dsh-vaultwarden 0.9.1 → 0.9.3

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to `dsh-vaultwarden` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.3] — 2026-10-21
+
+### 修复
+
+- 修复首次加载后侧栏一直停在占位块、下方留一大片空白的问题。根因是「读取资料夹」与「读取侧栏统计」被放在同一个 `Promise.all` 里：后者决定侧栏画什么，前者只用于「移动到文件夹」，但前者一旦挂住，就会把已经返回的统计一起扣住，侧栏因此永远停在"加载中"，而列表早已渲染出全部条目。
+- 两次读取改为各自结算：各带自己的超时，谁先到谁先渲染，互不等待。资料夹读取超时 5 秒，侧栏统计 6 秒（且整条重试链共用一个上限，不是每次尝试各算一遍）。
+- 统计读取失败时侧栏落到三个结构项并退出忙碌态，不再保留永远不会兑现的占位块。
+- 占位骨架条的颜色由背景层色改为宿主边框色：原先在白底面板上几乎不可见，一片空白看起来像空盒子而不是"加载中"。
+
+## [0.9.2] — 2026-10-21
+
+### 变更
+
+- 面板标题改为纯文字「凭据库」，去掉标题前的徽章；按钮改用不带动画的文字标签。
+- 标题字号由 17px 提升到 19px。
+- 侧栏与设置导航的分区徽章改为盾牌加锁孔，纯黑白，跟随主题明暗。
+
+### 修复
+
+- 修复标题与后面的版本号、GitHub 链接文字高度不齐的问题。
+- 修复 GitHub 链接内图标与文字未对齐的问题。
+
 ## [0.9.1] — 2026-10-21
 
 ### 修复

package/assets/badge/badge-tile.svg

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  dsh-vaultwarden — app tile
+  A dark rounded tile for launcher/app-icon slots, where the badge has to hold its own on a dark surface.
+
+  Elements
+    shield outline ..... a credential vault (Bitwarden's own mark is a shield)
+    keyhole ........... Bitwarden / Vaultwarden
+    orca .............. dsh's own whale wordmark
+    accent #175DDC .... Bitwarden brand blue
+
+  The whale is the real dsh mark: the single <path> from the host's frontend
+  bundle (viewBox 0 0 23.16 17.04), embedded verbatim rather than redrawn.
+  MIT, same as the plugin.
+-->
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96" width="96" height="96" role="img" aria-label="dsh-vaultwarden">
+  <title>dsh-vaultwarden</title>
+  <defs>
+    <linearGradient id="tile" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#262B33"/>
+      <stop offset="1" stop-color="#14171C"/>
+    </linearGradient>
+  </defs>
+  <rect x="2" y="2" width="92" height="92" rx="23" fill="url(#tile)"/>
+  <rect x="2" y="2" width="92" height="92" rx="23" fill="none" stroke="#333A44" stroke-width="1"/>
+  <path d="M48 10 L82 24 V52 C82 71 66 84 48 90 C30 84 14 71 14 52 V24 Z" transform="translate(6,4) scale(0.875)" fill="none" stroke="#FFFFFF" stroke-width="4.4" stroke-linejoin="round"/>
+  <circle cx="48" cy="32" r="5.6" fill="#FFFFFF"/>
+   <path d="M44 36.4 L52 36.4 L54.6 47 L41.4 47 Z" fill="#FFFFFF"/>
+  <g transform="translate(32,53)"><svg width="32" height="23.54" viewBox="0 0 23.16 17.04" fill="#175DDC" overflow="visible"><path d="M22.9168 1.43018C22.6713 1.31018 22.5658 1.53918 22.4223 1.65519C22.3733 1.69269 22.3318 1.74169 22.2903 1.78669C21.9317 2.1697 21.5127 2.42121 20.9657 2.39121C20.1657 2.34621 19.4827 2.59771 18.8787 3.20973C18.7502 2.45521 18.3236 2.0047 17.6746 1.71569C17.3351 1.56568 16.9916 1.41518 16.7536 1.08867C16.5876 0.856163 16.5421 0.597155 16.4591 0.341647C16.4061 0.187643 16.3536 0.0301382 16.1761 0.00363739C15.9836 -0.0263635 15.9081 0.135141 15.8326 0.270145C15.5306 0.822162 15.4136 1.43018 15.4251 2.0462C15.4516 3.43174 16.0366 4.53527 17.1991 5.3203C17.3311 5.4103 17.3651 5.5003 17.3236 5.63181C17.2441 5.90231 17.1501 6.16482 17.0671 6.43533C17.0141 6.60784 16.9351 6.64584 16.7501 6.57033C16.1121 6.30383 15.5611 5.90931 15.074 5.4328C14.2475 4.63328 13.5 3.75075 12.568 3.05973C12.349 2.89822 12.13 2.74822 11.9034 2.60522C10.9524 1.68169 12.028 0.923165 12.277 0.833162C12.5375 0.739159 12.3675 0.41615 11.5259 0.42015C10.6844 0.42365 9.91439 0.705658 8.93286 1.08117C8.78935 1.13767 8.63835 1.17867 8.48384 1.21267C7.59332 1.04367 6.66829 1.00617 5.70226 1.11517C3.88321 1.31768 2.43016 2.1777 1.36213 3.64575C0.0790928 5.4103 -0.222916 7.41536 0.146595 9.50642C0.535106 11.7105 1.66014 13.535 3.38869 14.9616C5.18125 16.4406 7.24581 17.1657 9.60138 17.0266C11.0319 16.9441 12.6245 16.7526 14.421 15.2321C14.874 15.4576 15.3496 15.5476 16.1381 15.6151C16.7456 15.6716 17.3306 15.5851 17.7836 15.4911C18.4931 15.3411 18.4441 14.6841 18.1876 14.5636C16.1081 13.595 16.5646 13.9891 16.1496 13.67C17.2061 12.42 18.8202 10.1979 19.3182 7.17235C19.3672 6.83834 19.4297 6.36783 19.4222 6.09732C19.4182 5.93231 19.4562 5.86831 19.6447 5.84931C20.1657 5.78931 20.6712 5.64681 21.1357 5.3913C22.4833 4.65528 23.0268 3.44624 23.1548 1.9972C23.1738 1.77569 23.1508 1.54668 22.9168 1.43018ZM11.1749 14.4736C9.15936 12.889 8.18184 12.3675 7.77832 12.39C7.40081 12.4125 7.46881 12.8445 7.55182 13.126C7.63882 13.404 7.75182 13.5955 7.91033 13.8396C8.01983 14.0011 8.09533 14.2411 7.80083 14.4216C7.15181 14.8231 6.02327 14.2866 5.97027 14.2601C4.65673 13.4865 3.5587 12.4655 2.78467 11.069C2.03715 9.72493 1.60314 8.28289 1.53164 6.74384C1.51264 6.37233 1.62214 6.24082 1.99215 6.17332C2.47916 6.08332 2.98118 6.06432 3.46769 6.13582C5.52476 6.43633 7.27581 7.35586 8.74385 8.8129C9.58188 9.64243 10.2159 10.634 10.8689 11.6025C11.5634 12.631 12.3105 13.611 13.262 14.4146C13.598 14.6961 13.866 14.9101 14.1225 15.0681C13.349 15.1546 12.058 15.1731 11.1749 14.4746L11.1749 14.4736ZM12.141 8.25988C12.141 8.09488 12.273 7.96338 12.439 7.96338C12.4765 7.96338 12.5105 7.97088 12.541 7.98188C12.5825 7.99688 12.6205 8.01938 12.6505 8.05338C12.7035 8.10588 12.7335 8.18088 12.7335 8.25988C12.7335 8.42489 12.6015 8.55639 12.4355 8.55639C12.2695 8.55639 12.141 8.42489 12.141 8.25988ZM15.1415 9.79893C14.949 9.87793 14.7565 9.94544 14.5715 9.95294C14.2845 9.96794 13.9715 9.85143 13.8015 9.70893C13.5375 9.48742 13.3485 9.36342 13.2695 8.97691C13.2355 8.8119 13.2545 8.55639 13.2845 8.40989C13.3525 8.09438 13.277 7.89187 13.0545 7.70787C12.8735 7.55786 12.643 7.51636 12.39 7.51636C12.2955 7.51636 12.209 7.47486 12.1445 7.44136C12.039 7.38886 11.9519 7.25735 12.035 7.09585C12.0615 7.04335 12.19 6.91584 12.22 6.89334C12.5635 6.69784 12.9595 6.76184 13.326 6.90834C13.6655 7.04735 13.9225 7.30236 14.292 7.66287C14.6695 8.09838 14.7375 8.21838 14.9525 8.54539C15.1225 8.8009 15.277 9.06341 15.3831 9.36392C15.4471 9.55142 15.3641 9.70493 15.1415 9.79893Z"/></svg></g>
+</svg>

package/assets/badge/badge-white.svg

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  dsh-vaultwarden — badge, white shield
+  For a coloured or photographic background where a tint would disappear.
+
+  Elements
+    shield outline ..... a credential vault (Bitwarden's own mark is a shield)
+    keyhole ........... Bitwarden / Vaultwarden
+    orca .............. dsh's own whale wordmark
+    accent #175DDC .... Bitwarden brand blue
+
+  The whale is the real dsh mark: the single <path> from the host's frontend
+  bundle (viewBox 0 0 23.16 17.04), embedded verbatim rather than redrawn.
+  MIT, same as the plugin.
+-->
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96" width="96" height="96" role="img" aria-label="dsh-vaultwarden">
+  <title>dsh-vaultwarden</title>
+  <path d="M48 10 L82 24 V52 C82 71 66 84 48 90 C30 84 14 71 14 52 V24 Z" fill="#FFFFFF" stroke="#1F2328" stroke-width="3.2" stroke-linejoin="round"/>
+  <circle cx="48" cy="30" r="6" fill="#1F2328"/>
+   <path d="M44 34.8 L52 34.8 L54.6 47 L41.4 47 Z" fill="#1F2328"/>
+  <g transform="translate(31,53)"><svg width="34" height="25.02" viewBox="0 0 23.16 17.04" fill="#175DDC" overflow="visible"><path d="M22.9168 1.43018C22.6713 1.31018 22.5658 1.53918 22.4223 1.65519C22.3733 1.69269 22.3318 1.74169 22.2903 1.78669C21.9317 2.1697 21.5127 2.42121 20.9657 2.39121C20.1657 2.34621 19.4827 2.59771 18.8787 3.20973C18.7502 2.45521 18.3236 2.0047 17.6746 1.71569C17.3351 1.56568 16.9916 1.41518 16.7536 1.08867C16.5876 0.856163 16.5421 0.597155 16.4591 0.341647C16.4061 0.187643 16.3536 0.0301382 16.1761 0.00363739C15.9836 -0.0263635 15.9081 0.135141 15.8326 0.270145C15.5306 0.822162 15.4136 1.43018 15.4251 2.0462C15.4516 3.43174 16.0366 4.53527 17.1991 5.3203C17.3311 5.4103 17.3651 5.5003 17.3236 5.63181C17.2441 5.90231 17.1501 6.16482 17.0671 6.43533C17.0141 6.60784 16.9351 6.64584 16.7501 6.57033C16.1121 6.30383 15.5611 5.90931 15.074 5.4328C14.2475 4.63328 13.5 3.75075 12.568 3.05973C12.349 2.89822 12.13 2.74822 11.9034 2.60522C10.9524 1.68169 12.028 0.923165 12.277 0.833162C12.5375 0.739159 12.3675 0.41615 11.5259 0.42015C10.6844 0.42365 9.91439 0.705658 8.93286 1.08117C8.78935 1.13767 8.63835 1.17867 8.48384 1.21267C7.59332 1.04367 6.66829 1.00617 5.70226 1.11517C3.88321 1.31768 2.43016 2.1777 1.36213 3.64575C0.0790928 5.4103 -0.222916 7.41536 0.146595 9.50642C0.535106 11.7105 1.66014 13.535 3.38869 14.9616C5.18125 16.4406 7.24581 17.1657 9.60138 17.0266C11.0319 16.9441 12.6245 16.7526 14.421 15.2321C14.874 15.4576 15.3496 15.5476 16.1381 15.6151C16.7456 15.6716 17.3306 15.5851 17.7836 15.4911C18.4931 15.3411 18.4441 14.6841 18.1876 14.5636C16.1081 13.595 16.5646 13.9891 16.1496 13.67C17.2061 12.42 18.8202 10.1979 19.3182 7.17235C19.3672 6.83834 19.4297 6.36783 19.4222 6.09732C19.4182 5.93231 19.4562 5.86831 19.6447 5.84931C20.1657 5.78931 20.6712 5.64681 21.1357 5.3913C22.4833 4.65528 23.0268 3.44624 23.1548 1.9972C23.1738 1.77569 23.1508 1.54668 22.9168 1.43018ZM11.1749 14.4736C9.15936 12.889 8.18184 12.3675 7.77832 12.39C7.40081 12.4125 7.46881 12.8445 7.55182 13.126C7.63882 13.404 7.75182 13.5955 7.91033 13.8396C8.01983 14.0011 8.09533 14.2411 7.80083 14.4216C7.15181 14.8231 6.02327 14.2866 5.97027 14.2601C4.65673 13.4865 3.5587 12.4655 2.78467 11.069C2.03715 9.72493 1.60314 8.28289 1.53164 6.74384C1.51264 6.37233 1.62214 6.24082 1.99215 6.17332C2.47916 6.08332 2.98118 6.06432 3.46769 6.13582C5.52476 6.43633 7.27581 7.35586 8.74385 8.8129C9.58188 9.64243 10.2159 10.634 10.8689 11.6025C11.5634 12.631 12.3105 13.611 13.262 14.4146C13.598 14.6961 13.866 14.9101 14.1225 15.0681C13.349 15.1546 12.058 15.1731 11.1749 14.4746L11.1749 14.4736ZM12.141 8.25988C12.141 8.09488 12.273 7.96338 12.439 7.96338C12.4765 7.96338 12.5105 7.97088 12.541 7.98188C12.5825 7.99688 12.6205 8.01938 12.6505 8.05338C12.7035 8.10588 12.7335 8.18088 12.7335 8.25988C12.7335 8.42489 12.6015 8.55639 12.4355 8.55639C12.2695 8.55639 12.141 8.42489 12.141 8.25988ZM15.1415 9.79893C14.949 9.87793 14.7565 9.94544 14.5715 9.95294C14.2845 9.96794 13.9715 9.85143 13.8015 9.70893C13.5375 9.48742 13.3485 9.36342 13.2695 8.97691C13.2355 8.8119 13.2545 8.55639 13.2845 8.40989C13.3525 8.09438 13.277 7.89187 13.0545 7.70787C12.8735 7.55786 12.643 7.51636 12.39 7.51636C12.2955 7.51636 12.209 7.47486 12.1445 7.44136C12.039 7.38886 11.9519 7.25735 12.035 7.09585C12.0615 7.04335 12.19 6.91584 12.22 6.89334C12.5635 6.69784 12.9595 6.76184 13.326 6.90834C13.6655 7.04735 13.9225 7.30236 14.292 7.66287C14.6695 8.09838 14.7375 8.21838 14.9525 8.54539C15.1225 8.8009 15.277 9.06341 15.3831 9.36392C15.4471 9.55142 15.3641 9.70493 15.1415 9.79893Z"/></svg></g>
+</svg>

package/assets/badge/badge.svg

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  dsh-vaultwarden — badge
+  The primary badge. Tinted shield, ink keyhole, blue orca.
+
+  Elements
+    shield outline ..... a credential vault (Bitwarden's own mark is a shield)
+    keyhole ........... Bitwarden / Vaultwarden
+    orca .............. dsh's own whale wordmark
+    accent #175DDC .... Bitwarden brand blue
+
+  The whale is the real dsh mark: the single <path> from the host's frontend
+  bundle (viewBox 0 0 23.16 17.04), embedded verbatim rather than redrawn.
+  MIT, same as the plugin.
+-->
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96" width="96" height="96" role="img" aria-label="dsh-vaultwarden">
+  <title>dsh-vaultwarden</title>
+  <path d="M48 10 L82 24 V52 C82 71 66 84 48 90 C30 84 14 71 14 52 V24 Z" fill="#E7EDFB" stroke="#1F2328" stroke-width="3.2" stroke-linejoin="round"/>
+  <circle cx="48" cy="30" r="6" fill="#1F2328"/>
+   <path d="M44 34.8 L52 34.8 L54.6 47 L41.4 47 Z" fill="#1F2328"/>
+  <g transform="translate(31,53)"><svg width="34" height="25.02" viewBox="0 0 23.16 17.04" fill="#175DDC" overflow="visible"><path d="M22.9168 1.43018C22.6713 1.31018 22.5658 1.53918 22.4223 1.65519C22.3733 1.69269 22.3318 1.74169 22.2903 1.78669C21.9317 2.1697 21.5127 2.42121 20.9657 2.39121C20.1657 2.34621 19.4827 2.59771 18.8787 3.20973C18.7502 2.45521 18.3236 2.0047 17.6746 1.71569C17.3351 1.56568 16.9916 1.41518 16.7536 1.08867C16.5876 0.856163 16.5421 0.597155 16.4591 0.341647C16.4061 0.187643 16.3536 0.0301382 16.1761 0.00363739C15.9836 -0.0263635 15.9081 0.135141 15.8326 0.270145C15.5306 0.822162 15.4136 1.43018 15.4251 2.0462C15.4516 3.43174 16.0366 4.53527 17.1991 5.3203C17.3311 5.4103 17.3651 5.5003 17.3236 5.63181C17.2441 5.90231 17.1501 6.16482 17.0671 6.43533C17.0141 6.60784 16.9351 6.64584 16.7501 6.57033C16.1121 6.30383 15.5611 5.90931 15.074 5.4328C14.2475 4.63328 13.5 3.75075 12.568 3.05973C12.349 2.89822 12.13 2.74822 11.9034 2.60522C10.9524 1.68169 12.028 0.923165 12.277 0.833162C12.5375 0.739159 12.3675 0.41615 11.5259 0.42015C10.6844 0.42365 9.91439 0.705658 8.93286 1.08117C8.78935 1.13767 8.63835 1.17867 8.48384 1.21267C7.59332 1.04367 6.66829 1.00617 5.70226 1.11517C3.88321 1.31768 2.43016 2.1777 1.36213 3.64575C0.0790928 5.4103 -0.222916 7.41536 0.146595 9.50642C0.535106 11.7105 1.66014 13.535 3.38869 14.9616C5.18125 16.4406 7.24581 17.1657 9.60138 17.0266C11.0319 16.9441 12.6245 16.7526 14.421 15.2321C14.874 15.4576 15.3496 15.5476 16.1381 15.6151C16.7456 15.6716 17.3306 15.5851 17.7836 15.4911C18.4931 15.3411 18.4441 14.6841 18.1876 14.5636C16.1081 13.595 16.5646 13.9891 16.1496 13.67C17.2061 12.42 18.8202 10.1979 19.3182 7.17235C19.3672 6.83834 19.4297 6.36783 19.4222 6.09732C19.4182 5.93231 19.4562 5.86831 19.6447 5.84931C20.1657 5.78931 20.6712 5.64681 21.1357 5.3913C22.4833 4.65528 23.0268 3.44624 23.1548 1.9972C23.1738 1.77569 23.1508 1.54668 22.9168 1.43018ZM11.1749 14.4736C9.15936 12.889 8.18184 12.3675 7.77832 12.39C7.40081 12.4125 7.46881 12.8445 7.55182 13.126C7.63882 13.404 7.75182 13.5955 7.91033 13.8396C8.01983 14.0011 8.09533 14.2411 7.80083 14.4216C7.15181 14.8231 6.02327 14.2866 5.97027 14.2601C4.65673 13.4865 3.5587 12.4655 2.78467 11.069C2.03715 9.72493 1.60314 8.28289 1.53164 6.74384C1.51264 6.37233 1.62214 6.24082 1.99215 6.17332C2.47916 6.08332 2.98118 6.06432 3.46769 6.13582C5.52476 6.43633 7.27581 7.35586 8.74385 8.8129C9.58188 9.64243 10.2159 10.634 10.8689 11.6025C11.5634 12.631 12.3105 13.611 13.262 14.4146C13.598 14.6961 13.866 14.9101 14.1225 15.0681C13.349 15.1546 12.058 15.1731 11.1749 14.4746L11.1749 14.4736ZM12.141 8.25988C12.141 8.09488 12.273 7.96338 12.439 7.96338C12.4765 7.96338 12.5105 7.97088 12.541 7.98188C12.5825 7.99688 12.6205 8.01938 12.6505 8.05338C12.7035 8.10588 12.7335 8.18088 12.7335 8.25988C12.7335 8.42489 12.6015 8.55639 12.4355 8.55639C12.2695 8.55639 12.141 8.42489 12.141 8.25988ZM15.1415 9.79893C14.949 9.87793 14.7565 9.94544 14.5715 9.95294C14.2845 9.96794 13.9715 9.85143 13.8015 9.70893C13.5375 9.48742 13.3485 9.36342 13.2695 8.97691C13.2355 8.8119 13.2545 8.55639 13.2845 8.40989C13.3525 8.09438 13.277 7.89187 13.0545 7.70787C12.8735 7.55786 12.643 7.51636 12.39 7.51636C12.2955 7.51636 12.209 7.47486 12.1445 7.44136C12.039 7.38886 11.9519 7.25735 12.035 7.09585C12.0615 7.04335 12.19 6.91584 12.22 6.89334C12.5635 6.69784 12.9595 6.76184 13.326 6.90834C13.6655 7.04735 13.9225 7.30236 14.292 7.66287C14.6695 8.09838 14.7375 8.21838 14.9525 8.54539C15.1225 8.8009 15.277 9.06341 15.3831 9.36392C15.4471 9.55142 15.3641 9.70493 15.1415 9.79893Z"/></svg></g>
+</svg>

package/assets/badge/index.html

@@ -0,0 +1,32 @@
+<!doctype html><html><head><meta charset="utf-8"><style>
+*{box-sizing:border-box} body{margin:0;padding:18px;background:#f6f7f9;font:13px system-ui;color:#1f2328}
+.grid{display:flex;gap:16px;flex-wrap:wrap;align-items:flex-start}
+.cell{background:#fff;border:1px solid #e3e5e8;border-radius:14px;padding:14px;display:flex;flex-direction:column;align-items:center;gap:12px}
+.big img{display:block;width:160px;height:160px}
+.small{display:flex;gap:8px;align-items:flex-end}
+.small img{display:block}
+.n{font-size:11px;color:#666;font-family:ui-monospace,monospace}
+.dark{background:#1F2328;padding:16px;border-radius:14px;display:flex;gap:16px;align-items:center;margin-top:16px}
+</style></head><body>
+<div class="grid">
+  <div class="cell"><div class="big"><img src="badge.svg"></div>
+    <div class="small">
+      <img src="badge.svg" width="64" height="64"><img src="badge.svg" width="48" height="48">
+      <img src="badge.svg" width="32" height="32"><img src="badge.svg" width="24" height="24">
+      <img src="badge.svg" width="16" height="16">
+    </div><div class="n">badge.svg</div></div>
+  <div class="cell"><div class="big"><img src="badge-white.svg"></div>
+    <div class="small">
+      <img src="badge-white.svg" width="64" height="64"><img src="badge-white.svg" width="48" height="48">
+      <img src="badge-white.svg" width="32" height="32"><img src="badge-white.svg" width="24" height="24">
+      <img src="badge-white.svg" width="16" height="16">
+    </div><div class="n">badge-white.svg</div></div>
+</div>
+<div class="dark"><span style="font-size:11px;color:#8A9099">深色底 badge-tile.svg：</span>
+  <img src="badge-tile.svg" width="96" height="96">
+  <img src="badge-tile.svg" width="48" height="48">
+  <img src="badge-tile.svg" width="32" height="32">
+  <img src="badge-tile.svg" width="24" height="24">
+  <img src="badge-tile.svg" width="16" height="16">
+</div>
+</body></html>

package/lib/client.js

@@ -396,7 +396,7 @@ const nextOffsetOf = (payload, fallback) => {
      * `scripts/build.sh` stamps both constants from package.json on every
      * build, so this fallback is never hand-maintained and cannot drift.
      */
-    const BUILD_VERSION = '0.9.1'
+    const BUILD_VERSION = '0.9.3'
     const BUILD_REPOSITORY = 'https://github.com/BuvkB/dsh-vaultwarden'
     /**
      * Turn a package.json repository url into something a browser can open.
@@ -415,7 +415,7 @@ const nextOffsetOf = (payload, fallback) => {
 
     // ── dictionaries (zh first; en mirrors the same keys) ─────────────────────
     const DICT_ZH = {
-      panelTitle: 'Vaultwarden 凭据库',
+      panelTitle: '凭据库',
       // The heading is now three parts: a 凭据库 badge (its own key, shared with
       // the settings nav), the package name, then the version and repo link in
       // small type.
@@ -720,7 +720,7 @@ const nextOffsetOf = (payload, fallback) => {
       sessionEventTwoFactor: '后台重新登录需要两步验证',
     }
     const DICT_EN = {
-      panelTitle: 'Vaultwarden credentials',
+      panelTitle: 'Credentials',
       packageLabel: 'dsh-vaultwarden',
       versionLabel: 'v{version}',
       repoLabel: 'GitHub',
@@ -1242,8 +1242,21 @@ const nextOffsetOf = (payload, fallback) => {
        * piece and the metadata follows it — rather than a package name stranded
        * on line one above a version on line two.
        */
-      titleHead: { display: 'inline-flex', alignItems: 'baseline', gap: 7, minWidth: 0, whiteSpace: 'nowrap' },
-      titleText: { fontSize: 16, fontWeight: 600, letterSpacing: 0.1, color: TOKEN.text },
+      // `baseline`: this group is pure text now (the mark lives on the settings
+      // rail), and two sizes on one line have to sit on a shared baseline. With
+      // `center` the 17px heading centred against the 12.5px metadata's line box
+      // and hung a pixel low — visible as the heading looking dropped against
+      // its own metadata.
+      titleHead: { display: 'inline-flex', alignItems: 'baseline', gap: 4, minWidth: 0, whiteSpace: 'nowrap' },
+      // 17px, not 16: the heading is the one line a reader lands on when the
+      // panel opens, and at 16 it sat only half a step above the 13.5px list
+      // rows beside it. 17 with a 0.1 tracking keeps it a heading without
+      // turning it into a banner.
+      // 19px, and lifted 2px off the shared baseline: a 19px CJK glyph puts its
+      // ink about 2px lower than the 12.5px Latin x-height beside it even when
+      // both sit on the same baseline, which reads as the heading being dropped.
+      // The lift is optical, not structural — measured against the live DOM.
+      titleText: { fontSize: 19, fontWeight: 600, letterSpacing: 0.1, color: TOKEN.text, position: 'relative', top: -2 },
       /**
        * The package name: secondary grey, regular weight.
        *
@@ -1260,11 +1273,18 @@ const nextOffsetOf = (payload, fallback) => {
        * whole; without it the version could end a line and the link start the
        * next, which reads as two unrelated notes rather than one.
        */
-      titleMeta: { display: 'inline-flex', alignItems: 'center', gap: 5, minWidth: 0, whiteSpace: 'nowrap' },
+      // `baseline`, not `center`: the group mixes 12.5px (the package) with
+      // 11.5px (version, link) and 2px dots. Centring each item in the line box
+      // puts their optical centres together but leaves their baselines apart, so
+      // the row reads as slightly staggered letters. A shared baseline is what
+      // makes mixed sizes look set rather than assembled.
+      titleMeta: { display: 'inline-flex', alignItems: 'baseline', gap: 5, minWidth: 0, whiteSpace: 'nowrap' },
       /** The build number: monospace digits so a version never shifts the row. */
       titleVersion: { fontSize: 11.5, color: TOKEN.text2, fontVariantNumeric: 'tabular-nums', letterSpacing: 0.05 },
       /** The separator between version and link — the host's own 2px caption dot. */
-      titleDot: { width: 2, height: 2, borderRadius: 1, background: TOKEN.text2, opacity: 0.55, flex: 'none' },
+      // A dot has no baseline of its own, so it is nudged up to the optical
+      // middle of the text beside it when the row is baseline-aligned.
+      titleDot: { width: 2, height: 2, borderRadius: 1, background: TOKEN.text2, opacity: 0.55, flex: 'none', alignSelf: 'center' },
       /**
        * The repo link. Underlined only on hover: an always-underlined link next
        * to the heading reads as a mis-styled title.
@@ -1277,9 +1297,12 @@ const nextOffsetOf = (payload, fallback) => {
        */
       titleLink: {
         display: 'inline-flex',
-        alignItems: 'center',
+        // `baseline`, not `center`: the label is text and has to sit on the
+        // row's baseline like the package name and the version beside it. The
+        // mark inside is nudged back to the text's optical centre below.
+        alignItems: 'baseline',
         gap: 4,
-        fontSize: 11.5,
+        fontSize: 12.5,
         color: TOKEN.text2,
         textDecoration: 'none',
         cursor: 'pointer',
@@ -1686,7 +1709,13 @@ const nextOffsetOf = (payload, fallback) => {
        * The pulse is in the stylesheet, so a reader who asked for reduced motion
        * gets a static bar rather than a blinking one.
        */
-      skeletonBar: { height: 10, borderRadius: 999, background: TOKEN.bg2, flex: 'none' },
+      // The host's border colour, not `bg2`. `bg2` is a layer tint (#f5f5f5 on
+      // a white surface), and a bar painted in it is invisible on the panel's
+      // own background: the rail then reads as an empty box rather than as
+      // "still loading". The border token is by definition visible against the
+      // surface it borders, in both themes, and no browser-support question
+      // attaches to it the way it would to a colour mix.
+      skeletonBar: { height: 10, borderRadius: 999, background: TOKEN.border, flex: 'none' },
       /** A skeleton line: bar + optional label column, one per field row. */
       skeletonField: { display: 'grid', gridTemplateColumns: '92px minmax(0, 1fr) 28px', gap: 12, alignItems: 'center' },
       /** The list's own placeholder row: avatar tile + two bars + the chevron slot. */
@@ -1929,7 +1958,9 @@ const nextOffsetOf = (payload, fallback) => {
    every other row's text sits — no measured offsets, no negative margins
    that could push the label out of its cell on a tight layout. */
 .vw-nav-label { display: inline-flex; align-items: center; gap: 8px; min-width: 0 }
-.vw-nav-glyph { flex: none; width: 16px; height: 16px; color: inherit }
+/* 18px, matching the component's own default: the badge is a two-shape mark and
+   its plate needs the extra 2px to stay separate from the shield at this size. */
+.vw-nav-glyph { flex: none; width: 18px; height: 18px; color: inherit }
 .vw-nav-text { white-space: nowrap }
 /* The sidebar's own hover: its rows carry no border, so the shared button
    hover (which only moves a border colour) would say nothing there. */
@@ -2112,10 +2143,12 @@ const nextOffsetOf = (payload, fallback) => {
   .vw-root [data-vw-detail] { padding: 16px !important }
   .vw-root [data-row] { padding: 10px 12px !important; gap: 10px !important }
   /* The settings nav becomes a tight tab strip here (dsh-web-mobile packs
-     its cells at padding 6px 8px, gap 6px, 14px icons); the glyph follows
-     the host's metrics so the row keeps its rhythm. */
+     its cells at padding 6px 8px, gap 6px, 14px icons). The glyph follows the
+     strip's rhythm but stays at 17px rather than the 14px host icons: the
+     shield's keyhole closes up below that, and this row is the one place the
+     mark is the only thing identifying the section. */
   .vw-nav-label { gap: 6px }
-  .vw-nav-glyph { width: 14px; height: 14px }
+  .vw-nav-glyph { width: 17px; height: 17px }
 }
 `
       document.head.appendChild(style)
@@ -2128,37 +2161,45 @@ const nextOffsetOf = (payload, fallback) => {
      * `currentColor` at the sizes the host chrome uses, so it follows the
      * label colour instead of being painted blue everywhere.
      */
-    const VaultGlyph = ({ className, size = 16 }) =>
+    const VaultGlyph = ({ className, size = 18 }) =>
       h(
         'svg',
         {
           className,
           width: size,
           height: size,
-          // Same 24-unit grid and 1.7 stroke as NAV_ICON_SHAPES: this glyph
-          // sits in the settings rail right beside host rows, so it has to
-          // draw at the same optical weight as the family it belongs to.
-          // The host's icon language, same as NAV_ICON_SHAPES: 16 grid, 1px
-          // stroke, default joins, and a 0.16 fill where the mark needs a
-          // body. This glyph sits in the settings rail beside host rows, so it
-          // has to draw at the host's own weight.
+          // The plugin's badge: a shield outline with a solid keyhole.
+          //
+          // Two marks, one axis. Earlier passes added the dsh prompt to this —
+          // first on a filled plate, then as a bare `>_` — and every version
+          // failed the same way: three shapes in a 16-unit box have no room to
+          // agree on a centre, so the mark read as scattered rather than
+          // composed. The prompt is gone; what is left is the two things that
+          // any password manager's own icon carries, both centred on x=8 and
+          // both sized to leave the same air on every side.
+          //
+          // Monochrome through `currentColor`, so it follows the rail's ink and
+          // flips with the theme.
           viewBox: '0 0 16 16',
           fill: 'none',
-          stroke: 'currentColor',
-          strokeWidth: 1,
           'aria-hidden': 'true',
           focusable: 'false',
         },
-        // A shield has to be TALLER than wide, or it reads as a stubby badge:
-        // the previous outline spanned 13 × 13.65 — close enough to a square
-        // that the silhouette lost the shape's one defining proportion. This
-        // one is 11 wide × 13.8 tall (≈1:1.25, the ratio a heraldic shield
-        // actually uses) and reaches the top of the box, so it sits level with
-        // the 16px text beside it at 18px.
-        h('path', { d: 'M8 1.1L13.5 3.6V7.55C13.5 11.2 11.2 13.75 8 14.9C4.8 13.75 2.5 11.2 2.5 7.55V3.6L8 1.1Z', fill: 'currentColor', fillOpacity: 0.16 }),
-        // The keyhole is scaled to the narrower body: a 1.55 radius bow over a
-        // 1.3-wide shaft, centred on the same x=8 as the outline.
-        h('path', { d: 'M8 5.05C8.86 5.05 9.55 5.74 9.55 6.6C9.55 7.25 9.18 7.81 8.65 8.08V10.1H7.35V8.08C6.82 7.81 6.45 7.25 6.45 6.6C6.45 5.74 7.14 5.05 8 5.05Z', fill: 'currentColor', stroke: 'none' }),
+        // The shield: outline only, 1.3 stroke. Symmetric about x=8, and its
+        // outer box is inset 1 unit on every side so the stroke never clips.
+        h('path', {
+          d: 'M8 0.5 L13.2 2.85 V7.15 C13.2 10.6 11.1 13 8 14.3 C4.9 13 2.8 10.6 2.8 7.15 V2.85 Z',
+          fill: 'none',
+          stroke: 'currentColor',
+          strokeWidth: 1.3,
+          strokeLinejoin: 'round',
+        }),
+        // The keyhole: a round bow over a tapered shaft, centred on the same
+        // axis as the shield. Proportions are the ones a physical keyhole
+        // actually has — the bow is about half the shaft's height and the taper
+        // runs 1:2 — which is what keeps it from reading as a lollipop.
+        h('circle', { cx: 8, cy: 5.4, r: 1.4, fill: 'currentColor' }),
+        h('path', { d: 'M7.33 6.17 H8.67 L9.6 8.9 H6.4 Z', fill: 'currentColor' }),
       )
 
     /**
@@ -2697,6 +2738,34 @@ const nextOffsetOf = (payload, fallback) => {
       return /load failed|failed to fetch|networkerror|network error|fetch failed/i.test(text)
     }
 
+    /**
+     * Put a ceiling on one read.
+     *
+     * A promise that never settles is worse than one that rejects: `await`
+     * simply waits, so a request the host never answers — a request dropped by a
+     * captive portal, a socket the phone's radio parked until the tab wakes —
+     * leaves the sidebar shimmering with no rows and no error, which is the
+     * one failure mode the reader cannot act on. The timeout turns that into an
+     * ordinary rejection so the caller's existing fallback runs.
+     *
+     * Silent by construction: the timeout rejects with the same shape a failed
+     * call would (no host code), so callers cannot tell a slow host from a
+     * dropped one, and neither can the reader — who is told the counts are
+     * unknown, not which of a dozen network faults produced that.
+     */
+    const withTimeout = (promise, ms, label) =>
+      new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+          const error = new Error(`${label} 超时`)
+          error.code = 'timeout'
+          reject(error)
+        }, ms)
+        promise.then(
+          (value) => { clearTimeout(timer); resolve(value) },
+          (failure) => { clearTimeout(timer); reject(failure) },
+        )
+      })
+
     /** Build the RPC caller over the authenticated `/api` channel. */
     const makeInvoke = (connection) => async (method, args = {}) => {
       if (!connection || typeof connection.rpc?.call !== 'function') {
@@ -2746,6 +2815,30 @@ const nextOffsetOf = (payload, fallback) => {
      * meantime, which is a worse bug than the one this fixes.
      */
     const CLIPBOARD_TTL_MS = 20000
+    /**
+     * Ceiling on the sidebar's overview read, in milliseconds.
+     *
+     * A read that never settles is worse than one that rejects: `await` simply
+     * waits, so a request the host never answers — dropped by a captive portal,
+     * or a socket the phone's radio parked until the tab wakes — would leave the
+     * sidebar shimmering with no rows and no error, which is the one failure
+     * mode the reader cannot act on. The timeout turns that into an ordinary
+     * rejection so the caller's existing fallback runs.
+     *
+     * Long enough that a merely slow network still gets its counts, short enough
+     * that the rail settles into its structural places when the answer is simply
+     * not coming: the sidebar is furniture, and a count that never arrives must
+     * not hold the shape of the panel hostage.
+     */
+    const OVERVIEW_TIMEOUT_MS = 6000
+    /**
+     * The same ceiling for the other read that describes a place rather than a
+     * row. Shorter than the overview's, because nothing waits on it: the folder
+     * list only feeds the move-to-folder step, so a slow answer is better
+     * dropped than kept open — but it still must not stay open forever, which
+     * is exactly how the sidebar used to get stuck.
+     */
+    const READ_TIMEOUT_MS = 5000
     /**
      * Write `text` to the clipboard and schedule its removal.
      *
@@ -5040,15 +5133,52 @@ const nextOffsetOf = (payload, fallback) => {
           // either method, or a read that fails, leaves the sidebar on the one
           // place that needs no counts at all.
           await readVault(nextQuery, { quiet: Boolean(paintedSection ?? painted), identity, section: view })
-          const [folderPayload, overviewPayload] = await Promise.all([
-            invoke('folders').catch(() => null),
-            invoke('overview').catch((failure) => ({ failed: failure })),
-          ])
-          setFolders(Array.isArray(folderPayload?.folders) ? folderPayload.folders : [])
-          if (overviewPayload && !overviewPayload.failed) {
-            openCache.overview = { key: identity, overview: overviewPayload, at: Date.now() }
-            setOverview(overviewPayload)
-          }
+          // These two reads are settled INDEPENDENTLY, not awaited together.
+          //
+          // They used to sit in one Promise.all, which made the slower read the
+          // gate for the faster one: the rail is drawn from `overview`, and
+          // `folders` only feeds the move-to-folder step, but a folders call
+          // that never settled held the already-arrived overview hostage. The
+          // panel then showed its rows (readVault had finished) under a rail
+          // stuck on its ghost block, forever — the list said 428 entries and
+          // the sidebar still said "loading". That is the reported bug, and no
+          // amount of retrying or timing out the overview can fix it, because
+          // the overview had already succeeded.
+          //
+          // So each read gets its own ceiling and its own landing. Whatever
+          // arrives is applied at once; whatever does not is dropped on the
+          // floor by its own timer. Nothing here waits for anything else.
+          const foldersRead = withTimeout(invoke('folders'), READ_TIMEOUT_MS, 'folders')
+            .then((payload) => setFolders(Array.isArray(payload?.folders) ? payload.folders : []))
+            .catch(() => { /* an older host, or a read that failed: keep the folders on screen */ })
+          // Retry once: a single transient failure on a slow network used to
+          // leave the rail shimmering with no rows and no way to get them — the
+          // panel looked broken rather than busy. One quiet retry covers the
+          // dropped first attempt without doubling the cost of a host that
+          // genuinely lacks the method.
+          //
+          // ONE ceiling over the chain, not one per attempt: bounding each try
+          // separately makes the worst case the sum of them (two six-second
+          // waits), and the sum is exactly the case this exists for — a request
+          // that never answers, where the retry cannot help because the first
+          // one is still open. A single timer covers both attempts and the gap
+          // between them.
+          const overviewRead = withTimeout(invoke('overview').catch(() => invoke('overview')), OVERVIEW_TIMEOUT_MS, 'overview')
+            .then((payload) => {
+              openCache.overview = { key: identity, overview: payload, at: Date.now() }
+              setOverview(payload)
+            })
+            .catch(() => {
+              // Nothing arrived: stop pretending the rail is loading. An empty
+              // overview renders the three structural places and lets the nav
+              // fall out of its busy state, which is honest — the counts are
+              // unknown, but the rail is not stuck. A rail that kept claiming
+              // to be busy while the list underneath was already full is the
+              // shape of a hung panel, which is the one thing this file spends
+              // its length trying to avoid.
+              setOverview({ failed: true, sections: [], types: [], folderList: [], folderCount: 0, unfiled: 0 })
+            })
+          await Promise.all([foldersRead, overviewRead])
         },
         [invoke, readVault],
       )
@@ -6074,6 +6204,14 @@ const nextOffsetOf = (payload, fallback) => {
             navPlaceholders(t),
           )
         }
+        // The read failed and no retry is coming: the rail keeps its three
+        // structural places and stops claiming to be busy. Ghosts here would be
+        // a placeholder for something that is never going to arrive, which is
+        // the shape of a hung panel — the one thing this file spends its length
+        // trying to avoid.
+        if (overview.failed) {
+          return h('nav', { 'data-vw-nav': '', style: S.nav, 'aria-label': t('navSections') }, places)
+        }
         const types = overview.types ?? []
         if (types.length) {
           places.push(h('div', { key: 'g-types', 'data-vw-nav-group': 'types', style: S.navGroup }, `${t('sectionTypes')} (${types.length})`))
@@ -6110,7 +6248,7 @@ const nextOffsetOf = (payload, fallback) => {
       const refreshOverview = async () => {
         const identity = cacheKey(openCache.config?.config)
         try {
-          const payload = await invoke('overview')
+          const payload = await withTimeout(invoke('overview'), OVERVIEW_TIMEOUT_MS, 'overview')
           openCache.overview = { key: identity, overview: payload, at: Date.now() }
           setOverview(payload)
         } catch {
@@ -7130,11 +7268,11 @@ const nextOffsetOf = (payload, fallback) => {
         h(
           'div',
           { style: S.titleRow },
-          // No mark: the row is text, and the shield cost more than it gave —
-          // it had to be sized against the name beside it, and at any size it
-          // pushed the metadata onto a second row at phone width. The settings
-          // nav already carries the shield for this section, so the panel does
-          // not need to repeat it.
+          // No mark in the heading. The shield was tried here and cost more
+          // than it gave: it had to be sized against the name beside it, and at
+          // any size it pushed the metadata onto a second row at phone width.
+          // The settings rail already carries the badge for this section, so
+          // repeating it one line below read as an icon beside an icon.
           //
           // Two groups, not four loose items. The heading is one unit and the
           // metadata is another, so a narrow panel moves the WHOLE metadata
@@ -7143,7 +7281,15 @@ const nextOffsetOf = (payload, fallback) => {
           // through, which read as an unfinished line. Within a group nothing
           // wraps; `nowrap` on each is what makes that a guarantee rather than
           // a hope about the text's width.
-          h('span', { style: S.titleHead }, h('span', { style: S.titleText }, t('panelTitle'))),
+          h(
+            'span',
+            { style: S.titleHead },
+            // Heading only. The badge was here for a while and the row read as
+            // "icon, gap, icon" beside the settings rail's own shield on the
+            // same screen; the rail already identifies the section, so the
+            // heading does not repeat it.
+            h('span', { style: S.titleText }, t('panelTitle')),
+          ),
           // `plugin` (the host's own manifest read) wins when it is there;
           // otherwise the build stamp answers, so the line is never empty — not
           // on an older host, and not on a bundle served before a restart
@@ -7172,7 +7318,7 @@ const nextOffsetOf = (payload, fallback) => {
                 title: t('repoTitle'),
                 style: S.titleLink,
               },
-              navGlyph('github', 12),
+              h('span', { style: { display: 'inline-flex', alignSelf: 'center' } }, navGlyph('github', 13)),
               t('repoLabel'),
             ),
           ),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vaultwarden",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Vaultwarden/Bitwarden real-time sync for DeepSeek Harness: WebSocket push notifications, on-disk vault cache with revision probing, read/write tools and an entry browser panel. Independent implementation; see THIRD-PARTY-NOTICES.md.",
   "repository": {
     "type": "git",