dsh-workbuddy-xdpool 1.7.3 → 1.7.5

package/CHANGELOG.md

@@ -4,6 +4,110 @@
 
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 1.7.5 — 模型列表会告诉你「现在用哪个不花钱」
+
+> Hy4 preview 晚上 23 点到早上 8 点免费，Hy3 一直在免费期 —— 现在卡片上直接看得出来。
+
+**你会看到**：模型列表里，**当前免费的排在最上面**并带标记：
+
+```
+[免费]              hy3                  x0.00
+                    auto
+(23:00 起免费 · 活动至 10-31)  hy4-preview   x0.29
+                    hy3-x                x0.05
+```
+
+到了晚上 23 点，同一行会变成：
+
+```
+[免费至 08:00 · 活动至 10-31]  hy4-preview   x0.29
+[免费]              hy3                  x0.00
+```
+
+**为什么需要专门做**：因为**上游接口不说这件事**。我拉了真实的国内版接口逐字段核对：
+
+| 信息 | 上游提供吗 |
+|---|---|
+| Hy3 限免 | ✅ 提供 —— `credits: "x0.00"`，倍率本身就是 0，我们一直在正确显示 |
+| Hy4 preview **夜间**限免 | ❌ **不提供** —— 倍率恒为 `x0.29`，**没有任何时段字段** |
+| Hy4 preview **新用户 14 天**额度 | ❌ **不提供** —— 积分包里也没有这类条目 |
+
+所以夜间限免这条规则，只能由插件自己带。我把它写成一张**规则表**（`src/promo.ts`），包含「哪个平台、哪些 id 前缀、哪些小时、有效期到哪天」。
+
+**几个刻意的设计**：
+
+- **规则区分平台**。这是**国内版活动**，所以规则里带 `region: 'cn'`，**国际版完全不受影响** —— 国际版的 `hy4-preview-f` 显示「免费」是因为**上游倍率真的是 0**（客观事实），不是我们套了活动规则；
+- **免费状态是「此刻」的，不是模型固有属性**。所以同一天里 `hy4-preview` 的标记会变 —— 这才是真实情况；
+- **窗口外只给一个低调的虚线提示**（`23:00 起免费`），**不给「免费」徽章**。因为它此刻**确实要花积分**，标成免费会让你花错钱；
+- **只有「此刻免费」的才置顶**。窗口外的模型不置顶，否则就是把一个要花钱的模型举到最前面，误导性更强；
+- **标出活动截止日**（`活动至 10-31`）。方便你安排什么时候用 —— 而且活动一旦延期，改日期就能看到，不用翻更新日志；
+- **规则带过期日期**，到 10 月 31 日之后**自动失效**，不需要有人记得来删代码；
+- **`hy4-preview` 用前缀匹配**，因为上游有 `hy4-preview` 和 `hy4-preview-x` 两个 id，是同一款产品。
+
+### 关于「新用户 14 天免费额度」——明确没做
+
+你提到「新用户没用过 Hy4 preview，还能免费 14 天，要区分出来」。**这个我做不到，而且硬做会更糟**：
+
+上游**完全不记录**「这个账户有没有用过 Hy4 preview」—— 模型目录里没有、积分包里也没有（我实测过，44 个积分包里没有一个试用额度条目）。
+
+唯一能猜的办法是「插件自己记住第一次调用的时间」。但这有个致命问题：**它只知道「用本插件之后」的历史**。你之前要是在官方客户端用过 Hy4 preview，插件照样会以为你是新用户，然后给你标一个**假的「免费」** —— 而你会因此放心去用，结果**扣了积分**。
+
+**给你一个假的「免费」，比不给你标记更糟**，因为它直接改变你的花钱决定。所以这条留白，不做推测。
+
+如果你确实需要，可行的做法是**你自己确认**：卡片上显示的是客观事实（倍率 + 夜间窗口），你清楚自己是不是新用户，看一眼就知道该不该用。
+
+### 验证
+
+- 类型检查全绿，测试 **297 项全绿**（+19）。
+- 新增 `tests/promo.test.ts`：23:00–08:00 窗口内/外的判定、跨午夜（23 点在窗口内、8 点不在）、窗口关闭时间（`免费至 08:00`）、下次开启时间（`23:00 起免费`）、同族 id（`hy4-preview` 与 `hy4-preview-x`）、零倍率模型全天免费且不误入夜间规则、**到期自动失效**（10/31 有效、11/1 失效）、**免费置顶只认「此刻」免费**、**活动截止日随状态带出**、**国际版不受活动影响**（但零倍率模型在两边都算免费）。
+- **反向验证**：清空夜间小时 → 7 项变红；删掉过期日期 → 2 项变红；**移除平台过滤 → 「国际版不受影响」变红**。确认测试真的能抓住这三类缺陷。
+- 用**两个平台的真实清单**（国内版 16 个 / 国际版 24 个）跑卡片渲染逻辑，在 12:00 与 23:30 核对：国内版 `hy4-preview` 正确显示活动徽章与截止日，**国际版完全不受活动规则影响**。
+
+## 1.7.4 — 装在中文文件夹里的 WorkBuddy，终于找得到了
+
+> 「腾讯」两个字，让插件整整看不见一个装好、登录着、正在运行的 WorkBuddy。
+
+**你会看到**：插件卡片报「找不到 WorkBuddy 桌面端，无法取得密钥」，可你明明：程序装着、还开着、凭据文件就在那儿躺着。中文 Windows 上，只要**安装路径里带中文**（比如 `D:\ruanjian\anzhuang\腾讯\WorkBuddy\`）就会中招——国内用户把软件装进中文目录太常见了。
+
+**为什么**：插件去注册表里问「WorkBuddy 装哪儿了」，用的是 `reg.exe`，而 `reg.exe` 按**系统控制台代码页**输出——中文系统就是 GBK（936）。我们这边却当成 UTF-8 去读。于是：
+
+```
+实际路径：D:\ruanjian\anzhuang\腾讯\WorkBuddy\WorkBuddy.exe
+读出来：  D:\ruanjian\anzhuang\��Ѷ\WorkBuddy\WorkBuddy.exe   ← 存的什么鬼
+```
+
+`腾讯` 变成 `��Ѷ`，这个路径当然**不存在**。所有候选路径全部落空，插件就得出「没装」的结论。可笑的是它其实**探到了**注册表记录，只是**读成了乱码**。
+
+这个坑和之前那个「装到非系统盘」是两回事——那个是找不到记录，这个是找到了但读不对。
+
+**怎么修的**：
+
+- **改走 PowerShell 读注册表**（主路径）。`Get-ItemProperty` 直接调注册表 API，**根本不过控制台代码页那一关**，中文路径原样拿到；
+- **保留 `reg.exe` 作后备**（万一机器上 PowerShell 不可用），但**不再假定 UTF-8**：按字节读进来，逐个尝试各种编码，并且**用「这个路径是否真的存在」来判定哪个解码是对的**——这是唯一能区分「正确字节」和「看着像那么回事的乱码」的办法。
+
+**顺带修了报告里提到的两点**：
+
+- `DisplayIcon` 和 `InstallLocation` **两个字段都读**（不少安装包的 `InstallLocation` 是空的，只有 `DisplayIcon` 有值），并且清理 `",0` 后缀的逻辑保持不变；
+- `doctor` **现在会把探测到的每一条路径原样列出来**，前面标 `✓`/`·` 表示存不存在。以前它压根不显示这些路径——而这恰恰是排查「装了却找不到」最该看的东西。**乱码路径现在一眼就能看见**，不用再靠猜。
+
+### 验证
+
+- 类型检查全绿，测试 **278 项全绿**（+2）。
+- 新增 `tests/windows-registry-encoding.test.ts`：在本机**真实创建**一个含中文的目录（`D:\...\腾讯\WorkBuddy\WorkBuddy.exe`）并写进真实注册表，然后跑插件的真实探测逻辑，断言**拿到的路径与真实路径完全一致、且文件确实存在**。
+- **反向验证**：把修复撤掉、退回「`reg.exe` + UTF-8」，含中文的路径**读不出来**（0 条），测试变红——确认这个测试真的能抓住这个 bug。
+- 实测 `doctor` 输出：`✓ D:\DSH\_doc_check\腾讯\WorkBuddy\WorkBuddy.exe`，中文完整、存在性正确。
+
+### 给中招的人（在你升级之前，或者万一还有别的编码）
+
+临时指路，设完**完全退出 DSH 再启动**：
+
+```powershell
+[Environment]::SetEnvironmentVariable("WORKBUDDY_APP_EXECUTABLE",
+  "D:\ruanjian\anzhuang\腾讯\WorkBuddy\WorkBuddy.exe", "User")
+```
+
+写进 `$DSH_HOME/.env` 也一样有效（不用注销，更省事）。
+
 ## 1.7.3 — 模型不会因为一次网络抖动就消失
 
 > 开机那一秒网络还没起来，插件就把模型列表「降级」了，然后一整天都不再试第二次。

package/lib/bin.js

@@ -1,9 +1,9 @@
 import { createDecipheriv, createHash, randomUUID } from "node:crypto";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { copyFile, mkdir, readFile, readdir, rename, writeFile, writeFile as writeFile$1 } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
 import z from "@deepseek-ai/schemastery";
 import "@earendil-works/pi-ai";
 import "@earendil-works/pi-ai/api/openai-completions.lazy";
@@ -1890,42 +1890,155 @@ function macosBundleExecutable(bundle) {
 	return join(bundle, "Contents", "MacOS", name);
 }
 /**
+* Encodings a Windows console child process may emit in, most likely first.
+*
+* `reg.exe` writes with the ACTIVE CODE PAGE, never UTF-8: a Chinese Windows
+* (code page 936) returns a path containing 「腾讯」 as GBK bytes. Decoding
+* those as UTF-8 mangles them into `��Ѷ`, every `existsSync` then fails, and the
+* plugin concludes no desktop app is installed while one is running fine.
+*
+* The list is ordered and each entry is TRIED rather than guessed: the first
+* decoding that yields usable text wins, and the decision is validated against
+* the filesystem rather than by sniffing bytes.
+*/
+const WINDOWS_CONSOLE_ENCODINGS = [
+	"utf-8",
+	"gbk",
+	"big5",
+	"shift_jis",
+	"euc-kr",
+	"windows-1252"
+];
+/**
+* Decode bytes from a Windows console child process.
+*
+* `accept` decides whether a decoding is usable — the callers pass "this text
+* contains a path that actually exists". Bytes that are already UTF-8 pass on
+* the first attempt, so the healthy case pays nothing.
+*/
+function decodeWindowsConsole(buf, accept) {
+	for (const label of WINDOWS_CONSOLE_ENCODINGS) {
+		let text;
+		try {
+			text = new TextDecoder(label, { fatal: false }).decode(buf);
+		} catch {
+			continue;
+		}
+		if (accept(text)) return text;
+	}
+	return new TextDecoder("utf-8", { fatal: false }).decode(buf);
+}
+/** Strip the `"<path>",<index>` decoration DisplayIcon carries. */
+function cleanIconPath(raw) {
+	return raw.replace(/^"/u, "").replace(/",-?\d+$/u, "").replace(/,-?\d+$/u, "").trim();
+}
+/** Registry locations the installer records its own product under. */
+const UNINSTALL_KEY_ROOTS = [
+	"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+	"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+	"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
+];
+/**
 * Windows install locations recorded by the app's own uninstaller.
 *
 * The registry is the authoritative answer: it survives a non-default drive, a
 * renamed folder and a differently-named executable, none of which any fixed
 * path list can predict. Real machines put the app at `D:\workbuddy\WorkBuddy.exe`
-* and `D:\workbuddyai\WorkBuddyAI.exe` — exactly the layouts a
-* `%ProgramFiles%\WorkBuddy\WorkBuddy.exe` probe cannot see, which is why the
-* plugin reported "the desktop app could not provide the key" for an app that was
-* installed and running.
+* and `D:\ruanjian\anzhuang\腾讯\WorkBuddy\WorkBuddy.exe` — layouts a
+* `%ProgramFiles%\WorkBuddy\WorkBuddy.exe` probe cannot see.
 *
 * `DisplayIcon` is the field that actually carries the path (observed as
 * `D:\workbuddy\WorkBuddy.exe,0`); `InstallLocation` is usually empty for these
 * installers, so both are read and either may contribute.
 *
+* Two readers, because neither alone is enough:
+*
+*  - **PowerShell first.** `Get-ItemProperty` talks to the registry API, so no
+*    console code page is involved and non-ASCII paths come back intact. This
+*    is the encoding-proof path.
+*  - **`reg.exe` as a fallback**, for a machine where PowerShell is unavailable
+*    (locked-down or stripped images). Its raw bytes are decoded through
+*    {@link decodeWindowsConsole}, which is what the original code got wrong.
+*
 * Returns [] on any failure — a missing registry key is the normal case on
 * non-Windows, not an error.
 */
 function windowsRegistryAppPaths() {
 	if (process.platform !== "win32") return [];
-	const roots = [
-		["HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
-		["HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
-		["HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"]
-	];
+	const viaPowerShell = windowsRegistryAppPathsViaPowerShell();
+	if (viaPowerShell.length > 0) return viaPowerShell;
+	return windowsRegistryAppPathsViaReg();
+}
+/**
+* Registry read through PowerShell, immune to the console code page.
+*
+* `[Console]::OutputEncoding` is set to UTF-8 so the bytes Node receives are
+* UTF-8 regardless of the machine's code page. Values are printed one per line
+* and matched by the caller, so a Chinese path survives the round trip.
+*
+* Best-effort: any failure (no PowerShell, no keys, a policy restriction)
+* returns [], and the `reg.exe` reader takes over.
+*/
+function windowsRegistryAppPathsViaPowerShell() {
+	const script = [
+		"$ErrorActionPreference='SilentlyContinue'",
+		"try { [Console]::OutputEncoding=[System.Text.Encoding]::UTF8 } catch {}",
+		"$roots=@('HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*')",
+		"foreach($r in $roots){",
+		"  Get-ItemProperty -Path $r | ForEach-Object {",
+		"    $dn=[string]$_.DisplayName; $di=[string]$_.DisplayIcon; $il=[string]$_.InstallLocation",
+		"    if($dn -match 'WorkBuddy|CodeBuddy' -or $di -match 'WorkBuddy|CodeBuddy'){",
+		"      if($di -ne ''){ Write-Output $di }",
+		"      if($il -ne ''){ Write-Output $il }",
+		"    }",
+		"  }",
+		"}"
+	].join("\n");
+	let stdout;
+	try {
+		stdout = execFileSync("powershell", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-ExecutionPolicy",
+			"Bypass",
+			"-Command",
+			script
+		], {
+			encoding: "utf8",
+			timeout: 2e4,
+			windowsHide: true,
+			maxBuffer: 8388608
+		});
+	} catch {
+		return [];
+	}
 	const out = [];
-	for (const [root] of roots) {
-		let listing;
+	for (const line of stdout.split(/\r?\n/u)) {
+		const cleaned = cleanIconPath(line.trim());
+		if (cleaned !== "") out.push(cleaned);
+	}
+	return out;
+}
+/**
+* Registry read through `reg.exe`, with console-code-page detection.
+*
+* Kept as the fallback for machines without PowerShell. The decode step is the
+* fix: the output is captured as BYTES and decoded with whichever encoding
+* yields a path that exists, instead of assuming UTF-8 and quietly producing
+* mojibake that no existence check can ever match.
+*/
+function windowsRegistryAppPathsViaReg() {
+	const out = [];
+	for (const root of UNINSTALL_KEY_ROOTS) {
+		let listingBuf;
 		try {
-			listing = execFileSync("reg", [
+			listingBuf = execFileSync("reg", [
 				"query",
 				root,
 				"/s",
 				"/v",
 				"DisplayName"
 			], {
-				encoding: "utf8",
 				timeout: 1e4,
 				windowsHide: true,
 				maxBuffer: 8388608
@@ -1933,26 +2046,35 @@ function windowsRegistryAppPaths() {
 		} catch {
 			continue;
 		}
-		const keys = listing.split(/\r?\n(?=HKEY_)/u).filter((block) => /WorkBuddy|CodeBuddy/iu.test(block));
+		const keys = decodeWindowsConsole(listingBuf, (text) => /WorkBuddy|CodeBuddy/iu.test(text)).split(/\r?\n(?=HKEY_)/u).filter((block) => /WorkBuddy|CodeBuddy/iu.test(block));
 		for (const key of keys) {
 			const keyPath = /^(HKEY_[^\r\n]+)/u.exec(key)?.[1]?.trim();
 			if (keyPath === void 0) continue;
-			for (const name of ["DisplayIcon", "InstallLocation"]) try {
-				const value = execFileSync("reg", [
-					"query",
-					keyPath,
-					"/v",
-					name
-				], {
-					encoding: "utf8",
-					timeout: 5e3,
-					windowsHide: true
+			for (const name of ["DisplayIcon", "InstallLocation"]) {
+				let valueBuf;
+				try {
+					valueBuf = execFileSync("reg", [
+						"query",
+						keyPath,
+						"/v",
+						name
+					], {
+						timeout: 5e3,
+						windowsHide: true
+					});
+				} catch {
+					continue;
+				}
+				const value = decodeWindowsConsole(valueBuf, (text) => {
+					const candidate = /REG_(?:SZ|EXPAND_SZ)\s+(.+)$/mu.exec(text)?.[1]?.trim();
+					if (candidate === void 0) return false;
+					const path = cleanIconPath(candidate);
+					return path !== "" && existsSync(path);
 				});
 				const raw = /REG_(?:SZ|EXPAND_SZ)\s+(.+)$/mu.exec(value)?.[1]?.trim();
 				if (raw === void 0 || raw === "") continue;
-				const cleaned = raw.replace(/^"/u, "").replace(/",-?\d+$/u, "").replace(/,-?\d+$/u, "").trim();
-				out.push(cleaned);
-			} catch {}
+				out.push(cleanIconPath(raw));
+			}
 		}
 	}
 	return out;
@@ -2221,7 +2343,7 @@ const ENCRYPTED_CREDENTIAL_CODE = "ENCRYPTED_CREDENTIAL";
 var WorkBuddyEncryptedCredentialError = class extends Error {
 	code = ENCRYPTED_CREDENTIAL_CODE;
 	constructor(sourcePath) {
-		super(`workbuddy: ${sourcePath} holds encrypted credentials, but no WorkBuddy desktop app could be located to provide the key. If the app IS installed, it is simply outside the paths this plugin probes — set WORKBUDDY_APP_EXECUTABLE to its full .exe path (then restart DSH) and the credential will open. Signing in again will not help: the credential itself is intact. Run \`dsh-workbuddy-xdpool doctor\` to see which paths were probed.`);
+		super(`workbuddy: ${sourcePath} holds encrypted credentials, but no WorkBuddy desktop app could be located to provide the key. If the app IS installed, it is simply outside the paths this plugin probes — set WORKBUDDY_APP_EXECUTABLE to its full .exe path (then restart DSH) and the credential will open. Signing in again will not help: the credential itself is intact. Run \`dsh-workbuddy-xdpool doctor\` to see which paths were probed — if one of them looks like mojibake (e.g. "??" where a Chinese folder name should be), the registry value could not be decoded on this machine; report that line and use the override above in the meantime.`);
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
@@ -5111,6 +5233,31 @@ async function commandDoctor() {
 		imported = (await readdir2(accountDir())).filter((name) => name.endsWith(".json"));
 	} catch {}
 	lines.push(imported.length === 0 ? "  (none)" : imported.map((name) => `  ✓ ${name}`).join("\n"));
+	lines.push("");
+	lines.push("WorkBuddy desktop app:");
+	const override = process.env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim();
+	if (override !== void 0 && override !== "") lines.push(`  env ${WORKBUDDY_APP_EXECUTABLE_ENV} = ${override}`);
+	let candidates = [];
+	try {
+		candidates = workbuddyAppExecutableCandidates();
+	} catch (error) {
+		lines.push(`  ✗ candidate probe threw: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	let firstExisting;
+	for (const candidate of candidates) {
+		const exists = existsSync(candidate);
+		if (exists && firstExisting === void 0) firstExisting = candidate;
+		lines.push(`  ${exists ? "✓" : "·"} ${candidate}`);
+	}
+	lines.push(`  probed ${candidates.length} candidate path(s)`);
+	if (firstExisting === void 0) {
+		healthy = false;
+		lines.push("  ✗ no WorkBuddy desktop executable found at any probed path.");
+		lines.push("    If the app IS installed, set WORKBUDDY_APP_EXECUTABLE to its full .exe path");
+		lines.push("    (or put that line in $DSH_HOME/.env) and restart DSH. A path shown above that");
+		lines.push("    looks like mojibake (e.g. \"???\" for a Chinese folder) indicates the registry");
+		lines.push("    value could not be decoded on this machine — please report it with the line.");
+	} else lines.push(`  ✓ using ${firstExisting}`);
 	console.log(lines.join("\n"));
 	return healthy ? 0 : 1;
 }

package/lib/client.js

@@ -273,6 +273,12 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-xdpool-model-id{color:var(--dsw-alias-label-tertiary,#999);font-size:11px;line-height:16px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
 .dsm-workbuddy-xdpool-model-meta{display:flex;align-items:center;gap:8px;flex-wrap:wrap;color:var(--dsw-alias-label-tertiary,#999);font-size:11px;line-height:16px}
 .dsm-workbuddy-xdpool-model-meta-tag{padding:1px 8px;border-radius:999px;font-size:11px;line-height:16px;background:rgba(174,179,187,.11);color:var(--dsw-alias-label-secondary,#c6c9d0)}
+/* "free from HH:00": quieter than the badge on purpose — the model costs
+   credits right now, so it must not read as a promo the user can spend against. */
+.dsm-workbuddy-xdpool-model-meta-later{padding:1px 8px;border-radius:999px;font-size:11px;line-height:16px;border:1px dashed color-mix(in oklab, var(--dsw-alias-label-dimmed,#9aa0a8) 55%, transparent);color:var(--dsw-alias-label-tertiary,#9aa0a8)}
+/* "活动至 10-31": the campaign's end date. Muted — it is context for planning,
+   not a claim about the current price. */
+.dsm-workbuddy-xdpool-model-meta-promo{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:11px;line-height:16px;opacity:.85}
 .dsm-workbuddy-xdpool-model-cap{color:var(--dsw-alias-label-tertiary,#999);font-size:11px;line-height:16px;font-variant-numeric:tabular-nums}
 /* Model row: checkbox + image toggle + context-budget radios. */
 .dsm-workbuddy-xdpool-model-off{opacity:.55}
@@ -366,6 +372,104 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-xdpool-reserve-note-ok{color:var(--dsw-alias-state-success-primary,#22a06b)}
 .dsm-workbuddy-xdpool-reserve-note-bad{color:var(--dsw-alias-state-error-primary,#ef4444);font-weight:600}
 `.trim();
+		//#endregion
+		//#region src/promo.ts
+		/**
+		* Promotions in force.
+		*
+		* Source: the WorkBuddy announcement extending Hy3's free tier and
+		* Hy4-preview's night window to **2026-10-31**. Hy3 needs no entry here (its
+		* CN price is already zero upstream); only Hy4-preview's time window does,
+		* because the gateway charges for it around the clock.
+		*
+		* When a promotion is extended or a new one starts, edit this table. When one
+		* ends, either delete the row or let `until` lapse — both stop the badge.
+		*/
+		const PROMO_RULES = [{
+			idPrefix: "hy4-preview",
+			region: "cn",
+			hours: [
+				23,
+				0,
+				1,
+				2,
+				3,
+				4,
+				5,
+				6,
+				7
+			],
+			until: "2026-10-31",
+			label: "night"
+		}];
+		/** `YYYY-MM-DD` for a Date in LOCAL time (the promotions are announced locally). */
+		function localDayKey(date) {
+			const p = (n) => String(n).padStart(2, "0");
+			return `${date.getFullYear()}-${p(date.getMonth() + 1)}-${p(date.getDate())}`;
+		}
+		/** Whether a rule is still in force on `date`. */
+		function ruleActive(rule, date) {
+			return localDayKey(date) <= rule.until;
+		}
+		/** The first hour the window reopens, searching forward from `hour`. */
+		function nextWindowHour(rule, hour) {
+			for (let step = 1; step <= 24; step += 1) {
+				const candidate = (hour + step) % 24;
+				if (rule.hours.includes(candidate)) return candidate;
+			}
+		}
+		/** The hour the CURRENT window closes, searching forward from `hour`. */
+		function windowEndHour(rule, hour) {
+			for (let step = 1; step <= 24; step += 1) {
+				const candidate = (hour + step) % 24;
+				if (!rule.hours.includes(candidate)) return candidate;
+			}
+		}
+		/**
+		* The promotion status of one model at `now`, for one region.
+		*
+		* `now` is injected so the behaviour is testable without freezing the clock —
+		* a time-dependent badge that can only be tested by waiting is a badge nobody
+		* tests. `region` is required for the same reason the rules carry one: these
+		* campaigns are regional, and applying a domestic rule to the international
+		* roster would invent a discount that gateway does not offer.
+		*/
+		function promoStatusFor(model, now = /* @__PURE__ */ new Date(), region = "cn") {
+			if (model.multiplier === 0) return { kind: "free" };
+			for (const rule of PROMO_RULES) {
+				if (rule.region !== region) continue;
+				if (!model.id.startsWith(rule.idPrefix)) continue;
+				if (!ruleActive(rule, now)) continue;
+				const hour = now.getHours();
+				if (rule.hours.includes(hour)) {
+					const untilHour = windowEndHour(rule, hour);
+					return {
+						kind: "night",
+						label: rule.label,
+						untilHour: untilHour ?? hour,
+						promoUntil: rule.until
+					};
+				}
+				const nextHour = nextWindowHour(rule, hour);
+				if (nextHour !== void 0) return {
+					kind: "night-later",
+					label: rule.label,
+					nextHour,
+					promoUntil: rule.until
+				};
+			}
+		}
+		/**
+		* Whether a model is free RIGHT NOW, for sorting.
+		*
+		* Only the two "currently free" kinds count. `night-later` deliberately does
+		* NOT sort to the top: it costs credits at this moment, and floating a
+		* credit-priced model above cheaper ones would misrepresent the list.
+		*/
+		function isFreeNow(model, now = /* @__PURE__ */ new Date(), region = "cn") {
+			const status = promoStatusFor(model, now, region);
+			return status?.kind === "free" || status?.kind === "night";
+		}
 		//#endregion
 		//#region src/client/PoolCard.tsx
 		/**
@@ -546,17 +650,23 @@ window.__ModuleLoader__.load({
 		/**
 		* The promo badge for one model, or undefined when it has none.
 		*
-		* `free` is read off the CREDIT MULTIPLIER, not off a tag. Neither gateway ever
-		* sends a literal `free` tag: the global roster marks its zero-cost models
-		* (`hy3`, `hy4-preview-f`, `deepseek-v4.1-flash`) as `credits: "x0.00"`, so
-		* waiting for a tag meant the badge NEVER appeared — including on models that
-		* genuinely cost nothing.
+		* Two sources, because the gateway models one of them and not the other:
 		*
-		* An explicit free-ish tag still wins when present, so a gateway that starts
-		* tagging them keeps working without another change.
+		*  - `free` comes from the CREDIT MULTIPLIER. Neither gateway ever sends a
+		*    literal `free` tag, but it does price its free models at `credits: "x0.00"`
+		*    (CN `hy3`), so the multiplier is the honest signal.
+		*  - the NIGHT window comes from {@link promoStatusFor}, because the gateway
+		*    charges `x0.29` for `hy4-preview` around the clock and has no field for a
+		*    time-of-day rule. See that module for why the 14-day newcomer allowance is
+		*    deliberately not modelled.
+		*
+		* `region` is threaded through because the campaigns are REGIONAL: the
+		* Hy3 / Hy4-preview extension is a domestic promotion, so a global roster must
+		* not pick up a discount that gateway does not offer.
 		*/
-		function tagFor(model) {
+		function tagFor(model, now, region) {
 			const tags = model.tags ?? [];
+			if (promoStatusFor(model, now, region)?.kind === "night") return "night";
 			if (tags.includes("free") || model.multiplier === 0) return "free";
 			if (tags.includes("limited-free")) return "limited";
 			if (tags.includes("night-discount")) return "night";
@@ -837,6 +947,17 @@ window.__ModuleLoader__.load({
 			const modelsEditable = settingsWritable;
 			const modelsDirty = draft !== void 0 && status !== void 0 && draftIsDirty(status, draft);
 			const enabledCount = Object.values(modelDraft).filter((entry) => entry.enabled).length;
+			/**
+			* One clock reading per render, shared by the sort and every row.
+			*
+			* Taken once so the list cannot disagree with itself: calling `new Date()`
+			* per row would let a model be "free" for the badge and "not free" for the
+			* sort if the window boundary happened to fall between two rows.
+			*
+			* A promotion boundary is not a re-render trigger — the card refreshes on its
+			* own poll, which is frequent enough for a badge that changes twice a day.
+			*/
+			const now = /* @__PURE__ */ new Date();
 			const toggleModel = (id) => {
 				if (status === void 0) return;
 				const base = draft ?? draftFromStatus(status);
@@ -1510,8 +1631,9 @@ window.__ModuleLoader__.load({
 							})]
 						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: "dsm-workbuddy-xdpool-model-list",
-							children: status?.models.map((model) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ModelRow, {
+							children: [...status?.models ?? []].sort((a, b) => Number(isFreeNow(b, now, activeRegion)) - Number(isFreeNow(a, now, activeRegion))).map((model) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ModelRow, {
 								model,
+								region: activeRegion,
 								t,
 								draft: modelDraft[model.id] ?? {
 									enabled: model.enabled,
@@ -1865,9 +1987,26 @@ window.__ModuleLoader__.load({
 		* context radios stay disabled rather than pretending an edit took hold. The
 		* draft lives in the parent, so this component only ever reports intent.
 		*/
-		function ModelRow({ model, t, draft, editable, onToggle, onToggleImage, onBudget }) {
-			const tag = tagFor(model);
-			const tagText = tag === "free" ? t?.("row.free") ?? "free" : tag === "limited" ? t?.("row.limitedFree") ?? "limited free" : tag === "night" ? t?.("row.nightDiscount") ?? "night" : null;
+		function ModelRow({ model, region, t, draft, editable, onToggle, onToggleImage, onBudget }) {
+			const now = /* @__PURE__ */ new Date();
+			const tag = tagFor(model, now, region);
+			const promo = promoStatusFor(model, now, region);
+			const tagText = tag === "free" ? t?.("row.free") ?? "free" : tag === "limited" ? t?.("row.limitedFree") ?? "limited free" : tag === "night" ? t?.("row.nightFreeNow", { time: `${String(promo?.kind === "night" ? promo.untilHour : 0).padStart(2, "0")}:00` }) ?? "free until 08:00" : null;
+			/**
+			* The "cheaper later" hint: the model is on a promotion but the window is
+			* closed. Deliberately NOT a "free" badge — it costs credits at this moment,
+			* and telling the user otherwise would change what they spend.
+			*/
+			const laterHint = promo?.kind === "night-later" ? t?.("row.nightFreeLater", { time: `${String(promo.nextHour).padStart(2, "0")}:00` }) ?? `free from ${String(promo.nextHour).padStart(2, "0")}:00` : null;
+			/**
+			* How long the campaign itself runs, e.g. "活动至 10-31".
+			*
+			* Shown on both the free and the not-yet-free row, because the useful question
+			* is not only "is it free now" but "until when is this offer good at all" —
+			* an extension changes that date, and a user planning around the promotion
+			* needs it visible rather than buried in a changelog.
+			*/
+			const promoUntil = promo === void 0 || promo.kind === "free" ? null : t?.("row.promoUntil", { date: promo.promoUntil.slice(5).replace("-", "-") }) ?? `promo until ${promo.promoUntil}`;
 			const native = model.nativeContextWindow;
 			const capped = native > DEFAULT_CONTEXT_BUDGET;
 			const currentBudget = draft.budget ?? native;
@@ -1939,6 +2078,14 @@ window.__ModuleLoader__.load({
 							className: "dsm-workbuddy-xdpool-model-meta-tag",
 							children: tagText
 						}),
+						laterHint === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-workbuddy-xdpool-model-meta-later",
+							children: laterHint
+						}),
+						promoUntil === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-workbuddy-xdpool-model-meta-promo",
+							children: promoUntil
+						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							className: "dsm-workbuddy-xdpool-model-cap",
 							children: t?.("row.modelOutput", { size: formatCapacity(model.maxOutputTokens) }) ?? `out ${formatCapacity(model.maxOutputTokens)}`
@@ -2094,6 +2241,9 @@ window.__ModuleLoader__.load({
 			"row.free": "free",
 			"row.limitedFree": "limited free",
 			"row.nightDiscount": "night",
+			"row.nightFreeNow": "free until {time}",
+			"row.nightFreeLater": "free from {time}",
+			"row.promoUntil": "promo to {date}",
 			"row.imageCapable": "image input",
 			"row.rate": "{rate}x credits",
 			"row.accountsRescan": "Detect accounts again",
@@ -2239,6 +2389,9 @@ window.__ModuleLoader__.load({
 			"row.free": "免费",
 			"row.limitedFree": "限量免费",
 			"row.nightDiscount": "夜间",
+			"row.nightFreeNow": "免费至 {time}",
+			"row.nightFreeLater": "{time} 起免费",
+			"row.promoUntil": "活动至 {date}",
 			"row.imageCapable": "图片输入",
 			"row.rate": "{rate}x 积分",
 			"row.accountsRescan": "重新检测账号",

package/lib/index.js

@@ -1997,42 +1997,155 @@ function macosBundleExecutable(bundle) {
 	return join(bundle, "Contents", "MacOS", name);
 }
 /**
+* Encodings a Windows console child process may emit in, most likely first.
+*
+* `reg.exe` writes with the ACTIVE CODE PAGE, never UTF-8: a Chinese Windows
+* (code page 936) returns a path containing 「腾讯」 as GBK bytes. Decoding
+* those as UTF-8 mangles them into `��Ѷ`, every `existsSync` then fails, and the
+* plugin concludes no desktop app is installed while one is running fine.
+*
+* The list is ordered and each entry is TRIED rather than guessed: the first
+* decoding that yields usable text wins, and the decision is validated against
+* the filesystem rather than by sniffing bytes.
+*/
+const WINDOWS_CONSOLE_ENCODINGS = [
+	"utf-8",
+	"gbk",
+	"big5",
+	"shift_jis",
+	"euc-kr",
+	"windows-1252"
+];
+/**
+* Decode bytes from a Windows console child process.
+*
+* `accept` decides whether a decoding is usable — the callers pass "this text
+* contains a path that actually exists". Bytes that are already UTF-8 pass on
+* the first attempt, so the healthy case pays nothing.
+*/
+function decodeWindowsConsole(buf, accept) {
+	for (const label of WINDOWS_CONSOLE_ENCODINGS) {
+		let text;
+		try {
+			text = new TextDecoder(label, { fatal: false }).decode(buf);
+		} catch {
+			continue;
+		}
+		if (accept(text)) return text;
+	}
+	return new TextDecoder("utf-8", { fatal: false }).decode(buf);
+}
+/** Strip the `"<path>",<index>` decoration DisplayIcon carries. */
+function cleanIconPath(raw) {
+	return raw.replace(/^"/u, "").replace(/",-?\d+$/u, "").replace(/,-?\d+$/u, "").trim();
+}
+/** Registry locations the installer records its own product under. */
+const UNINSTALL_KEY_ROOTS = [
+	"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+	"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+	"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
+];
+/**
 * Windows install locations recorded by the app's own uninstaller.
 *
 * The registry is the authoritative answer: it survives a non-default drive, a
 * renamed folder and a differently-named executable, none of which any fixed
 * path list can predict. Real machines put the app at `D:\workbuddy\WorkBuddy.exe`
-* and `D:\workbuddyai\WorkBuddyAI.exe` — exactly the layouts a
-* `%ProgramFiles%\WorkBuddy\WorkBuddy.exe` probe cannot see, which is why the
-* plugin reported "the desktop app could not provide the key" for an app that was
-* installed and running.
+* and `D:\ruanjian\anzhuang\腾讯\WorkBuddy\WorkBuddy.exe` — layouts a
+* `%ProgramFiles%\WorkBuddy\WorkBuddy.exe` probe cannot see.
 *
 * `DisplayIcon` is the field that actually carries the path (observed as
 * `D:\workbuddy\WorkBuddy.exe,0`); `InstallLocation` is usually empty for these
 * installers, so both are read and either may contribute.
 *
+* Two readers, because neither alone is enough:
+*
+*  - **PowerShell first.** `Get-ItemProperty` talks to the registry API, so no
+*    console code page is involved and non-ASCII paths come back intact. This
+*    is the encoding-proof path.
+*  - **`reg.exe` as a fallback**, for a machine where PowerShell is unavailable
+*    (locked-down or stripped images). Its raw bytes are decoded through
+*    {@link decodeWindowsConsole}, which is what the original code got wrong.
+*
 * Returns [] on any failure — a missing registry key is the normal case on
 * non-Windows, not an error.
 */
 function windowsRegistryAppPaths() {
 	if (process.platform !== "win32") return [];
-	const roots = [
-		["HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
-		["HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
-		["HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"]
-	];
+	const viaPowerShell = windowsRegistryAppPathsViaPowerShell();
+	if (viaPowerShell.length > 0) return viaPowerShell;
+	return windowsRegistryAppPathsViaReg();
+}
+/**
+* Registry read through PowerShell, immune to the console code page.
+*
+* `[Console]::OutputEncoding` is set to UTF-8 so the bytes Node receives are
+* UTF-8 regardless of the machine's code page. Values are printed one per line
+* and matched by the caller, so a Chinese path survives the round trip.
+*
+* Best-effort: any failure (no PowerShell, no keys, a policy restriction)
+* returns [], and the `reg.exe` reader takes over.
+*/
+function windowsRegistryAppPathsViaPowerShell() {
+	const script = [
+		"$ErrorActionPreference='SilentlyContinue'",
+		"try { [Console]::OutputEncoding=[System.Text.Encoding]::UTF8 } catch {}",
+		"$roots=@('HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*')",
+		"foreach($r in $roots){",
+		"  Get-ItemProperty -Path $r | ForEach-Object {",
+		"    $dn=[string]$_.DisplayName; $di=[string]$_.DisplayIcon; $il=[string]$_.InstallLocation",
+		"    if($dn -match 'WorkBuddy|CodeBuddy' -or $di -match 'WorkBuddy|CodeBuddy'){",
+		"      if($di -ne ''){ Write-Output $di }",
+		"      if($il -ne ''){ Write-Output $il }",
+		"    }",
+		"  }",
+		"}"
+	].join("\n");
+	let stdout;
+	try {
+		stdout = execFileSync("powershell", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-ExecutionPolicy",
+			"Bypass",
+			"-Command",
+			script
+		], {
+			encoding: "utf8",
+			timeout: 2e4,
+			windowsHide: true,
+			maxBuffer: 8388608
+		});
+	} catch {
+		return [];
+	}
 	const out = [];
-	for (const [root] of roots) {
-		let listing;
+	for (const line of stdout.split(/\r?\n/u)) {
+		const cleaned = cleanIconPath(line.trim());
+		if (cleaned !== "") out.push(cleaned);
+	}
+	return out;
+}
+/**
+* Registry read through `reg.exe`, with console-code-page detection.
+*
+* Kept as the fallback for machines without PowerShell. The decode step is the
+* fix: the output is captured as BYTES and decoded with whichever encoding
+* yields a path that exists, instead of assuming UTF-8 and quietly producing
+* mojibake that no existence check can ever match.
+*/
+function windowsRegistryAppPathsViaReg() {
+	const out = [];
+	for (const root of UNINSTALL_KEY_ROOTS) {
+		let listingBuf;
 		try {
-			listing = execFileSync("reg", [
+			listingBuf = execFileSync("reg", [
 				"query",
 				root,
 				"/s",
 				"/v",
 				"DisplayName"
 			], {
-				encoding: "utf8",
 				timeout: 1e4,
 				windowsHide: true,
 				maxBuffer: 8388608
@@ -2040,26 +2153,35 @@ function windowsRegistryAppPaths() {
 		} catch {
 			continue;
 		}
-		const keys = listing.split(/\r?\n(?=HKEY_)/u).filter((block) => /WorkBuddy|CodeBuddy/iu.test(block));
+		const keys = decodeWindowsConsole(listingBuf, (text) => /WorkBuddy|CodeBuddy/iu.test(text)).split(/\r?\n(?=HKEY_)/u).filter((block) => /WorkBuddy|CodeBuddy/iu.test(block));
 		for (const key of keys) {
 			const keyPath = /^(HKEY_[^\r\n]+)/u.exec(key)?.[1]?.trim();
 			if (keyPath === void 0) continue;
-			for (const name of ["DisplayIcon", "InstallLocation"]) try {
-				const value = execFileSync("reg", [
-					"query",
-					keyPath,
-					"/v",
-					name
-				], {
-					encoding: "utf8",
-					timeout: 5e3,
-					windowsHide: true
+			for (const name of ["DisplayIcon", "InstallLocation"]) {
+				let valueBuf;
+				try {
+					valueBuf = execFileSync("reg", [
+						"query",
+						keyPath,
+						"/v",
+						name
+					], {
+						timeout: 5e3,
+						windowsHide: true
+					});
+				} catch {
+					continue;
+				}
+				const value = decodeWindowsConsole(valueBuf, (text) => {
+					const candidate = /REG_(?:SZ|EXPAND_SZ)\s+(.+)$/mu.exec(text)?.[1]?.trim();
+					if (candidate === void 0) return false;
+					const path = cleanIconPath(candidate);
+					return path !== "" && existsSync(path);
 				});
 				const raw = /REG_(?:SZ|EXPAND_SZ)\s+(.+)$/mu.exec(value)?.[1]?.trim();
 				if (raw === void 0 || raw === "") continue;
-				const cleaned = raw.replace(/^"/u, "").replace(/",-?\d+$/u, "").replace(/,-?\d+$/u, "").trim();
-				out.push(cleaned);
-			} catch {}
+				out.push(cleanIconPath(raw));
+			}
 		}
 	}
 	return out;
@@ -2328,7 +2450,7 @@ const ENCRYPTED_CREDENTIAL_CODE = "ENCRYPTED_CREDENTIAL";
 var WorkBuddyEncryptedCredentialError = class extends Error {
 	code = ENCRYPTED_CREDENTIAL_CODE;
 	constructor(sourcePath) {
-		super(`workbuddy: ${sourcePath} holds encrypted credentials, but no WorkBuddy desktop app could be located to provide the key. If the app IS installed, it is simply outside the paths this plugin probes — set WORKBUDDY_APP_EXECUTABLE to its full .exe path (then restart DSH) and the credential will open. Signing in again will not help: the credential itself is intact. Run \`dsh-workbuddy-xdpool doctor\` to see which paths were probed.`);
+		super(`workbuddy: ${sourcePath} holds encrypted credentials, but no WorkBuddy desktop app could be located to provide the key. If the app IS installed, it is simply outside the paths this plugin probes — set WORKBUDDY_APP_EXECUTABLE to its full .exe path (then restart DSH) and the credential will open. Signing in again will not help: the credential itself is intact. Run \`dsh-workbuddy-xdpool doctor\` to see which paths were probed — if one of them looks like mojibake (e.g. "??" where a Chinese folder name should be), the registry value could not be decoded on this machine; report that line and use the override above in the meantime.`);
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-xdpool",
   "displayName": "DSH WorkBuddy XD Pool",
   "description": "Merge every locally signed-in WorkBuddy account into DeepSeek Harness as one auto-failing-over model pool (multi-account rotation, live credits, daily check-in and model catalog).",
-  "version": "1.7.3",
+  "version": "1.7.5",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-workbuddy-xdpool#readme",