dsh-connect-workbuddy 4.3.4 → 4.4.2

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 4.4.2 (2026-10-13)
+
+### Fixes
+
+- **DSH 0.2.1-alpha.2 下 workbuddy 模型工具调用全失效：把 pi-ai 主版本 1 判为 modern。**（PR #52，issues #24/#25/#26 的同源延伸）
+  - **现象**：DSH `0.2.1-alpha.2` 起，**所有** workbuddy / workbuddy-global 模型都无法调用工具（本地模型与 deepseek 账号组不受影响），且**界面上没有任何报错**。会话事件流停在「只有思考块」→「整轮 completed」，全程没有 `tool-call` 事件；模型有时还会把 DSML 标记当**正文**吐出来。
+  - **根因**：`src/pi-ai-runtime.ts` 的 `generationOf()` 用 `/^0\.(\d+)\./u` 解析版本，**只认 `0.x`**。DSH 0.2.1-alpha.2 随包的是 `@earendil-works/pi-ai@1.0.2`，`'1.0.2'` 匹配不到 → 返回 `'legacy'`。`legacy` 会让 `withLegacyContext()` 用 `adaptLegacyPiAiContext()` 把上下文折成 pi-ai **0.85** 形状：system 消息抽出去当 `systemPrompt`，工具声明搬到**顶层 `tools`**。而 pi-ai 1.x 从 `context.messages` 里 system 消息的 `toolsAdded` 读工具（`resolveTranscriptTools` / `getCurrentTools`），**不看顶层 `tools`**——请求里一个工具声明都没有，模型自然发不出 `toolCall`。国内网关容忍无 system 的请求，模型就把 DSML 写进正文。更隐蔽的是 shim 的 DSML 恢复也一并失效（`gate.declaredNames` 为空 → 整段禁用），所以整套缺陷**完全静默**。
+  - **为什么在作者 checkout 上不复现**：源码注释里写着 "this checkout resolves 0.85.1 today"——解析到 0.85.1 时 `legacy` 分支是**正确**的。另外 `doctor` 在宿主**之外**跑会显示 `modern`，那是 `resolvedLocally: false` 的默认值，与宿主内的真实判定无关。
+  - **修法**：只特判**主版本 1**，`>= 87` 的 minor 判定保持不变。已逐包对照 **pi-ai 0.87.1、1.0.2、1.1.0、1.2.0** 四个版本：三者的 `openai-completions` 都从 `context.messages` 调 `resolveTranscriptTools()`，`getCurrentTools()` 都读 system 消息的 `toolsAdded`/`toolsRemoved`，契约一致。**刻意是 `=== 1` 而不是 `>= 1`**：未核验未来 2.x 的上下文契约，不替未验证的版本做兼容承诺；测试里 `2.0.0` 明确断言仍为 `legacy`。
+  - **顺带记录的边界事实**（本版**未**改动 peer 范围）：宿主 `dsh-app-boot` 的 `evaluatePluginCompatibility()` 只校验 `@deepseek-ai/dsh*` 命名空间，所以 `"@earendil-works/pi-ai": ">=0.85.0 <0.88.0"` 这条 peer **从不参与校验**，插件会对着越界的 1.x 静默运行。peer 范围的取舍留给维护者单独决定。
+  - **守卫**：`tests/pi-ai-runtime.spec.ts` 的版本→代际用例改为数据驱动，并用临时目录里伪造的 `package.json` 驱动 `piAiRuntimeFor()`，**不依赖本机解析到哪个版本**，因此在解析到 0.85.1 的机器上也能跑。覆盖 `0.85.0/0.85.1/0.86.3 → legacy`、`0.87.0/0.87.1/1.0.0/1.0.2/1.1.0 → modern`、`2.0.0 → legacy`、不可解析版本保守判 `legacy`。变异验证（还原修复）后恰好 4 个 1.x 用例变红，其余 13 个不变。
+
+- **上游流被截断时，恢复层把补写的 `[DONE]` 粘在半截帧之后，客户端 SSE 解析崩溃（PI_AI_ERROR）。**（PR #54，issue #53）
+  - **现象**：对话中途偶发整轮直接失败，报错文本 `Unexpected non-whitespace character after JSON at position 319 (line 2 column 1)`，宿主归到兜底码 `PI_AI_ERROR`。该码**不在宿主的原地重试集**里（只认 `EMPTY_RESPONSE`/`RATE_LIMIT`/`SERVER`/`TIMEOUT`/`TRANSPORT`），所以一旦出现，这一轮直接结束、不重试——用户看到的就是「突然断了」。已确认与具体模型、工作区无关，且**紧跟在一次 transport 故障之后**。
+  - **根因**：是恢复层自己制造了非法的 SSE 帧，不是上游发的。两处叠加——① `consume()` 把流尾巴的残余帧直接透传，不补帧分隔空行；② `finish()` 补写合成终止帧时，没有确保前面有帧分隔。于是客户端实际收到的是**同一个 SSE 事件里的两条 `data:` 行**（中间只有一个 `\n`，不是空行）。openai SDK 的 `SSEDecoder` 会把一个事件内的多条 `data:` 行用 `\n` 拼起来再解析，拼出来就是「一个完整 JSON + 换行 + 第二个 JSON」，`JSON.parse` 在第二行行首抛错。**报错位置恰好是 319，因为第一段 chunk 的长度正好是 318**——这不是巧合。
+  - **修法**：把「每个帧必须自带空行终止符」变成不变量，而不是在 `finish()` 里特判——`RecoveryStream` 有 6 处直接 `res.write`，逐个补分隔容易漏，而 `handleFrame` 里 JSON 解析失败的原帧透传路径同样会写出不带空行的帧。现在类内所有帧写出收敛到单一出口 `emitFrame()`，由它补齐帧尾；`consume()` 对 `carry` 剩下的半帧先归一化再交给 `handleFrame`。**缺换行和缺空行是两种情形**：前者补一个 `\n` 只结束「行」不结束「事件」，必须补 `\n\n` 才能让随后的 `[DONE]` 不粘上去。
+  - **顺带修掉一个静默丢内容**：`finish()` **不**补 `[DONE]` 时，半截帧没有空行收尾，SDK 永远等不到分隔，最后那一小段内容被静默丢弃。归一化帧尾后这段内容能正常 dispatch 出来。
+  - **不影响普通路径**：`push()` 切出的帧本就带终止符，经 `emitFrame` 原样通过，仍是 byte-for-byte 透传——「帧顺序永不改变」的既有承诺不受影响。
+  - **守卫**：新增 `tests/issue53-sse-terminator.spec.ts`，断言在**字节层**：按 SSE 规范切事件，每个事件内多条 `data:` 行拼接后必须是单个合法 JSON。缺陷本质是字节粘连，只有字节级断言能抓住它。变异验证（还原两处修复）后 3 个缺陷用例全部变红，「完整流字节不变」的守卫用例保持绿色——说明没有过度归一化。
+
+- **保存/删除/导入时的忙碌遮罩：改用宿主主题令牌，spinner 换成宿主同款弧线。**
+  - **现象**：遮罩卡片是一块近黑的板子，上面的字（尤其是副标题「完成后列表会立即刷新。」）几乎看不清；spinner 的转法也和外壳里其他转圈明显不同拍。
+  - **根因**：三处都出在自造值上。① 卡片底色用 `--dsw-alias-bg-primary`，而这个变量在宿主的令牌集里**根本不存在**（宿主只有 `bg-base` / `bg-layer-1..3` / `bg-module-platform` / `bg-overlay` 等），于是一路回退到硬编码的近黑 `#1b1c20`。② 遮罩底色写死 `rgba(0,0,0,.38)`，既不跟随主题、也没有宿主的模糊。③ 副标题用 `label-tertiary`——那是宿主最暗的一档（亮色 `neutral-bluish-600`、暗色 `neutral-bluish-400`），给元数据用的，不该承载一句要等的人必须读的话。
+  - **修法**：卡片改用宿主给弹层用的 `--dsw-alias-bg-layer-2`（亮色白 / 暗色 `neutral-bluish-850`，各自成立）；遮罩改用宿主自己遮罩用的 `--dsw-alias-bg-mask-1`（亮 `.24` / 暗 `.5`）+ `--dsw-mask-blur`，与外壳里其他遮罩一致；副标题改用 `label-secondary`。阴影也从手写的 `0 8px 28px rgba(0,0,0,.35)` 换成宿主的 `--dsw-elevation-prominent`。
+  - **spinner**：原本是 18px 的 CSS border 环、`.7s` 匀速转，比宿主自己的状态转圈（`_dsh-state-dot-spin`，SVG 弧线 + dash 呼吸、`1.5s`）快了近一倍。比起形状本身，**这个速度差才是它看着廉价的主因**。现在改为同款弧线几何与 `1.5s` 节奏，`currentColor` 继承所在层级，reduced-motion 降级为静态弧线（与宿主降级方式一致），并补 `aria-hidden` 免得 `role=status` 之外多报一次。
+  - **顺带记录一个会静默损坏产物的坑**：`WORKBUDDY_CARD_CSS` 是模板字符串，注释里写反引号会**提前截断整个样式表**，而 typecheck 与 build **都不报错**（截断后的尾部仍是合法 TS，被当成一堆散落的表达式语句）。本次改注释时真的踩到了。新增一条守卫：按顶层语句数断言（正常 2 条变量声明；一旦截断会炸成几十条表达式语句）。变异验证：塞回一个反引号后该守卫变红，恢复后全绿。
+  - **守卫**：`tests/client-host-contract.spec.ts` 由 8 例增至 10 例。
+
+### Docs
+
+- 无。本版含上述三处修复与配套测试。
+
+## 4.4.1 (2026-10-12)
+
+### Fixes
+
+- **登录成功后「正在添加账号…」的遮罩不再无限转圈；导入的遮罩同样有上限。**（issue #51）
+  - **现象**：报告者描述「登录成功后这里会转很久，等一分钟也没等完，每次都是直接退出 DSH 重新打开」，截图里账号表**已经有三条账号、其中一条正在服务**，而遮罩仍停在「正在添加账号…｜完成后列表会立即刷新。」。这两个事实合起来就是全部分析：凭据在 Host 答 `done` **之前**就已写入，所以表格有数据说明**登录本身是成功的**，卡住的是它的下一步。
+  - **根因**：`OAuthSignIn` 的 `done` 分支里，`setPhase({ kind: 'syncing' })` 之后跟着一句 `await onAdded?.()`，而遮罩的显示条件正是 `phase.kind === 'syncing'`。也就是说**遮罩唯一的退出条件是一个 promise 落地**——既没有超时，也没有 `catch`。重读（卡片那次同源 usage 请求）只要永不 settle，`phase` 就永远停在 `syncing`。上一段的 `waiting` 阶段**有**自己的本地超时，`syncing` 两者都没有，这是本缺陷的形状。
+  - **为什么代码评审看不见**：这是本次修复中最值得记下的一点。`phase` 是轮询 effect 的依赖项，`setPhase({ kind: 'syncing' })` 会让该 effect 重跑，React **先执行上一次的 cleanup**，而 cleanup 会把旧闭包的 `cancelled` 置为 `true`。React 在 `await` 恢复之前就提交了这次 cleanup，所以**恢复后总会看到 `cancelled === true` 并直接 return**。于是——**只有当重读快到不与 React 提交相交时**（即最快的那条路径），它才在 cleanup 之前落地、通过守卫并显示成功行。**慢到跨过一次 React 提交的顺序（也就是报告者遇到的那种）反而必然失败。缺陷藏在它自己的常见路径背后**，这也是第一版「把竞态写在原处」的修法**实测无效**的原因（不是推断，是跑出来的）。
+  - **修法**：把这个等待搬进一个以 `phase` 为键的独立 effect。它的 cleanup 只在阶段**离开** `syncing` 时才跑，也就是在它已经做完事之后，因此不存在自我取消。新加的账号名走 `addedAccountName` state（而不是 ref），这样第二次登录（再添一个账号）会正确地重新计时，而不是复用上一轮的闭包值。
+  - **两个出口都报成功，且刻意不做区分**：账号**确实**已经添加（Host 在答 `done` 之前就存好了凭据），所以诚实的说法是成功；超时只是不让屏幕无限期地声称相反。真正失败的 usage 路由仍由卡片自己以 `refreshError` 如实报告——那部分数据的拥有者是卡片，不是这里。
+  - **导入路径一并设上限**：`AccountTransfer` 的 `await onChanged?.()` 是同一形态、同一个遮罩，唯一的区别是它没有把 `phase` 放进任何 effect 依赖，所以原地加超时即可生效。两条路径共用同一个 `settlesWithin` 实现，正是为了不再各自漂移。**一个上限值 `5_000ms`**：远长于一次健康的回环重读，又远短于轮询节奏给人的预期。
+  - **守卫**：新增 `tests/issue51-sync-veil.spec.tsx`（5 例）。断言的是**可观察结果**而不是实现细节——重读仍在 pending 时遮罩必须已经落下、成功行必须已经出现；快路径不得因此被拖到超时；重读**抛错**按成功处理（它若逃逸进轮询的 `catch` 会重试轮询并再次报告同一个已添加的账号）；只在超时窗口内推进时钟时遮罩必须仍在。
+  - **变异验证**：把 `src/client/OAuthSignIn.tsx` 改回原来的 `await onAdded?.()` 并删掉新 effect（即完全恢复旧逻辑），5 例中**3 例变红**；改回修复版 5 例全绿。这条记录有意写下来，因为**第一版修法本身是无效的**——只有经过这次还原才确认了守卫真的能抓住它。
+  - **测试基建注意**：`tests/pool-render-helpers.tsx` 的 `settle()` 用 `setTimeout` 排空异步工作，而假时钟会冻结它，所以本文件不能沿用 `settle()`（会一直挂到测试超时，表现为「找不到按钮」这类级联报错）。本文件改用 `act` + `advanceTimersByTimeAsync` 手动驱动时钟。另：登录轮询间隔是 `OAUTH_POLL_INTERVAL_MS = 2000`，**不是**卡片 usage 的一分钟——写作过程中一度按 60 秒推进时钟，等价于把整个流程跑完，因此这一处边界在测试里以注释标明。
+  - **未改动**：`window.open('')` 的占位窗口与「被拦则降级为弹窗内手动链接」这套行为一字未动。报告者说的「从来没有成功打开过浏览器」在该桌面外壳里 `window.open` 返回 `null`，走的是**已文档化的降级路径**，功能不损失（弹窗里始终有可复制的链接与「重新打开页面」按钮）；把它改成别的行为属于另一个议题，不在本次范围内。
+
+## 4.4.0 (2026-10-12)
+
+### Features
+
+- **「在对话框显示积分」开关移进「账号池」标题行，少占一行。**
+  - **改动**：该开关原本单独占一行（在 tab 栏下方），一个复选框换来一整行高度。现在它与「账号池」标题在同一行：标题在左，开关紧随其后，右侧仍是「当前账号」徽标。**账号池区块不会因此变高**。
+  - **没有采用「干脆删掉这行、只在别处留开关」的做法**：`AccountPool` 在宿主不提供 pool 状态时（旧宿主，或该路由缺字段）会 `return null`，把开关交给它会让**整个设置项随之消失**——一个设置控件不能因为另一个区块没渲染就不可达。因此有两条渲染点，**同一时刻只有一条生效**：有 pool 时进标题行，没有 pool 时回落到它自己那行（`dsm-workbuddy-credits-switch-row`，间距与移动前一致）。守卫按**祖先关系**断言（开关在 `.dsm-workbuddy-pool-head` 之内，且回落行不存在），而不是只数复选框个数——两条同时渲染也能通过「存在性」断言，却把省下的那一行又还了回去。
+  - **开关不因区域被关闭而隐藏**：区域关掉时它照旧渲染为**禁用**状态。藏起来会让用户看不到「为什么侧边栏没有那行」，而卡片自己的提示指向的是供应商复选框，不是一个凭空消失的控件。
+  - **文案随位置微调（不是为了好看）**：标签从「在对话框显示 WB CN 积分 / Show WB CN credits in the composer」缩到「对话框显示 WB CN 积分 / WB CN credits in composer」，省掉的是「在」与「Show」这类可以由上下文承接的词，**区域区分保留**——开关现在与「账号池」同排、不再紧贴 tab 栏，丢掉区域名会让 CN 与国际版两个开关在文案上无法区分。完整解释仍在 `title` 提示里，一字未减。
+  - **徽标改用 `margin-left:auto` 而非整行的 `space-between`**：三个子元素下 `space-between` 会把开关甩到中间而不是贴着标题；只有两个子元素（无开关）时 `margin-left:auto` 让徽标仍留在右边缘，与改动前一致。
+  - **联动清理**：`AccountPool` 新增 `headerExtra` 插槽（与既有 `accountTools` 同款「传现成节点」约定），开关的写入路径、禁用规则与「与卡片其他区域写入者串行」的逻辑**全部留在卡片里**——它们依赖设置 scope 与保存状态，搬进池区块等于把同一份写入与串行化逻辑再实现一遍。
+  - **守卫**：`tests/card-credits-switch.spec.tsx` 由 11 例增至 14 例，新增「开关在账号池标题行内且回落行不存在」「没有 pool 时回落到自己那行」「标签仍带区域名」三条。**变异验证**：把开关改回「永远单独成行」→ 第一条变红（`expected null not to be null`，即标题行里找不到开关）。
+
 ## 4.3.4 (2026-10-12)
 
 ### Fixes

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, Z as findWorkbuddyAppExecutableWithSource, a as readHostHeartbeat, at as hostPeersInfo, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-DkdNZKKY.js";
+import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, Z as findWorkbuddyAppExecutableWithSource, a as readHostHeartbeat, at as hostPeersInfo, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-CBFAiYPg.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -668,6 +668,45 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/client/BusyOverlay.tsx
 		/**
+		* The shared busy veil's spinner: an arc that breathes while it turns.
+		*
+		* Deliberately the host's own state-spinner shape (dsh's `_dsh-state-dot-spin`)
+		* rather than a border-ring: a two-tone CSS ring at .7s read as a loading
+		* indicator from another decade and was out of step with every spinner in the
+		* shell. The motion lives in CSS (`dsm-workbuddy-veil-spin` /
+		* `-dash`), so this element only describes the geometry; `currentColor` lets it
+		* inherit whatever tier it sits in.
+		*
+		* `aria-hidden` because the veil's `role="status"` already announces the
+		* message — a second announcement from a decorative arc is noise.
+		*/
+		function VeilSpinner() {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				className: "dsm-workbuddy-veil-spinner",
+				viewBox: "0 0 20 20",
+				"aria-hidden": "true",
+				focusable: "false",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
+					className: "dsm-workbuddy-veil-spinner-track",
+					cx: "10",
+					cy: "10",
+					r: "8",
+					fill: "none",
+					stroke: "currentColor",
+					strokeWidth: "2"
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
+					className: "dsm-workbuddy-veil-spinner-arc",
+					cx: "10",
+					cy: "10",
+					r: "8",
+					fill: "none",
+					stroke: "currentColor",
+					strokeWidth: "2",
+					strokeLinecap: "round"
+				})]
+			});
+		}
+		/**
 		* The veil. Deliberately NOT a modal dialog: it carries no focusable control
 		* and no dismissal — there is nothing for the user to decide, only a step to
 		* wait through. `aria-busy` plus a polite live region state that to screen
@@ -683,10 +722,7 @@ window.__ModuleLoader__.load({
 				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 					className: "dsm-workbuddy-veil-card",
 					children: [
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: "dsm-workbuddy-veil-spinner",
-							"aria-hidden": "true"
-						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(VeilSpinner, {}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							className: "dsm-workbuddy-veil-text",
 							children: message
@@ -1177,7 +1213,7 @@ window.__ModuleLoader__.load({
 		* section implying the feature exists.
 		*/
 		function AccountPool(props) {
-			const { t, region, pool, settingsScope, siblingBusy, onBusyChange, onSaved, onRefresh, onRescan, rescanning, onSelectAccount, selectingAccount, accountTools } = props;
+			const { t, region, pool, settingsScope, siblingBusy, onBusyChange, onSaved, onRefresh, onRescan, rescanning, onSelectAccount, selectingAccount, accountTools, headerExtra } = props;
 			const [draft, setDraft] = (0, react.useState)(null);
 			const [saving, setSaving] = (0, react.useState)(false);
 			const [saveError, setSaveError] = (0, react.useState)(void 0);
@@ -1614,7 +1650,7 @@ window.__ModuleLoader__.load({
 				visible: true,
 				message: t("row.poolSaving"),
 				hint: t("row.veilHintList")
-			}) : null, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-head" }, (0, react.createElement)("h3", { className: "dsm-workbuddy-pool-title" }, t("row.poolTitle")), currentName === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-current-badge" }, t("row.poolCurrentHeader", { account: currentName }))), !poolRunning && onSelectAccount !== void 0 && pool.accounts.length > 0 ? (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, t("row.poolManualAccountLabel")), (0, react.createElement)("span", null, t("row.poolManualAccountHint"))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("select", {
+			}) : null, (0, react.createElement)("div", { className: "dsm-workbuddy-pool-head" }, (0, react.createElement)("h3", { className: "dsm-workbuddy-pool-title" }, t("row.poolTitle")), headerExtra === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-head-extra" }, headerExtra), currentName === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-current-badge" }, t("row.poolCurrentHeader", { account: currentName }))), !poolRunning && onSelectAccount !== void 0 && pool.accounts.length > 0 ? (0, react.createElement)("div", { className: "dsm-workbuddy-pool-set" }, (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-copy" }, (0, react.createElement)("b", null, t("row.poolManualAccountLabel")), (0, react.createElement)("span", null, t("row.poolManualAccountHint"))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-set-ctl" }, (0, react.createElement)("select", {
 				className: "dsm-workbuddy-pool-select dsm-workbuddy-pool-account-select",
 				value: currentAccount?.accountId ?? "",
 				disabled: selectingAccount === true,
@@ -1893,7 +1929,53 @@ window.__ModuleLoader__.load({
 		function elapsedSeconds(sinceMs, nowMs) {
 			return Math.max(0, Math.floor((nowMs - sinceMs) / 1e3));
 		}
-		/** Copy the sign-in URL to the clipboard; true on success. */
+		/**
+		* How long the `syncing` phase may hold the veil before it lets go (issue #51).
+		*
+		* Shorter than a poll interval would be pointless; a few seconds is far longer
+		* than a healthy loopback re-read takes, and anything past that is
+		* indistinguishable from "never".
+		*
+		* What sits below this decision is an asymmetry worth spelling out. The
+		* `waiting` phase has its own local deadline (see the waiting-clock effect), so
+		* a login whose `loginId` died still ends. The `syncing` phase reached the veil
+		* and awaited the card's re-read with NEITHER a deadline NOR a `catch` — and the
+		* veil's visibility is `phase.kind === 'syncing'` and nothing else. So a re-read
+		* that never settled held the veil up forever, while the credential was already
+		* in the vault: reopening the card (or force-quitting DSH) showed the account,
+		* which is exactly the "half usable" report — sign-in succeeded, the screen
+		* never said so.
+		*/
+		const SYNC_SETTLE_TIMEOUT_MS = 5e3;
+		/**
+		* Await `work` but give up after `timeoutMs`; resolves `false` on timeout.
+		*
+		* The timer is cleared in a `finally`, so the common case (the re-read settles
+		* first) leaves no pending timer holding the event loop — the reason this is a
+		* race with an explicit cleanup rather than `Promise.race` alone.
+		*
+		* The timeout arm never rejects: a re-read that FAILS is not a failed sign-in,
+		* and the caller must not be able to confuse the two. Rejection and timeout
+		* stand for the same thing here — "the list did not prove it refreshed" — so
+		* they take the same path.
+		*
+		* EXPORTED because `AccountTransfer`'s veil awaits the same card re-read and had
+		* the same unbounded wait; sharing one implementation is what stops the two
+		* veils from drifting apart again.
+		*/
+		async function settlesWithin(work, timeoutMs) {
+			let timer;
+			try {
+				return await Promise.race([Promise.resolve(work).then(() => true, () => false), new Promise((resolve) => {
+					timer = setTimeout(() => resolve(false), timeoutMs);
+				})]);
+			} finally {
+				if (timer !== void 0) clearTimeout(timer);
+			}
+		}
+		/**
+		* Copy the sign-in URL to the clipboard; true on success.
+		*/
 		async function copyUrl(url) {
 			try {
 				await navigator.clipboard.writeText(url);
@@ -1913,6 +1995,17 @@ window.__ModuleLoader__.load({
 			const [copied, setCopied] = (0, react.useState)(false);
 			const [pollTick, setPollTick] = (0, react.useState)(0);
 			const [nowMs, setNowMs] = (0, react.useState)(() => Date.now());
+			/**
+			* The account the Host just added, held for the sync effect.
+			*
+			* The poll that answers `done` names the account; the effect that ends the
+			* `syncing` phase needs that name to write the success line, and it cannot
+			* read it off the phase because the phase is what it is about to replace.
+			* State rather than a ref: the effect is keyed on it, so a second sign-in
+			* (adding a second account) re-arms the deadline properly instead of reusing
+			* a stale closure value.
+			*/
+			const [addedAccountName, setAddedAccountName] = (0, react.useState)("");
 			const mounted = (0, react.useRef)(true);
 			(0, react.useEffect)(() => {
 				mounted.current = true;
@@ -1983,13 +2076,7 @@ window.__ModuleLoader__.load({
 									kind: "syncing",
 									accountName
 								});
-								await onAdded?.();
-								if (cancelled || !mounted.current) return;
-								setPhase({
-									kind: "finished",
-									message: "added",
-									accountName
-								});
+								setAddedAccountName(accountName);
 							}
 						} catch {
 							setPollTick((tick) => tick + 1);
@@ -2007,6 +2094,69 @@ window.__ModuleLoader__.load({
 				region
 			]);
 			/**
+			* End the `syncing` phase — on the re-read, or on the deadline, whichever
+			* comes first (issue #51).
+			*
+			* ## Why this is a separate effect and not an `await` in the poll
+			*
+			* The first attempt at this fix put the race inside the poll's `done` branch:
+			*
+			*     setPhase({ kind: 'syncing', accountName })
+			*     await settlesWithin(onAdded?.(), SYNC_SETTLE_TIMEOUT_MS)
+			*     if (cancelled || !mounted.current) return
+			*     setPhase({ kind: 'finished', … })
+			*
+			* and it did not work — measured, not assumed. `phase` is a dependency of the
+			* poll effect, so `setPhase({kind:'syncing'})` re-runs that effect, and React
+			* runs the PREVIOUS cleanup first. That cleanup sets the old closure's
+			* `cancelled = true`. React commits the cleanup before the `await` it is
+			* inside ever resumes, so the resume always sees `cancelled === true` and
+			* returns: the veil stayed up exactly as it had before.
+			*
+			* This also explains why the defect was invisible in review. A FAST re-read
+			* resolves inside the same microtask batch, before React commits the cleanup,
+			* so it passes the guard and the success line appears. Only a re-read slow
+			* enough to cross a React commit — i.e. the reported case — loses the race
+			* against its own cleanup. The bug hid behind its own common path.
+			*
+			* Running the wait in an effect keyed on the phase sidesteps the whole
+			* interaction: this effect's own cleanup runs when the phase LEAVES
+			* `syncing`, which is after it has already done its job, so there is no
+			* self-cancellation to lose.
+			*
+			* ## The two outcomes
+			*
+			* Both end in `finished`/`added` and the difference is deliberately not shown
+			* to the user. The account IS added — the Host stored the credential before it
+			* answered the poll — so the honest report is success either way; the deadline
+			* only stops the screen from claiming otherwise indefinitely. (`refreshUsage`
+			* already surfaces a failed re-read as `refreshError` on the card itself, so
+			* a genuinely broken usage route is still reported, by the component that
+			* owns that data.)
+			*/
+			(0, react.useEffect)(() => {
+				if (phase.kind !== "syncing") return;
+				let cancelled = false;
+				const finish = () => {
+					if (cancelled || !mounted.current) return;
+					setPhase({
+						kind: "finished",
+						message: "added",
+						accountName: addedAccountName
+					});
+				};
+				settlesWithin(Promise.resolve(onAdded?.()), SYNC_SETTLE_TIMEOUT_MS).then(finish);
+				const timer = setTimeout(finish, SYNC_SETTLE_TIMEOUT_MS);
+				return () => {
+					cancelled = true;
+					clearTimeout(timer);
+				};
+			}, [
+				addedAccountName,
+				onAdded,
+				phase
+			]);
+			/**
 			* Open a placeholder window WITHOUT `noopener`, and deliberately so.
 			*
 			* `noopener` is the correct feature for a link whose destination never needs
@@ -2227,6 +2377,17 @@ window.__ModuleLoader__.load({
 		*
 		* @module dsh-connect-workbuddy/client/AccountTransfer
 		*/
+		/**
+		* How long the veil may wait on the card's re-read before it comes down.
+		*
+		* Same ceiling and same reasoning as the sign-in path's
+		* `SYNC_SETTLE_TIMEOUT_MS` (issue #51): the veil is the only feedback this
+		* operation gives, so its exit condition must not be a promise that can stay
+		* pending. The `refreshing` phase has no other way out — no deadline, no
+		* failure branch — so an unsettled re-read left the operator staring at
+		* 「正在导入…」 over an import that had already succeeded.
+		*/
+		const REFRESH_SETTLE_TIMEOUT_MS = 5e3;
 		/** Build the default export file name: workbuddy-accounts-YYYY-MM-DD.json. */
 		function exportFileName() {
 			const pad = (value) => String(value).padStart(2, "0");
@@ -2385,7 +2546,7 @@ window.__ModuleLoader__.load({
 						kind: "refreshing",
 						message
 					});
-					await onChanged?.();
+					await settlesWithin(Promise.resolve(onChanged?.()), REFRESH_SETTLE_TIMEOUT_MS);
 					if (!mounted.current) return;
 					setPhase({
 						kind: "done",
@@ -2665,10 +2826,17 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-tab-switch{display:inline-flex;align-items:center;flex:none;padding:0 8px 0 2px;cursor:pointer}
 .dsm-workbuddy-tab-switch input{margin:0;cursor:pointer;accent-color:var(--dsw-alias-brand-primary,#5686fe)}
 .dsm-workbuddy-tab-switch input:disabled{opacity:.4;cursor:default}
-/* One sidebar-credit switch, belonging to the ACTIVE tab's region. It sits on
-   its own line so it reads as a property of this tab rather than as a shared
-   pair of settings — the tab bar already says which region is in scope. */
-.dsm-workbuddy-credits-switch{display:flex;align-items:center;gap:6px;margin:8px 0 2px;cursor:pointer;font-size:12px;line-height:18px;color:var(--dsw-alias-label-secondary,#c6c9d0)}
+/* One sidebar-credit switch, belonging to the ACTIVE tab's region. It rides in
+   the account-pool heading row (dsm-workbuddy-pool-head-extra) so one
+   checkbox no longer costs a full line of vertical space; the tab bar already
+   says which region is in scope, so it still reads as this tab's property
+   rather than as a shared pair of settings. No vertical margin: the heading row
+   owns the spacing. */
+.dsm-workbuddy-credits-switch{display:inline-flex;align-items:center;gap:6px;cursor:pointer;font-size:12px;line-height:18px;color:var(--dsw-alias-label-secondary,#c6c9d0)}
+/* The standalone fallback site: used only when the account-pool section did not
+   render (no Host pool state), so there is no heading row to share. This is the
+   spacing the control carried before it moved beside that heading. */
+.dsm-workbuddy-credits-switch-row{display:flex;align-items:center;margin:8px 0 2px}
 .dsm-workbuddy-credits-switch input{margin:0;cursor:pointer;accent-color:var(--dsw-alias-brand-primary,#5686fe)}
 .dsm-workbuddy-credits-switch input:disabled{opacity:.4;cursor:default}
 .dsm-workbuddy-tab-off{opacity:.55}
@@ -2754,8 +2922,15 @@ window.__ModuleLoader__.load({
 
 /* ---- Account pool ---- */
 .dsm-workbuddy-pool{display:flex;flex-direction:column;gap:12px;margin:0;padding:16px 0 4px;border-top:1px solid var(--dsw-alias-border-l2,#36373b)}
-.dsm-workbuddy-pool-head{display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap}
-.dsm-workbuddy-pool-current-badge{padding:2px 10px;border-radius:999px;background:rgba(86,134,254,.16);color:var(--dsw-alias-brand-primary,#5686fe);font-size:12px;font-weight:600;line-height:18px;white-space:nowrap}
+/* Title, then the inline extra (the sidebar-credit switch), then the
+   serving-account badge on the far edge. The badge is pushed right with
+   margin-left:auto rather than the row using space-between: with three
+   children the latter would strand the switch in the middle instead of binding
+   it to the title, and with only two (no switch) margin-left:auto keeps the
+   badge on the right edge exactly as before. */
+.dsm-workbuddy-pool-head{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
+.dsm-workbuddy-pool-head-extra{display:inline-flex;align-items:center}
+.dsm-workbuddy-pool-current-badge{margin-left:auto;padding:2px 10px;border-radius:999px;background:rgba(86,134,254,.16);color:var(--dsw-alias-brand-primary,#5686fe);font-size:12px;font-weight:600;line-height:18px;white-space:nowrap}
 /* Sits under the header block, before the batch buttons: account discovery is
    the first step of using the pool, so it reads above the actions it enables. */
 /* Manual-mode account picker: shares the settings row layout (.pool-set), and
@@ -2916,17 +3091,48 @@ window.__ModuleLoader__.load({
    "here is why nothing moved yet". Fixed positioning so it covers the card
    regardless of which section started the operation, and a semi-transparent
    backdrop so the table stays visible underneath — the user is watching a
-   specific row change, and hiding it would defeat the point. */
-.dsm-workbuddy-veil{position:fixed;inset:0;z-index:60;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.38);cursor:progress}
-.dsm-workbuddy-veil-card{display:flex;flex-direction:column;align-items:center;gap:8px;max-width:min(340px,80vw);padding:16px 20px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:12px;background:var(--dsw-alias-bg-primary,#1b1c20);box-shadow:0 8px 28px rgba(0,0,0,.35)}
-.dsm-workbuddy-veil-text{font-size:13px;line-height:20px;color:var(--dsw-alias-label-primary,#e8e9ed);text-align:center}
-.dsm-workbuddy-veil-hint{font-size:12px;line-height:18px;color:var(--dsw-alias-label-tertiary,#999);text-align:center}
-/* The spinner is the one thing that proves the UI is alive when the row under
-   it has not changed yet — which is precisely the confusion the veil exists to
-   remove. Reduced-motion users get the static ring instead of a rotation. */
-.dsm-workbuddy-veil-spinner{width:18px;height:18px;border:2px solid var(--dsw-alias-border-l2,#3a3d45);border-top-color:var(--dsw-alias-brand-primary,#5686fe);border-radius:50%;animation:dsm-workbuddy-veil-spin .7s linear infinite}
+   specific row change, and hiding it would defeat the point.
+
+   The mask and the card surface are the HOST's own tokens, not this file's
+   invention. --dsw-alias-bg-mask-1 + --dsw-mask-blur is exactly what the
+   host's own overlays use (see dsh-client-ui-settings-general's Dws9Sa_mask),
+   so the veil now dims the way every other overlay in the shell does instead
+   of laying its own black wash on top. The previous hardcoded rgba(0,0,0,.38)
+   was tuned against neither theme: too weak next to the host's .24 mask in
+   light mode, and it ignored the host's blur entirely.
+
+   bg-layer-2 (not bg-primary, which does not exist in the host's token set
+   at all and therefore always fell through to this file's near-black #1b1c20)
+   is the same surface the host puts behind its panels — that near-black fallback
+   is what made the veil read as a black slab with unreadable text on it. */
+.dsm-workbuddy-veil{position:fixed;inset:0;z-index:60;display:flex;align-items:center;justify-content:center;background:var(--dsw-alias-bg-mask-1,rgba(0,0,0,.32));backdrop-filter:var(--dsw-mask-blur);cursor:progress}
+/* --dsw-elevation-prominent is the host's own panel shadow (a hairline stroke
+   plus two soft layers); the previous 0 8px 28px rgba(0,0,0,.35) was a
+   hand-rolled drop shadow that read as a heavy grey box. */
+.dsm-workbuddy-veil-card{display:flex;flex-direction:column;align-items:center;gap:8px;max-width:min(340px,80vw);padding:16px 20px;border:1px solid var(--dsw-alias-border-l2,#0000001a);border-radius:12px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:var(--dsw-elevation-prominent,0 8px 28px rgba(0,0,0,.35))}
+.dsm-workbuddy-veil-text{font-size:13px;line-height:20px;color:var(--dsw-alias-label-primary,#0f1115);text-align:center}
+/* label-secondary, not label-tertiary: this line carries the operation's
+   detail and must stay legible. tertiary is the host's dimmest tier
+   (neutral-bluish-600 on light, neutral-bluish-400 on dark) and is meant
+   for metadata, not for a sentence the user has to read while waiting. */
+.dsm-workbuddy-veil-hint{font-size:12px;line-height:18px;color:var(--dsw-alias-label-secondary,#61666b);text-align:center}
+/* The spinner proves the UI is alive when the row under it has not changed yet
+   — which is precisely the confusion the veil exists to remove. It follows the
+   host's own state spinner (dsh's _dsh-state-dot-spin): an SVG arc whose
+   dash breathes while it turns, currentColor so it inherits the tier it sits
+   in, and the same 1.5s beat. The previous 18px border-ring at .7s was roughly
+   twice the host's speed and visibly out of step with every other spinner in
+   the shell — that mismatch, more than the shape itself, is what made it look
+   cheap.
+
+   Reduced-motion users get the static arc rather than a frozen ring, matching
+   how the host degrades its own spinner. */
+.dsm-workbuddy-veil-spinner{width:20px;height:20px;color:var(--dsw-alias-label-secondary,#61666b);animation:dsm-workbuddy-veil-spin 1.5s linear infinite}
+.dsm-workbuddy-veil-spinner-track{opacity:.25}
+.dsm-workbuddy-veil-spinner-arc{stroke-dasharray:12 150;animation:dsm-workbuddy-veil-dash 1.5s ease-in-out infinite}
 @keyframes dsm-workbuddy-veil-spin{to{transform:rotate(360deg)}}
-@media (prefers-reduced-motion: reduce){.dsm-workbuddy-veil-spinner{animation:none}}
+@keyframes dsm-workbuddy-veil-dash{0%{stroke-dasharray:12 150;stroke-dashoffset:0}50%{stroke-dasharray:24 150;stroke-dashoffset:-6}to{stroke-dasharray:12 150;stroke-dashoffset:0}}
+@media (prefers-reduced-motion: reduce){.dsm-workbuddy-veil-spinner{animation:none}.dsm-workbuddy-veil-spinner-arc{animation:none;stroke-dasharray:18 150;stroke-dashoffset:-3}}
 `;
 		/**
 		* Composer credit readout styles, injected by the readout component itself.
@@ -3979,6 +4185,39 @@ window.__ModuleLoader__.load({
 					accountName: account.accountName
 				}))
 			})] });
+			/**
+			* Sidebar credit line switch — ONE control, for the ACTIVE tab's region only.
+			*
+			* The two regions are independent providers with independent accounts, so
+			* each tab owns its own switch and they are never shown as a pair: this one
+			* writes `regions.<activeRegion>.showCreditsInMainUi`, which decides only
+			* whether THAT region's line appears in the sidebar. That matches how every
+			* other control in this card is scoped to the selected tab (account, pool,
+			* model list), and it means a CN-only user is never shown a switch for an
+			* account they do not have. An earlier revision rendered both boxes side by
+			* side under the tab bar regardless of the active tab; that read as one
+			* shared setting and was replaced.
+			*
+			* RENDERED BESIDE THE POOL HEADING, not on its own row. It used to occupy a
+			* full line of vertical space for a single checkbox; the pool heading already
+			* had a title-left / badge-right row, so the control fits there without the
+			* block growing. It is handed to `AccountPool` as a ready-made node purely so
+			* the two can share a flex row — the write path, the disabled rules and the
+			* serialization against the card's other region writers all stay here, where
+			* the settings scope and the save state live.
+			*/
+			const creditsSwitch = /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+				className: "dsm-workbuddy-credits-switch",
+				title: activeRegion === "cn" ? t("row.showCreditsCnHint") : t("row.showCreditsGlobalHint"),
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+					type: "checkbox",
+					checked: activeRegionOn ? creditsShownOn(activeRegion) : false,
+					disabled: !activeRegionOn || togglingCredits === activeRegion || !canWrite || saving || poolBusy,
+					onChange: (event) => {
+						toggleCredits(activeRegion, event.target.checked);
+					}
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: activeRegion === "cn" ? t("row.showCreditsCn") : t("row.showCreditsGlobal") })]
+			});
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
 				className: `dsm-plugin-card${open ? " dsm-plugin-card-open" : ""}`,
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
@@ -4063,18 +4302,6 @@ window.__ModuleLoader__.load({
 								className: "dsm-workbuddy-tab-off-notice",
 								children: t("row.tabOffNotice")
 							}) : null,
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-								className: "dsm-workbuddy-credits-switch",
-								title: activeRegion === "cn" ? t("row.showCreditsCnHint") : t("row.showCreditsGlobalHint"),
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-									type: "checkbox",
-									checked: activeRegionOn ? creditsShownOn(activeRegion) : false,
-									disabled: !activeRegionOn || togglingCredits === activeRegion || !canWrite || saving || poolBusy,
-									onChange: (event) => {
-										toggleCredits(activeRegion, event.target.checked);
-									}
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: activeRegion === "cn" ? t("row.showCreditsCn") : t("row.showCreditsGlobal") })]
-							}),
 							status.status === "error" || status.status === "signed-in" && status.creditsError !== void 0 ? status.status === "signed-in" && status.credentialRejected === true ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 								className: "dsm-workbuddy-usage-hint",
 								children: t("row.reloginHint")
@@ -4131,11 +4358,16 @@ window.__ModuleLoader__.load({
 									},
 									selectingAccount: switchingAccount,
 									accountTools,
+									...status.pool === void 0 ? {} : { headerExtra: creditsSwitch },
 									siblingBusy: saving || togglingRegion !== void 0,
 									onBusyChange: setPoolBusy,
 									onSaved: async () => await refreshUsage(activeRegion) !== void 0,
 									onRefresh: () => refreshUsage(activeRegion)
 								}),
+								status.pool === void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "dsm-workbuddy-credits-switch-row",
+									children: creditsSwitch
+								}) : null,
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("section", {
 									className: "dsm-workbuddy-models",
 									"aria-label": t("row.modelsTitle"),
@@ -5234,8 +5466,8 @@ window.__ModuleLoader__.load({
 			"row.poolRowRemoved": "{accountName}: hidden from the list. 「Detect accounts again」 re-adds it; the desktop app stays signed in.",
 			"row.poolRowRemoving": "Removing the account…",
 			"row.poolRowRemoveDesktopOnly": "{accountName}: hidden from the list — this account comes from the desktop app's own sign-in, which is left untouched. 「Detect accounts again」 re-adds it.",
-			"row.showCreditsCn": "Show WB CN credits in the composer",
-			"row.showCreditsGlobal": "Show WB AI credits in the composer",
+			"row.showCreditsCn": "WB CN credits in composer",
+			"row.showCreditsGlobal": "WB AI credits in composer",
 			"row.showCreditsCnHint": "Show the domestic (WB CN) credit balance in the composer toolbar, but only while this session uses a WB CN model. Click it for per-account balances and a manual refresh (refreshes by itself every 5 minutes).",
 			"row.showCreditsGlobalHint": "Show the international (WB AI) credit balance in the composer toolbar, but only while this session uses a WB AI model. Click it for per-account balances and a manual refresh (refreshes by itself every 5 minutes).",
 			"composer.pointsCn": "WB CN",
@@ -5494,8 +5726,8 @@ window.__ModuleLoader__.load({
 			"row.poolRowRemoved": "{accountName}：已从列表中隐藏。点「重新检测账号」会重新加入，桌面 App 的登录不受影响。",
 			"row.poolRowRemoving": "正在删除账号…",
 			"row.poolRowRemoveDesktopOnly": "{accountName}：已从列表中隐藏——这个账号来自桌面 App 自己的登录，该登录未被改动。点「重新检测账号」会重新加入。",
-			"row.showCreditsCn": "在对话框显示 WB CN 积分",
-			"row.showCreditsGlobal": "在对话框显示 WB AI 积分",
+			"row.showCreditsCn": "对话框显示 WB CN 积分",
+			"row.showCreditsGlobal": "对话框显示 WB AI 积分",
 			"row.showCreditsCnHint": "在对话输入框工具栏显示国内版（WB CN）剩余积分，仅当本会话使用 WB CN 模型时出现。点击可看各账号余额并手动刷新（每 5 分钟也会自动刷新）。",
 			"row.showCreditsGlobalHint": "在对话输入框工具栏显示国际版（WB AI）剩余积分，仅当本会话使用 WB AI 模型时出现。点击可看各账号余额并手动刷新（每 5 分钟也会自动刷新）。",
 			"composer.pointsCn": "WB CN",

package/lib/{host-heartbeat-DkdNZKKY.js → host-heartbeat-CBFAiYPg.js}

@@ -3611,9 +3611,10 @@ var WorkBuddyCatalog = class {
 * pi-ai into the standalone `doctor` CLI, which must also run from market
 * installs where NO local pi-ai exists and the module is only provided inside
 * the DSH host — a static import there is a load-time crash. Resolution
-* itself does not need the module: within the peer range, the manifest
-* version and the `normalizeContext` feature (present from 0.87 on, not
-* before) agree.
+* itself does not need the module: the manifest version and the
+* `normalizeContext` feature (present from 0.87 on, not before) agree across
+* `0.87+` AND `1.x` — 1.x is 0.87's successor and keeps the same normalized
+* transcript, so the split is `>= 0.87` rather than "within 0.x".
 *
 * When resolution FAILS — the normal state of a market install probed outside
 * the host — there is no local copy, so inside DSH the host supplies pi-ai.
@@ -3695,13 +3696,36 @@ function readVersion(moduleFile) {
 	}
 }
 /**
-* The generation a manifest version belongs to. Within the peer range
-* (<0.88.0) the split is exactly `0.87+` versus earlier; an unreadable
-* version conservatively reports `legacy` (and doctor shows it as
-* unreadable, so the guess is visible rather than silent).
+* The generation a manifest version belongs to.
+*
+* `0.87+` consumes normalized transcripts natively; earlier releases want the
+* 0.85 shape, so within the declared peer range the split is exactly `0.87+`
+* versus earlier. An unreadable version conservatively reports `legacy` (and
+* doctor shows it as unreadable, so the guess is visible rather than silent).
+*
+* The 1.x line MUST land on `modern`, and it is not a hypothetical: DSH
+* 0.2.1-alpha.2 ships `@earendil-works/pi-ai@1.0.2`, while npm currently
+* publishes 1.1.0. Both 0.87.1 and 1.0.2/1.1.0 read tools from the same place
+* (`context.messages` → the leading system message's `toolsAdded`; see
+* pi-ai's `resolveTranscriptTools`). Matching only `0.<minor>.` classified
+* 1.0.2 as `legacy`, so `withLegacyContext` folded the transcript into the
+* 0.85 shape — which moves the tool declarations to a top-level `tools` field
+* pi-ai 1.x never reads. Every request then went upstream with NO tools
+* declared: no model could emit a `toolCall`, and the domestic gateway, which
+* tolerates a prompt-less body, had the model write DSML markup into the answer
+* text instead. The host's compatibility gate does not catch this: it only
+* evaluates peers in the `@deepseek-ai/dsh*` namespace, so an out-of-range
+* `@earendil-works/pi-ai` peer is never enforced.
+*
+* Deliberately match major 1 only. This establishes compatibility for the
+* observed 1.x line (including current 1.1.0) without assuming an uninspected
+* future major such as 2.x keeps the same transcript contract. The declared
+* peer range remains the plugin's supported-version boundary.
 */
 function generationOf(version) {
 	if (version === void 0) return "legacy";
+	const major = /^(\d+)\./u.exec(version);
+	if (major !== null && Number(major[1]) === 1) return "modern";
 	const match = /^0\.(\d+)\./u.exec(version);
 	if (match === null) return "legacy";
 	return Number(match[1]) >= 87 ? "modern" : "legacy";
@@ -3709,7 +3733,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.3.4";
+const WORKBUDDY_CONNECT_VERSION = "4.4.2";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -1112,9 +1112,10 @@ declare function createWorkBuddyShim(options: WorkBuddyShimOptions): WorkBuddySh
  * pi-ai into the standalone `doctor` CLI, which must also run from market
  * installs where NO local pi-ai exists and the module is only provided inside
  * the DSH host — a static import there is a load-time crash. Resolution
- * itself does not need the module: within the peer range, the manifest
- * version and the `normalizeContext` feature (present from 0.87 on, not
- * before) agree.
+ * itself does not need the module: the manifest version and the
+ * `normalizeContext` feature (present from 0.87 on, not before) agree across
+ * `0.87+` AND `1.x` — 1.x is 0.87's successor and keeps the same normalized
+ * transcript, so the split is `>= 0.87` rather than "within 0.x".
  *
  * When resolution FAILS — the normal state of a market install probed outside
  * the host — there is no local copy, so inside DSH the host supplies pi-ai.

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as isWorkbuddyBundle, A as workbuddyAccountId, B as parseCreditMultiplier, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, H as parseUpstreamModel, I as classifyUpstreamError, J as deriveAtRestKeyId, K as clearAtRestKeyCache, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as isEncryptedFieldWrapper, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as prepareChatBody, V as parseReasoning, W as regionOf, X as findWorkbuddyAppExecutable, Y as fetchAtRestKeyPayload, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as writeFileAtomic, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as macosBundleExecutable, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as workbuddyAppExecutableCandidates, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as openEncryptedField, o as workbuddyHostHeartbeatPath, ot as resolveDshHome, p as applyContextBudgets, q as deriveAtRestKey, r as isHeartbeatProcessAlive, rt as readAtRestKey, s as writeHostHeartbeat, st as withFileLock, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosNestedAppBundles, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-DkdNZKKY.js";
+import { $ as isWorkbuddyBundle, A as workbuddyAccountId, B as parseCreditMultiplier, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, H as parseUpstreamModel, I as classifyUpstreamError, J as deriveAtRestKeyId, K as clearAtRestKeyCache, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as isEncryptedFieldWrapper, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as prepareChatBody, V as parseReasoning, W as regionOf, X as findWorkbuddyAppExecutable, Y as fetchAtRestKeyPayload, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as writeFileAtomic, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as macosBundleExecutable, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as workbuddyAppExecutableCandidates, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as openEncryptedField, o as workbuddyHostHeartbeatPath, ot as resolveDshHome, p as applyContextBudgets, q as deriveAtRestKey, r as isHeartbeatProcessAlive, rt as readAtRestKey, s as writeHostHeartbeat, st as withFileLock, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosNestedAppBundles, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-CBFAiYPg.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1308,6 +1308,15 @@ function readBody(req) {
 *      Once a native `delta.tool_calls` appears, recovery switches off for the
 *      rest of the response — two live call channels for one answer is worse
 *      than either one alone.
+*
+*   5. EVERY FRAME LEAVES SELF-CONTAINED. An SSE event ends at a blank line,
+*      and a frame written without its terminator merges into the NEXT event
+*      the client decodes — whose `data:` lines are then joined and parsed as
+*      one document (issue #53). Every write therefore goes through
+*      {@link emitFrame}, which completes the terminator; `push()` cuts frames
+*      that already carry it, and the one source of unterminated bytes — the
+*      half-frame left in `carry` when the upstream dies — is normalized in
+*      {@link consume}.
 */
 var RecoveryStream = class {
 	res;
@@ -1382,7 +1391,7 @@ var RecoveryStream = class {
 			finish_reason: ""
 		};
 		this.windowOpened = true;
-		this.res.write(contentFrame(chunk, choiceRecord, notice));
+		this.emitFrame(contentFrame(chunk, choiceRecord, notice));
 	}
 	/** True when a call or real prose has reached the client. */
 	get delivered() {
@@ -1392,6 +1401,43 @@ var RecoveryStream = class {
 	get residueSeen() {
 		return this.sawResidue;
 	}
+	/**
+	* The single exit every byte of a FRAME passes through.
+	*
+	* SSE dispatches one event per blank-line-terminated run of `data:` lines.
+	* A frame written WITHOUT its terminator leaves the client's decoder
+	* waiting for a blank line that never arrives, so the NEXT write is
+	* appended to the SAME event — and a client that joins the several `data:`
+	* lines of one event with `\n` and parses the result as one JSON document
+	* (openai's `SSEDecoder` does exactly that) then reads two payloads as one
+	* and fails. Issue #53 is that failure: the upstream died between a `data:`
+	* line and its blank line, `consume()` forwarded the half-frame verbatim,
+	* and `finish()` glued its synthetic `[DONE]` onto it, producing
+	* `data: {...}\ndata: [DONE]\n\n` — parsed as one event whose data is
+	* `"{...}\n[DONE]"`, which throws "Unexpected non-whitespace character
+	* after JSON at position N". The whole turn is then classified as a
+	* non-retryable error, so the user simply sees the answer stop.
+	*
+	* Completing the terminator here fixes both halves at once: the truncated
+	* frame becomes a self-contained event, and the `[DONE]` that follows can no
+	* longer be joined to it. It is idempotent for the frames `push()` cuts —
+	* those always carry the terminator already, so they pass through
+	* byte-for-byte, which keeps guarantee 1 (frame order is never changed)
+	* intact.
+	*
+	* Note that a missing NEWLINE is also completed: `data: {…}` cut mid-line
+	* needs the full `\n\n`, not a single `\n`, to close the event. Such a frame
+	* is upstream-corrupted JSON that cannot be repaired here; closing it at
+	* least keeps the corruption confined to its own event instead of taking
+	* the terminator down with it.
+	*/
+	emitFrame(frame) {
+		if (frame.endsWith("\n\n")) {
+			this.res.write(frame);
+			return;
+		}
+		this.res.write(frame.endsWith("\n") ? `${frame}\n` : `${frame}\n\n`);
+	}
 	/** Record that text the gates refused was seen (markup residue, not prose). */
 	noteResidue(seen) {
 		this.sawResidue ||= seen;
@@ -1407,7 +1453,10 @@ var RecoveryStream = class {
 		}
 		const tail = this.carry;
 		this.carry = "";
-		if (tail !== "") this.handleFrame(tail);
+		if (tail !== "") {
+			const lineTerminated = tail.endsWith("\n");
+			this.handleFrame(lineTerminated ? `${tail}\n` : `${tail}\n\n`);
+		}
 	}
 	/**
 	* Close the response: emit the block still unfinished at end-of-stream, then
@@ -1420,7 +1469,7 @@ var RecoveryStream = class {
 			this.emitContent(flushed.text);
 		}
 		this.closeWindow();
-		if (!this.sawDone && this.res.writable) this.res.write("data: [DONE]\n\n");
+		if (!this.sawDone && this.res.writable) this.emitFrame("data: [DONE]\n\n");
 		if (this.res.writable) this.res.end();
 	}
 	/** Drop held bytes without writing them (used when a retry replaced them). */
@@ -1498,7 +1547,7 @@ var RecoveryStream = class {
 			this.windowOpened = true;
 			this.flushNotice();
 			this.closeWindow();
-			this.res.write(frame);
+			this.emitFrame(frame);
 			this.wroteContent = true;
 			return;
 		}
@@ -1509,7 +1558,7 @@ var RecoveryStream = class {
 			this.send(callsFrame(chunk, choiceRecord, outcome.calls), false);
 			this.wroteContent = true;
 			this.closeWindow();
-			if (outcome.text !== "") this.res.write(contentFrame(chunk, choiceRecord, outcome.text));
+			if (outcome.text !== "") this.emitFrame(contentFrame(chunk, choiceRecord, outcome.text));
 			return;
 		}
 		this.noteResidue(!outcome.prose && outcome.text !== "");
@@ -1573,7 +1622,7 @@ var RecoveryStream = class {
 	/** Queue a frame while the window is open, or write it once it has closed. */
 	send(frame, final) {
 		if (this.windowClosed || !this.windowOpened) {
-			this.res.write(frame);
+			this.emitFrame(frame);
 			return;
 		}
 		const entry = {
@@ -1597,7 +1646,7 @@ var RecoveryStream = class {
 		this.windowClosed = true;
 		const pending = this.held;
 		this.held = [];
-		for (const entry of pending) this.res.write(entry.frame);
+		for (const entry of pending) this.emitFrame(entry.frame);
 	}
 };
 /** The SSE `data:` payload of one frame, or nothing when it carries none. */

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "4.3.4",
+  "version": "4.4.2",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",