens || !sameIds(draft.memberAccountIds, saved.memberAccountIds));
 			/**
 			* Membership that actually resolves to a local sign-in — what a batch runs on.
@@ -1405,6 +1474,14 @@ window.__ModuleLoader__.load({
 			/** The account whose per-row action is in flight; gates every row's buttons. */
 			const [rowBusyAccountId, setRowBusyAccountId] = (0, react.useState)(void 0);
 			/**
+			* Which per-row action is running, for the veil's scenario line.
+			*
+			* A removal and a test both set `rowBusyAccountId`, but they mean different
+			* things to the person watching ("this account is going away" versus "this
+			* account is being measured") — and the veil exists precisely to say which.
+			*/
+			const [rowBusyAction, setRowBusyAction] = (0, react.useState)(void 0);
+			/**
 			* Test ONE account from its row.
 			*
 			* Same Host rule as the batch (testOne reuses the batch's probe), the same
@@ -1413,6 +1490,7 @@ window.__ModuleLoader__.load({
 			*/
 			const runRowTest = (0, react.useCallback)(async (accountId) => {
 				setRowBusyAccountId(accountId);
+				setRowBusyAction("test");
 				setActionError(void 0);
 				const url = withWorkBuddyRegionAndAction(WORKBUDDY_POOL_PATH, region, "test") + "&accountId=" + encodeURIComponent(accountId);
 				try {
@@ -1447,7 +1525,10 @@ window.__ModuleLoader__.load({
 						appendLog(t("row.poolLogBatchFailed", { message }), "error");
 					}
 				} finally {
-					if (mounted.current) setRowBusyAccountId(void 0);
+					if (mounted.current) {
+						setRowBusyAccountId(void 0);
+						setRowBusyAction(void 0);
+					}
 				}
 			}, [
 				appendLog,
@@ -1456,12 +1537,17 @@ window.__ModuleLoader__.load({
 				t
 			]);
 			/**
-			* Remove ONE account's plugin-stored credential from its row. The Host only
-			* ever deletes the vault entry; a desktop sign-in reappears on the next
-			* rescan, and the message below says which of the two happened.
+			* Remove ONE account from its row, via the Host.
+			*
+			* The Host dismisses the account (and deletes its vault entry when it has
+			* one), so the row stays gone across rescans. The desktop app is not signed
+			* out. The message below still distinguishes the two cases, because "there
+			* was no plugin-stored copy" is worth saying: it tells the user the account
+			* comes from the app itself rather than from an OAuth sign-in or an import.
 			*/
 			const runRowRemove = (0, react.useCallback)(async (accountId, accountName) => {
 				setRowBusyAccountId(accountId);
+				setRowBusyAction("remove");
 				setActionError(void 0);
 				const url = withWorkBuddyRegionAndAction(WORKBUDDY_POOL_PATH, region, "remove") + "&accountId=" + encodeURIComponent(accountId);
 				try {
@@ -1478,7 +1564,7 @@ window.__ModuleLoader__.load({
 					}));
 					if (!mounted.current) return;
 					appendLog(body?.removed === true ? t("row.poolRowRemoved", { accountName: accountName === "" ? t("row.accountUnnamed") : accountName }) : t("row.poolRowRemoveDesktopOnly", { accountName: accountName === "" ? t("row.accountUnnamed") : accountName }), body?.removed === true ? "ok" : "info");
-					onRefresh?.();
+					await onRefresh?.();
 				} catch (error) {
 					const message = error instanceof Error ? error.message : t("row.requestFailed");
 					if (mounted.current) {
@@ -1486,7 +1572,10 @@ window.__ModuleLoader__.load({
 						appendLog(t("row.poolLogBatchFailed", { message }), "error");
 					}
 				} finally {
-					if (mounted.current) setRowBusyAccountId(void 0);
+					if (mounted.current) {
+						setRowBusyAccountId(void 0);
+						setRowBusyAction(void 0);
+					}
 				}
 			}, [
 				appendLog,
@@ -1517,7 +1606,15 @@ window.__ModuleLoader__.load({
 			*/
 			const currentAccount = pool.accounts.find((account) => account.current);
 			const currentName = currentAccount === void 0 ? void 0 : currentAccount.accountName === "" ? t("row.accountUnnamed") : currentAccount.accountName;
-			return (0, react.createElement)("section", { className: "dsm-workbuddy-pool" }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-head" }, (0, react.createElement)("h3", { className: "dsm-workbuddy-pool-title" }, t("row.poolTitle")), currentName === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-current-badge" }, t("row.poolCurrentHeader", { account: currentName }))), !active.enabled && onSelectAccount !== void 0 && pool.accounts.length > 0 ? (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, t("row.poolManualAccountLabel")), (0, react.createElement)("span", null, t("row.poolManualAccountHint"))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("select", {
+			return (0, react.createElement)("section", { className: "dsm-workbuddy-pool" }, rowBusyAction === "remove" ? (0, react.createElement)(BusyOverlay, {
+				visible: true,
+				message: t("row.poolRowRemoving"),
+				hint: t("row.veilHintList")
+			}) : null, saving ? (0, react.createElement)(BusyOverlay, {
+				visible: true,
+				message: t("row.poolSaving"),
+				hint: t("row.veilHintList")
+			}) : null, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-head" }, (0, react.createElement)("h3", { className: "dsm-workbuddy-pool-title" }, t("row.poolTitle")), currentName === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-current-badge" }, t("row.poolCurrentHeader", { account: currentName }))), !poolRunning && onSelectAccount !== void 0 && pool.accounts.length > 0 ? (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, t("row.poolManualAccountLabel")), (0, react.createElement)("span", null, t("row.poolManualAccountHint"))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("select", {
 				className: "dsm-workbuddy-pool-select dsm-workbuddy-pool-account-select",
 				value: currentAccount?.accountId ?? "",
 				disabled: selectingAccount === true,
@@ -1550,7 +1647,7 @@ window.__ModuleLoader__.load({
 				className: "dsm-btn dsm-btn-outline",
 				disabled: rescanning === true,
 				onClick: onRescan
-			}, rescanning === true ? t("row.accountsScanning") : t("row.accountsRescan")))), !active.enabled ? (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolEnabledHint")) : null, active.enabled && usable.length === 0 ? (0, react.createElement)("p", {
+			}, rescanning === true ? t("row.accountsScanning") : t("row.accountsRescan")))), !poolRunning ? (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolEnabledHint")) : null, poolRunning && usable.length === 0 ? (0, react.createElement)("p", {
 				className: "dsm-workbuddy-pool-warn",
 				role: "status"
 			}, `${t("row.poolNoCandidate")} ${t("row.poolNoCandidateHint")}`) : null, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-members" }, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-members-head" }, (0, react.createElement)("div", null, (0, react.createElement)("h4", { className: "dsm-workbuddy-pool-members-title" }, t("row.poolMembersTitle")), (0, react.createElement)("p", { className: "dsm-workbuddy-pool-note" }, t("row.poolMembersHint"))), (0, react.createElement)("div", { className: "dsm-workbuddy-pool-members-actions" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-hint" }, t("row.poolSelectedCount", {
@@ -1773,19 +1870,22 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/client/OAuthSignIn.tsx
 		/**
-		* The card's OAuth QR sign-in section.
-		*
-		* 参考：扫码登录的通行形态 —— 发起登录 → 打开授权页 →
-		*   轮询到完成为止 → 展示结果。本实现把轮询循环压成一个组件内 effect：
-		*   打开授权页的是用户点击的链接（浏览器标签页，非弹窗），组件只负责
-		*   按 `OAUTH_POLL_INTERVAL_MS` 节奏问 Host「完成了吗」，完成即停。
-		*
-		* 为什么不用 window.open：卡片运行在 Harness 的设置页 iframe/沙箱里，弹窗
-		*   会被拦截；把授权 URL 渲染成普通链接（target=_blank rel=noopener）是
-		*   沙箱内最可靠的方式，用户也可以复制链接到手机上继续（URL 即登录态）。
-		*
-		* 所有状态就地管理，零跨组件往返：取消 = 停止轮询 + 清理 loginId；
-		* Host 重启导致 loginId 失效会得到 done+error，与超时同一条文案路径。
+		* The card's OAuth QR sign-in section: one resting bar row plus a dialog
+		* opened by the sign-in button.
+		*
+		* 参考：workbuddy2api-panel 的「添加账号」弹窗交互形态 —— 静态入口一行，
+		*   点开后弹窗内分步走：获取授权链接 → 自动打开浏览器 → 弹窗内显示链接
+		*   与等待状态 → 完成/失败回填结果。本实现沿用该步骤划分；弹窗样式直接
+		*   用本项目导出/导入弹框的类（dsm-workbuddy-transfer-dialog），不引入
+		*   第二套视觉。
+		* 改动：自动打开浏览器。弹窗拦截的规避方式是「用户手势内同步 window.open
+		*   占位，拿到授权 URL 后再导航」——点击「获取授权链接」的那一刻浏览器
+		*   仍认定这是用户激活的手势链，占位窗口不会被拦；若 Host 环境连占位都
+		*   拦（返回 null），降级为弹窗内手动「打开登录页」链接，功能不损失。
+		*
+		* 轮询循环压成一个组件内 effect：按 `OAUTH_POLL_INTERVAL_MS` 节奏问 Host
+		*   「完成了吗」，完成即停。所有状态就地管理，零跨组件往返；Host 重启
+		*   导致 loginId 失效会得到 done+error，与超时同一条文案路径。
 		*
 		* @module dsh-connect-workbuddy/client/OAuthSignIn
 		*/
@@ -1793,13 +1893,24 @@ window.__ModuleLoader__.load({
 		function elapsedSeconds(sinceMs, nowMs) {
 			return Math.max(0, Math.floor((nowMs - sinceMs) / 1e3));
 		}
+		/** Copy the sign-in URL to the clipboard; true on success. */
+		async function copyUrl(url) {
+			try {
+				await navigator.clipboard.writeText(url);
+				return true;
+			} catch {
+				return false;
+			}
+		}
 		/**
 		* The section. Rendered on BOTH sign-in states: a signed-out machine gains
 		* its first account here; a signed-in one can add another without leaving
 		* the card.
 		*/
-		function OAuthSignIn({ t, region }) {
+		function OAuthSignIn({ t, region, onAdded }) {
 			const [phase, setPhase] = (0, react.useState)({ kind: "idle" });
+			const [dialogOpen, setDialogOpen] = (0, react.useState)(false);
+			const [copied, setCopied] = (0, react.useState)(false);
 			const [pollTick, setPollTick] = (0, react.useState)(0);
 			const [nowMs, setNowMs] = (0, react.useState)(() => Date.now());
 			const mounted = (0, react.useRef)(true);
@@ -1826,7 +1937,11 @@ window.__ModuleLoader__.load({
 				return () => {
 					clearInterval(timer);
 				};
-			}, [waiting, phase]);
+			}, [
+				waiting,
+				phase,
+				t
+			]);
 			(0, react.useEffect)(() => {
 				if (phase.kind !== "waiting") return;
 				const { loginId } = phase;
@@ -1862,11 +1977,20 @@ window.__ModuleLoader__.load({
 								message: "error",
 								error: body.error
 							});
-							else setPhase({
-								kind: "finished",
-								message: "added",
-								accountName: body.accountName ?? ""
-							});
+							else {
+								const accountName = body.accountName ?? "";
+								setPhase({
+									kind: "syncing",
+									accountName
+								});
+								await onAdded?.();
+								if (cancelled || !mounted.current) return;
+								setPhase({
+									kind: "finished",
+									message: "added",
+									accountName
+								});
+							}
 						} catch {
 							setPollTick((tick) => tick + 1);
 						}
@@ -1877,12 +2001,47 @@ window.__ModuleLoader__.load({
 					clearTimeout(timer);
 				};
 			}, [
+				onAdded,
 				phase,
 				pollTick,
 				region
 			]);
-			const start = async () => {
+			/**
+			* Open a placeholder window WITHOUT `noopener`, and deliberately so.
+			*
+			* `noopener` is the correct feature for a link whose destination never needs
+			* a handle — and that is exactly why it is wrong here. Per the spec, a
+			* `window.open` call carrying `noopener` opens the tab but returns `null`
+			* (MDN: "the new window will not have access to the originating window via
+			* `Window.opener` and returns `null`"). The placeholder exists ONLY to be
+			* navigated once the Host answers, so the handle IS the point: passing
+			* `noopener` made `placeholder` null, the navigation was skipped, and every
+			* sign-in left an empty `about:blank` tab behind instead of the sign-in page.
+			*
+			* The security property is kept, just established on the handle instead of
+			* through the feature: `opener = null` is applied to the placeholder before
+			* anything is loaded into it, so the destination still cannot reach back
+			* through `window.opener`. `noreferrer` is dropped for the same reason —
+			* the spec makes it imply `noopener`, so it would reintroduce the null.
+			* Nothing is lost: the placeholder is same-origin and empty until navigated,
+			* and the referrer would only ever have been the settings page.
+			*/
+			function openPlaceholder() {
+				const placeholder = window.open("", "_blank");
+				if (placeholder !== null) placeholder.opener = null;
+				return placeholder;
+			}
+			/**
+			* Fetch the authorization URL AND open the browser in one gesture chain.
+			* The placeholder window is opened synchronously — inside the click's user
+			* activation, before any await — so popup blocking cannot intervene; the
+			* URL is navigated once the Host answers. A blocked placeholder (null)
+			* degrades to the manual link inside the dialog, losing nothing but the
+			* convenience.
+			*/
+			const start = async (placeholder) => {
 				setPhase({ kind: "opening" });
+				setCopied(false);
 				try {
 					const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_OAUTH_PATH, region, "start"), {
 						method: "POST",
@@ -1890,8 +2049,12 @@ window.__ModuleLoader__.load({
 						credentials: "same-origin"
 					});
 					const body = await response.json();
-					if (!mounted.current) return;
+					if (!mounted.current) {
+						placeholder?.close();
+						return;
+					}
 					if (!response.ok || typeof body.loginId !== "string" || typeof body.verificationUri !== "string") {
+						placeholder?.close();
 						setPhase({
 							kind: "finished",
 							message: "error",
@@ -1899,6 +2062,7 @@ window.__ModuleLoader__.load({
 						});
 						return;
 					}
+					if (placeholder !== null) placeholder.location.href = body.verificationUri;
 					setPhase({
 						kind: "waiting",
 						loginId: body.loginId,
@@ -1908,6 +2072,7 @@ window.__ModuleLoader__.load({
 					});
 					setNowMs(Date.now());
 				} catch (error) {
+					placeholder?.close();
 					if (mounted.current) setPhase({
 						kind: "finished",
 						message: "error",
@@ -1915,72 +2080,133 @@ window.__ModuleLoader__.load({
 					});
 				}
 			};
-			if (phase.kind === "finished") {
-				const text = phase.message === "added" ? t("row.oauthDone", { accountName: phase.accountName === "" || phase.accountName === void 0 ? t("row.accountUnnamed") : phase.accountName }) : phase.message === "cancelled" ? t("row.oauthCancelled") : t("row.oauthError", { message: phase.error ?? "" });
-				return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
-					className: "dsm-workbuddy-bar",
-					"aria-label": t("row.oauthTitle"),
-					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						className: `dsm-workbuddy-bar-status ${phase.message === "added" ? "dsm-workbuddy-bar-ok" : "dsm-workbuddy-bar-error"}`,
-						children: text
-					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-						type: "button",
-						className: "dsm-btn dsm-btn-outline",
-						onClick: () => {
-							setPhase({ kind: "idle" });
-						},
-						children: t("row.oauthStart")
-					})]
-				});
-			}
+			/** Open the dialog and begin the login in the same click: the placeholder
+			* window must be created synchronously to count as a user gesture. */
+			const beginSignIn = () => {
+				setDialogOpen(true);
+				start(openPlaceholder());
+			};
+			/** Re-open the sign-in page from the waiting dialog (no new session).
+			*
+			* Here `noopener,noreferrer` IS right: this is a one-way navigation to a
+			* third-party page and nothing needs a handle on it — the contrast with
+			* {@link openPlaceholder} is the whole distinction. */
+			const reopen = () => {
+				if (phase.kind !== "waiting") return;
+				window.open(phase.verificationUri, "_blank", "noopener,noreferrer");
+			};
+			/**
+			* The three strings that NAME the sign-in method, per region.
+			*
+			* CN signs in by scanning a QR code with the WorkBuddy app; the international
+			* build signs in on a web page. Every other line in this section (waiting,
+			* cancel, done, copy) is about the flow, not the method, so it stays shared —
+			* splitting it too would let the two regions drift apart for no gain.
+			*/
+			const titleKey = region === "cn" ? "row.oauthTitle" : "row.oauthTitleGlobal";
+			const startKey = region === "cn" ? "row.oauthStart" : "row.oauthStartGlobal";
+			const finishText = phase.kind === "finished" ? phase.message === "added" ? t("row.oauthDone", { accountName: phase.accountName === "" || phase.accountName === void 0 ? t("row.accountUnnamed") : phase.accountName }) : phase.message === "cancelled" ? t("row.oauthCancelled") : t("row.oauthError", { message: phase.error ?? "" }) : "";
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 				className: "dsm-workbuddy-bar",
-				"aria-label": t("row.oauthTitle"),
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-					className: "dsm-workbuddy-bar-label",
-					children: t("row.oauthTitle")
-				}), phase.kind === "waiting" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
-						className: "dsm-workbuddy-bar-status",
-						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
-								href: phase.verificationUri,
-								target: "_blank",
-								rel: "noopener noreferrer",
-								children: t("row.oauthOpen")
-							}),
-							" — ",
-							t("row.oauthOpened")
-						]
+				"aria-label": t(titleKey),
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(BusyOverlay, {
+						visible: phase.kind === "syncing",
+						message: t("row.oauthSyncing"),
+						hint: t("row.veilHintList")
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
-						className: "dsm-workbuddy-bar-hint",
-						children: [
-							t("row.oauthWaiting", { seconds: elapsedSeconds(phase.startedAtMs, nowMs) }),
-							" ",
-							t("row.oauthExpires", { minutes: Math.max(1, Math.round((phase.expiresAtMs - nowMs) / 6e4)) })
-						]
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsm-workbuddy-bar-label",
+						children: t(titleKey)
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-						type: "button",
-						className: "dsm-btn dsm-btn-outline",
-						onClick: () => {
-							setPhase({
-								kind: "finished",
-								message: "cancelled"
-							});
-						},
-						children: t("row.oauthCancel")
-					})
-				] }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-					type: "button",
-					className: "dsm-btn dsm-btn-outline",
-					disabled: phase.kind === "opening",
-					onClick: () => {
-						start();
-					},
-					children: phase.kind === "opening" ? t("row.oauthStarting") : t("row.oauthStart")
-				})]
+					phase.kind === "finished" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: `dsm-workbuddy-bar-status ${phase.message === "added" ? "dsm-workbuddy-bar-ok" : "dsm-workbuddy-bar-error"}`,
+						children: finishText
+					}) : phase.kind === "waiting" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsm-workbuddy-bar-status",
+						children: t("row.oauthOpened")
+					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dsm-workbuddy-bar-actions",
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: "dsm-btn dsm-btn-outline",
+							disabled: phase.kind === "opening",
+							onClick: beginSignIn,
+							children: phase.kind === "opening" ? t("row.oauthStarting") : t(startKey)
+						})
+					}),
+					dialogOpen ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dsm-workbuddy-transfer-dialog",
+						role: "dialog",
+						"aria-label": t(titleKey),
+						children: phase.kind === "opening" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.oauthStarting") }) : phase.kind === "waiting" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.oauthOpenHint") }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dsm-workbuddy-oauth-url",
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+									href: phase.verificationUri,
+									target: "_blank",
+									rel: "noopener noreferrer",
+									children: phase.verificationUri
+								})
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+								className: "dsm-workbuddy-hint",
+								children: [
+									t("row.oauthWaiting", { seconds: elapsedSeconds(phase.startedAtMs, nowMs) }),
+									" ",
+									t("row.oauthExpires", { minutes: Math.max(1, Math.round((phase.expiresAtMs - nowMs) / 6e4)) })
+								]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dsm-workbuddy-transfer-dialog-actions",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsm-btn dsm-btn-outline",
+										onClick: () => {
+											copyUrl(phase.verificationUri).then((ok) => {
+												if (mounted.current) setCopied(ok);
+											});
+										},
+										children: copied ? t("row.oauthCopied") : t("row.oauthCopy")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsm-btn dsm-btn-outline",
+										onClick: reopen,
+										children: t("row.oauthReopen")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "dsm-btn dsm-btn-outline",
+										onClick: () => {
+											setPhase({
+												kind: "finished",
+												message: "cancelled"
+											});
+										},
+										children: t("row.oauthCancel")
+									})
+								]
+							})
+						] }) : phase.kind === "finished" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: `${phase.message === "added" ? "dsm-workbuddy-bar-ok" : phase.message === "error" ? "dsm-workbuddy-bar-error" : ""}`,
+							children: finishText
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "dsm-workbuddy-transfer-dialog-actions",
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "dsm-btn dsm-btn-outline",
+								onClick: () => {
+									setDialogOpen(false);
+								},
+								children: t("row.oauthDialogClose")
+							})
+						})] }) : null
+					}) : null
+				]
 			});
 		}
 		//#endregion
@@ -2022,13 +2248,24 @@ window.__ModuleLoader__.load({
 		/** The section. Rendered on both sign-in states — a signed-out machine can
 		* still import a file exported elsewhere; export without accounts answers
 		* the error line. */
-		function AccountTransfer({ t, region, accounts }) {
+		function AccountTransfer({ t, region, accounts, onChanged }) {
 			const [phase, setPhase] = (0, react.useState)({ kind: "idle" });
 			const [dialog, setDialog] = (0, react.useState)(void 0);
 			const [selected, setSelected] = (0, react.useState)(/* @__PURE__ */ new Set());
 			const [preview, setPreview] = (0, react.useState)(void 0);
 			const [importSelected, setImportSelected] = (0, react.useState)(/* @__PURE__ */ new Set());
 			const fileInput = (0, react.useRef)(null);
+			/**
+			* The text of the file the user just picked.
+			*
+			* Held here rather than re-read from the input at import time: the picker
+			* is a bare system dialog that closes immediately (see the import button),
+			* so between preview and confirm there is no dialog on screen holding the
+			* File. Re-reading `fileInput.current.files` would also break the moment
+			* anything clears the input — and it must be cleared after every pick, or
+			* choosing the SAME file twice fires no change event.
+			*/
+			const importText = (0, react.useRef)("");
 			const mounted = (0, react.useRef)(true);
 			(0, react.useEffect)(() => {
 				mounted.current = true;
@@ -2084,6 +2321,7 @@ window.__ModuleLoader__.load({
 				setPhase({ kind: "importing" });
 				try {
 					const text = await file.text();
+					importText.current = text;
 					const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_TRANSFER_PATH, region, "preview"), {
 						method: "POST",
 						headers: {
@@ -2113,10 +2351,10 @@ window.__ModuleLoader__.load({
 				}
 			};
 			const runImport = async () => {
-				if (preview === void 0 || importSelected.size === 0 || fileInput.current?.files?.[0] === void 0) return;
+				if (preview === void 0 || importSelected.size === 0 || importText.current === "") return;
 				setPhase({ kind: "importing" });
 				try {
-					const text = await fileInput.current.files[0].text();
+					const text = importText.current;
 					const response = await fetch(withWorkBuddyRouteAction(WORKBUDDY_TRANSFER_PATH, region, "import"), {
 						method: "POST",
 						headers: {
@@ -2139,12 +2377,19 @@ window.__ModuleLoader__.load({
 						return;
 					}
 					closeDialog();
+					const message = t("row.transferImported", {
+						imported: body.imported,
+						skipped: body.skipped ?? 0
+					});
+					setPhase({
+						kind: "refreshing",
+						message
+					});
+					await onChanged?.();
+					if (!mounted.current) return;
 					setPhase({
 						kind: "done",
-						message: t("row.transferImported", {
-							imported: body.imported,
-							skipped: body.skipped ?? 0
-						})
+						message
 					});
 				} catch (error) {
 					if (mounted.current) setPhase({
@@ -2153,11 +2398,18 @@ window.__ModuleLoader__.load({
 					});
 				}
 			};
-			const busy = phase.kind === "exporting" || phase.kind === "importing";
+			const busy = phase.kind === "exporting" || phase.kind === "importing" || phase.kind === "refreshing";
+			/** The veil's scenario line: what is happening, in the user's terms. */
+			const veilMessage = phase.kind === "exporting" ? t("row.transferExporting") : phase.kind === "importing" || phase.kind === "refreshing" ? t("row.transferImporting") : "";
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 				className: "dsm-workbuddy-bar",
 				"aria-label": t("row.transferTitle"),
 				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(BusyOverlay, {
+						visible: busy,
+						message: veilMessage,
+						...busy ? { hint: t("row.veilHintList") } : {}
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 						className: "dsm-workbuddy-bar-label",
 						children: t("row.transferTitle")
@@ -2185,13 +2437,27 @@ window.__ModuleLoader__.load({
 							className: "dsm-btn dsm-btn-outline",
 							disabled: busy,
 							onClick: () => {
-								setPreview(void 0);
-								setImportSelected(/* @__PURE__ */ new Set());
-								setDialog("import");
+								fileInput.current?.click();
 							},
 							children: t("row.transferImport")
 						})]
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+						ref: fileInput,
+						type: "file",
+						accept: "application/json,.json",
+						className: "dsm-workbuddy-transfer-file",
+						onChange: (event) => {
+							const file = event.target.files?.[0];
+							event.target.value = "";
+							if (file !== void 0) {
+								setPreview(void 0);
+								setImportSelected(/* @__PURE__ */ new Set());
+								setDialog("import");
+								readImportFile(file);
+							}
+						}
+					}),
 					dialog === "export" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "dsm-workbuddy-transfer-dialog",
 						role: "dialog",
@@ -2238,62 +2504,49 @@ window.__ModuleLoader__.load({
 							})
 						]
 					}) : null,
-					dialog === "import" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					dialog === "import" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: "dsm-workbuddy-transfer-dialog",
 						role: "dialog",
 						"aria-label": t("row.transferImport"),
-						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.transferImportPick") }),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-								ref: fileInput,
-								type: "file",
-								accept: "application/json,.json",
-								disabled: busy,
-								onChange: (event) => {
-									const file = event.target.files?.[0];
-									if (file !== void 0) readImportFile(file);
-								}
+						children: preview === void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.transferPreviewing") }) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.transferPreviewTotal", { total: preview.total }) }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+								className: "dsm-workbuddy-transfer-list",
+								children: preview.accounts.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+										type: "checkbox",
+										disabled: !entry.hasToken,
+										checked: importSelected.has(entry.index),
+										onChange: (event) => {
+											const next = new Set(importSelected);
+											if (event.target.checked) next.add(entry.index);
+											else next.delete(entry.index);
+											setImportSelected(next);
+										}
+									}),
+									" ",
+									entry.nickname !== "" ? entry.nickname : entry.email !== "" ? entry.email : entry.uid !== "" ? entry.uid : t("row.transferEntryUnknown"),
+									entry.hasToken ? "" : ` — ${t("row.transferNoToken")}`
+								] }) }, entry.index))
 							}),
-							preview === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("row.transferPreviewTotal", { total: preview.total }) }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
-									className: "dsm-workbuddy-transfer-list",
-									children: preview.accounts.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", { children: [
-										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-											type: "checkbox",
-											disabled: !entry.hasToken,
-											checked: importSelected.has(entry.index),
-											onChange: (event) => {
-												const next = new Set(importSelected);
-												if (event.target.checked) next.add(entry.index);
-												else next.delete(entry.index);
-												setImportSelected(next);
-											}
-										}),
-										" ",
-										entry.nickname !== "" ? entry.nickname : entry.email !== "" ? entry.email : entry.uid !== "" ? entry.uid : t("row.transferEntryUnknown"),
-										entry.hasToken ? "" : ` — ${t("row.transferNoToken")}`
-									] }) }, entry.index))
-								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-									className: "dsm-workbuddy-transfer-dialog-actions",
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-										type: "button",
-										className: "dsm-btn dsm-btn-outline",
-										onClick: closeDialog,
-										children: t("row.transferCancel")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-										type: "button",
-										className: "dsm-btn dsm-btn-outline",
-										disabled: importSelected.size === 0 || phase.kind === "importing",
-										onClick: () => {
-											runImport();
-										},
-										children: phase.kind === "importing" ? t("row.transferImporting") : t("row.transferImportConfirm", { count: importSelected.size })
-									})]
-								})
-							] })
-						]
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dsm-workbuddy-transfer-dialog-actions",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "dsm-btn dsm-btn-outline",
+									onClick: closeDialog,
+									children: t("row.transferCancel")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "dsm-btn dsm-btn-outline",
+									disabled: importSelected.size === 0 || phase.kind === "importing",
+									onClick: () => {
+										runImport();
+									},
+									children: phase.kind === "importing" ? t("row.transferImporting") : t("row.transferImportConfirm", { count: importSelected.size })
+								})]
+							})
+						] })
 					}) : null
 				]
 			});
@@ -2645,6 +2898,35 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-transfer-list label{display:flex;align-items:center;gap:6px;font-size:12px;color:var(--dsw-alias-label-primary,#e8e9ed);cursor:pointer;padding:2px 0}
 .dsm-workbuddy-transfer-list input[type="checkbox"]{flex:none}
 .dsm-workbuddy-transfer input[type="file"]{font-size:12px;color:var(--dsw-alias-label-primary,#e8e9ed);margin-bottom:8px}
+/* The import picker's input is driven by the 「import」 button, so it must not
+   render as a visible field: hide it from layout AND from assistive tech (the
+   button carries the accessible name). Not display:none alone — that also
+   removes it from the tab order in some engines, which is fine here, but the
+   clip-based form is the one that reliably keeps programmatic .click() working
+   across browsers. */
+.dsm-workbuddy-transfer-file{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}
+/* The sign-in URL inside the OAuth dialog: long https links must wrap rather
+   than push the dialog wide — break-all, since URLs have no soft wrap points. */
+.dsm-workbuddy-oauth-url{word-break:break-all;overflow-wrap:anywhere}
+.dsm-workbuddy-oauth-url a{color:var(--dsw-alias-brand-primary,#5686fe);text-decoration:none}
+.dsm-workbuddy-oauth-url a:hover{text-decoration:underline}
+/* The shared busy veil: a fixed overlay for operations whose result only shows
+   up after the list re-read (remove / import / sign-in).
+   It is NOT a modal: no control, no dismissal — only "this is running" and
+   "here is why nothing moved yet". Fixed positioning so it covers the card
+   regardless of which section started the operation, and a semi-transparent
+   backdrop so the table stays visible underneath — the user is watching a
+   specific row change, and hiding it would defeat the point. */
+.dsm-workbuddy-veil{position:fixed;inset:0;z-index:60;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.38);cursor:progress}
+.dsm-workbuddy-veil-card{display:flex;flex-direction:column;align-items:center;gap:8px;max-width:min(340px,80vw);padding:16px 20px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:12px;background:var(--dsw-alias-bg-primary,#1b1c20);box-shadow:0 8px 28px rgba(0,0,0,.35)}
+.dsm-workbuddy-veil-text{font-size:13px;line-height:20px;color:var(--dsw-alias-label-primary,#e8e9ed);text-align:center}
+.dsm-workbuddy-veil-hint{font-size:12px;line-height:18px;color:var(--dsw-alias-label-tertiary,#999);text-align:center}
+/* The spinner is the one thing that proves the UI is alive when the row under
+   it has not changed yet — which is precisely the confusion the veil exists to
+   remove. Reduced-motion users get the static ring instead of a rotation. */
+.dsm-workbuddy-veil-spinner{width:18px;height:18px;border:2px solid var(--dsw-alias-border-l2,#3a3d45);border-top-color:var(--dsw-alias-brand-primary,#5686fe);border-radius:50%;animation:dsm-workbuddy-veil-spin .7s linear infinite}
+@keyframes dsm-workbuddy-veil-spin{to{transform:rotate(360deg)}}
+@media (prefers-reduced-motion: reduce){.dsm-workbuddy-veil-spinner{animation:none}}
 `;
 		/**
 		* Composer credit readout styles, injected by the readout component itself.
@@ -3274,8 +3556,18 @@ window.__ModuleLoader__.load({
 				accounts: [],
 				selectionExplicit: false
 			};
+			/**
+			* Whether the ACTIVE region knows of any account at all.
+			*
+			* This is the poll's precondition in place of `status === 'signed-in'`. The
+			* signed-in flag means "a credential resolves", which is false for a region
+			* whose accounts exist but none is usable yet — exactly the state an import
+			* or a fresh OAuth sign-in creates. Polling on it meant those regions never
+			* refreshed, so the list stayed empty until the card was reopened.
+			*/
+			const hasAccounts = status.status !== "error" && status.accounts.length > 0;
 			(0, react.useEffect)(() => {
-				if (!open || status.status !== "signed-in") return;
+				if (!open || !hasAccounts) return;
 				const controller = new AbortController();
 				const timer = window.setInterval(() => {
 					refreshUsage(activeRegion, controller.signal);
@@ -3305,6 +3597,7 @@ window.__ModuleLoader__.load({
 			*/
 			const rescanAccounts = async () => {
 				setBusy(true);
+				setAccountError(void 0);
 				try {
 					const response = await fetch(withWorkBuddyRegion(WORKBUDDY_ACCOUNTS_REFRESH_PATH, activeRegion), {
 						method: "POST",
@@ -3313,7 +3606,10 @@ window.__ModuleLoader__.load({
 					});
 					const body = await response.json();
 					if (!response.ok || !Array.isArray(body.accounts)) throw new Error(`HTTP ${response.status}`);
+					if (body.dismissalsCleared === false) setAccountError(t("row.rescanHidesKept"));
 					await refreshUsage(activeRegion);
+				} catch (error) {
+					if (mounted.current) setAccountError(error instanceof Error ? error.message : t("row.requestFailed"));
 				} finally {
 					if (mounted.current) setBusy(false);
 				}
@@ -3672,10 +3968,12 @@ window.__ModuleLoader__.load({
 			*/
 			const accountTools = /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(OAuthSignIn, {
 				t,
-				region: activeRegion
+				region: activeRegion,
+				onAdded: () => refreshUsage(activeRegion)
 			}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountTransfer, {
 				t,
 				region: activeRegion,
+				onChanged: () => refreshUsage(activeRegion),
 				accounts: status.status === "error" ? [] : status.accounts.map((account) => ({
 					id: account.id,
 					accountName: account.accountName
@@ -3781,6 +4079,11 @@ window.__ModuleLoader__.load({
 								className: "dsm-workbuddy-usage-hint",
 								children: t("row.reloginHint")
 							}) : null,
+							accountError === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "dsm-workbuddy-account-error",
+								role: "alert",
+								children: accountError
+							}),
 							selectionLost ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 								className: "dsm-workbuddy-usage-hint",
 								children: t("row.selectionLostHint")
@@ -3831,9 +4134,7 @@ window.__ModuleLoader__.load({
 									siblingBusy: saving || togglingRegion !== void 0,
 									onBusyChange: setPoolBusy,
 									onSaved: async () => await refreshUsage(activeRegion) !== void 0,
-									onRefresh: () => {
-										refreshUsage(activeRegion);
-									}
+									onRefresh: () => refreshUsage(activeRegion)
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("section", {
 									className: "dsm-workbuddy-models",
@@ -4279,6 +4580,17 @@ window.__ModuleLoader__.load({
 			if (usage.status !== "signed-in") return void 0;
 			return usage.credits?.total;
 		}
+		/**
+		* The Host's per-region readout switch off a usage document, when it carries one.
+		*
+		* The `error` variant has no data at all, so it can only ever answer `undefined`
+		* — "the Host did not say", which leaves the settings scope in charge.
+		*/
+		function hostCreditsShownOf(usage) {
+			if (usage === void 0 || usage.status === "error") return void 0;
+			const value = usage.showCreditsInMainUi;
+			return typeof value === "boolean" ? value : void 0;
+		}
 		/** Group the digits so a four-figure balance stays readable in a narrow row. */
 		function formatCredits(value) {
 			return value.toLocaleString("en-US", { maximumFractionDigits: 0 });
@@ -4365,8 +4677,9 @@ window.__ModuleLoader__.load({
 					if (Array.isArray(data.accounts)) setAccountCredits(data.accounts);
 				} catch {}
 			}, [activeRegion]);
+			const hostHidden = hostCreditsShownOf(usage) === false;
 			(0, react.useEffect)(() => {
-				if (owned === void 0) return void 0;
+				if (owned === void 0 || hostHidden) return void 0;
 				let cancelled = false;
 				let timer;
 				const controller = new AbortController();
@@ -4381,7 +4694,11 @@ window.__ModuleLoader__.load({
 					if (timer !== void 0) window.clearInterval(timer);
 					controller.abort();
 				};
-			}, [owned, fetchUsage]);
+			}, [
+				owned,
+				hostHidden,
+				fetchUsage
+			]);
 			(0, react.useEffect)(() => {
 				if (!open || activeRegion === void 0) return void 0;
 				const controller = new AbortController();
@@ -4430,6 +4747,22 @@ window.__ModuleLoader__.load({
 				}
 			};
 			if (owned === void 0) return null;
+			/**
+			* The Host's own answer for this region, when the document carries one.
+			*
+			* The Host is the AUTHORITY on whether this readout is wanted, exactly as the
+			* card's `creditsShownOn` treats it — and here it is also the fix for a defect
+			* shipped in 4.3.0 (issue #46): the gate's decision rests on the settings
+			* scope, which on a host whose describe mirror lands late was bound to a
+			* namespace nothing serves. Every read of that scope is then `undefined`, and
+			* the opt-out rule (`!== false`) reads "shown" forever — so unticking the
+			* checkbox wrote correctly and changed nothing on screen.
+			*
+			* Checked AFTER the fetch rather than before it because the answer only
+			* arrives with the document. The cost is one usage read for a readout the user
+			* may have hidden, against a persistent wrong number on screen.
+			*/
+			if (hostCreditsShownOf(usage) === false) return null;
 			const signedIn = usage?.status === "signed-in" ? usage : void 0;
 			const total = signedIn === void 0 ? void 0 : creditsOf(signedIn);
 			const signedOut = usage !== void 0 && usage.status === "signed-out";
@@ -4616,11 +4949,22 @@ window.__ModuleLoader__.load({
 		* The region's own switches are applied HERE rather than inside the component,
 		* so a region that is switched off (or whose provider is off) starts no fetch
 		* loop at all.
+		*
+		* `hostValue` is the Host's own `showCreditsInMainUi` answer for this region,
+		* when a usage document carrying it is already in hand. It OUTRANKS the settings
+		* scope, exactly as the card's `creditsShownOn` does and for the same measured
+		* reason: the browser's settings mirror is documented as stale for this
+		* namespace on the affected deployments, and — the shipped 4.3.0 defect (issue
+		* #46) — the scope can be bound to a namespace nothing serves, where every read
+		* is `undefined` and the opt-out rule then reads "shown" forever. The Host is
+		* the authority; the scope is the fallback for a Host line that predates the
+		* field.
 		*/
-		function composerCreditsRegionOf(projection, scope) {
+		function composerCreditsRegionOf(projection, scope, hostValue) {
 			const provider = selectedProviderOf(projection);
 			const region = provider === void 0 ? void 0 : WORKBUDDY_COMPOSER_PROVIDERS[provider];
 			if (region === void 0) return void 0;
+			if (typeof hostValue === "boolean") return hostValue ? region : void 0;
 			const value = scope === void 0 ? void 0 : unwrapVolatileDeep(scope.getSnapshot().value);
 			if (!regionCreditsShownOf(value, region)) return void 0;
 			if (!regionEnabledOf(value, region)) return void 0;
@@ -4681,6 +5025,7 @@ window.__ModuleLoader__.load({
 			"row.sourceDsh": "plugin copy",
 			"row.searchedMore": "Show the {count} path(s) that were not found",
 			"row.reloginHint": "If errors occur, sign back in to the WorkBuddy app.",
+			"row.rescanHidesKept": "The accounts you removed are still hidden: the plugin could not update its own list file. On Windows this is usually a file lock — close antivirus or sync tools that may be holding files in the DSH profile, then try again.",
 			"row.credentialRejectedTitle": "WorkBuddy refused this account's token",
 			"row.credentialRejectedIntro": "The token for \"{accountName}\" is no longer accepted by the upstream, so credits and check-in are unavailable. Signing in again only helps if the problem is the token itself — here is what actually applies:",
 			"row.credentialRejectedSwitch": "Another sign-in on this machine answered the upstream: \"{accountName}\". Switching to it fixes this — no need to sign in again.",
@@ -4751,7 +5096,6 @@ window.__ModuleLoader__.load({
 			"row.oauthStart": "Sign in with QR code",
 			"row.oauthStarting": "Opening…",
 			"row.oauthOpenHint": "Open the sign-in page and confirm — the account is added here automatically when you finish:",
-			"row.oauthOpen": "Open sign-in page",
 			"row.oauthOpened": "Opened. Waiting for you to finish…",
 			"row.oauthWaiting": "Waiting for the sign-in to finish… ({seconds}s)",
 			"row.oauthExpires": "The sign-in window expires in about {minutes} min.",
@@ -4760,7 +5104,14 @@ window.__ModuleLoader__.load({
 			"row.oauthTimedOut": "The sign-in timed out — start again when ready.",
 			"row.oauthDone": "Added “{accountName}”. Pick it above to use it.",
 			"row.oauthError": "Sign-in failed: {message}",
-			"row.oauthUnavailable": "QR sign-in is not offered by this build of the plugin.",
+			"row.oauthCopy": "Copy link",
+			"row.oauthCopied": "Link copied",
+			"row.oauthReopen": "Open page again",
+			"row.oauthDialogClose": "Close",
+			"row.oauthTitleGlobal": "Add an account by web sign-in",
+			"row.oauthStartGlobal": "Sign in on the web",
+			"row.veilHintList": "The list refreshes as soon as this finishes.",
+			"row.oauthSyncing": "Adding the account…",
 			"row.transferTitle": "Export / import accounts",
 			"row.transferHint": "Move accounts between computers as a JSON file. The file carries the credentials — keep it private. The format is shared with other WorkBuddy credential managers.",
 			"row.transferExport": "Export accounts",
@@ -4770,7 +5121,7 @@ window.__ModuleLoader__.load({
 			"row.transferExported": "Exported {count} account(s) to {fileName}.",
 			"row.transferImport": "Import accounts",
 			"row.transferImporting": "Importing…",
-			"row.transferImportPick": "Choose a JSON file exported from this or a compatible tool:",
+			"row.transferPreviewing": "Reading the file…",
 			"row.transferPreviewTotal": "{total} account(s) in the file — untick what should stay out. Accounts already stored here are overwritten by the import.",
 			"row.transferImportConfirm": "Import {count} account(s)",
 			"row.transferImported": "Imported {imported} account(s); {skipped} skipped (no token, or belongs to the other region).",
@@ -4878,10 +5229,11 @@ window.__ModuleLoader__.load({
 			"row.poolUnsavedMembers": "Selection changed — save to apply",
 			"row.poolRowTest": "Test",
 			"row.poolRowRemove": "Remove",
-			"row.poolRowRemoveHint": "Forget this account's plugin-stored credential. A desktop-app sign-in reappears on the next scan — only the plugin's own copy is deleted.",
+			"row.poolRowRemoveHint": "Remove this account from the list. The WorkBuddy desktop app is not signed out — it keeps its own sign-in. Removing only hides the account here; 「Detect accounts again」 brings it back.",
 			"row.poolRowRemoveAria": "Remove the stored credential of {accountName}",
-			"row.poolRowRemoved": "{accountName}: removed from the plugin's storage.",
-			"row.poolRowRemoveDesktopOnly": "{accountName}: nothing plugin-stored to remove — this account comes from the desktop app's own sign-in.",
+			"row.poolRowRemoved": "{accountName}: hidden from the list. 「Detect accounts again」 re-adds it; the desktop app stays signed in.",
+			"row.poolRowRemoving": "Removing the account…",
+			"row.poolRowRemoveDesktopOnly": "{accountName}: hidden from the list — this account comes from the desktop app's own sign-in, which is left untouched. 「Detect accounts again」 re-adds it.",
 			"row.showCreditsCn": "Show WB CN credits in the composer",
 			"row.showCreditsGlobal": "Show WB AI credits in the composer",
 			"row.showCreditsCnHint": "Show the domestic (WB CN) credit balance in the composer toolbar, but only while this session uses a WB CN model. Click it for per-account balances and a manual refresh (refreshes by itself every 5 minutes).",
@@ -4933,6 +5285,7 @@ window.__ModuleLoader__.load({
 			"row.sourceDsh": "插件副本",
 			"row.searchedMore": "显示另外 {count} 条「不存在」的路径",
 			"row.reloginHint": "出现错误，重新登录 WorkBuddy APP 即可。",
+			"row.rescanHidesKept": "已删除的账号仍是隐藏状态：插件没能更新自己的名单文件。Windows 上通常是文件被占用——请关闭可能正在占用 DSH 配置目录的杀毒/同步工具后重试。",
 			"row.credentialRejectedTitle": "WorkBuddy 拒绝了这个账号的 token",
 			"row.credentialRejectedIntro": "「{accountName}」的 token 已不被上游接受，所以积分与签到都用不了。重新登录只在「确实是 token 的问题」时才有用——当前实际适用的是下面这一条：",
 			"row.credentialRejectedSwitch": "本机另一个账号「{accountName}」刚刚实测可用，切换到它即可恢复，不必重新登录。",
@@ -5003,7 +5356,6 @@ window.__ModuleLoader__.load({
 			"row.oauthStart": "扫码登录",
 			"row.oauthStarting": "正在打开…",
 			"row.oauthOpenHint": "打开登录页并完成确认——完成后账号会自动出现在这里：",
-			"row.oauthOpen": "打开登录页",
 			"row.oauthOpened": "已打开，等待你完成登录…",
 			"row.oauthWaiting": "正在等待登录完成…（{seconds} 秒）",
 			"row.oauthExpires": "登录窗口约 {minutes} 分钟后过期。",
@@ -5012,7 +5364,14 @@ window.__ModuleLoader__.load({
 			"row.oauthTimedOut": "登录超时——请重新开始。",
 			"row.oauthDone": "已添加「{accountName}」。在上方选中它即可使用。",
 			"row.oauthError": "登录失败：{message}",
-			"row.oauthUnavailable": "当前版本的插件不支持扫码登录。",
+			"row.oauthCopy": "复制链接",
+			"row.oauthCopied": "已复制链接",
+			"row.oauthReopen": "重新打开页面",
+			"row.oauthDialogClose": "关闭",
+			"row.oauthTitleGlobal": "网页登录添加账号",
+			"row.oauthStartGlobal": "网页登录",
+			"row.veilHintList": "完成后列表会立即刷新。",
+			"row.oauthSyncing": "正在添加账号…",
 			"row.transferTitle": "导出 / 导入账号",
 			"row.transferHint": "用 JSON 文件在电脑之间迁移账号。文件里是账号凭据——请妥善保管。该格式与同类 WorkBuddy 凭据管理工具通用。",
 			"row.transferExport": "导出账号",
@@ -5022,7 +5381,7 @@ window.__ModuleLoader__.load({
 			"row.transferExported": "已导出 {count} 个账号到 {fileName}。",
 			"row.transferImport": "导入账号",
 			"row.transferImporting": "正在导入…",
-			"row.transferImportPick": "选择本插件或同类工具导出的 JSON 文件：",
+			"row.transferPreviewing": "正在读取文件…",
 			"row.transferPreviewTotal": "文件中共 {total} 个账号——不需要的请取消勾选。导入会覆盖这里已存储的同名账号。",
 			"row.transferImportConfirm": "导入 {count} 个账号",
 			"row.transferImported": "已导入 {imported} 个账号；跳过 {skipped} 个（缺 token，或属于另一个区域）。",
@@ -5130,10 +5489,11 @@ window.__ModuleLoader__.load({
 			"row.poolUnsavedMembers": "勾选已改动 —— 保存后生效",
 			"row.poolRowTest": "测试",
 			"row.poolRowRemove": "删除",
-			"row.poolRowRemoveHint": "删除插件保存的这个账号凭据。桌面 App 的登录不会被删除——下次扫描它还会出现；只有插件自己的副本会被移除。",
+			"row.poolRowRemoveHint": "把这个账号从列表中移除。桌面 App 不会被退出登录——它保留自己的登录状态。移除只是暂时隐藏，点「重新检测账号」即可找回。",
 			"row.poolRowRemoveAria": "删除 {accountName} 的已存凭据",
-			"row.poolRowRemoved": "{accountName}：已从插件存储中移除。",
-			"row.poolRowRemoveDesktopOnly": "{accountName}：没有插件存储的凭据可删——这个账号来自桌面 App 自己的登录。",
+			"row.poolRowRemoved": "{accountName}：已从列表中隐藏。点「重新检测账号」会重新加入，桌面 App 的登录不受影响。",
+			"row.poolRowRemoving": "正在删除账号…",
+			"row.poolRowRemoveDesktopOnly": "{accountName}：已从列表中隐藏——这个账号来自桌面 App 自己的登录，该登录未被改动。点「重新检测账号」会重新加入。",
 			"row.showCreditsCn": "在对话框显示 WB CN 积分",
 			"row.showCreditsGlobal": "在对话框显示 WB AI 积分",
 			"row.showCreditsCnHint": "在对话输入框工具栏显示国内版（WB CN）剩余积分，仅当本会话使用 WB CN 模型时出现。点击可看各账号余额并手动刷新（每 5 分钟也会自动刷新）。",
@@ -5210,17 +5570,10 @@ window.__ModuleLoader__.load({
 				const softGet = (name) => ctx.get(name);
 				let settingsScope;
 				const forms = softGet("configForms");
-				if (forms !== void 0) {
-					let ns = WORKBUDDY_SETTINGS_NS;
-					try {
-						const served = (forms.describe().getSnapshot().view?.namespaces ?? []).find((entry) => entry.ns === "workbuddy" || /workbuddy/i.test(entry.ns));
-						if (served !== void 0) ns = served.ns;
-					} catch {}
-					settingsScope = forms.get(ns);
-				}
+				/** Register one card slot; returns its disposer, or undefined if it failed. */
 				const registerCard = (slotName, key) => {
 					try {
-						ctx.slots.inject(slotName, () => ctx.slots.register({
+						return ctx.slots.inject(slotName, () => ctx.slots.register({
 							name: slotName,
 							key,
 							priority: 30,
@@ -5231,10 +5584,9 @@ window.__ModuleLoader__.load({
 						}, WorkBuddyCard));
 					} catch (error) {
 						console.error(`[dsh-connect-workbuddy] card slot "${slotName}" failed to register (host provider unaffected):`, error);
+						return;
 					}
 				};
-				registerCard("plugins.bundle.config", "dsh-connect-workbuddy");
-				registerCard("plugins.row.config", "dsh-connect-workbuddy#dsh-connect-workbuddy");
 				/**
 				* Credit readout in the composer tool row (`conversation.input.left`, a
 				* session-scope list slot).
@@ -5255,7 +5607,7 @@ window.__ModuleLoader__.load({
 				*/
 				const registerComposerCredits = () => {
 					try {
-						ctx.slots.inject("conversation.input.left", () => ctx.slots.register({
+						return ctx.slots.inject("conversation.input.left", () => ctx.slots.register({
 							name: "conversation.input.left",
 							id: "dsh-connect-workbuddy-composer-credits",
 							order: 4,
@@ -5267,9 +5619,84 @@ window.__ModuleLoader__.load({
 						}, ComposerCreditsGate));
 					} catch (error) {
 						console.error("[dsh-connect-workbuddy] composer credits slot failed to register (host provider unaffected):", error);
+						return;
 					}
 				};
-				registerComposerCredits();
+				/**
+				* Every slot this plugin contributes, and how to (re)create them.
+				*
+				* Kept as one list because the binding of `settingsScope` and the slot
+				* registrations must move TOGETHER: see {@link bindSettingsScope} for why a
+				* late-arriving namespace has to produce fresh registrations rather than a
+				* mutated closure.
+				*/
+				/**
+				* Disposers of the slots registered for the CURRENT namespace binding.
+				*
+				* Declared before {@link bindSettingsScope} because that function closes
+				* over it and reassigns it; the binding is only armed at the end of `apply`,
+				* so this is initialised by then either way — hoisting it keeps that
+				* ordering a non-requirement rather than a trap.
+				*/
+				let liveDisposers = [];
+				const registerAllSlots = () => [
+					registerCard("plugins.bundle.config", "dsh-connect-workbuddy"),
+					registerCard("plugins.row.config", "dsh-connect-workbuddy#dsh-connect-workbuddy"),
+					registerComposerCredits()
+				].filter((disposer) => disposer !== void 0);
+				/**
+				* Bind `settingsScope` to whichever namespace the Host really serves, and
+				* RE-REGISTER every slot when that answer changes.
+				*
+				* Why this is not a one-shot read at startup — the shipped 4.3.0 defect
+				* (issue #46): the mirror is filled by an async `remote.settings.describe()`,
+				* so at `apply` time `view` is usually still absent. The old code read that
+				* absence as "the declared name must be right", bound
+				* `forms.get('workbuddy')`, and never looked again. `ConfigFormController.
+				* derive()` matches the namespace EXACTLY, so the guessed form stayed
+				* `unavailable` forever; the composer gate — reading only that scope —
+				* judged the opt-out switch `undefined !== false` and kept rendering the
+				* readout. Unticking the box wrote `false` correctly and changed nothing on
+				* screen.
+				*
+				* `whileServed` is the Host's own idiom for this (`mirror.subscribe` plus an
+				* immediate sync). It is strictly better than re-reading the snapshot by
+				* hand because it ALSO withdraws the binding if the Host stops serving our
+				* namespace, and it hands `register` the set of namespaces actually served
+				* — so the choice is made from live data instead of a captured guess.
+				*
+				* `register` runs on the unserved→served EDGE, not on every mirror update
+				* (see the service's `sync`), so the disposal below is not a churn loop: it
+				* clears whatever a previous edge left registered. That replacement is NOT
+				* optional, because the renderer caches each entry's inject result by object
+				* identity (`rootInjectCache` / `cachedRootInject` in
+				* `dsh-client-ui-renderer`: `if (!props) { props = runInject(...) }`), so an
+				* entry registered before the mirror landed is never re-evaluated. Late
+				* binding can therefore only work if the OLD registrations are disposed and
+				* NEW ones created — which is what this callback does.
+				*/
+				const bindSettingsScope = () => {
+					if (forms === void 0 || typeof forms.whileServed !== "function") {
+						settingsScope = forms?.get(WORKBUDDY_SETTINGS_NS);
+						liveDisposers = registerAllSlots();
+						return;
+					}
+					ctx.effect(() => forms.whileServed(WORKBUDDY_SETTINGS_NAMESPACE_CANDIDATES, (served) => {
+						const ns = WORKBUDDY_SETTINGS_NAMESPACE_CANDIDATES.find((candidate) => served.has(candidate)) ?? [...served].find((entry) => /workbuddy/i.test(entry));
+						settingsScope = ns === void 0 ? void 0 : forms.get(ns);
+						for (const dispose of liveDisposers) try {
+							dispose();
+						} catch {}
+						liveDisposers = registerAllSlots();
+						return () => {
+							for (const dispose of liveDisposers) try {
+								dispose();
+							} catch {}
+							liveDisposers = [];
+						};
+					}), "dsh-connect-workbuddy: settings namespace binding");
+				};
+				bindSettingsScope();
 			} catch (error) {
 				console.error("[dsh-connect-workbuddy] client card failed to load (host provider unaffected):", error);
 			}